24 files changed, 152 insertions, 98 deletions

diff --git a/MAINTAINERS b/MAINTAINERS
index cdbbaf59a43b..c856aee0f1e2 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -3632,6 +3632,7 @@ L:	netdev@vger.kernel.org
 W:      http://www.linuxfoundation.org/en/Net
 W:      http://patchwork.ozlabs.org/project/netdev/list/
 T:      git git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6.git
+T:      git git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next-2.6.git
 S:      Maintained
 F:      net/
 F:      include/net/
diff --git a/drivers/isdn/hardware/eicon/maintidi.c b/drivers/isdn/hardware/eicon/maintidi.c
index 23960cb6eaab..41c26e756452 100644
--- a/drivers/isdn/hardware/eicon/maintidi.c
+++ b/drivers/isdn/hardware/eicon/maintidi.c
@@ -959,8 +959,9 @@ static int process_idi_event (diva_strace_context_t* pLib,
         }
         if (!strncmp("State\\Layer2 No1", path, pVar->path_length)) {
                 char* tmp = &pLib->lines[0].pInterface->Layer2[0];
-    dword l2_state;
-    diva_strace_read_uint (pVar, &l2_state);
+                dword l2_state;
+                if (diva_strace_read_uint(pVar, &l2_state))
+                        return -1;
 
                 switch (l2_state) {
                         case 0:
diff --git a/drivers/isdn/hardware/eicon/message.c b/drivers/isdn/hardware/eicon/message.c
index 27d5dd68f4fb..ae89fb89da64 100644
--- a/drivers/isdn/hardware/eicon/message.c
+++ b/drivers/isdn/hardware/eicon/message.c
@@ -2692,7 +2692,7 @@ static byte connect_b3_req(dword Id, word Number, DIVA_CAPI_ADAPTER *a,
           if (!(fax_control_bits & T30_CONTROL_BIT_MORE_DOCUMENTS)
            || (fax_feature_bits & T30_FEATURE_BIT_MORE_DOCUMENTS))
           {
-            len = (byte)(&(((T30_INFO *) 0)->universal_6));
+            len = offsetof(T30_INFO, universal_6);
             fax_info_change = false;
             if (ncpi->length >= 4)
             {
@@ -2754,7 +2754,7 @@ static byte connect_b3_req(dword Id, word Number, DIVA_CAPI_ADAPTER *a,
                     for (i = 0; i < w; i++)
                       ((T30_INFO   *)(plci->fax_connect_info_buffer))->station_id[i] = fax_parms[4].info[1+i];
                     ((T30_INFO   *)(plci->fax_connect_info_buffer))->head_line_len = 0;
-                    len = (byte)(((T30_INFO *) 0)->station_id + 20);
+                    len = offsetof(T30_INFO, station_id) + 20;
                     w = fax_parms[5].length;
                     if (w > 20)
                       w = 20;
@@ -2788,7 +2788,7 @@ static byte connect_b3_req(dword Id, word Number, DIVA_CAPI_ADAPTER *a,
                 }
                 else
                 {
-                  len = (byte)(&(((T30_INFO *) 0)->universal_6));
+                  len = offsetof(T30_INFO, universal_6);
                 }
                 fax_info_change = true;
 
