24 files changed, 127 insertions, 115 deletions
diff --git a/drivers/net/pppol2tp.c b/drivers/net/pppol2tp.c
index e0b072d9fdb7..86e5dba079fe 100644
--- a/drivers/net/pppol2tp.c
+++ b/drivers/net/pppol2tp.c
@@ -455,6 +455,7 @@ static void pppol2tp_recv_dequeue(struct pppol2tp_session *session)
                               skb_queue_len(&session->reorder_q));
                        __skb_unlink(skb, &session->reorder_q);
                        kfree_skb(skb);
+                        sock_put(session->sock);
                        continue;
                }
@@ -1110,6 +1111,8 @@ static void pppol2tp_tunnel_closeall(struct pppol2tp_tunnel *tunnel)
        for (hash = 0; hash < PPPOL2TP_HASH_SIZE; hash++) {
 again:
                hlist_for_each_safe(walk, tmp, &tunnel->session_hlist[hash]) {
+                        struct sk_buff *skb;
                        session = hlist_entry(walk, struct pppol2tp_session, hlist);
                        sk = session->sock;
@@ -1138,7 +1141,10 @@ again:
                        /* Purge any queued data */
                        skb_queue_purge(&sk->sk_receive_queue);
                        skb_queue_purge(&sk->sk_write_queue);
-                        skb_queue_purge(&session->reorder_q);
+                        while ((skb = skb_dequeue(&session->reorder_q))) {
+                                kfree_skb(skb);
+                                sock_put(sk);
+                        }
                        release_sock(sk);
                        sock_put(sk);
diff --git a/drivers/net/tun.c b/drivers/net/tun.c
index 038c1ef94d2e..7b816a032957 100644
--- a/drivers/net/tun.c
+++ b/drivers/net/tun.c
@@ -663,7 +663,11 @@ static int tun_chr_ioctl(struct inode *inode, struct file *file,
        case SIOCSIFHWADDR:
        {
                /* try to set the actual net device's hw address */
-                int ret = dev_set_mac_address(tun->dev, &ifr.ifr_hwaddr);
+                int ret;
+                rtnl_lock();
+                ret = dev_set_mac_address(tun->dev, &ifr.ifr_hwaddr);
+                rtnl_unlock();
                if (ret == 0) {
                        /** Set the character device's hardware address. This is used when
diff --git a/drivers/net/wireless/b43legacy/main.c b/drivers/net/wireless/b43legacy/main.c
index c39de422e220..5f3f34e1dbfd 100644
--- a/drivers/net/wireless/b43legacy/main.c
+++ b/drivers/net/wireless/b43legacy/main.c
@@ -3829,7 +3829,7 @@ static void b43legacy_print_driverinfo(void)
 #ifdef CONFIG_B43LEGACY_DMA
        feat_dma = "D";
 #endif
-        printk(KERN_INFO "Broadcom 43xx driver loaded "
+        printk(KERN_INFO "Broadcom 43xx-legacy driver loaded "
               "[ Features: %s%s%s%s%s, Firmware-ID: "
               B43legacy_SUPPORTED_FIRMWARE_ID " ]\n",
               feat_pci, feat_leds, feat_rfkill, feat_pio, feat_dma);
diff --git a/drivers/net/wireless/libertas/cmdresp.c b/drivers/net/wireless/libertas/cmdresp.c
index 159216a91903..bdc6a1cc2103 100644
--- a/drivers/net/wireless/libertas/cmdresp.c
+++ b/drivers/net/wireless/libertas/cmdresp.c
@@ -562,9 +562,7 @@ int lbs_process_rx_command(struct lbs_private *priv)
        }
