Merge commit 'v2.6.38-rc8' into x86/asm

Merge reason: Update with the latest fixes.

Signed-off-by: Ingo Molnar <mingo@elte.hu>

46 files changed, 374 insertions, 185 deletions

diff --git a/net/batman-adv/unicast.c b/net/batman-adv/unicast.c
index ee41fef04b21..d1a611322549 100644
--- a/net/batman-adv/unicast.c
+++ b/net/batman-adv/unicast.c
@@ -50,12 +50,12 @@ static struct sk_buff *frag_merge_packet(struct list_head *head,
                 skb = tfp->skb;
         }
 
+        if (skb_linearize(skb) < 0 || skb_linearize(tmp_skb) < 0)
+                goto err;
+
         skb_pull(tmp_skb, sizeof(struct unicast_frag_packet));
-        if (pskb_expand_head(skb, 0, tmp_skb->len, GFP_ATOMIC) < 0) {
-                /* free buffered skb, skb will be freed later */
-                kfree_skb(tfp->skb);
-                return NULL;
-        }
+        if (pskb_expand_head(skb, 0, tmp_skb->len, GFP_ATOMIC) < 0)
+                goto err;
 
         /* move free entry to end */
         tfp->skb = NULL;
@@ -70,6 +70,11 @@ static struct sk_buff *frag_merge_packet(struct list_head *head,
         unicast_packet->packet_type = BAT_UNICAST;
 
         return skb;
+
+err:
+        /* free buffered skb, skb will be freed later */
+        kfree_skb(tfp->skb);
+        return NULL;
 }
 
 static void frag_create_entry(struct list_head *head, struct sk_buff *skb)
diff --git a/net/bluetooth/l2cap.c b/net/bluetooth/l2cap.c
index 7550abb0c96a..675614e38e14 100644
--- a/net/bluetooth/l2cap.c
+++ b/net/bluetooth/l2cap.c
@@ -859,6 +859,7 @@ static void __l2cap_sock_close(struct sock *sk, int reason)
                                 result = L2CAP_CR_SEC_BLOCK;
                         else
                                 result = L2CAP_CR_BAD_PSM;
+                        sk->sk_state = BT_DISCONN;
 
                         rsp.scid   = cpu_to_le16(l2cap_pi(sk)->dcid);
                         rsp.dcid   = cpu_to_le16(l2cap_pi(sk)->scid);
diff --git a/net/bluetooth/rfcomm/tty.c b/net/bluetooth/rfcomm/tty.c
index 2575c2db6404..d7b9af4703d0 100644
--- a/net/bluetooth/rfcomm/tty.c
+++ b/net/bluetooth/rfcomm/tty.c
@@ -727,7 +727,9 @@ static int rfcomm_tty_open(struct tty_struct *tty, struct file *filp)
                         break;
                 }
 
+                tty_unlock();
                 schedule();
+                tty_lock();
         }
         set_current_state(TASK_RUNNING);
         remove_wait_queue(&dev->wait, &wait);
diff --git a/net/bridge/br_input.c b/net/bridge/br_input.c
index 6f6d8e1b776f..88e4aa9cb1f9 100644
--- a/net/bridge/br_input.c
+++ b/net/bridge/br_input.c
@@ -80,7 +80,7 @@ int br_handle_frame_finish(struct sk_buff *skb)
         if (is_multicast_ether_addr(dest)) {
                 mdst = br_mdb_get(br, skb);
                 if (mdst || BR_INPUT_SKB_CB_MROUTERS_ONLY(skb)) {
-                        if ((mdst && !hlist_unhashed(&mdst->mglist)) ||
+                        if ((mdst && mdst->mglist) ||
                             br_multicast_is_router(br))
                                 skb2 = skb;
                         br_multicast_forward(mdst, skb, skb2);
diff --git a/net/bridge/br_multicast.c b/net/bridge/br_multicast.c
index f701a21acb34..030a002ff8ee 100644
--- a/net/bridge/br_multicast.c
+++ b/net/bridge/br_multicast.c
@@ -37,10 +37,9 @@
         rcu_dereference_protected(X, lockdep_is_held(&br->multicast_lock))
 
 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
-static inline int ipv6_is_local_multicast(const struct in6_addr *addr)
+static inline int ipv6_is_transient_multicast(const struct in6_addr *addr)
 {
-        if (ipv6_addr_is_multicast(addr) &&
-            IPV6_ADDR_MC_SCOPE(addr) <= IPV6_ADDR_SCOPE_LINKLOCAL)
+        if (ipv6_addr_is_multicast(addr) && IPV6_ADDR_MC_FLAG_TRANSIENT(addr))
                 return 1;
         return 0;
 }
@@ -232,8 +231,7 @@ static void br_multicast_group_expired(unsigned long data)
         if (!netif_running(br->dev) || timer_pending(&mp->timer))
                 goto out;
 
-        if (!hlist_unhashed(&mp->mglist))
-                hlist_del_init(&mp->mglist);
+        mp->mglist = false;
 
         if (mp->ports)
                 goto out;
@@ -276,7 +274,7 @@ static void br_multicast_del_pg(struct net_bridge *br,
                 del_timer(&p->query_timer);
                 call_rcu_bh(&p->rcu, br_multicast_free_pg);
 
-                if (!mp->ports && hlist_unhashed(&mp->mglist) &&
+                if (!mp->ports && !mp->mglist &&
                     netif_running(br->dev))
                         mod_timer(&mp->timer, jiffies);
 
@@ -436,7 +434,6 @@ static struct sk_buff *br_ip6_multicast_alloc_query(struct net_bridge *br,
         eth = eth_hdr(skb);
 
         memcpy(eth->h_source, br->dev->dev_addr, 6);
-        ipv6_eth_mc_map(group, eth->h_dest);
         eth->h_proto = htons(ETH_P_IPV6);
         skb_put(skb, sizeof(*eth));
 
@@ -448,8 +445,10 @@ static struct sk_buff *br_ip6_multicast_alloc_query(struct net_bridge *br,
         ip6h->payload_len = htons(8 + sizeof(*mldq));
         ip6h->nexthdr = IPPROTO_HOPOPTS;
         ip6h->hop_limit = 1;
-        ipv6_addr_set(&ip6h->saddr, 0, 0, 0, 0);
+        ipv6_dev_get_saddr(dev_net(br->dev), br->dev, &ip6h->daddr, 0,
+                           &ip6h->saddr);
         ipv6_addr_set(&ip6h->daddr, htonl(0xff020000), 0, 0, htonl(1));
+        ipv6_eth_mc_map(&ip6h->daddr, eth->h_dest);
 
         hopopt = (u8 *)(ip6h + 1);
         hopopt[0] = IPPROTO_ICMPV6;             /* next hdr */
@@ -528,7 +527,7 @@ static void br_multicast_group_query_expired(unsigned long data)
         struct net_bridge *br = mp->br;
 
         spin_lock(&br->multicast_lock);
-        if (!netif_running(br->dev) || hlist_unhashed(&mp->mglist) ||
+        if (!netif_running(br->dev) || !mp->mglist ||
             mp->queries_sent >= br->multicast_last_member_count)
                 goto out;
 
@@ -719,7 +718,7 @@ static int br_multicast_add_group(struct net_bridge *br,
                 goto err;
 
         if (!port) {
-                hlist_add_head(&mp->mglist, &br->mglist);
+                mp->mglist = true;
                 mod_timer(&mp->timer, now + br->multicast_membership_interval);
                 goto out;
         }
@@ -781,11 +780,11 @@ static int br_ip6_multicast_add_group(struct net_bridge *br,
 {
         struct br_ip br_group;
 
-        if (ipv6_is_local_multicast(group))
+        if (!ipv6_is_transient_multicast(group))
                 return 0;
 
         ipv6_addr_copy(&br_group.u.ip6, group);
-        br_group.proto = htons(ETH_P_IP);
+        br_group.proto = htons(ETH_P_IPV6);
 
         return br_multicast_add_group(br, port, &br_group);
 }
@@ -1014,18 +1013,19 @@ static int br_ip6_multicast_mld2_report(struct net_bridge *br,
 
                 nsrcs = skb_header_pointer(skb,
                                            len + offsetof(struct mld2_grec,
-                                                          grec_mca),
+                                                          grec_nsrcs),
                                            sizeof(_nsrcs), &_nsrcs);
                 if (!nsrcs)
                         return -EINVAL;
 
                 if (!pskb_may_pull(skb,
                                    len + sizeof(*grec) +
-                                   sizeof(struct in6_addr) * (*nsrcs)))
+                                   sizeof(struct in6_addr) * ntohs(*nsrcs)))
                         return -EINVAL;
 
                 grec = (struct mld2_grec *)(skb->data + len);
-                len += sizeof(*grec) + sizeof(struct in6_addr) * (*nsrcs);
+                len += sizeof(*grec) +
+                       sizeof(struct in6_addr) * ntohs(*nsrcs);
 
                 /* We treat these as MLDv1 reports for now. */
                 switch (grec->grec_type) {
@@ -1165,7 +1165,7 @@ static int br_ip4_multicast_query(struct net_bridge *br,
 
         max_delay *= br->multicast_last_member_count;
 