@@ -2892,7 +2892,7 @@ static byte connect_b3_res(dword Id, word Number, DIVA_CAPI_ADAPTER *a,
     && (plci->nsf_control_bits & T30_NSF_CONTROL_BIT_ENABLE_NSF)
     && (plci->nsf_control_bits & T30_NSF_CONTROL_BIT_NEGOTIATE_RESP))
    {
-            len = ((byte)(((T30_INFO *) 0)->station_id + 20));
+            len = offsetof(T30_INFO, station_id) + 20;
             if (plci->fax_connect_info_length < len)
             {
               ((T30_INFO *)(plci->fax_connect_info_buffer))->station_id_len = 0;
@@ -3802,7 +3802,7 @@ static byte manufacturer_res(dword Id, word Number, DIVA_CAPI_ADAPTER *a,
       break;
     }
     ncpi = &m_parms[1];
-    len = ((byte)(((T30_INFO *) 0)->station_id + 20));
+    len = offsetof(T30_INFO, station_id) + 20;
     if (plci->fax_connect_info_length < len)
     {
       ((T30_INFO *)(plci->fax_connect_info_buffer))->station_id_len = 0;
@@ -6844,7 +6844,7 @@ static void nl_ind(PLCI *plci)
         if ((plci->requested_options_conn | plci->requested_options | a->requested_options_table[plci->appl->Id-1])
           & ((1L << PRIVATE_FAX_SUB_SEP_PWD) | (1L << PRIVATE_FAX_NONSTANDARD)))
         {
-          i = ((word)(((T30_INFO *) 0)->station_id + 20)) + ((T30_INFO   *)plci->NL.RBuffer->P)->head_line_len;
+          i = offsetof(T30_INFO, station_id) + 20 + ((T30_INFO   *)plci->NL.RBuffer->P)->head_line_len;
           while (i < plci->NL.RBuffer->length)
             plci->ncpi_buffer[++len] = plci->NL.RBuffer->P[i++];
         }
@@ -7236,7 +7236,7 @@ static void nl_ind(PLCI *plci)
     {
       plci->RData[1].P = plci->RData[0].P;
       plci->RData[1].PLength = plci->RData[0].PLength;
-      plci->RData[0].P = v120_header_buffer + (-((int) v120_header_buffer) & 3);
+      plci->RData[0].P = v120_header_buffer + (-((unsigned long)v120_header_buffer) & 3);
       if ((plci->NL.RBuffer->P[0] & V120_HEADER_EXTEND_BIT) || (plci->NL.RLength == 1))
         plci->RData[0].PLength = 1;
       else
@@ -8473,7 +8473,7 @@ static word add_b23(PLCI *plci, API_PARSE *bp)
             fax_control_bits |= T30_CONTROL_BIT_ACCEPT_SEL_POLLING;
           }
             len = nlc[0];
-          pos = ((byte)(((T30_INFO *) 0)->station_id + 20));
+          pos = offsetof(T30_INFO, station_id) + 20;
    if (pos < plci->fax_connect_info_length)
    {
      for (i = 1 + plci->fax_connect_info_buffer[pos]; i != 0; i--)
@@ -8525,7 +8525,7 @@ static word add_b23(PLCI *plci, API_PARSE *bp)
       }
 
       PUT_WORD(&(((T30_INFO *)&nlc[1])->control_bits_low), fax_control_bits);
-      len = ((byte)(((T30_INFO *) 0)->station_id + 20));
+      len = offsetof(T30_INFO, station_id) + 20;
       for (i = 0; i < len; i++)
         plci->fax_connect_info_buffer[i] = nlc[1+i];
       ((T30_INFO   *) plci->fax_connect_info_buffer)->head_line_len = 0;
diff --git a/drivers/isdn/hisax/amd7930_fn.c b/drivers/isdn/hisax/amd7930_fn.c
index bf526a7a63af..d6fdf1f66754 100644
--- a/drivers/isdn/hisax/amd7930_fn.c
+++ b/drivers/isdn/hisax/amd7930_fn.c
@@ -594,6 +594,7 @@ Amd7930_l1hw(struct PStack *st, int pr, void *arg)
                                 if (cs->debug & L1_DEB_WARN)
                                         debugl1(cs, "Amd7930: l1hw: l2l1 tx_skb exist this shouldn't happen");
                                 skb_queue_tail(&cs->sq, skb);
+                                spin_unlock_irqrestore(&cs->lock, flags);
                                 break;
                         }
                         if (cs->debug & DEB_DLOG_HEX)
diff --git a/drivers/isdn/hisax/diva.c b/drivers/isdn/hisax/diva.c
index 018bd293e580..0b0c2e5d806b 100644
--- a/drivers/isdn/hisax/diva.c
+++ b/drivers/isdn/hisax/diva.c
@@ -382,7 +382,7 @@ MemwaitforXFW(struct IsdnCardState *cs, int hscx)
 {
         int to = 50;
 
-        while ((!(MemReadHSCX(cs, hscx, HSCX_STAR) & 0x44) == 0x40) && to) {
+        while (((MemReadHSCX(cs, hscx, HSCX_STAR) & 0x44) != 0x40) && to) {
                 udelay(1);
                 to--;
         }
diff --git a/drivers/isdn/hisax/hfc_usb.c b/drivers/isdn/hisax/hfc_usb.c
index 9de54202c90c..a420b64472e3 100644
--- a/drivers/isdn/hisax/hfc_usb.c
+++ b/drivers/isdn/hisax/hfc_usb.c
@@ -817,8 +817,8 @@ collect_rx_frame(usb_fifo * fifo, __u8 * data, int len, int finish)
         }
         /* we have a complete hdlc packet */
         if (finish) {
-                if ((!fifo->skbuff->data[fifo->skbuff->len - 1])
-                    && (fifo->skbuff->len > 3)) {
+                if (fifo->skbuff->len > 3 &&
+                                !fifo->skbuff->data[fifo->skbuff->len - 1]) {
 