        resp = (void *)priv->upld_buf;
+        curcmd = le16_to_cpu(priv->cur_cmd->cmdbuf->command);
-        curcmd = le16_to_cpu(resp->command);
        respcmd = le16_to_cpu(resp->command);
        result = le16_to_cpu(resp->result);
@@ -572,9 +570,9 @@ int lbs_process_rx_command(struct lbs_private *priv)
                     respcmd, le16_to_cpu(resp->seqnum), priv->upld_len, jiffies);
        lbs_deb_hex(LBS_DEB_HOST, "CMD_RESP", (void *) resp, priv->upld_len);
-        if (resp->seqnum != resp->seqnum) {
+        if (resp->seqnum != priv->cur_cmd->cmdbuf->seqnum) {
                lbs_pr_info("Received CMD_RESP with invalid sequence %d (expected %d)\n",
-                            le16_to_cpu(resp->seqnum), le16_to_cpu(resp->seqnum));
+                            le16_to_cpu(resp->seqnum), le16_to_cpu(priv->cur_cmd->cmdbuf->seqnum));
                spin_unlock_irqrestore(&priv->driver_lock, flags);
                ret = -1;
                goto done;
diff --git a/drivers/net/wireless/p54common.c b/drivers/net/wireless/p54common.c
index 5cda49aff3a8..d191e055a788 100644
--- a/drivers/net/wireless/p54common.c
+++ b/drivers/net/wireless/p54common.c
@@ -166,18 +166,23 @@ int p54_parse_eeprom(struct ieee80211_hw *dev, void *eeprom, int len)
        struct p54_common *priv = dev->priv;
        struct eeprom_pda_wrap *wrap = NULL;
        struct pda_entry *entry;
-        int i = 0;
        unsigned int data_len, entry_len;
        void *tmp;
        int err;
+        u8 *end = (u8 *)eeprom + len;
        wrap = (struct eeprom_pda_wrap *) eeprom;
-        entry = (void *)wrap->data + wrap->len;
+        entry = (void *)wrap->data + le16_to_cpu(wrap->len);
-        i += 2;
-        i += le16_to_cpu(entry->len)*2;
+        /* verify that at least the entry length/code fits */
-        while (i < len) {
+        while ((u8 *)entry <= end - sizeof(*entry)) {
                entry_len = le16_to_cpu(entry->len);
                data_len = ((entry_len - 1) << 1);
+                /* abort if entry exceeds whole structure */
+                if ((u8 *)entry + sizeof(*entry) + data_len > end)
+                        break;
                switch (le16_to_cpu(entry->code)) {
                case PDR_MAC_ADDRESS:
                        SET_IEEE80211_PERM_ADDR(dev, entry->data);
@@ -249,13 +254,12 @@ int p54_parse_eeprom(struct ieee80211_hw *dev, void *eeprom, int len)
                        priv->version = *(u8 *)(entry->data + 1);
                        break;
                case PDR_END:
-                        i = len;
+                        /* make it overrun */
+                        entry_len = len;
                        break;
                }
                entry = (void *)entry + (entry_len + 1)*2;
-                i += 2;
-                i += entry_len*2;
        }
        if (!priv->iq_autocal || !priv->output_limit || !priv->curve_data) {
diff --git a/drivers/net/wireless/p54common.h b/drivers/net/wireless/p54common.h
index a721334e20d9..b67ff34e26fe 100644
--- a/drivers/net/wireless/p54common.h
+++ b/drivers/net/wireless/p54common.h
@@ -53,10 +53,10 @@ struct pda_entry {
 } __attribute__ ((packed));