-        if (!hlist_unhashed(&mp->mglist) &&
+        if (mp->mglist &&
             (timer_pending(&mp->timer) ?
              time_after(mp->timer.expires, now + max_delay) :
              try_to_del_timer_sync(&mp->timer) >= 0))
@@ -1177,7 +1177,7 @@ static int br_ip4_multicast_query(struct net_bridge *br,
                 if (timer_pending(&p->timer) ?
                     time_after(p->timer.expires, now + max_delay) :
                     try_to_del_timer_sync(&p->timer) >= 0)
-                        mod_timer(&mp->timer, now + max_delay);
+                        mod_timer(&p->timer, now + max_delay);
         }
 
 out:
@@ -1236,7 +1236,7 @@ static int br_ip6_multicast_query(struct net_bridge *br,
                 goto out;
 
         max_delay *= br->multicast_last_member_count;
-        if (!hlist_unhashed(&mp->mglist) &&
+        if (mp->mglist &&
             (timer_pending(&mp->timer) ?
              time_after(mp->timer.expires, now + max_delay) :
              try_to_del_timer_sync(&mp->timer) >= 0))
@@ -1248,7 +1248,7 @@ static int br_ip6_multicast_query(struct net_bridge *br,
                 if (timer_pending(&p->timer) ?
                     time_after(p->timer.expires, now + max_delay) :
                     try_to_del_timer_sync(&p->timer) >= 0)
-                        mod_timer(&mp->timer, now + max_delay);
+                        mod_timer(&p->timer, now + max_delay);
         }
 
 out:
@@ -1283,7 +1283,7 @@ static void br_multicast_leave_group(struct net_bridge *br,
                      br->multicast_last_member_interval;
 
         if (!port) {
-                if (!hlist_unhashed(&mp->mglist) &&
+                if (mp->mglist &&
                     (timer_pending(&mp->timer) ?
                      time_after(mp->timer.expires, time) :
                      try_to_del_timer_sync(&mp->timer) >= 0)) {
@@ -1341,7 +1341,7 @@ static void br_ip6_multicast_leave_group(struct net_bridge *br,
 {
         struct br_ip br_group;
 
-        if (ipv6_is_local_multicast(group))
+        if (!ipv6_is_transient_multicast(group))
                 return;
 
         ipv6_addr_copy(&br_group.u.ip6, group);
diff --git a/net/bridge/br_private.h b/net/bridge/br_private.h
index 84aac7734bfc..4e1b620b6be6 100644
--- a/net/bridge/br_private.h
+++ b/net/bridge/br_private.h
@@ -84,13 +84,13 @@ struct net_bridge_port_group {
 struct net_bridge_mdb_entry
 {
         struct hlist_node               hlist[2];
-        struct hlist_node               mglist;
         struct net_bridge               *br;
         struct net_bridge_port_group __rcu *ports;
         struct rcu_head                 rcu;
         struct timer_list               timer;
         struct timer_list               query_timer;
         struct br_ip                    addr;
+        bool                            mglist;
         u32                             queries_sent;
 };
 
@@ -238,7 +238,6 @@ struct net_bridge
         spinlock_t                      multicast_lock;
         struct net_bridge_mdb_htable __rcu *mdb;
         struct hlist_head               router_list;
-        struct hlist_head               mglist;
 
         struct timer_list               multicast_router_timer;
         struct timer_list               multicast_querier_timer;
diff --git a/net/caif/chnl_net.c b/net/caif/chnl_net.c
index fa9dab372b68..6008d6dc18a0 100644
--- a/net/caif/chnl_net.c
+++ b/net/caif/chnl_net.c
@@ -394,9 +394,7 @@ static void ipcaif_net_setup(struct net_device *dev)
         priv->conn_req.sockaddr.u.dgm.connection_id = -1;
         priv->flowenabled = false;
 
-        ASSERT_RTNL();
         init_waitqueue_head(&priv->netmgmt_wq);
-        list_add(&priv->list_field, &chnl_net_list);
 }
 
 
@@ -453,6 +451,8 @@ static int ipcaif_newlink(struct net *src_net, struct net_device *dev,
         ret = register_netdevice(dev);
         if (ret)
                 pr_warn("device rtml registration failed\n");
+        else
+                list_add(&caifdev->list_field, &chnl_net_list);
         return ret;
 }
 
diff --git a/net/ceph/messenger.c b/net/ceph/messenger.c
index dff633d62e5b..05f357828a2f 100644
--- a/net/ceph/messenger.c
+++ b/net/ceph/messenger.c
@@ -252,8 +252,12 @@ static int ceph_tcp_recvmsg(struct socket *sock, void *buf, size_t len)
 {
         struct kvec iov = {buf, len};
         struct msghdr msg = { .msg_flags = MSG_DONTWAIT | MSG_NOSIGNAL };
+        int r;
 
-        return kernel_recvmsg(sock, &msg, &iov, 1, len, msg.msg_flags);
+        r = kernel_recvmsg(sock, &msg, &iov, 1, len, msg.msg_flags);
+        if (r == -EAGAIN)
+                r = 0;
+        return r;
 }
 
 /*
@@ -264,13 +268,17 @@ static int ceph_tcp_sendmsg(struct socket *sock, struct kvec *iov,
                      size_t kvlen, size_t len, int more)
 {
         struct msghdr msg = { .msg_flags = MSG_DONTWAIT | MSG_NOSIGNAL };
+        int r;
 
         if (more)
                 msg.msg_flags |= MSG_MORE;
         else
                 msg.msg_flags |= MSG_EOR;  /* superfluous, but what the hell */
 
-        return kernel_sendmsg(sock, &msg, iov, kvlen, len);
+        r = kernel_sendmsg(sock, &msg, iov, kvlen, len);
+        if (r == -EAGAIN)
+                r = 0;
+        return r;
 }
 
 
@@ -328,7 +336,6 @@ static void reset_connection(struct ceph_connection *con)
                 ceph_msg_put(con->out_msg);
                 con->out_msg = NULL;
         }
-        con->out_keepalive_pending = false;
         con->in_seq = 0;
         con->in_seq_acked = 0;
 }
@@ -847,6 +854,8 @@ static int write_partial_msg_pages(struct ceph_connection *con)
                     (msg->pages || msg->pagelist || msg->bio || in_trail))
                         kunmap(page);
 
+                if (ret == -EAGAIN)
+                        ret = 0;
                 if (ret <= 0)
                         goto out;
 
@@ -1238,8 +1247,6 @@ static int process_connect(struct ceph_connection *con)
                      con->auth_retry);
                 if (con->auth_retry == 2) {
                         con->error_msg = "connect authorization failure";
-                        reset_connection(con);
-                        set_bit(CLOSED, &con->state);
                         return -1;
                 }
                 con->auth_retry = 1;
@@ -1705,14 +1712,6 @@ more:
 
         /* open the socket first? */
         if (con->sock == NULL) {
-                /*
-                 * if we were STANDBY and are reconnecting _this_
-                 * connection, bump connect_seq now.  Always bump
-                 * global_seq.
-                 */
-                if (test_and_clear_bit(STANDBY, &con->state))
-                        con->connect_seq++;
-
                 prepare_write_banner(msgr, con);
                 prepare_write_connect(msgr, con, 1);
                 prepare_read_banner(con);
@@ -1737,16 +1736,12 @@ more_kvec:
         if (con->out_skip) {
                 ret = write_partial_skip(con);
                 if (ret <= 0)
-                        goto done;
-                if (ret < 0) {
-                        dout("try_write write_partial_skip err %d\n", ret);
-                        goto done;
-                }
+                        goto out;
         }
         if (con->out_kvec_left) {
                 ret = write_partial_kvec(con);
                 if (ret <= 0)
-                        goto done;
+                        goto out;
         }
 
         /* msg pages? */
@@ -1761,11 +1756,11 @@ more_kvec:
                 if (ret == 1)
                         goto more_kvec;  /* we need to send the footer, too! */
                 if (ret == 0)
-                        goto done;
+                        goto out;
                 if (ret < 0) {
                         dout("try_write write_partial_msg_pages err %d\n",
                              ret);
-                        goto done;
+                        goto out;
                 }
         }
 
@@ -1789,10 +1784,9 @@ do_next:
         /* Nothing to do! */
         clear_bit(WRITE_PENDING, &con->state);
         dout("try_write nothing else to write.\n");
-done:
         ret = 0;
 out:
-        dout("try_write done on %p\n", con);
+        dout("try_write done on %p ret %d\n", con, ret);
         return ret;
 }
 
@@ -1821,19 +1815,17 @@ more:
                         dout("try_read connecting\n");
                         ret = read_partial_banner(con);
                         if (ret <= 0)
-                                goto done;
-                        if (process_banner(con) < 0) {
-                                ret = -1;
                                 goto out;
-                        }
+                        ret = process_banner(con);
+                        if (ret < 0)
+                                goto out;
                 }
                 ret = read_partial_connect(con);
                 if (ret <= 0)
-                        goto done;
-                if (process_connect(con) < 0) {
-                        ret = -1;
                         goto out;
-                }
+                ret = process_connect(con);
+                if (ret < 0)
+                        goto out;
                 goto more;
         }
 