                         if (fifon == HFCUSB_D_RX) {
                                 DBG(HFCUSB_DBG_DCHANNEL,
diff --git a/drivers/isdn/hisax/hscx_irq.c b/drivers/isdn/hisax/hscx_irq.c
index 7b1ad5e4ecda..2387d76c721a 100644
--- a/drivers/isdn/hisax/hscx_irq.c
+++ b/drivers/isdn/hisax/hscx_irq.c
@@ -32,7 +32,7 @@ waitforXFW(struct IsdnCardState *cs, int hscx)
 {
         int to = 50;
 
-        while ((!(READHSCX(cs, hscx, HSCX_STAR) & 0x44) == 0x40) && to) {
+        while (((READHSCX(cs, hscx, HSCX_STAR) & 0x44) != 0x40) && to) {
                 udelay(1);
                 to--;
         }
diff --git a/drivers/isdn/hisax/icc.c b/drivers/isdn/hisax/icc.c
index 9aba646ba221..c80cbb8a2ef9 100644
--- a/drivers/isdn/hisax/icc.c
+++ b/drivers/isdn/hisax/icc.c
@@ -468,6 +468,7 @@ ICC_l1hw(struct PStack *st, int pr, void *arg)
                                 if (cs->debug & L1_DEB_WARN)
                                         debugl1(cs, " l2l1 tx_skb exist this shouldn't happen");
                                 skb_queue_tail(&cs->sq, skb);
+                                spin_unlock_irqrestore(&cs->lock, flags);
                                 break;
                         }
                         if (cs->debug & DEB_DLOG_HEX)
diff --git a/drivers/isdn/mISDN/stack.c b/drivers/isdn/mISDN/stack.c
index 3e1532a180ff..0d05ec43012c 100644
--- a/drivers/isdn/mISDN/stack.c
+++ b/drivers/isdn/mISDN/stack.c
@@ -364,7 +364,7 @@ add_layer2(struct mISDNchannel *ch, struct mISDNstack *st)
 static int
 st_own_ctrl(struct mISDNchannel *ch, u_int cmd, void *arg)
 {
-        if (!ch->st || ch->st->layer1)
+        if (!ch->st || !ch->st->layer1)
                 return -EINVAL;
         return ch->st->layer1->ctrl(ch->st->layer1, cmd, arg);
 }
diff --git a/drivers/net/benet/be_cmds.h b/drivers/net/benet/be_cmds.h
index 49953787e41c..e5f9676cf1bc 100644
--- a/drivers/net/benet/be_cmds.h
+++ b/drivers/net/benet/be_cmds.h
@@ -68,7 +68,7 @@ enum {
 #define CQE_STATUS_COMPL_MASK           0xFFFF
 #define CQE_STATUS_COMPL_SHIFT          0       /* bits 0 - 15 */
 #define CQE_STATUS_EXTD_MASK            0xFFFF
-#define CQE_STATUS_EXTD_SHIFT           0       /* bits 0 - 15 */
+#define CQE_STATUS_EXTD_SHIFT           16      /* bits 16 - 31 */
 
 struct be_mcc_compl {
         u32 status;             /* dword 0 */
diff --git a/drivers/net/davinci_emac.c b/drivers/net/davinci_emac.c
index f72c56dec33c..3179521aee90 100644
--- a/drivers/net/davinci_emac.c
+++ b/drivers/net/davinci_emac.c
@@ -2221,7 +2221,7 @@ void emac_poll_controller(struct net_device *ndev)
         struct emac_priv *priv = netdev_priv(ndev);
 
         emac_int_disable(priv);
-        emac_irq(ndev->irq, priv);
+        emac_irq(ndev->irq, ndev);
         emac_int_enable(priv);
 }
 #endif
diff --git a/drivers/net/usb/Kconfig b/drivers/net/usb/Kconfig
index c47237c2d638..32d93564a74d 100644
--- a/drivers/net/usb/Kconfig
+++ b/drivers/net/usb/Kconfig
@@ -174,7 +174,7 @@ config USB_NET_CDCETHER
             * Ericsson Mobile Broadband Module (all variants)
             * Motorola (DM100 and SB4100)
             * Broadcom Cable Modem (reference design)
-            * Toshiba (PCX1100U and F3507g)
+            * Toshiba (PCX1100U and F3507g/F3607gw)
             * ...
 