 struct eeprom_pda_wrap {
-        u32 magic;
+        __le32 magic;
-        u16 pad;
+        __le16 pad;
-        u16 len;
+        __le16 len;
-        u32 arm_opcode;
+        __le32 arm_opcode;
        u8 data[0];
 } __attribute__ ((packed));
diff --git a/drivers/net/wireless/rndis_wlan.c b/drivers/net/wireless/rndis_wlan.c
index d9460aed1f22..10b776c1adc5 100644
--- a/drivers/net/wireless/rndis_wlan.c
+++ b/drivers/net/wireless/rndis_wlan.c
@@ -260,7 +260,7 @@ struct NDIS_802_11_KEY {
        __le32 KeyLength;
        u8 Bssid[6];
        u8 Padding[6];
-        __le64 KeyRSC;
+        u8 KeyRSC[8];
        u8 KeyMaterial[32];
 } __attribute__((packed));
@@ -1508,7 +1508,7 @@ static int rndis_iw_set_encode_ext(struct net_device *dev,
        struct usbnet *usbdev = dev->priv;
        struct rndis_wext_private *priv = get_rndis_wext_priv(usbdev);
        struct NDIS_802_11_KEY ndis_key;
-        int i, keyidx, ret;
+        int keyidx, ret;
        u8 *addr;
        keyidx = wrqu->encoding.flags & IW_ENCODE_INDEX;
@@ -1543,9 +1543,7 @@ static int rndis_iw_set_encode_ext(struct net_device *dev,
        ndis_key.KeyIndex = cpu_to_le32(keyidx);
        if (ext->ext_flags & IW_ENCODE_EXT_RX_SEQ_VALID) {
-                for (i = 0; i < 6; i++)
+                memcpy(ndis_key.KeyRSC, ext->rx_seq, 6);
-                        ndis_key.KeyRSC |=
-                                cpu_to_le64(ext->rx_seq[i] << (i * 8));
                ndis_key.KeyIndex |= cpu_to_le32(1 << 29);
        }
diff --git a/drivers/ssb/driver_pcicore.c b/drivers/ssb/driver_pcicore.c
index 07ab48d9ceab..74b9a8aea52b 100644
--- a/drivers/ssb/driver_pcicore.c
+++ b/drivers/ssb/driver_pcicore.c
@@ -111,7 +111,10 @@ static void __init ssb_fixup_pcibridge(struct pci_dev *dev)
        /* Enable PCI bridge bus mastering and memory space */
        pci_set_master(dev);
-        pcibios_enable_device(dev, ~0);
+        if (pcibios_enable_device(dev, ~0) < 0) {
+                ssb_printk(KERN_ERR "PCI: SSB bridge enable failed\n");
+                return;
+        }
        /* Enable PCI bridge BAR1 prefetch and burst */
        pci_write_config_dword(dev, SSB_BAR1_CONTROL, 3);
diff --git a/include/linux/netpoll.h b/include/linux/netpoll.h
index a0525a1f4715..e3d79593fb3a 100644
--- a/include/linux/netpoll.h
+++ b/include/linux/netpoll.h
@@ -25,6 +25,7 @@ struct netpoll {
 struct netpoll_info {
        atomic_t refcnt;
+        int rx_flags;
        spinlock_t rx_lock;
        struct netpoll *rx_np; /* netpoll that registered an rx_hook */
        struct sk_buff_head arp_tx; /* list of arp requests to reply to */
@@ -50,12 +51,12 @@ static inline int netpoll_rx(struct sk_buff *skb)
        unsigned long flags;
        int ret = 0;
-        if (!npinfo || !npinfo->rx_np)
+        if (!npinfo || (!npinfo->rx_np && !npinfo->rx_flags))
                return 0;
        spin_lock_irqsave(&npinfo->rx_lock, flags);
-        /* check rx_np again with the lock held */
+        /* check rx_flags again with the lock held */
-        if (npinfo->rx_np && __netpoll_rx(skb))
+        if (npinfo->rx_flags && __netpoll_rx(skb))
                ret = 1;