@@ -1848,7 +1840,7 @@ more:
                 dout("skipping %d / %d bytes\n", skip, -con->in_base_pos);
                 ret = ceph_tcp_recvmsg(con->sock, buf, skip);
                 if (ret <= 0)
-                        goto done;
+                        goto out;
                 con->in_base_pos += ret;
                 if (con->in_base_pos)
                         goto more;
@@ -1859,7 +1851,7 @@ more:
                  */
                 ret = ceph_tcp_recvmsg(con->sock, &con->in_tag, 1);
                 if (ret <= 0)
-                        goto done;
+                        goto out;
                 dout("try_read got tag %d\n", (int)con->in_tag);
                 switch (con->in_tag) {
                 case CEPH_MSGR_TAG_MSG:
@@ -1870,7 +1862,7 @@ more:
                         break;
                 case CEPH_MSGR_TAG_CLOSE:
                         set_bit(CLOSED, &con->state);   /* fixme */
-                        goto done;
+                        goto out;
                 default:
                         goto bad_tag;
                 }
@@ -1882,13 +1874,12 @@ more:
                         case -EBADMSG:
                                 con->error_msg = "bad crc";
                                 ret = -EIO;
-                                goto out;
+                                break;
                         case -EIO:
                                 con->error_msg = "io error";
-                                goto out;
-                        default:
-                                goto done;
+                                break;
                         }
+                        goto out;
                 }
                 if (con->in_tag == CEPH_MSGR_TAG_READY)
                         goto more;
@@ -1898,15 +1889,13 @@ more:
         if (con->in_tag == CEPH_MSGR_TAG_ACK) {
                 ret = read_partial_ack(con);
                 if (ret <= 0)
-                        goto done;
+                        goto out;
                 process_ack(con);
                 goto more;
         }
 
-done:
-        ret = 0;
 out:
-        dout("try_read done on %p\n", con);
+        dout("try_read done on %p ret %d\n", con, ret);
         return ret;
 
 bad_tag:
@@ -1951,7 +1940,24 @@ static void con_work(struct work_struct *work)
                                                    work.work);
 
         mutex_lock(&con->mutex);
+        if (test_and_clear_bit(BACKOFF, &con->state)) {
+                dout("con_work %p backing off\n", con);
+                if (queue_delayed_work(ceph_msgr_wq, &con->work,
+                                       round_jiffies_relative(con->delay))) {
+                        dout("con_work %p backoff %lu\n", con, con->delay);
+                        mutex_unlock(&con->mutex);
+                        return;
+                } else {
+                        con->ops->put(con);
+                        dout("con_work %p FAILED to back off %lu\n", con,
+                             con->delay);
+                }
+        }
 
+        if (test_bit(STANDBY, &con->state)) {
+                dout("con_work %p STANDBY\n", con);
+                goto done;
+        }
         if (test_bit(CLOSED, &con->state)) { /* e.g. if we are replaced */
                 dout("con_work CLOSED\n");
                 con_close_socket(con);
@@ -2008,10 +2014,12 @@ static void ceph_fault(struct ceph_connection *con)
         /* Requeue anything that hasn't been acked */
         list_splice_init(&con->out_sent, &con->out_queue);
 
-        /* If there are no messages in the queue, place the connection
-         * in a STANDBY state (i.e., don't try to reconnect just yet). */
-        if (list_empty(&con->out_queue) && !con->out_keepalive_pending) {
-                dout("fault setting STANDBY\n");
+        /* If there are no messages queued or keepalive pending, place
+         * the connection in a STANDBY state */
+        if (list_empty(&con->out_queue) &&
+            !test_bit(KEEPALIVE_PENDING, &con->state)) {
+                dout("fault %p setting STANDBY clearing WRITE_PENDING\n", con);
+                clear_bit(WRITE_PENDING, &con->state);
                 set_bit(STANDBY, &con->state);
         } else {
                 /* retry after a delay. */
@@ -2019,11 +2027,24 @@ static void ceph_fault(struct ceph_connection *con)
                         con->delay = BASE_DELAY_INTERVAL;
                 else if (con->delay < MAX_DELAY_INTERVAL)
                         con->delay *= 2;
-                dout("fault queueing %p delay %lu\n", con, con->delay);
                 con->ops->get(con);
                 if (queue_delayed_work(ceph_msgr_wq, &con->work,
-                                       round_jiffies_relative(con->delay)) == 0)
+                                       round_jiffies_relative(con->delay))) {
+                        dout("fault queued %p delay %lu\n", con, con->delay);
+                } else {
                         con->ops->put(con);
+                        dout("fault failed to queue %p delay %lu, backoff\n",
+                             con, con->delay);
+                        /*
+                         * In many cases we see a socket state change
+                         * while con_work is running and end up
+                         * queuing (non-delayed) work, such that we
+                         * can't backoff with a delay.  Set a flag so
+                         * that when con_work restarts we schedule the
+                         * delay then.
+                         */
+                        set_bit(BACKOFF, &con->state);
+                }
         }
 
 out_unlock:
@@ -2094,6 +2115,19 @@ void ceph_messenger_destroy(struct ceph_messenger *msgr)
 }
 EXPORT_SYMBOL(ceph_messenger_destroy);
 
+static void clear_standby(struct ceph_connection *con)
+{
+        /* come back from STANDBY? */
+        if (test_and_clear_bit(STANDBY, &con->state)) {
+                mutex_lock(&con->mutex);
+                dout("clear_standby %p and ++connect_seq\n", con);
+                con->connect_seq++;
+                WARN_ON(test_bit(WRITE_PENDING, &con->state));
+                WARN_ON(test_bit(KEEPALIVE_PENDING, &con->state));
+                mutex_unlock(&con->mutex);
+        }
+}
+
 /*
  * Queue up an outgoing message on the given connection.
  */
@@ -2126,6 +2160,7 @@ void ceph_con_send(struct ceph_connection *con, struct ceph_msg *msg)
 
         /* if there wasn't anything waiting to send before, queue
          * new work */
+        clear_standby(con);
         if (test_and_set_bit(WRITE_PENDING, &con->state) == 0)
                 queue_con(con);
 }
@@ -2191,6 +2226,8 @@ void ceph_con_revoke_message(struct ceph_connection *con, struct ceph_msg *msg)
  */
 void ceph_con_keepalive(struct ceph_connection *con)
 {
+        dout("con_keepalive %p\n", con);
+        clear_standby(con);
         if (test_and_set_bit(KEEPALIVE_PENDING, &con->state) == 0 &&
             test_and_set_bit(WRITE_PENDING, &con->state) == 0)
                 queue_con(con);
diff --git a/net/ceph/pagevec.c b/net/ceph/pagevec.c
index 1a040e64c69f..cd9c21df87d1 100644
--- a/net/ceph/pagevec.c
+++ b/net/ceph/pagevec.c
@@ -16,22 +16,30 @@ struct page **ceph_get_direct_page_vector(const char __user *data,
                                           int num_pages, bool write_page)
 {
         struct page **pages;
-        int rc;
+        int got = 0;
+        int rc = 0;
 
         pages = kmalloc(sizeof(*pages) * num_pages, GFP_NOFS);
         if (!pages)
                 return ERR_PTR(-ENOMEM);
 
         down_read(&current->mm->mmap_sem);
-        rc = get_user_pages(current, current->mm, (unsigned long)data,
-                            num_pages, write_page, 0, pages, NULL);
+        while (got < num_pages) {
+                rc = get_user_pages(current, current->mm,
+                    (unsigned long)data + ((unsigned long)got * PAGE_SIZE),
+                    num_pages - got, write_page, 0, pages + got, NULL);
+                if (rc < 0)
+                        break;
+                BUG_ON(rc == 0);
+                got += rc;
+        }
         up_read(&current->mm->mmap_sem);
-        if (rc < num_pages)
+        if (rc < 0)
                 goto fail;
         return pages;
 
 fail:
-        ceph_put_page_vector(pages, rc > 0 ? rc : 0, false);
+        ceph_put_page_vector(pages, got, false);
         return ERR_PTR(rc);
 }
 EXPORT_SYMBOL(ceph_get_direct_page_vector);
diff --git a/net/core/dev.c b/net/core/dev.c
index b6d0bf875a8e..8ae6631abcc2 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -1280,10 +1280,13 @@ static int __dev_close_many(struct list_head *head)
 
 static int __dev_close(struct net_device *dev)
 {
+        int retval;
         LIST_HEAD(single);
 
         list_add(&dev->unreg_list, &single);
-        return __dev_close_many(&single);
+        retval = __dev_close_many(&single);
+        list_del(&single);
+        return retval;
 }
 
 int dev_close_many(struct list_head *head)
@@ -1325,7 +1328,7 @@ int dev_close(struct net_device *dev)
 
         list_add(&dev->unreg_list, &single);
         dev_close_many(&single);
-
+        list_del(&single);
         return 0;
 }
 EXPORT_SYMBOL(dev_close);
@@ -5063,6 +5066,7 @@ static void rollback_registered(struct net_device *dev)
 
         list_add(&dev->unreg_list, &single);
         rollback_registered_many(&single);
+        list_del(&single);
 }
 
 unsigned long netdev_fix_features(unsigned long features, const char *name)
@@ -5660,30 +5664,35 @@ struct net_device *alloc_netdev_mqs(int sizeof_priv, const char *name,
 
         dev_net_set(dev, &init_net);
 