           This driver creates an interface named "ethX", where X depends on
diff --git a/drivers/net/usb/cdc_ether.c b/drivers/net/usb/cdc_ether.c
index 4a6aff579403..21e1ba160008 100644
--- a/drivers/net/usb/cdc_ether.c
+++ b/drivers/net/usb/cdc_ether.c
@@ -544,20 +544,60 @@ static const struct usb_device_id	products [] = {
                         USB_CDC_SUBCLASS_MDLM, USB_CDC_PROTO_NONE),
         .driver_info = (unsigned long) &cdc_info,
 }, {
-        /* Ericsson F3307 */
+        /* Ericsson F3607gw ver 2 */
+        USB_DEVICE_AND_INTERFACE_INFO(0x0bdb, 0x1905, USB_CLASS_COMM,
+                        USB_CDC_SUBCLASS_MDLM, USB_CDC_PROTO_NONE),
+        .driver_info = (unsigned long) &cdc_info,
+}, {
+        /* Ericsson F3607gw ver 3 */
         USB_DEVICE_AND_INTERFACE_INFO(0x0bdb, 0x1906, USB_CLASS_COMM,
                         USB_CDC_SUBCLASS_MDLM, USB_CDC_PROTO_NONE),
         .driver_info = (unsigned long) &cdc_info,
 }, {
+        /* Ericsson F3307 */
+        USB_DEVICE_AND_INTERFACE_INFO(0x0bdb, 0x190a, USB_CLASS_COMM,
+                        USB_CDC_SUBCLASS_MDLM, USB_CDC_PROTO_NONE),
+        .driver_info = (unsigned long) &cdc_info,
+}, {
+        /* Ericsson F3307 ver 2 */
+        USB_DEVICE_AND_INTERFACE_INFO(0x0bdb, 0x1909, USB_CLASS_COMM,
+                        USB_CDC_SUBCLASS_MDLM, USB_CDC_PROTO_NONE),
+        .driver_info = (unsigned long) &cdc_info,
+}, {
+        /* Ericsson C3607w */
+        USB_DEVICE_AND_INTERFACE_INFO(0x0bdb, 0x1049, USB_CLASS_COMM,
+                        USB_CDC_SUBCLASS_MDLM, USB_CDC_PROTO_NONE),
+        .driver_info = (unsigned long) &cdc_info,
+}, {
         /* Toshiba F3507g */
         USB_DEVICE_AND_INTERFACE_INFO(0x0930, 0x130b, USB_CLASS_COMM,
                         USB_CDC_SUBCLASS_MDLM, USB_CDC_PROTO_NONE),
         .driver_info = (unsigned long) &cdc_info,
 }, {
+        /* Toshiba F3607gw */
+        USB_DEVICE_AND_INTERFACE_INFO(0x0930, 0x130c, USB_CLASS_COMM,
+                        USB_CDC_SUBCLASS_MDLM, USB_CDC_PROTO_NONE),
+        .driver_info = (unsigned long) &cdc_info,
+}, {
+        /* Toshiba F3607gw ver 2 */
+        USB_DEVICE_AND_INTERFACE_INFO(0x0930, 0x1311, USB_CLASS_COMM,
+                        USB_CDC_SUBCLASS_MDLM, USB_CDC_PROTO_NONE),
+        .driver_info = (unsigned long) &cdc_info,
+}, {
         /* Dell F3507g */
         USB_DEVICE_AND_INTERFACE_INFO(0x413c, 0x8147, USB_CLASS_COMM,
                         USB_CDC_SUBCLASS_MDLM, USB_CDC_PROTO_NONE),
         .driver_info = (unsigned long) &cdc_info,
+}, {
+        /* Dell F3607gw */
+        USB_DEVICE_AND_INTERFACE_INFO(0x413c, 0x8183, USB_CLASS_COMM,
+                        USB_CDC_SUBCLASS_MDLM, USB_CDC_PROTO_NONE),
+        .driver_info = (unsigned long) &cdc_info,
+}, {
+        /* Dell F3607gw ver 2 */
+        USB_DEVICE_AND_INTERFACE_INFO(0x413c, 0x8184, USB_CLASS_COMM,
+                        USB_CDC_SUBCLASS_MDLM, USB_CDC_PROTO_NONE),
+        .driver_info = (unsigned long) &cdc_info,
 },
         { },            // END
 };
diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c
index d9ebac8a2d99..bb8b52d0d1ce 100644
--- a/drivers/net/virtio_net.c
+++ b/drivers/net/virtio_net.c
@@ -999,7 +999,7 @@ static unsigned int features[] = {
         VIRTIO_NET_F_CTRL_RX, VIRTIO_NET_F_CTRL_VLAN,
 };
 
-static struct virtio_driver virtio_net = {
+static struct virtio_driver virtio_net_driver = {
         .feature_table = features,
         .feature_table_size = ARRAY_SIZE(features),
         .driver.name =  KBUILD_MODNAME,
@@ -1012,12 +1012,12 @@ static struct virtio_driver virtio_net = {
 
 static int __init init(void)
 {
-        return register_virtio_driver(&virtio_net);
+        return register_virtio_driver(&virtio_net_driver);
 }
 
 static void __exit fini(void)
 {
-        unregister_virtio_driver(&virtio_net);
+        unregister_virtio_driver(&virtio_net_driver);
 }
 module_init(init);
 module_exit(fini);
diff --git a/include/net/netfilter/nf_conntrack.h b/include/net/netfilter/nf_conntrack.h
index cbdd6284996d..5cf7270e3ffc 100644
--- a/include/net/netfilter/nf_conntrack.h
+++ b/include/net/netfilter/nf_conntrack.h
@@ -255,11 +255,9 @@ static inline bool nf_ct_kill(struct nf_conn *ct)
 }
 