        spin_unlock_irqrestore(&npinfo->rx_lock, flags);
diff --git a/include/net/inet_sock.h b/include/net/inet_sock.h
index 70013c5f4e59..89cd011edb99 100644
--- a/include/net/inet_sock.h
+++ b/include/net/inet_sock.h
@@ -175,7 +175,8 @@ extern void build_ehash_secret(void);
 static inline unsigned int inet_ehashfn(const __be32 laddr, const __u16 lport,
                                        const __be32 faddr, const __be16 fport)
 {
-        return jhash_2words((__force __u32) laddr ^ (__force __u32) faddr,
+        return jhash_3words((__force __u32) laddr,
+                            (__force __u32) faddr,
                            ((__u32) lport) << 16 | (__force __u32)fport,
                            inet_ehash_secret);
 }
diff --git a/net/bluetooth/l2cap.c b/net/bluetooth/l2cap.c
index 7c5459c8e8ef..34f8bf98bc05 100644
--- a/net/bluetooth/l2cap.c
+++ b/net/bluetooth/l2cap.c
@@ -417,7 +417,8 @@ static void l2cap_conn_del(struct hci_conn *hcon, int err)
                l2cap_sock_kill(sk);
        }
-        del_timer_sync(&conn->info_timer);
+        if (conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_SENT)
+                del_timer_sync(&conn->info_timer);
        hcon->l2cap_data = NULL;
        kfree(conn);
diff --git a/net/core/neighbour.c b/net/core/neighbour.c
index aef01533dfb6..d9a02b2cc289 100644
--- a/net/core/neighbour.c
+++ b/net/core/neighbour.c
@@ -839,7 +839,7 @@ static void neigh_timer_handler(unsigned long arg)
                struct sk_buff *skb = skb_peek(&neigh->arp_queue);
                /* keep skb alive even if arp_queue overflows */
                if (skb)
-                        skb_get(skb);
+                        skb = skb_copy(skb, GFP_ATOMIC);
                write_unlock(&neigh->lock);
                neigh->ops->solicit(neigh, skb);
                atomic_inc(&neigh->probes);
diff --git a/net/core/netpoll.c b/net/core/netpoll.c
index 6faa128a4c8e..4b7e756181c9 100644
--- a/net/core/netpoll.c
+++ b/net/core/netpoll.c
@@ -39,6 +39,8 @@ static struct sk_buff_head skb_pool;
 static atomic_t trapped;
 #define USEC_PER_POLL   50
+#define NETPOLL_RX_ENABLED  1
+#define NETPOLL_RX_DROP     2
 #define MAX_SKB_SIZE \
                (MAX_UDP_CHUNK + sizeof(struct udphdr) + \
@@ -126,11 +128,13 @@ static int poll_one_napi(struct netpoll_info *npinfo,
        if (!test_bit(NAPI_STATE_SCHED, &napi->state))
                return budget;
+        npinfo->rx_flags |= NETPOLL_RX_DROP;
        atomic_inc(&trapped);
        work = napi->poll(napi, budget);
        atomic_dec(&trapped);
+        npinfo->rx_flags &= ~NETPOLL_RX_DROP;
        return budget - work;
 }
@@ -472,7 +476,7 @@ int __netpoll_rx(struct sk_buff *skb)
        if (skb->dev->type != ARPHRD_ETHER)
                goto out;
-        /* if receive ARP during middle of NAPI poll, then queue */
+        /* check if netpoll clients need ARP */
        if (skb->protocol == htons(ETH_P_ARP) &&
            atomic_read(&trapped)) {
                skb_queue_tail(&npi->arp_tx, skb);
@@ -534,9 +538,6 @@ int __netpoll_rx(struct sk_buff *skb)
        return 1;
 out:
-        /* If packet received while already in poll then just
-         * silently drop.