+        dev->gso_max_size = GSO_MAX_SIZE;
+
+        INIT_LIST_HEAD(&dev->ethtool_ntuple_list.list);
+        dev->ethtool_ntuple_list.count = 0;
+        INIT_LIST_HEAD(&dev->napi_list);
+        INIT_LIST_HEAD(&dev->unreg_list);
+        INIT_LIST_HEAD(&dev->link_watch_list);
+        dev->priv_flags = IFF_XMIT_DST_RELEASE;
+        setup(dev);
+
         dev->num_tx_queues = txqs;
         dev->real_num_tx_queues = txqs;
         if (netif_alloc_netdev_queues(dev))
-                goto free_pcpu;
+                goto free_all;
 
 #ifdef CONFIG_RPS
         dev->num_rx_queues = rxqs;
         dev->real_num_rx_queues = rxqs;
         if (netif_alloc_rx_queues(dev))
-                goto free_pcpu;
+                goto free_all;
 #endif
 
-        dev->gso_max_size = GSO_MAX_SIZE;
-
-        INIT_LIST_HEAD(&dev->ethtool_ntuple_list.list);
-        dev->ethtool_ntuple_list.count = 0;
-        INIT_LIST_HEAD(&dev->napi_list);
-        INIT_LIST_HEAD(&dev->unreg_list);
-        INIT_LIST_HEAD(&dev->link_watch_list);
-        dev->priv_flags = IFF_XMIT_DST_RELEASE;
-        setup(dev);
         strcpy(dev->name, name);
         return dev;
 
+free_all:
+        free_netdev(dev);
+        return NULL;
+
 free_pcpu:
         free_percpu(dev->pcpu_refcnt);
         kfree(dev->_tx);
@@ -6211,6 +6220,7 @@ static void __net_exit default_device_exit_batch(struct list_head *net_list)
                 }
         }
         unregister_netdevice_many(&dev_kill_list);
+        list_del(&dev_kill_list);
         rtnl_unlock();
 }
 
diff --git a/net/core/dev_addr_lists.c b/net/core/dev_addr_lists.c
index 508f9c18992f..133fd22ea287 100644
--- a/net/core/dev_addr_lists.c
+++ b/net/core/dev_addr_lists.c
@@ -144,7 +144,7 @@ void __hw_addr_del_multiple(struct netdev_hw_addr_list *to_list,
 
         list_for_each_entry(ha, &from_list->list, list) {
                 type = addr_type ? addr_type : ha->type;
-                __hw_addr_del(to_list, ha->addr, addr_len, addr_type);
+                __hw_addr_del(to_list, ha->addr, addr_len, type);
         }
 }
 EXPORT_SYMBOL(__hw_addr_del_multiple);
diff --git a/net/dcb/dcbnl.c b/net/dcb/dcbnl.c
index 6b03f561caec..c44348adba3b 100644
--- a/net/dcb/dcbnl.c
+++ b/net/dcb/dcbnl.c
@@ -626,6 +626,9 @@ static int dcbnl_getapp(struct net_device *netdev, struct nlattr **tb,
         dcb->cmd = DCB_CMD_GAPP;
 
         app_nest = nla_nest_start(dcbnl_skb, DCB_ATTR_APP);
+        if (!app_nest)
+                goto out_cancel;
+
         ret = nla_put_u8(dcbnl_skb, DCB_APP_ATTR_IDTYPE, idtype);
         if (ret)
                 goto out_cancel;
@@ -1190,7 +1193,7 @@ static int dcbnl_ieee_set(struct net_device *netdev, struct nlattr **tb,
                         goto err;
         }
 
-        if (ieee[DCB_ATTR_IEEE_PFC] && ops->ieee_setets) {
+        if (ieee[DCB_ATTR_IEEE_PFC] && ops->ieee_setpfc) {
                 struct ieee_pfc *pfc = nla_data(ieee[DCB_ATTR_IEEE_PFC]);
                 err = ops->ieee_setpfc(netdev, pfc);
                 if (err)
@@ -1613,6 +1616,10 @@ EXPORT_SYMBOL(dcb_getapp);
 u8 dcb_setapp(struct net_device *dev, struct dcb_app *new)
 {
         struct dcb_app_type *itr;
+        struct dcb_app_type event;
+
+        memcpy(&event.name, dev->name, sizeof(event.name));
+        memcpy(&event.app, new, sizeof(event.app));
 
         spin_lock(&dcb_lock);
         /* Search for existing match and replace */
@@ -1644,7 +1651,7 @@ u8 dcb_setapp(struct net_device *dev, struct dcb_app *new)
         }
 out:
         spin_unlock(&dcb_lock);
-        call_dcbevent_notifiers(DCB_APP_EVENT, new);
+        call_dcbevent_notifiers(DCB_APP_EVENT, &event);
         return 0;
 }
 EXPORT_SYMBOL(dcb_setapp);
diff --git a/net/dccp/input.c b/net/dccp/input.c
index 8cde009e8b85..4222e7a654b0 100644
--- a/net/dccp/input.c
+++ b/net/dccp/input.c
@@ -614,6 +614,9 @@ int dccp_rcv_state_process(struct sock *sk, struct sk_buff *skb,
                 /* Caller (dccp_v4_do_rcv) will send Reset */
                 dcb->dccpd_reset_code = DCCP_RESET_CODE_NO_CONNECTION;
                 return 1;
+        } else if (sk->sk_state == DCCP_CLOSED) {
+                dcb->dccpd_reset_code = DCCP_RESET_CODE_NO_CONNECTION;
+                return 1;
         }
 
         if (sk->sk_state != DCCP_REQUESTING && sk->sk_state != DCCP_RESPOND) {
@@ -668,10 +671,6 @@ int dccp_rcv_state_process(struct sock *sk, struct sk_buff *skb,
         }
 
         switch (sk->sk_state) {
-        case DCCP_CLOSED:
-                dcb->dccpd_reset_code = DCCP_RESET_CODE_NO_CONNECTION;
-                return 1;
-
         case DCCP_REQUESTING:
                 queued = dccp_rcv_request_sent_state_process(sk, skb, dh, len);
                 if (queued >= 0)
diff --git a/net/dns_resolver/dns_key.c b/net/dns_resolver/dns_key.c
index 739435a6af39..cfa7a5e1c5c9 100644
--- a/net/dns_resolver/dns_key.c
+++ b/net/dns_resolver/dns_key.c
@@ -67,8 +67,9 @@ dns_resolver_instantiate(struct key *key, const void *_data, size_t datalen)
         size_t result_len = 0;
         const char *data = _data, *end, *opt;
 
-        kenter("%%%d,%s,'%s',%zu",
-               key->serial, key->description, data, datalen);
+        kenter("%%%d,%s,'%*.*s',%zu",
+               key->serial, key->description,
+               (int)datalen, (int)datalen, data, datalen);
 
         if (datalen <= 1 || !data || data[datalen - 1] != '\0')
                 return -EINVAL;
@@ -217,6 +218,19 @@ static void dns_resolver_describe(const struct key *key, struct seq_file *m)
                 seq_printf(m, ": %u", key->datalen);
 }
 
+/*
+ * read the DNS data
+ * - the key's semaphore is read-locked
+ */
+static long dns_resolver_read(const struct key *key,
+                              char __user *buffer, size_t buflen)
+{
+        if (key->type_data.x[0])
+                return key->type_data.x[0];
+
+        return user_read(key, buffer, buflen);
+}
+
 struct key_type key_type_dns_resolver = {
         .name           = "dns_resolver",
         .instantiate    = dns_resolver_instantiate,
@@ -224,7 +238,7 @@ struct key_type key_type_dns_resolver = {
         .revoke         = user_revoke,
         .destroy        = user_destroy,
         .describe       = dns_resolver_describe,
-        .read           = user_read,
+        .read           = dns_resolver_read,
 };
 
 static int __init init_dns_resolver(void)
diff --git a/net/ipv4/devinet.c b/net/ipv4/devinet.c
index 748cb5b337bd..df4616fce929 100644
--- a/net/ipv4/devinet.c
+++ b/net/ipv4/devinet.c
@@ -1030,6 +1030,21 @@ static inline bool inetdev_valid_mtu(unsigned mtu)
         return mtu >= 68;
 }
 
+static void inetdev_send_gratuitous_arp(struct net_device *dev,
+                                        struct in_device *in_dev)
+
+{
+        struct in_ifaddr *ifa = in_dev->ifa_list;
+
+        if (!ifa)
+                return;
+
+        arp_send(ARPOP_REQUEST, ETH_P_ARP,
+                 ifa->ifa_address, dev,
+                 ifa->ifa_address, NULL,
+                 dev->dev_addr, NULL);
+}
+
 /* Called only under RTNL semaphore */
 
 static int inetdev_event(struct notifier_block *this, unsigned long event,
@@ -1082,18 +1097,13 @@ static int inetdev_event(struct notifier_block *this, unsigned long event,
                 }
                 ip_mc_up(in_dev);
                 /* fall through */
-        case NETDEV_NOTIFY_PEERS:
         case NETDEV_CHANGEADDR:
+                if (!IN_DEV_ARP_NOTIFY(in_dev))
+                        break;
+                /* fall through */
+        case NETDEV_NOTIFY_PEERS:
                 /* Send gratuitous ARP to notify of link change */
-                if (IN_DEV_ARP_NOTIFY(in_dev)) {
-                        struct in_ifaddr *ifa = in_dev->ifa_list;
-
-                        if (ifa)
-                                arp_send(ARPOP_REQUEST, ETH_P_ARP,
-                                         ifa->ifa_address, dev,
-                                         ifa->ifa_address, NULL,
-                                         dev->dev_addr, NULL);
-                }
+                inetdev_send_gratuitous_arp(dev, in_dev);
                 break;
         case NETDEV_DOWN:
                 ip_mc_down(in_dev);
diff --git a/net/ipv4/inet_timewait_sock.c b/net/ipv4/inet_timewait_sock.c
index c5af909cf701..3c8dfa16614d 100644
--- a/net/ipv4/inet_timewait_sock.c
+++ b/net/ipv4/inet_timewait_sock.c
@@ -505,7 +505,9 @@ restart:
                         }
 
                         rcu_read_unlock();
+                        local_bh_disable();
                         inet_twsk_deschedule(tw, twdr);
+                        local_bh_enable();
                         inet_twsk_put(tw);
                         goto restart_rcu;
                 }
diff --git a/net/ipv4/ip_gre.c b/net/ipv4/ip_gre.c
index eb68a0e34e49..6613edfac28c 100644
--- a/net/ipv4/ip_gre.c
+++ b/net/ipv4/ip_gre.c
@@ -775,6 +775,7 @@ static netdev_tx_t ipgre_tunnel_xmit(struct sk_buff *skb, struct net_device *dev
                         .fl4_dst = dst,
                         .fl4_src = tiph->saddr,
                         .fl4_tos = RT_TOS(tos),
+                        .proto = IPPROTO_GRE,
                         .fl_gre_key = tunnel->parms.o_key
                 };
                 if (ip_route_output_key(dev_net(dev), &rt, &fl)) {
diff --git a/net/ipv4/route.c b/net/ipv4/route.c
index 788a3e74834e..6ed6603c2f6d 100644
--- a/net/ipv4/route.c
+++ b/net/ipv4/route.c
@@ -2722,6 +2722,7 @@ static struct dst_ops ipv4_dst_blackhole_ops = {
         .destroy                =       ipv4_dst_destroy,
         .check                  =       ipv4_blackhole_dst_check,
         .default_mtu            =       ipv4_blackhole_default_mtu,
+        .default_advmss         =       ipv4_default_advmss,
         .update_pmtu            =       ipv4_rt_blackhole_update_pmtu,
 };
 
diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
index eb7f82ebf4a3..65f6c0406245 100644
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -1222,7 +1222,7 @@ static int tcp_check_dsack(struct sock *sk, struct sk_buff *ack_skb,
         }
 
         /* D-SACK for already forgotten data... Do dumb counting. */
-        if (dup_sack &&
+        if (dup_sack && tp->undo_marker && tp->undo_retrans &&
             !after(end_seq_0, prior_snd_una) &&
             after(end_seq_0, tp->undo_marker))
                 tp->undo_retrans--;
@@ -1299,7 +1299,8 @@ static u8 tcp_sacktag_one(struct sk_buff *skb, struct sock *sk,
 
         /* Account D-SACK for retransmitted packet. */
         if (dup_sack && (sacked & TCPCB_RETRANS)) {
-                if (after(TCP_SKB_CB(skb)->end_seq, tp->undo_marker))
+                if (tp->undo_marker && tp->undo_retrans &&
+                    after(TCP_SKB_CB(skb)->end_seq, tp->undo_marker))
                         tp->undo_retrans--;
                 if (sacked & TCPCB_SACKED_ACKED)
                         state->reord = min(fack_count, state->reord);
diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
index 406f320336e6..dfa5beb0c1c8 100644
--- a/net/ipv4/tcp_output.c
+++ b/net/ipv4/tcp_output.c
@@ -2162,7 +2162,7 @@ int tcp_retransmit_skb(struct sock *sk, struct sk_buff *skb)
                 if (!tp->retrans_stamp)
                         tp->retrans_stamp = TCP_SKB_CB(skb)->when;
 
-                tp->undo_retrans++;
+                tp->undo_retrans += tcp_skb_pcount(skb);
 
                 /* snd_nxt is stored to detect loss of retransmitted segment,
                  * see tcp_input.c tcp_sacktag_write_queue().
diff --git a/net/ipv6/netfilter/ip6t_LOG.c b/net/ipv6/netfilter/ip6t_LOG.c
index 09c88891a753..de338037a736 100644
--- a/net/ipv6/netfilter/ip6t_LOG.c
+++ b/net/ipv6/netfilter/ip6t_LOG.c
@@ -410,7 +410,7 @@ fallback:
                 if (p != NULL) {
                         sb_add(m, "%02x", *p++);
                         for (i = 1; i < len; i++)
-                                sb_add(m, ":%02x", p[i]);
+                                sb_add(m, ":%02x", *p++);
                 }
                 sb_add(m, " ");
 
diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index 1c29f95695de..904312e25a3c 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -128,6 +128,7 @@ static struct dst_ops ip6_dst_blackhole_ops = {
         .destroy                =       ip6_dst_destroy,
         .check                  =       ip6_dst_check,
         .default_mtu            =       ip6_blackhole_default_mtu,
+        .default_advmss         =       ip6_default_advmss,
         .update_pmtu            =       ip6_rt_blackhole_update_pmtu,
 };
 
@@ -2556,14 +2557,16 @@ static
 int ipv6_sysctl_rtcache_flush(ctl_table *ctl, int write,
                               void __user *buffer, size_t *lenp, loff_t *ppos)
 {
-        struct net *net = current->nsproxy->net_ns;
-        int delay = net->ipv6.sysctl.flush_delay;
-        if (write) {
-                proc_dointvec(ctl, write, buffer, lenp, ppos);
-                fib6_run_gc(delay <= 0 ? ~0UL : (unsigned long)delay, net);
-                return 0;
-        } else
+        struct net *net;
+        int delay;
+        if (!write)
                 return -EINVAL;
+
+        net = (struct net *)ctl->extra1;
+        delay = net->ipv6.sysctl.flush_delay;
+        proc_dointvec(ctl, write, buffer, lenp, ppos);
+        fib6_run_gc(delay <= 0 ? ~0UL : (unsigned long)delay, net);
+        return 0;
 }
 
 ctl_table ipv6_route_table_template[] = {
@@ -2650,6 +2653,7 @@ struct ctl_table * __net_init ipv6_route_sysctl_init(struct net *net)
 
         if (table) {
                 table[0].data = &net->ipv6.sysctl.flush_delay;
+                table[0].extra1 = net;
                 table[1].data = &net->ipv6.ip6_dst_ops.gc_thresh;
                 table[2].data = &net->ipv6.sysctl.ip6_rt_max_size;
                 table[3].data = &net->ipv6.sysctl.ip6_rt_gc_min_interval;
diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c
index 4bc8a9250cfd..9cd73b11506e 100644
--- a/net/mac80211/cfg.c
+++ b/net/mac80211/cfg.c
@@ -1822,6 +1822,7 @@ static int ieee80211_mgmt_tx(struct wiphy *wiphy, struct net_device *dev,
                 *cookie ^= 2;
                 IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_CTL_TX_OFFCHAN;
                 local->hw_roc_skb = skb;
+                local->hw_roc_skb_for_status = skb;
                 mutex_unlock(&local->mtx);
 
                 return 0;
@@ -1875,6 +1876,7 @@ static int ieee80211_mgmt_tx_cancel_wait(struct wiphy *wiphy,
                 if (ret == 0) {
                         kfree_skb(local->hw_roc_skb);
                         local->hw_roc_skb = NULL;
+                        local->hw_roc_skb_for_status = NULL;
                 }
 
                 mutex_unlock(&local->mtx);
diff --git a/net/mac80211/ieee80211_i.h b/net/mac80211/ieee80211_i.h
index c47d7c0e48a4..533fd32f49ff 100644
--- a/net/mac80211/ieee80211_i.h
+++ b/net/mac80211/ieee80211_i.h
@@ -953,7 +953,7 @@ struct ieee80211_local {
 
         struct ieee80211_channel *hw_roc_channel;
         struct net_device *hw_roc_dev;
-        struct sk_buff *hw_roc_skb;
+        struct sk_buff *hw_roc_skb, *hw_roc_skb_for_status;
         struct work_struct hw_roc_start, hw_roc_done;
         enum nl80211_channel_type hw_roc_channel_type;
         unsigned int hw_roc_duration;
diff --git a/net/mac80211/iface.c b/net/mac80211/iface.c
index 8acba456744e..7a10a8d1b2d0 100644
--- a/net/mac80211/iface.c
+++ b/net/mac80211/iface.c
@@ -1229,6 +1229,7 @@ void ieee80211_remove_interfaces(struct ieee80211_local *local)
         }
         mutex_unlock(&local->iflist_mtx);
         unregister_netdevice_many(&unreg_list);
+        list_del(&unreg_list);
 }
 
 static u32 ieee80211_idle_off(struct ieee80211_local *local,
diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
index 45fbb9e33746..c9ceb4d57ab0 100644
--- a/net/mac80211/mlme.c
+++ b/net/mac80211/mlme.c
@@ -1033,6 +1033,12 @@ void ieee80211_sta_rx_notify(struct ieee80211_sub_if_data *sdata,
         if (is_multicast_ether_addr(hdr->addr1))
                 return;
 
+        /*
+         * In case we receive frames after disassociation.
+         */
+        if (!sdata->u.mgd.associated)
+                return;
+
         ieee80211_sta_reset_conn_monitor(sdata);
 }
 
diff --git a/net/mac80211/status.c b/net/mac80211/status.c
index 38a797217a91..071ac95c4aa0 100644
--- a/net/mac80211/status.c
+++ b/net/mac80211/status.c
@@ -323,6 +323,7 @@ void ieee80211_tx_status(struct ieee80211_hw *hw, struct sk_buff *skb)
 
         if (info->flags & IEEE80211_TX_INTFL_NL80211_FRAME_TX) {
                 struct ieee80211_work *wk;
+                u64 cookie = (unsigned long)skb;
 
                 rcu_read_lock();
                 list_for_each_entry_rcu(wk, &local->work_list, list) {
@@ -334,8 +335,12 @@ void ieee80211_tx_status(struct ieee80211_hw *hw, struct sk_buff *skb)
                         break;
                 }
                 rcu_read_unlock();
+                if (local->hw_roc_skb_for_status == skb) {
+                        cookie = local->hw_roc_cookie ^ 2;
+                        local->hw_roc_skb_for_status = NULL;
+                }
                 cfg80211_mgmt_tx_status(
-                        skb->dev, (unsigned long) skb, skb->data, skb->len,
+                        skb->dev, cookie, skb->data, skb->len,
                         !!(info->flags & IEEE80211_TX_STAT_ACK), GFP_ATOMIC);
         }
 
diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c
index b64b42bc774b..b0beaa58246b 100644
--- a/net/mac80211/tx.c
+++ b/net/mac80211/tx.c
@@ -1547,7 +1547,7 @@ static int ieee80211_skb_resize(struct ieee80211_local *local,
                 skb_orphan(skb);
         }
 
-        if (skb_header_cloned(skb))
+        if (skb_cloned(skb))
                 I802_DEBUG_INC(local->tx_expand_skb_head_cloned);
         else if (head_need || tail_need)
                 I802_DEBUG_INC(local->tx_expand_skb_head);
diff --git a/net/mac80211/util.c b/net/mac80211/util.c
index cf68700abffa..d036597aabbe 100644
--- a/net/mac80211/util.c
+++ b/net/mac80211/util.c
@@ -1210,7 +1210,9 @@ int ieee80211_reconfig(struct ieee80211_local *local)
                 switch (sdata->vif.type) {
                 case NL80211_IFTYPE_STATION:
                         changed |= BSS_CHANGED_ASSOC;
+                        mutex_lock(&sdata->u.mgd.mtx);
                         ieee80211_bss_info_change_notify(sdata, changed);
+                        mutex_unlock(&sdata->u.mgd.mtx);
                         break;
                 case NL80211_IFTYPE_ADHOC:
                         changed |= BSS_CHANGED_IBSS;
diff --git a/net/netfilter/core.c b/net/netfilter/core.c
index 32fcbe290c04..4aa614b8a96a 100644
--- a/net/netfilter/core.c
+++ b/net/netfilter/core.c
@@ -133,6 +133,7 @@ unsigned int nf_iterate(struct list_head *head,
 
                 /* Optimization: we don't need to hold module
                    reference here, since function can't sleep. --RR */
+repeat:
                 verdict = elem->hook(hook, skb, indev, outdev, okfn);
                 if (verdict != NF_ACCEPT) {
 #ifdef CONFIG_NETFILTER_DEBUG
@@ -145,7 +146,7 @@ unsigned int nf_iterate(struct list_head *head,
 #endif
                         if (verdict != NF_REPEAT)
                                 return verdict;
-                        *i = (*i)->prev;
+                        goto repeat;
                 }
         }
         return NF_ACCEPT;
diff --git a/net/netfilter/ipvs/ip_vs_ctl.c b/net/netfilter/ipvs/ip_vs_ctl.c
index 22f7ad5101ab..ba98e1308f3c 100644
--- a/net/netfilter/ipvs/ip_vs_ctl.c
+++ b/net/netfilter/ipvs/ip_vs_ctl.c
@@ -808,9 +808,9 @@ __ip_vs_update_dest(struct ip_vs_service *svc, struct ip_vs_dest *dest,
         dest->u_threshold = udest->u_threshold;
         dest->l_threshold = udest->l_threshold;
 
-        spin_lock(&dest->dst_lock);
+        spin_lock_bh(&dest->dst_lock);
         ip_vs_dst_reset(dest);
-        spin_unlock(&dest->dst_lock);
+        spin_unlock_bh(&dest->dst_lock);
 
         if (add)
                 ip_vs_new_estimator(&dest->stats);
diff --git a/net/netfilter/nf_conntrack_core.c b/net/netfilter/nf_conntrack_core.c
index e61511929c66..84f4fcc5884b 100644
--- a/net/netfilter/nf_conntrack_core.c
+++ b/net/netfilter/nf_conntrack_core.c
@@ -942,8 +942,15 @@ nf_conntrack_in(struct net *net, u_int8_t pf, unsigned int hooknum,
         if (set_reply && !test_and_set_bit(IPS_SEEN_REPLY_BIT, &ct->status))
                 nf_conntrack_event_cache(IPCT_REPLY, ct);
 out:
-        if (tmpl)
-                nf_ct_put(tmpl);
+        if (tmpl) {
+                /* Special case: we have to repeat this hook, assign the
+                 * template again to this packet. We assume that this packet
+                 * has no conntrack assigned. This is used by nf_ct_tcp. */
+                if (ret == NF_REPEAT)
+                        skb->nfct = (struct nf_conntrack *)tmpl;
+                else
+                        nf_ct_put(tmpl);
+        }
 
         return ret;
 }
diff --git a/net/netfilter/nf_log.c b/net/netfilter/nf_log.c
index b07393eab88e..91816998ed86 100644
--- a/net/netfilter/nf_log.c
+++ b/net/netfilter/nf_log.c
@@ -85,6 +85,8 @@ EXPORT_SYMBOL(nf_log_unregister);
 
 int nf_log_bind_pf(u_int8_t pf, const struct nf_logger *logger)
 {
+        if (pf >= ARRAY_SIZE(nf_loggers))
+                return -EINVAL;
         mutex_lock(&nf_log_mutex);
         if (__find_logger(pf, logger->name) == NULL) {
                 mutex_unlock(&nf_log_mutex);
@@ -98,6 +100,8 @@ EXPORT_SYMBOL(nf_log_bind_pf);
 
 void nf_log_unbind_pf(u_int8_t pf)
 {
+        if (pf >= ARRAY_SIZE(nf_loggers))
+                return;
         mutex_lock(&nf_log_mutex);
         rcu_assign_pointer(nf_loggers[pf], NULL);
         mutex_unlock(&nf_log_mutex);
diff --git a/net/netfilter/nf_tproxy_core.c b/net/netfilter/nf_tproxy_core.c
index 4d87befb04c0..474d621cbc2e 100644
--- a/net/netfilter/nf_tproxy_core.c
+++ b/net/netfilter/nf_tproxy_core.c
@@ -28,26 +28,23 @@ nf_tproxy_destructor(struct sk_buff *skb)
         skb->destructor = NULL;
 
         if (sk)
-                nf_tproxy_put_sock(sk);
+                sock_put(sk);
 }
 
 /* consumes sk */
-int
+void
 nf_tproxy_assign_sock(struct sk_buff *skb, struct sock *sk)
 {
-        bool transparent = (sk->sk_state == TCP_TIME_WAIT) ?
-                                inet_twsk(sk)->tw_transparent :
-                                inet_sk(sk)->transparent;
-
-        if (transparent) {
-                skb_orphan(skb);
-                skb->sk = sk;
-                skb->destructor = nf_tproxy_destructor;
-                return 1;
-        } else
-                nf_tproxy_put_sock(sk);
-
-        return 0;
+        /* assigning tw sockets complicates things; most
+         * skb->sk->X checks would have to test sk->sk_state first */
+        if (sk->sk_state == TCP_TIME_WAIT) {
+                inet_twsk_put(inet_twsk(sk));
+                return;
+        }
+
+        skb_orphan(skb);
+        skb->sk = sk;
+        skb->destructor = nf_tproxy_destructor;
 }
 EXPORT_SYMBOL_GPL(nf_tproxy_assign_sock);
 
diff --git a/net/netfilter/xt_TPROXY.c b/net/netfilter/xt_TPROXY.c
index 640678f47a2a..dcfd57eb9d02 100644
--- a/net/netfilter/xt_TPROXY.c
+++ b/net/netfilter/xt_TPROXY.c
@@ -33,6 +33,20 @@
 #include <net/netfilter/nf_tproxy_core.h>
 #include <linux/netfilter/xt_TPROXY.h>
 
+static bool tproxy_sk_is_transparent(struct sock *sk)
+{
+        if (sk->sk_state != TCP_TIME_WAIT) {
+                if (inet_sk(sk)->transparent)
+                        return true;
+                sock_put(sk);
+        } else {
+                if (inet_twsk(sk)->tw_transparent)
+                        return true;
+                inet_twsk_put(inet_twsk(sk));
+        }
+        return false;
+}
+
 static inline __be32
 tproxy_laddr4(struct sk_buff *skb, __be32 user_laddr, __be32 daddr)
 {
@@ -141,7 +155,7 @@ tproxy_tg4(struct sk_buff *skb, __be32 laddr, __be16 lport,
                                            skb->dev, NFT_LOOKUP_LISTENER);
 
         /* NOTE: assign_sock consumes our sk reference */
-        if (sk && nf_tproxy_assign_sock(skb, sk)) {
+        if (sk && tproxy_sk_is_transparent(sk)) {
                 /* This should be in a separate target, but we don't do multiple
                    targets on the same rule yet */
                 skb->mark = (skb->mark & ~mark_mask) ^ mark_value;
@@ -149,6 +163,8 @@ tproxy_tg4(struct sk_buff *skb, __be32 laddr, __be16 lport,
                 pr_debug("redirecting: proto %hhu %pI4:%hu -> %pI4:%hu, mark: %x\n",
                          iph->protocol, &iph->daddr, ntohs(hp->dest),
                          &laddr, ntohs(lport), skb->mark);
+
+                nf_tproxy_assign_sock(skb, sk);
                 return NF_ACCEPT;
         }
 
@@ -306,7 +322,7 @@ tproxy_tg6_v1(struct sk_buff *skb, const struct xt_action_param *par)
                                            par->in, NFT_LOOKUP_LISTENER);
 
         /* NOTE: assign_sock consumes our sk reference */
-        if (sk && nf_tproxy_assign_sock(skb, sk)) {
+        if (sk && tproxy_sk_is_transparent(sk)) {
                 /* This should be in a separate target, but we don't do multiple
                    targets on the same rule yet */
                 skb->mark = (skb->mark & ~tgi->mark_mask) ^ tgi->mark_value;
@@ -314,6 +330,8 @@ tproxy_tg6_v1(struct sk_buff *skb, const struct xt_action_param *par)
                 pr_debug("redirecting: proto %hhu %pI6:%hu -> %pI6:%hu, mark: %x\n",
                          tproto, &iph->saddr, ntohs(hp->source),
                          laddr, ntohs(lport), skb->mark);
+
+                nf_tproxy_assign_sock(skb, sk);
                 return NF_ACCEPT;
         }
 
diff --git a/net/netfilter/xt_socket.c b/net/netfilter/xt_socket.c
index 00d6ae838303..9cc46356b577 100644
--- a/net/netfilter/xt_socket.c
+++ b/net/netfilter/xt_socket.c
@@ -35,6 +35,15 @@
 #include <net/netfilter/nf_conntrack.h>
 #endif
 
+static void
+xt_socket_put_sk(struct sock *sk)
+{
+        if (sk->sk_state == TCP_TIME_WAIT)
+                inet_twsk_put(inet_twsk(sk));
+        else
+                sock_put(sk);
+}
+
 static int
 extract_icmp4_fields(const struct sk_buff *skb,
                     u8 *protocol,
@@ -164,7 +173,7 @@ socket_match(const struct sk_buff *skb, struct xt_action_param *par,
                                        (sk->sk_state == TCP_TIME_WAIT &&
                                         inet_twsk(sk)->tw_transparent));
 
-                nf_tproxy_put_sock(sk);
+                xt_socket_put_sk(sk);
 
                 if (wildcard || !transparent)
                         sk = NULL;
@@ -298,7 +307,7 @@ socket_mt6_v1(const struct sk_buff *skb, struct xt_action_param *par)
                                        (sk->sk_state == TCP_TIME_WAIT &&
                                         inet_twsk(sk)->tw_transparent));
 
-                nf_tproxy_put_sock(sk);
+                xt_socket_put_sk(sk);
 
                 if (wildcard || !transparent)
                         sk = NULL;
diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c
index 478181d53c55..1f924595bdef 100644
--- a/net/netlink/af_netlink.c
+++ b/net/netlink/af_netlink.c
@@ -1407,7 +1407,7 @@ static int netlink_recvmsg(struct kiocb *kiocb, struct socket *sock,
         int noblock = flags&MSG_DONTWAIT;
         size_t copied;
         struct sk_buff *skb, *data_skb;
-        int err;
+        int err, ret;
 
         if (flags&MSG_OOB)
                 return -EOPNOTSUPP;
@@ -1470,8 +1470,13 @@ static int netlink_recvmsg(struct kiocb *kiocb, struct socket *sock,
 
         skb_free_datagram(sk, skb);
 
-        if (nlk->cb && atomic_read(&sk->sk_rmem_alloc) <= sk->sk_rcvbuf / 2)
-                netlink_dump(sk);
+        if (nlk->cb && atomic_read(&sk->sk_rmem_alloc) <= sk->sk_rcvbuf / 2) {
+                ret = netlink_dump(sk);
+                if (ret) {
+                        sk->sk_err = ret;
+                        sk->sk_error_report(sk);
+                }
+        }
 
         scm_recv(sock, msg, siocb->scm, flags);
 out:
@@ -1736,6 +1741,7 @@ int netlink_dump_start(struct sock *ssk, struct sk_buff *skb,
         struct netlink_callback *cb;
         struct sock *sk;
         struct netlink_sock *nlk;
+        int ret;
 
         cb = kzalloc(sizeof(*cb), GFP_KERNEL);
         if (cb == NULL)
@@ -1764,9 +1770,13 @@ int netlink_dump_start(struct sock *ssk, struct sk_buff *skb,
         nlk->cb = cb;
         mutex_unlock(nlk->cb_mutex);
 
-        netlink_dump(sk);
+        ret = netlink_dump(sk);
+
         sock_put(sk);
 
+        if (ret)
+                return ret;
+
         /* We successfully started a dump, by returning -EINTR we
          * signal not to send ACK even if it was requested.
          */
diff --git a/net/rxrpc/ar-input.c b/net/rxrpc/ar-input.c
index 89315009bab1..1a2b0633fece 100644
--- a/net/rxrpc/ar-input.c
+++ b/net/rxrpc/ar-input.c
@@ -423,6 +423,7 @@ void rxrpc_fast_process_packet(struct rxrpc_call *call, struct sk_buff *skb)
                         goto protocol_error;
                 }
 
+        case RXRPC_PACKET_TYPE_ACKALL:
         case RXRPC_PACKET_TYPE_ACK:
                 /* ACK processing is done in process context */
                 read_lock_bh(&call->state_lock);
diff --git a/net/rxrpc/ar-key.c b/net/rxrpc/ar-key.c
index 5ee16f0353fe..d763793d39de 100644
--- a/net/rxrpc/ar-key.c
+++ b/net/rxrpc/ar-key.c
@@ -89,11 +89,11 @@ static int rxrpc_instantiate_xdr_rxkad(struct key *key, const __be32 *xdr,
                 return ret;
 
         plen -= sizeof(*token);
-        token = kmalloc(sizeof(*token), GFP_KERNEL);
+        token = kzalloc(sizeof(*token), GFP_KERNEL);
         if (!token)
                 return -ENOMEM;
 
-        token->kad = kmalloc(plen, GFP_KERNEL);
+        token->kad = kzalloc(plen, GFP_KERNEL);
         if (!token->kad) {
                 kfree(token);
                 return -ENOMEM;
@@ -731,10 +731,10 @@ static int rxrpc_instantiate(struct key *key, const void *data, size_t datalen)
                 goto error;
 
         ret = -ENOMEM;
-        token = kmalloc(sizeof(*token), GFP_KERNEL);
+        token = kzalloc(sizeof(*token), GFP_KERNEL);
         if (!token)
                 goto error;
-        token->kad = kmalloc(plen, GFP_KERNEL);
+        token->kad = kzalloc(plen, GFP_KERNEL);
         if (!token->kad)
                 goto error_free;
 
diff --git a/net/sched/sch_generic.c b/net/sched/sch_generic.c
index 34dc598440a2..1bc698039ae2 100644
--- a/net/sched/sch_generic.c
+++ b/net/sched/sch_generic.c
@@ -839,6 +839,7 @@ void dev_deactivate(struct net_device *dev)
 
         list_add(&dev->unreg_list, &single);
         dev_deactivate_many(&single);
+        list_del(&single);
 }
 
 static void dev_init_scheduler_queue(struct net_device *dev,
diff --git a/net/sctp/sm_make_chunk.c b/net/sctp/sm_make_chunk.c
index 2cc46f0962ca..b23428f3c0dd 100644
--- a/net/sctp/sm_make_chunk.c
+++ b/net/sctp/sm_make_chunk.c
@@ -2029,11 +2029,11 @@ static sctp_ierror_t sctp_process_unk_param(const struct sctp_association *asoc,
                         *errp = sctp_make_op_error_fixed(asoc, chunk);
 
                 if (*errp) {
-                        sctp_init_cause_fixed(*errp, SCTP_ERROR_UNKNOWN_PARAM,
-                                        WORD_ROUND(ntohs(param.p->length)));
-                        sctp_addto_chunk_fixed(*errp,
-                                        WORD_ROUND(ntohs(param.p->length)),
-                                        param.v);
+                        if (!sctp_init_cause_fixed(*errp, SCTP_ERROR_UNKNOWN_PARAM,
+                                        WORD_ROUND(ntohs(param.p->length))))
+                                sctp_addto_chunk_fixed(*errp,
+                                                WORD_ROUND(ntohs(param.p->length)),
+                                                param.v);
                 } else {
                         /* If there is no memory for generating the ERROR
                          * report as specified, an ABORT will be triggered
diff --git a/net/wireless/wext-compat.c b/net/wireless/wext-compat.c
index 3e5dbd4e4cd5..d112f038edf0 100644
--- a/net/wireless/wext-compat.c
+++ b/net/wireless/wext-compat.c
@@ -802,11 +802,11 @@ int cfg80211_wext_siwfreq(struct net_device *dev,
                         return freq;
                 if (freq == 0)
                         return -EINVAL;
-                wdev_lock(wdev);
                 mutex_lock(&rdev->devlist_mtx);
+                wdev_lock(wdev);
                 err = cfg80211_set_freq(rdev, wdev, freq, NL80211_CHAN_NO_HT);
-                mutex_unlock(&rdev->devlist_mtx);
                 wdev_unlock(wdev);
+                mutex_unlock(&rdev->devlist_mtx);
                 return err;
         default:
                 return -EOPNOTSUPP;
diff --git a/net/x25/x25_facilities.c b/net/x25/x25_facilities.c
index 55187c8f6420..406207515b5e 100644
--- a/net/x25/x25_facilities.c
+++ b/net/x25/x25_facilities.c
@@ -27,9 +27,19 @@
 #include <net/sock.h>
 #include <net/x25.h>
 
-/*
- * Parse a set of facilities into the facilities structures. Unrecognised
- *      facilities are written to the debug log file.
+/**
+ * x25_parse_facilities - Parse facilities from skb into the facilities structs
+ *
+ * @skb: sk_buff to parse
+ * @facilities: Regular facilites, updated as facilities are found
+ * @dte_facs: ITU DTE facilities, updated as DTE facilities are found
+ * @vc_fac_mask: mask is updated with all facilities found
+ *
+ * Return codes:
+ *  -1 - Parsing error, caller should drop call and clean up
+ *   0 - Parse OK, this skb has no facilities
+ *  >0 - Parse OK, returns the length of the facilities header
+ *
  */
 int x25_parse_facilities(struct sk_buff *skb, struct x25_facilities *facilities,
                 struct x25_dte_facilities *dte_facs, unsigned long *vc_fac_mask)
@@ -62,7 +72,7 @@ int x25_parse_facilities(struct sk_buff *skb, struct x25_facilities *facilities,
                 switch (*p & X25_FAC_CLASS_MASK) {
                 case X25_FAC_CLASS_A:
                         if (len < 2)
-                                return 0;
+                                return -1;
                         switch (*p) {
                         case X25_FAC_REVERSE:
                                 if((p[1] & 0x81) == 0x81) {
@@ -107,7 +117,7 @@ int x25_parse_facilities(struct sk_buff *skb, struct x25_facilities *facilities,
                         break;
                 case X25_FAC_CLASS_B:
                         if (len < 3)
-                                return 0;
+                                return -1;
                         switch (*p) {
                         case X25_FAC_PACKET_SIZE:
                                 facilities->pacsize_in  = p[1];
@@ -130,7 +140,7 @@ int x25_parse_facilities(struct sk_buff *skb, struct x25_facilities *facilities,
                         break;
                 case X25_FAC_CLASS_C:
                         if (len < 4)
-                                return 0;
+                                return -1;
                         printk(KERN_DEBUG "X.25: unknown facility %02X, "
                                "values %02X, %02X, %02X\n",
                                p[0], p[1], p[2], p[3]);
@@ -139,18 +149,18 @@ int x25_parse_facilities(struct sk_buff *skb, struct x25_facilities *facilities,
                         break;
                 case X25_FAC_CLASS_D:
                         if (len < p[1] + 2)
-                                return 0;
+                                return -1;
                         switch (*p) {
                         case X25_FAC_CALLING_AE:
                                 if (p[1] > X25_MAX_DTE_FACIL_LEN || p[1] <= 1)
-                                        return 0;
+                                        return -1;
                                 dte_facs->calling_len = p[2];
                                 memcpy(dte_facs->calling_ae, &p[3], p[1] - 1);
                                 *vc_fac_mask |= X25_MASK_CALLING_AE;
                                 break;
                         case X25_FAC_CALLED_AE:
                                 if (p[1] > X25_MAX_DTE_FACIL_LEN || p[1] <= 1)
-                                        return 0;
+                                        return -1;
                                 dte_facs->called_len = p[2];
                                 memcpy(dte_facs->called_ae, &p[3], p[1] - 1);
                                 *vc_fac_mask |= X25_MASK_CALLED_AE;
diff --git a/net/x25/x25_in.c b/net/x25/x25_in.c
index f729f022be69..15de65f04719 100644
--- a/net/x25/x25_in.c
+++ b/net/x25/x25_in.c
@@ -91,10 +91,10 @@ static int x25_state1_machine(struct sock *sk, struct sk_buff *skb, int frametyp
 {
         struct x25_address source_addr, dest_addr;
         int len;
+        struct x25_sock *x25 = x25_sk(sk);
 
         switch (frametype) {
                 case X25_CALL_ACCEPTED: {
-                        struct x25_sock *x25 = x25_sk(sk);
 
                         x25_stop_timer(sk);
                         x25->condition = 0x00;
@@ -113,14 +113,16 @@ static int x25_state1_machine(struct sock *sk, struct sk_buff *skb, int frametyp
                                                 &dest_addr);
                         if (len > 0)
                                 skb_pull(skb, len);
+                        else if (len < 0)
+                                goto out_clear;
 
                         len = x25_parse_facilities(skb, &x25->facilities,
                                                 &x25->dte_facilities,
                                                 &x25->vc_facil_mask);
                         if (len > 0)
                                 skb_pull(skb, len);
-                        else
-                                return -1;
+                        else if (len < 0)
+                                goto out_clear;
                         /*
                          *      Copy any Call User Data.
                          */
@@ -144,6 +146,12 @@ static int x25_state1_machine(struct sock *sk, struct sk_buff *skb, int frametyp
         }
 
         return 0;
+
+out_clear:
+        x25_write_internal(sk, X25_CLEAR_REQUEST);
+        x25->state = X25_STATE_2;
+        x25_start_t23timer(sk);
+        return 0;
 }
 
 /*
diff --git a/net/x25/x25_link.c b/net/x25/x25_link.c
index 4cbc942f762a..21306928d47f 100644
--- a/net/x25/x25_link.c
+++ b/net/x25/x25_link.c
@@ -396,9 +396,12 @@ void __exit x25_link_free(void)
         write_lock_bh(&x25_neigh_list_lock);
 
         list_for_each_safe(entry, tmp, &x25_neigh_list) {
+                struct net_device *dev;
+
                 nb = list_entry(entry, struct x25_neigh, node);
+                dev = nb->dev;
                 __x25_remove_neigh(nb);
-                dev_put(nb->dev);
+                dev_put(dev);
         }
         write_unlock_bh(&x25_neigh_list_lock);
 }
diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c
index 8b3ef404c794..6459588befc3 100644
--- a/net/xfrm/xfrm_policy.c
+++ b/net/xfrm/xfrm_policy.c
@@ -1340,10 +1340,13 @@ static inline struct xfrm_dst *xfrm_alloc_dst(struct net *net, int family)
         default:
                 BUG();
         }
-        xdst = dst_alloc(dst_ops) ?: ERR_PTR(-ENOBUFS);
+        xdst = dst_alloc(dst_ops);
         xfrm_policy_put_afinfo(afinfo);
 
-        xdst->flo.ops = &xfrm_bundle_fc_ops;
+        if (likely(xdst))
+                xdst->flo.ops = &xfrm_bundle_fc_ops;
+        else
+                xdst = ERR_PTR(-ENOBUFS);
 
         return xdst;
 }