 /* These are for NAT.  Icky. */
-/* Update TCP window tracking data when NAT mangles the packet */
-extern void nf_conntrack_tcp_update(const struct sk_buff *skb,
-                                    unsigned int dataoff,
-                                    struct nf_conn *ct, int dir,
-                                    s16 offset);
+extern s16 (*nf_ct_nat_offset)(const struct nf_conn *ct,
+                               enum ip_conntrack_dir dir,
+                               u32 seq);
 
 /* Fake conntrack entry for untracked connections */
 extern struct nf_conn nf_conntrack_untracked;
diff --git a/include/net/netfilter/nf_nat_helper.h b/include/net/netfilter/nf_nat_helper.h
index 237a961f40e1..4222220920a5 100644
--- a/include/net/netfilter/nf_nat_helper.h
+++ b/include/net/netfilter/nf_nat_helper.h
@@ -32,4 +32,8 @@ extern int (*nf_nat_seq_adjust_hook)(struct sk_buff *skb,
  * to port ct->master->saved_proto. */
 extern void nf_nat_follow_master(struct nf_conn *ct,
                                  struct nf_conntrack_expect *this);
+
+extern s16 nf_nat_get_offset(const struct nf_conn *ct,
+                             enum ip_conntrack_dir dir,
+                             u32 seq);
 #endif
diff --git a/net/bridge/br_if.c b/net/bridge/br_if.c
index b1b3b0fbf41c..4a9f52732655 100644
--- a/net/bridge/br_if.c
+++ b/net/bridge/br_if.c
@@ -377,12 +377,16 @@ int br_add_if(struct net_bridge *br, struct net_device *dev)
         struct net_bridge_port *p;
         int err = 0;
 
-        if (dev->flags & IFF_LOOPBACK || dev->type != ARPHRD_ETHER)
+        /* Don't allow bridging non-ethernet like devices */
+        if ((dev->flags & IFF_LOOPBACK) ||
+            dev->type != ARPHRD_ETHER || dev->addr_len != ETH_ALEN)
                 return -EINVAL;
 
+        /* No bridging of bridges */
         if (dev->netdev_ops->ndo_start_xmit == br_dev_xmit)
                 return -ELOOP;
 
+        /* Device is already being bridged */
         if (dev->br_port != NULL)
                 return -EBUSY;
 
diff --git a/net/decnet/sysctl_net_decnet.c b/net/decnet/sysctl_net_decnet.c
index 26b0ab1e9f56..2036568beea9 100644
--- a/net/decnet/sysctl_net_decnet.c
+++ b/net/decnet/sysctl_net_decnet.c
@@ -263,11 +263,10 @@ static int dn_def_dev_strategy(ctl_table *table,
                         return -ENODEV;
 
                 rv = -ENODEV;
-                if (dev->dn_ptr != NULL) {
+                if (dev->dn_ptr != NULL)
                         rv = dn_dev_set_default(dev, 1);
-                        if (rv)
-                                dev_put(dev);
-                }
+                if (rv)
+                        dev_put(dev);
         }
 
         return rv;
diff --git a/net/ipv4/netfilter/nf_nat_core.c b/net/ipv4/netfilter/nf_nat_core.c
index 68afc6ecd343..fe1a64479dd0 100644
--- a/net/ipv4/netfilter/nf_nat_core.c
+++ b/net/ipv4/netfilter/nf_nat_core.c
@@ -750,6 +750,8 @@ static int __init nf_nat_init(void)
         BUG_ON(nfnetlink_parse_nat_setup_hook != NULL);
         rcu_assign_pointer(nfnetlink_parse_nat_setup_hook,
                            nfnetlink_parse_nat_setup);
+        BUG_ON(nf_ct_nat_offset != NULL);
+        rcu_assign_pointer(nf_ct_nat_offset, nf_nat_get_offset);
         return 0;
 
  cleanup_extend:
@@ -764,6 +766,7 @@ static void __exit nf_nat_cleanup(void)
         nf_ct_extend_unregister(&nat_extend);
         rcu_assign_pointer(nf_nat_seq_adjust_hook, NULL);
         rcu_assign_pointer(nfnetlink_parse_nat_setup_hook, NULL);
+        rcu_assign_pointer(nf_ct_nat_offset, NULL);
         synchronize_net();
 }
 
diff --git a/net/ipv4/netfilter/nf_nat_helper.c b/net/ipv4/netfilter/nf_nat_helper.c
index 09172a65d9b6..f9520fa3aba9 100644
--- a/net/ipv4/netfilter/nf_nat_helper.c
+++ b/net/ipv4/netfilter/nf_nat_helper.c
@@ -73,6 +73,28 @@ adjust_tcp_sequence(u32 seq,
         DUMP_OFFSET(this_way);
 }
 