-         */
        if (atomic_read(&trapped)) {
                kfree_skb(skb);
                return 1;
@@ -675,6 +676,7 @@ int netpoll_setup(struct netpoll *np)
                        goto release;
                }
+                npinfo->rx_flags = 0;
                npinfo->rx_np = NULL;
                spin_lock_init(&npinfo->rx_lock);
@@ -756,6 +758,7 @@ int netpoll_setup(struct netpoll *np)
        if (np->rx_hook) {
                spin_lock_irqsave(&npinfo->rx_lock, flags);
+                npinfo->rx_flags |= NETPOLL_RX_ENABLED;
                npinfo->rx_np = np;
                spin_unlock_irqrestore(&npinfo->rx_lock, flags);
        }
@@ -797,6 +800,7 @@ void netpoll_cleanup(struct netpoll *np)
                        if (npinfo->rx_np == np) {
                                spin_lock_irqsave(&npinfo->rx_lock, flags);
                                npinfo->rx_np = NULL;
+                                npinfo->rx_flags &= ~NETPOLL_RX_ENABLED;
                                spin_unlock_irqrestore(&npinfo->rx_lock, flags);
                        }
diff --git a/net/ipv4/Kconfig b/net/ipv4/Kconfig
index 19880b086e71..9c7e5ffb223d 100644
--- a/net/ipv4/Kconfig
+++ b/net/ipv4/Kconfig
@@ -343,7 +343,7 @@ config INET_ESP
        tristate "IP: ESP transformation"
        select XFRM
        select CRYPTO
-        select CRYPTO_AEAD
+        select CRYPTO_AUTHENC
        select CRYPTO_HMAC
        select CRYPTO_MD5
        select CRYPTO_CBC
diff --git a/net/ipv4/ipconfig.c b/net/ipv4/ipconfig.c
index 10013ccee8dd..5dd938579eeb 100644
--- a/net/ipv4/ipconfig.c
+++ b/net/ipv4/ipconfig.c
@@ -753,9 +753,9 @@ static void __init ic_bootp_send_if(struct ic_device *d, unsigned long jiffies_d
                printk("Unknown ARP type 0x%04x for device %s\n", dev->type, dev->name);
                b->htype = dev->type; /* can cause undefined behavior */
        }
+        /* server_ip and your_ip address are both already zero per RFC2131 */
        b->hlen = dev->addr_len;
-        b->your_ip = NONE;
-        b->server_ip = NONE;
        memcpy(b->hw_addr, dev->dev_addr, dev->addr_len);
        b->secs = htons(jiffies_diff / HZ);
        b->xid = d->xid;
diff --git a/net/ipv4/tcp_bic.c b/net/ipv4/tcp_bic.c
index 5212ed9b0c98..7eb7636db0d0 100644
--- a/net/ipv4/tcp_bic.c
+++ b/net/ipv4/tcp_bic.c
@@ -1,12 +1,13 @@
 /*
 * Binary Increase Congestion control for TCP
- *
+ * Home page:
+ *      http://netsrv.csc.ncsu.edu/twiki/bin/view/Main/BIC
 * This is from the implementation of BICTCP in
 * Lison-Xu, Kahaled Harfoush, and Injong Rhee.
 *  "Binary Increase Congestion Control for Fast, Long Distance
 *  Networks" in InfoComm 2004
 * Available from:
- *  http://www.csc.ncsu.edu/faculty/rhee/export/bitcp.pdf
+ *  http://netsrv.csc.ncsu.edu/export/bitcp.pdf
 *
 * Unless BIC is enabled and congestion window is large
 * this behaves the same as the original Reno.
diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
index 19c449f62672..7facdb0f6960 100644
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -1367,7 +1367,7 @@ static struct sk_buff *tcp_sacktag_walk(struct sk_buff *skb, struct sock *sk,
 * a normal way
 */
 static struct sk_buff *tcp_sacktag_skip(struct sk_buff *skb, struct sock *sk,
-                                        u32 skip_to_seq)
+                                        u32 skip_to_seq, int *fack_count)
 {
        tcp_for_write_queue_from(skb, sk) {
                if (skb == tcp_send_head(sk))
@@ -1375,6 +1375,8 @@ static struct sk_buff *tcp_sacktag_skip(struct sk_buff *skb, struct sock *sk,
                if (!before(TCP_SKB_CB(skb)->end_seq, skip_to_seq))
                        break;
+                *fack_count += tcp_skb_pcount(skb);
        }
        return skb;
 }
@@ -1390,7 +1392,7 @@ static struct sk_buff *tcp_maybe_skipping_dsack(struct sk_buff *skb,
                return skb;
        if (before(next_dup->start_seq, skip_to_seq)) {
-                skb = tcp_sacktag_skip(skb, sk, next_dup->start_seq);
+                skb = tcp_sacktag_skip(skb, sk, next_dup->start_seq, fack_count);
                tcp_sacktag_walk(skb, sk, NULL,
                                 next_dup->start_seq, next_dup->end_seq,
                                 1, fack_count, reord, flag);
@@ -1537,7 +1539,8 @@ tcp_sacktag_write_queue(struct sock *sk, struct sk_buff *ack_skb,
                        /* Head todo? */
                        if (before(start_seq, cache->start_seq)) {
-                                skb = tcp_sacktag_skip(skb, sk, start_seq);
+                                skb = tcp_sacktag_skip(skb, sk, start_seq,
+                                                       &fack_count);
                                skb = tcp_sacktag_walk(skb, sk, next_dup,
                                                       start_seq,
                                                       cache->start_seq,
@@ -1565,7 +1568,8 @@ tcp_sacktag_write_queue(struct sock *sk, struct sk_buff *ack_skb,
                                goto walk;
                        }
-                        skb = tcp_sacktag_skip(skb, sk, cache->end_seq);
+                        skb = tcp_sacktag_skip(skb, sk, cache->end_seq,
+                                               &fack_count);
                        /* Check overlap against next cached too (past this one already) */
                        cache++;
                        continue;
@@ -1577,7 +1581,7 @@ tcp_sacktag_write_queue(struct sock *sk, struct sk_buff *ack_skb,
                                break;
                        fack_count = tp->fackets_out;
                }
-                skb = tcp_sacktag_skip(skb, sk, start_seq);
+                skb = tcp_sacktag_skip(skb, sk, start_seq, &fack_count);
 walk:
                skb = tcp_sacktag_walk(skb, sk, next_dup, start_seq, end_seq,
diff --git a/net/ipv6/Kconfig b/net/ipv6/Kconfig
index 3ffb0323668c..58219dfffef8 100644
--- a/net/ipv6/Kconfig
+++ b/net/ipv6/Kconfig
@@ -85,7 +85,7 @@ config INET6_ESP
        depends on IPV6
        select XFRM
        select CRYPTO
-        select CRYPTO_AEAD
+        select CRYPTO_AUTHENC
        select CRYPTO_HMAC
        select CRYPTO_MD5
        select CRYPTO_CBC
diff --git a/net/irda/ircomm/ircomm_core.c b/net/irda/ircomm/ircomm_core.c
index b825399fc160..6eef1f2a7553 100644
--- a/net/irda/ircomm/ircomm_core.c
+++ b/net/irda/ircomm/ircomm_core.c
@@ -76,9 +76,11 @@ static int __init ircomm_init(void)
 #ifdef CONFIG_PROC_FS
        { struct proc_dir_entry *ent;
-        ent = create_proc_entry("ircomm", 0, proc_irda);
+        ent = proc_create("ircomm", 0, proc_irda, &ircomm_proc_fops);
-        if (ent)
+        if (!ent) {
-                ent->proc_fops = &ircomm_proc_fops;