+/* Get the offset value, for conntrack */
+s16 nf_nat_get_offset(const struct nf_conn *ct,
+                      enum ip_conntrack_dir dir,
+                      u32 seq)
+{
+        struct nf_conn_nat *nat = nfct_nat(ct);
+        struct nf_nat_seq *this_way;
+        s16 offset;
+
+        if (!nat)
+                return 0;
+
+        this_way = &nat->seq[dir];
+        spin_lock_bh(&nf_nat_seqofs_lock);
+        offset = after(seq, this_way->correction_pos)
+                 ? this_way->offset_after : this_way->offset_before;
+        spin_unlock_bh(&nf_nat_seqofs_lock);
+
+        return offset;
+}
+EXPORT_SYMBOL_GPL(nf_nat_get_offset);
+
 /* Frobs data inside this packet, which is linear. */
 static void mangle_contents(struct sk_buff *skb,
                             unsigned int dataoff,
@@ -189,11 +211,6 @@ nf_nat_mangle_tcp_packet(struct sk_buff *skb,
                 adjust_tcp_sequence(ntohl(tcph->seq),
                                     (int)rep_len - (int)match_len,
                                     ct, ctinfo);
-                /* Tell TCP window tracking about seq change */
-                nf_conntrack_tcp_update(skb, ip_hdrlen(skb),
-                                        ct, CTINFO2DIR(ctinfo),
-                                        (int)rep_len - (int)match_len);
-
                 nf_conntrack_event_cache(IPCT_NATSEQADJ, ct);
         }
         return 1;
@@ -415,12 +432,7 @@ nf_nat_seq_adjust(struct sk_buff *skb,
         tcph->seq = newseq;
         tcph->ack_seq = newack;
 
-        if (!nf_nat_sack_adjust(skb, tcph, ct, ctinfo))
-                return 0;
-
-        nf_conntrack_tcp_update(skb, ip_hdrlen(skb), ct, dir, seqoff);
-
-        return 1;
+        return nf_nat_sack_adjust(skb, tcph, ct, ctinfo);
 }
 
 /* Setup NAT on this expected conntrack so it follows master. */
diff --git a/net/netfilter/nf_conntrack_core.c b/net/netfilter/nf_conntrack_core.c
index 7c9ec3dee96e..0cdfb388a191 100644
--- a/net/netfilter/nf_conntrack_core.c
+++ b/net/netfilter/nf_conntrack_core.c
@@ -1350,6 +1350,11 @@ err_stat:
         return ret;
 }
 
+s16 (*nf_ct_nat_offset)(const struct nf_conn *ct,
+                        enum ip_conntrack_dir dir,
+                        u32 seq);
+EXPORT_SYMBOL_GPL(nf_ct_nat_offset);
+
 int nf_conntrack_init(struct net *net)
 {
         int ret;
@@ -1367,6 +1372,9 @@ int nf_conntrack_init(struct net *net)
                 /* For use by REJECT target */
                 rcu_assign_pointer(ip_ct_attach, nf_conntrack_attach);
                 rcu_assign_pointer(nf_ct_destroy, destroy_conntrack);
+
+                /* Howto get NAT offsets */
+                rcu_assign_pointer(nf_ct_nat_offset, NULL);
         }
         return 0;
 
diff --git a/net/netfilter/nf_conntrack_proto_tcp.c b/net/netfilter/nf_conntrack_proto_tcp.c
index 97a82ba75376..ba2b76937283 100644
--- a/net/netfilter/nf_conntrack_proto_tcp.c
+++ b/net/netfilter/nf_conntrack_proto_tcp.c
@@ -492,6 +492,21 @@ static void tcp_sack(const struct sk_buff *skb, unsigned int dataoff,
         }
 }
 
+#ifdef CONFIG_NF_NAT_NEEDED
+static inline s16 nat_offset(const struct nf_conn *ct,
+                             enum ip_conntrack_dir dir,
+                             u32 seq)
+{
+        typeof(nf_ct_nat_offset) get_offset = rcu_dereference(nf_ct_nat_offset);
+
+        return get_offset != NULL ? get_offset(ct, dir, seq) : 0;
+}
+#define NAT_OFFSET(pf, ct, dir, seq) \
+        (pf == NFPROTO_IPV4 ? nat_offset(ct, dir, seq) : 0)
+#else
+#define NAT_OFFSET(pf, ct, dir, seq)    0
+#endif
+
 static bool tcp_in_window(const struct nf_conn *ct,
                           struct ip_ct_tcp *state,
                           enum ip_conntrack_dir dir,
@@ -506,6 +521,7 @@ static bool tcp_in_window(const struct nf_conn *ct,
         struct ip_ct_tcp_state *receiver = &state->seen[!dir];
         const struct nf_conntrack_tuple *tuple = &ct->tuplehash[dir].tuple;
         __u32 seq, ack, sack, end, win, swin;
+        s16 receiver_offset;
         bool res;
 
         /*
@@ -519,11 +535,16 @@ static bool tcp_in_window(const struct nf_conn *ct,
         if (receiver->flags & IP_CT_TCP_FLAG_SACK_PERM)
                 tcp_sack(skb, dataoff, tcph, &sack);
 
+        /* Take into account NAT sequence number mangling */
+        receiver_offset = NAT_OFFSET(pf, ct, !dir, ack - 1);
+        ack -= receiver_offset;
+        sack -= receiver_offset;
+
         pr_debug("tcp_in_window: START\n");
         pr_debug("tcp_in_window: ");
         nf_ct_dump_tuple(tuple);
-        pr_debug("seq=%u ack=%u sack=%u win=%u end=%u\n",
-                 seq, ack, sack, win, end);
+        pr_debug("seq=%u ack=%u+(%d) sack=%u+(%d) win=%u end=%u\n",
+                 seq, ack, receiver_offset, sack, receiver_offset, win, end);
         pr_debug("tcp_in_window: sender end=%u maxend=%u maxwin=%u scale=%i "
                  "receiver end=%u maxend=%u maxwin=%u scale=%i\n",
                  sender->td_end, sender->td_maxend, sender->td_maxwin,
@@ -613,8 +634,8 @@ static bool tcp_in_window(const struct nf_conn *ct,
 
         pr_debug("tcp_in_window: ");
         nf_ct_dump_tuple(tuple);
-        pr_debug("seq=%u ack=%u sack =%u win=%u end=%u\n",
-                 seq, ack, sack, win, end);
+        pr_debug("seq=%u ack=%u+(%d) sack=%u+(%d) win=%u end=%u\n",
+                 seq, ack, receiver_offset, sack, receiver_offset, win, end);
         pr_debug("tcp_in_window: sender end=%u maxend=%u maxwin=%u scale=%i "
                  "receiver end=%u maxend=%u maxwin=%u scale=%i\n",
                  sender->td_end, sender->td_maxend, sender->td_maxwin,
@@ -700,7 +721,7 @@ static bool tcp_in_window(const struct nf_conn *ct,
                         before(seq, sender->td_maxend + 1) ?
                         after(end, sender->td_end - receiver->td_maxwin - 1) ?
                         before(sack, receiver->td_end + 1) ?
-                        after(ack, receiver->td_end - MAXACKWINDOW(sender)) ? "BUG"
+                        after(sack, receiver->td_end - MAXACKWINDOW(sender) - 1) ? "BUG"
                         : "ACK is under the lower bound (possible overly delayed ACK)"
                         : "ACK is over the upper bound (ACKed data not seen yet)"
                         : "SEQ is under the lower bound (already ACKed data retransmitted)"
@@ -715,39 +736,6 @@ static bool tcp_in_window(const struct nf_conn *ct,
         return res;
 }
 
-#ifdef CONFIG_NF_NAT_NEEDED
-/* Update sender->td_end after NAT successfully mangled the packet */
-/* Caller must linearize skb at tcp header. */
-void nf_conntrack_tcp_update(const struct sk_buff *skb,
-                             unsigned int dataoff,
-                             struct nf_conn *ct, int dir,
-                             s16 offset)
-{
-        const struct tcphdr *tcph = (const void *)skb->data + dataoff;
-        const struct ip_ct_tcp_state *sender = &ct->proto.tcp.seen[dir];
-        const struct ip_ct_tcp_state *receiver = &ct->proto.tcp.seen[!dir];
-        __u32 end;
-
-        end = segment_seq_plus_len(ntohl(tcph->seq), skb->len, dataoff, tcph);
-
-        spin_lock_bh(&ct->lock);
-        /*
-         * We have to worry for the ack in the reply packet only...
-         */
-        if (ct->proto.tcp.seen[dir].td_end + offset == end)
-                ct->proto.tcp.seen[dir].td_end = end;
-        ct->proto.tcp.last_end = end;
-        spin_unlock_bh(&ct->lock);
-        pr_debug("tcp_update: sender end=%u maxend=%u maxwin=%u scale=%i "
-                 "receiver end=%u maxend=%u maxwin=%u scale=%i\n",
-                 sender->td_end, sender->td_maxend, sender->td_maxwin,
-                 sender->td_scale,
-                 receiver->td_end, receiver->td_maxend, receiver->td_maxwin,
-                 receiver->td_scale);
-}
-EXPORT_SYMBOL_GPL(nf_conntrack_tcp_update);
-#endif
-
 #define TH_FIN  0x01
 #define TH_SYN  0x02
 #define TH_RST  0x04
diff --git a/net/netfilter/xt_connlimit.c b/net/netfilter/xt_connlimit.c
index 680980954395..38f03f75a636 100644
--- a/net/netfilter/xt_connlimit.c
+++ b/net/netfilter/xt_connlimit.c
@@ -103,7 +103,7 @@ static int count_them(struct xt_connlimit_data *data,
                       const struct nf_conntrack_tuple *tuple,
                       const union nf_inet_addr *addr,
                       const union nf_inet_addr *mask,
-                      const struct xt_match *match)
+                      u_int8_t family)
 {
         const struct nf_conntrack_tuple_hash *found;
         struct xt_connlimit_conn *conn;
@@ -113,8 +113,7 @@ static int count_them(struct xt_connlimit_data *data,
         bool addit = true;
         int matches = 0;
 