+                printk(KERN_ERR "ircomm_init: can't create /proc entry!\n");
+                return -ENODEV;
+        }
        }
 #endif /* CONFIG_PROC_FS */
diff --git a/net/irda/irlan/irlan_common.c b/net/irda/irlan/irlan_common.c
index a4b56e25a917..1eb4bbcb1c9e 100644
--- a/net/irda/irlan/irlan_common.c
+++ b/net/irda/irlan/irlan_common.c
@@ -128,13 +128,11 @@ static int __init irlan_init(void)
 #ifdef CONFIG_PROC_FS
        { struct proc_dir_entry *proc;
-        proc = create_proc_entry("irlan", 0, proc_irda);
+        proc = proc_create("irlan", 0, proc_irda, &irlan_fops);
        if (!proc) {
                printk(KERN_ERR "irlan_init: can't create /proc entry!\n");
                return -ENODEV;
        }
-        proc->proc_fops = &irlan_fops;
        }
 #endif /* CONFIG_PROC_FS */
diff --git a/net/irda/irproc.c b/net/irda/irproc.c
index cae24fbda966..88e80a312732 100644
--- a/net/irda/irproc.c
+++ b/net/irda/irproc.c
@@ -72,11 +72,9 @@ void __init irda_proc_register(void)
                return;
        proc_irda->owner = THIS_MODULE;
-        for (i=0; i<ARRAY_SIZE(irda_dirs); i++) {
+        for (i = 0; i < ARRAY_SIZE(irda_dirs); i++)
-                d = create_proc_entry(irda_dirs[i].name, 0, proc_irda);
+                d = proc_create(irda_dirs[i].name, 0, proc_irda,
-                if (d)
+                                irda_dirs[i].fops);
-                        d->proc_fops = irda_dirs[i].fops;
-        }
 }
 /*
diff --git a/net/iucv/iucv.c b/net/iucv/iucv.c
index 2753b0c448f3..d764f4c1b7e4 100644
--- a/net/iucv/iucv.c
+++ b/net/iucv/iucv.c
@@ -621,7 +621,6 @@ static int iucv_sever_pathid(u16 pathid, u8 userdata[16])
        return iucv_call_b2f0(IUCV_SEVER, parm);
 }
-#ifdef CONFIG_SMP
 /**
 * __iucv_cleanup_queue
 * @dummy: unused dummy argument
@@ -632,7 +631,6 @@ static int iucv_sever_pathid(u16 pathid, u8 userdata[16])
 static void __iucv_cleanup_queue(void *dummy)
 {
 }
-#endif
 /**
 * iucv_cleanup_queue
diff --git a/net/mac80211/rc80211_pid_algo.c b/net/mac80211/rc80211_pid_algo.c
index c339571632b2..3b77410588e7 100644
--- a/net/mac80211/rc80211_pid_algo.c
+++ b/net/mac80211/rc80211_pid_algo.c
@@ -2,7 +2,7 @@
 * Copyright 2002-2005, Instant802 Networks, Inc.
 * Copyright 2005, Devicescape Software, Inc.
 * Copyright 2007, Mattias Nissler <mattias.nissler@gmx.de>
- * Copyright 2007, Stefano Brivio <stefano.brivio@polimi.it>
+ * Copyright 2007-2008, Stefano Brivio <stefano.brivio@polimi.it>
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License version 2 as
@@ -63,72 +63,66 @@
 * RC_PID_ARITH_SHIFT.
 */
+/* Adjust the rate while ensuring that we won't switch to a lower rate if it
-/* Shift the adjustment so that we won't switch to a lower rate if it exhibited
+ * exhibited a worse failed frames behaviour and we'll choose the highest rate
- * a worse failed frames behaviour and we'll choose the highest rate whose
+ * whose failed frames behaviour is not worse than the one of the original rate
- * failed frames behaviour is not worse than the one of the original rate
+ * target. While at it, check that the new rate is valid. */
- * target. While at it, check that the adjustment is within the ranges. Then,
- * provide the new rate index. */
-static int rate_control_pid_shift_adjust(struct rc_pid_rateinfo *r,
-                                         int adj, int cur, int l)
-{
-        int i, j, k, tmp;
-        j = r[cur].rev_index;
-        i = j + adj;
-        if (i < 0)
-                return r[0].index;
-        if (i >= l - 1)
-                return r[l - 1].index;
-        tmp = i;
-        if (adj < 0) {
-                for (k = j; k >= i; k--)
-                        if (r[k].diff <= r[j].diff)
-                                tmp = k;
-        } else {
-                for (k = i + 1; k + i < l; k++)
-                        if (r[k].diff <= r[i].diff)
-                                tmp = k;
-        }
-        return r[tmp].index;
-}
 static void rate_control_pid_adjust_rate(struct ieee80211_local *local,
                                         struct sta_info *sta, int adj,
                                         struct rc_pid_rateinfo *rinfo)
 {
        struct ieee80211_sub_if_data *sdata;
        struct ieee80211_hw_mode *mode;
-        int newidx;
+        int cur_sorted, new_sorted, probe, tmp, n_bitrates;
-        int maxrate;
+        int cur = sta->txrate;
-        int back = (adj > 0) ? 1 : -1;
        sdata = IEEE80211_DEV_TO_SUB_IF(sta->dev);
        mode = local->oper_hw_mode;
-        maxrate = sdata->bss ? sdata->bss->max_ratectrl_rateidx : -1;
+        n_bitrates = mode->num_rates;
-        newidx = rate_control_pid_shift_adjust(rinfo, adj, sta->txrate,
+        /* Map passed arguments to sorted values. */
-                                               mode->num_rates);
+        cur_sorted = rinfo[cur].rev_index;
+        new_sorted = cur_sorted + adj;
-        while (newidx != sta->txrate) {
+        /* Check limits. */
-                if (rate_supported(sta, mode, newidx) &&
+        if (new_sorted < 0)
-                    (maxrate < 0 || newidx <= maxrate)) {
+                new_sorted = rinfo[0].rev_index;
-                        sta->txrate = newidx;
+        else if (new_sorted >= n_bitrates)
-                        break;
+                new_sorted = rinfo[n_bitrates - 1].rev_index;
-                }
-                newidx += back;
+        tmp = new_sorted;
+        if (adj < 0) {
+                /* Ensure that the rate decrease isn't disadvantageous. */
+                for (probe = cur_sorted; probe >= new_sorted; probe--)
+                        if (rinfo[probe].diff <= rinfo[cur_sorted].diff &&
+                            rate_supported(sta, mode, rinfo[probe].index))
+                                tmp = probe;
+        } else {
+                /* Look for rate increase with zero (or below) cost. */
+                for (probe = new_sorted + 1; probe < n_bitrates; probe++)
+                        if (rinfo[probe].diff <= rinfo[new_sorted].diff &&
+                            rate_supported(sta, mode, rinfo[probe].index))
+                                tmp = probe;
        }
+        /* Fit the rate found to the nearest supported rate. */
+        do {
+                if (rate_supported(sta, mode, rinfo[tmp].index)) {
+                        sta->txrate = rinfo[tmp].index;
+                        break;
+                }
+                if (adj < 0)
+                        tmp--;
+                else
+                        tmp++;
+        } while (tmp < n_bitrates && tmp >= 0);
 #ifdef CONFIG_MAC80211_DEBUGFS
        rate_control_pid_event_rate_change(
                &((struct rc_pid_sta_info *)sta->rate_ctrl_priv)->events,
-                newidx, mode->rates[newidx].rate);
+                cur, mode->rates[cur].rate);
 #endif
 }
diff --git a/net/sctp/proc.c b/net/sctp/proc.c
index 9e214da82d9e..973f1dbc2ec3 100644
--- a/net/sctp/proc.c
+++ b/net/sctp/proc.c
@@ -256,12 +256,10 @@ int __init sctp_eps_proc_init(void)
 {
        struct proc_dir_entry *p;
-        p = create_proc_entry("eps", S_IRUGO, proc_net_sctp);
+        p = proc_create("eps", S_IRUGO, proc_net_sctp, &sctp_eps_seq_fops);
        if (!p)
                return -ENOMEM;
-        p->proc_fops = &sctp_eps_seq_fops;
        return 0;
 }
@@ -367,12 +365,11 @@ int __init sctp_assocs_proc_init(void)
 {
        struct proc_dir_entry *p;
-        p = create_proc_entry("assocs", S_IRUGO, proc_net_sctp);
+        p = proc_create("assocs", S_IRUGO, proc_net_sctp,
+                        &sctp_assocs_seq_fops);
        if (!p)
                return -ENOMEM;
-        p->proc_fops = &sctp_assocs_seq_fops;
        return 0;
 }