-
-        if (match->family == NFPROTO_IPV6)
+        if (family == NFPROTO_IPV6)
                 hash = &data->iphash[connlimit_iphash6(addr, mask)];
         else
                 hash = &data->iphash[connlimit_iphash(addr->ip & mask->ip)];
@@ -157,8 +156,7 @@ static int count_them(struct xt_connlimit_data *data,
                         continue;
                 }
 
-                if (same_source_net(addr, mask, &conn->tuple.src.u3,
-                    match->family))
+                if (same_source_net(addr, mask, &conn->tuple.src.u3, family))
                         /* same source network -> be counted! */
                         ++matches;
                 nf_ct_put(found_ct);
@@ -207,7 +205,7 @@ connlimit_mt(const struct sk_buff *skb, const struct xt_match_param *par)
 
         spin_lock_bh(&info->data->lock);
         connections = count_them(info->data, tuple_ptr, &addr,
-                                 &info->mask, par->match);
+                                 &info->mask, par->family);
         spin_unlock_bh(&info->data->lock);
 
         if (connections < 0) {
diff --git a/net/rose/rose_route.c b/net/rose/rose_route.c
index 9478d9b3d977..f3e21989b88c 100644
--- a/net/rose/rose_route.c
+++ b/net/rose/rose_route.c
@@ -578,18 +578,18 @@ static int rose_clear_routes(void)
 
 /*
  *      Check that the device given is a valid AX.25 interface that is "up".
+ *      called whith RTNL
  */
-static struct net_device *rose_ax25_dev_get(char *devname)
+static struct net_device *rose_ax25_dev_find(char *devname)
 {
         struct net_device *dev;
 
-        if ((dev = dev_get_by_name(&init_net, devname)) == NULL)
+        if ((dev = __dev_get_by_name(&init_net, devname)) == NULL)
                 return NULL;
 
         if ((dev->flags & IFF_UP) && dev->type == ARPHRD_AX25)
                 return dev;
 
-        dev_put(dev);
         return NULL;
 }
 
@@ -720,27 +720,23 @@ int rose_rt_ioctl(unsigned int cmd, void __user *arg)
         case SIOCADDRT:
                 if (copy_from_user(&rose_route, arg, sizeof(struct rose_route_struct)))
                         return -EFAULT;
-                if ((dev = rose_ax25_dev_get(rose_route.device)) == NULL)
+                if ((dev = rose_ax25_dev_find(rose_route.device)) == NULL)
                         return -EINVAL;
-                if (rose_dev_exists(&rose_route.address)) { /* Can't add routes to ourself */
-                        dev_put(dev);
+                if (rose_dev_exists(&rose_route.address)) /* Can't add routes to ourself */
                         return -EINVAL;
-                }
                 if (rose_route.mask > 10) /* Mask can't be more than 10 digits */
                         return -EINVAL;
                 if (rose_route.ndigis > AX25_MAX_DIGIS)
                         return -EINVAL;
                 err = rose_add_node(&rose_route, dev);
-                dev_put(dev);
                 return err;
 
         case SIOCDELRT:
                 if (copy_from_user(&rose_route, arg, sizeof(struct rose_route_struct)))
                         return -EFAULT;
-                if ((dev = rose_ax25_dev_get(rose_route.device)) == NULL)
+                if ((dev = rose_ax25_dev_find(rose_route.device)) == NULL)
                         return -EINVAL;
                 err = rose_del_node(&rose_route, dev);
-                dev_put(dev);
                 return err;
 
         case SIOCRSCLRRT: