44 files changed, 332 insertions, 214 deletions

diff --git a/drivers/net/ethernet/apm/xgene/xgene_enet_main.c b/drivers/net/ethernet/apm/xgene/xgene_enet_main.c
index af7c40ac1455..e1a8f4e19983 100644
--- a/drivers/net/ethernet/apm/xgene/xgene_enet_main.c
+++ b/drivers/net/ethernet/apm/xgene/xgene_enet_main.c
@@ -581,7 +581,11 @@ static struct xgene_enet_desc_ring *xgene_enet_create_desc_ring(
         struct xgene_enet_desc_ring *ring;
         struct xgene_enet_pdata *pdata = netdev_priv(ndev);
         struct device *dev = ndev_to_dev(ndev);
-        u32 size;
+        int size;
+
+        size = xgene_enet_get_ring_size(dev, cfgsize);
+        if (size < 0)
+                return NULL;
 
         ring = devm_kzalloc(dev, sizeof(struct xgene_enet_desc_ring),
                             GFP_KERNEL);
@@ -593,7 +597,6 @@ static struct xgene_enet_desc_ring *xgene_enet_create_desc_ring(
         ring->cfgsize = cfgsize;
         ring->id = ring_id;
 
-        size = xgene_enet_get_ring_size(dev, cfgsize);
         ring->desc_addr = dma_zalloc_coherent(dev, size, &ring->dma,
                                               GFP_KERNEL);
         if (!ring->desc_addr) {
diff --git a/drivers/net/ethernet/broadcom/tg3.c b/drivers/net/ethernet/broadcom/tg3.c
index a3dd5dc64f4c..4296b3d26f02 100644
--- a/drivers/net/ethernet/broadcom/tg3.c
+++ b/drivers/net/ethernet/broadcom/tg3.c
@@ -14093,8 +14093,9 @@ static struct rtnl_link_stats64 *tg3_get_stats64(struct net_device *dev,
 
         spin_lock_bh(&tp->lock);
         if (!tp->hw_stats) {
+                *stats = tp->net_stats_prev;
                 spin_unlock_bh(&tp->lock);
-                return &tp->net_stats_prev;
+                return stats;
         }
 
         tg3_get_nstats(tp, stats);
diff --git a/drivers/net/ethernet/ibm/ehea/Makefile b/drivers/net/ethernet/ibm/ehea/Makefile
index 775d9969b5c2..cd473e295242 100644
--- a/drivers/net/ethernet/ibm/ehea/Makefile
+++ b/drivers/net/ethernet/ibm/ehea/Makefile
@@ -1,6 +1,6 @@
 #
 # Makefile for the eHEA ethernet device driver for IBM eServer System p
 #
-ehea-y = ehea_main.o ehea_phyp.o ehea_qmr.o ehea_ethtool.o ehea_phyp.o
+ehea-y = ehea_main.o ehea_phyp.o ehea_qmr.o ehea_ethtool.o
 obj-$(CONFIG_EHEA) += ehea.o
 
diff --git a/drivers/net/ethernet/intel/e1000e/manage.c b/drivers/net/ethernet/intel/e1000e/manage.c
index 58856032298d..06edfca1a35e 100644
--- a/drivers/net/ethernet/intel/e1000e/manage.c
+++ b/drivers/net/ethernet/intel/e1000e/manage.c
@@ -47,7 +47,7 @@ static u8 e1000_calculate_checksum(u8 *buffer, u32 length)
  *  e1000_mng_enable_host_if - Checks host interface is enabled
  *  @hw: pointer to the HW structure
  *
- *  Returns E1000_success upon success, else E1000_ERR_HOST_INTERFACE_COMMAND
+ *  Returns 0 upon success, else -E1000_ERR_HOST_INTERFACE_COMMAND
  *
  *  This function checks whether the HOST IF is enabled for command operation
  *  and also checks whether the previous command is completed.  It busy waits
@@ -78,7 +78,7 @@ static s32 e1000_mng_enable_host_if(struct e1000_hw *hw)
         }
 
         if (i == E1000_MNG_DHCP_COMMAND_TIMEOUT) {
-                e_dbg("Previous command timeout failed .\n");
+                e_dbg("Previous command timeout failed.\n");
                 return -E1000_ERR_HOST_INTERFACE_COMMAND;
         }
 
diff --git a/drivers/net/ethernet/intel/i40e/i40e_fcoe.c b/drivers/net/ethernet/intel/i40e/i40e_fcoe.c
index 6938fc1ad877..5d01db1d789b 100644
--- a/drivers/net/ethernet/intel/i40e/i40e_fcoe.c
+++ b/drivers/net/ethernet/intel/i40e/i40e_fcoe.c
@@ -33,6 +33,7 @@
 #include <scsi/fc/fc_fcoe.h>
 #include <scsi/libfc.h>
 #include <scsi/libfcoe.h>
+#include <uapi/linux/dcbnl.h>
 
 #include "i40e.h"
 #include "i40e_fcoe.h"
diff --git a/drivers/net/ethernet/intel/i40e/i40e_main.c b/drivers/net/ethernet/intel/i40e/i40e_main.c
index 51bc03072ed3..871474f6fe62 100644
--- a/drivers/net/ethernet/intel/i40e/i40e_main.c
+++ b/drivers/net/ethernet/intel/i40e/i40e_main.c
@@ -4415,13 +4415,13 @@ static void i40e_print_link_message(struct i40e_vsi *vsi, bool isup)
 
         switch (vsi->back->hw.phy.link_info.link_speed) {
         case I40E_LINK_SPEED_40GB:
-                strncpy(speed, "40 Gbps", SPEED_SIZE);
+                strlcpy(speed, "40 Gbps", SPEED_SIZE);
                 break;
         case I40E_LINK_SPEED_10GB:
-                strncpy(speed, "10 Gbps", SPEED_SIZE);
+                strlcpy(speed, "10 Gbps", SPEED_SIZE);
                 break;
         case I40E_LINK_SPEED_1GB:
-                strncpy(speed, "1000 Mbps", SPEED_SIZE);
+                strlcpy(speed, "1000 Mbps", SPEED_SIZE);
                 break;
         default:
                 break;
@@ -4429,16 +4429,16 @@ static void i40e_print_link_message(struct i40e_vsi *vsi, bool isup)
 
         switch (vsi->back->hw.fc.current_mode) {
         case I40E_FC_FULL:
-                strncpy(fc, "RX/TX", FC_SIZE);
+                strlcpy(fc, "RX/TX", FC_SIZE);
                 break;
         case I40E_FC_TX_PAUSE:
-                strncpy(fc, "TX", FC_SIZE);
+                strlcpy(fc, "TX", FC_SIZE);
                 break;
         case I40E_FC_RX_PAUSE:
-                strncpy(fc, "RX", FC_SIZE);
+                strlcpy(fc, "RX", FC_SIZE);
                 break;
         default:
-                strncpy(fc, "None", FC_SIZE);
+                strlcpy(fc, "None", FC_SIZE);
                 break;
         }
 
@@ -5839,7 +5839,7 @@ static void i40e_send_version(struct i40e_pf *pf)
         dv.minor_version = DRV_VERSION_MINOR;
         dv.build_version = DRV_VERSION_BUILD;
         dv.subbuild_version = 0;
-        strncpy(dv.driver_string, DRV_VERSION, sizeof(dv.driver_string));
+        strlcpy(dv.driver_string, DRV_VERSION, sizeof(dv.driver_string));
         i40e_aq_send_driver_version(&pf->hw, &dv, NULL);
 }
 
@@ -6293,7 +6293,7 @@ static int i40e_vsi_alloc_arrays(struct i40e_vsi *vsi, bool alloc_qvectors)
 
         if (alloc_qvectors) {
                 /* allocate memory for q_vector pointers */
-                size = sizeof(struct i40e_q_vectors *) * vsi->num_q_vectors;
+                size = sizeof(struct i40e_q_vector *) * vsi->num_q_vectors;
                 vsi->q_vectors = kzalloc(size, GFP_KERNEL);
                 if (!vsi->q_vectors) {
                         ret = -ENOMEM;
diff --git a/drivers/net/ethernet/intel/i40e/i40e_nvm.c b/drivers/net/ethernet/intel/i40e/i40e_nvm.c
index 97bda3dffd49..25c4f9a3011f 100644
--- a/drivers/net/ethernet/intel/i40e/i40e_nvm.c
+++ b/drivers/net/ethernet/intel/i40e/i40e_nvm.c
@@ -251,9 +251,9 @@ i40e_status i40e_read_nvm_buffer(struct i40e_hw *hw, u16 offset,
  *
  * Writes a 16 bit words buffer to the Shadow RAM using the admin command.
  **/
-i40e_status i40e_write_nvm_aq(struct i40e_hw *hw, u8 module_pointer,
-                              u32 offset, u16 words, void *data,
-                              bool last_command)
+static i40e_status i40e_write_nvm_aq(struct i40e_hw *hw, u8 module_pointer,
+                                     u32 offset, u16 words, void *data,
+                                     bool last_command)
 {
         i40e_status ret_code = I40E_ERR_NVM;
 
diff --git a/drivers/net/ethernet/myricom/myri10ge/myri10ge.c b/drivers/net/ethernet/myricom/myri10ge/myri10ge.c
index 69c26f04d8ce..679db026f4be 100644
--- a/drivers/net/ethernet/myricom/myri10ge/myri10ge.c
+++ b/drivers/net/ethernet/myricom/myri10ge/myri10ge.c
@@ -873,6 +873,10 @@ static int myri10ge_dma_test(struct myri10ge_priv *mgp, int test_type)
                 return -ENOMEM;
         dmatest_bus = pci_map_page(mgp->pdev, dmatest_page, 0, PAGE_SIZE,
                                    DMA_BIDIRECTIONAL);
+        if (unlikely(pci_dma_mapping_error(mgp->pdev, dmatest_bus))) {
+                __free_page(dmatest_page);
+                return -ENOMEM;
+        }
 
         /* Run a small DMA test.
          * The magic multipliers to the length tell the firmware
@@ -1294,6 +1298,7 @@ myri10ge_alloc_rx_pages(struct myri10ge_priv *mgp, struct myri10ge_rx_buf *rx,
                         int bytes, int watchdog)
 {
         struct page *page;
+        dma_addr_t bus;
         int idx;
 #if MYRI10GE_ALLOC_SIZE > 4096
         int end_offset;
@@ -1318,11 +1323,21 @@ myri10ge_alloc_rx_pages(struct myri10ge_priv *mgp, struct myri10ge_rx_buf *rx,
                                         rx->watchdog_needed = 1;
                                 return;
                         }
+
+                        bus = pci_map_page(mgp->pdev, page, 0,
+                                           MYRI10GE_ALLOC_SIZE,
+                                           PCI_DMA_FROMDEVICE);
+                        if (unlikely(pci_dma_mapping_error(mgp->pdev, bus))) {
+                                __free_pages(page, MYRI10GE_ALLOC_ORDER);
+                                if (rx->fill_cnt - rx->cnt < 16)
+                                        rx->watchdog_needed = 1;
+                                return;
+                        }
+
                         rx->page = page;
                         rx->page_offset = 0;
-                        rx->bus = pci_map_page(mgp->pdev, page, 0,
-                                               MYRI10GE_ALLOC_SIZE,
-                                               PCI_DMA_FROMDEVICE);
+                        rx->bus = bus;
+
                 }
                 rx->info[idx].page = rx->page;
                 rx->info[idx].page_offset = rx->page_offset;
@@ -2764,6 +2779,35 @@ myri10ge_submit_req(struct myri10ge_tx_buf *tx, struct mcp_kreq_ether_send *src,
         mb();
 }
 
+static void myri10ge_unmap_tx_dma(struct myri10ge_priv *mgp,
+                                  struct myri10ge_tx_buf *tx, int idx)
+{
+        unsigned int len;
+        int last_idx;
+
+        /* Free any DMA resources we've alloced and clear out the skb slot */
+        last_idx = (idx + 1) & tx->mask;
+        idx = tx->req & tx->mask;
+        do {
+                len = dma_unmap_len(&tx->info[idx], len);
+                if (len) {
+                        if (tx->info[idx].skb != NULL)
+                                pci_unmap_single(mgp->pdev,
+                                                 dma_unmap_addr(&tx->info[idx],
+                                                                bus), len,
+                                                 PCI_DMA_TODEVICE);
+                        else
+                                pci_unmap_page(mgp->pdev,
+                                               dma_unmap_addr(&tx->info[idx],
+                                                              bus), len,
+                                               PCI_DMA_TODEVICE);
+                        dma_unmap_len_set(&tx->info[idx], len, 0);
+                        tx->info[idx].skb = NULL;
+                }
+                idx = (idx + 1) & tx->mask;
+        } while (idx != last_idx);
+}
+
 /*
  * Transmit a packet.  We need to split the packet so that a single
  * segment does not cross myri10ge->tx_boundary, so this makes segment
@@ -2787,7 +2831,7 @@ static netdev_tx_t myri10ge_xmit(struct sk_buff *skb,
         u32 low;
         __be32 high_swapped;
         unsigned int len;
-        int idx, last_idx, avail, frag_cnt, frag_idx, count, mss, max_segments;
+        int idx, avail, frag_cnt, frag_idx, count, mss, max_segments;
         u16 pseudo_hdr_offset, cksum_offset, queue;
         int cum_len, seglen, boundary, rdma_count;
         u8 flags, odd_flag;
@@ -2884,9 +2928,12 @@ again:
 
         /* map the skb for DMA */
         len = skb_headlen(skb);
+        bus = pci_map_single(mgp->pdev, skb->data, len, PCI_DMA_TODEVICE);
+        if (unlikely(pci_dma_mapping_error(mgp->pdev, bus)))
+                goto drop;
+
         idx = tx->req & tx->mask;
         tx->info[idx].skb = skb;
-        bus = pci_map_single(mgp->pdev, skb->data, len, PCI_DMA_TODEVICE);
         dma_unmap_addr_set(&tx->info[idx], bus, bus);
         dma_unmap_len_set(&tx->info[idx], len, len);
 
@@ -2985,12 +3032,16 @@ again:
                         break;
 
                 /* map next fragment for DMA */
-                idx = (count + tx->req) & tx->mask;
                 frag = &skb_shinfo(skb)->frags[frag_idx];
                 frag_idx++;
                 len = skb_frag_size(frag);
                 bus = skb_frag_dma_map(&mgp->pdev->dev, frag, 0, len,
                                        DMA_TO_DEVICE);
+                if (unlikely(pci_dma_mapping_error(mgp->pdev, bus))) {
+                        myri10ge_unmap_tx_dma(mgp, tx, idx);
+                        goto drop;
+                }
+                idx = (count + tx->req) & tx->mask;
                 dma_unmap_addr_set(&tx->info[idx], bus, bus);
                 dma_unmap_len_set(&tx->info[idx], len, len);
         }
@@ -3021,31 +3072,8 @@ again:
         return NETDEV_TX_OK;
 
 abort_linearize:
-        /* Free any DMA resources we've alloced and clear out the skb
-         * slot so as to not trip up assertions, and to avoid a
-         * double-free if linearizing fails */
+        myri10ge_unmap_tx_dma(mgp, tx, idx);
 
-        last_idx = (idx + 1) & tx->mask;
-        idx = tx->req & tx->mask;
-        tx->info[idx].skb = NULL;
-        do {
-                len = dma_unmap_len(&tx->info[idx], len);
-                if (len) {
-                        if (tx->info[idx].skb != NULL)
-                                pci_unmap_single(mgp->pdev,
-                                                 dma_unmap_addr(&tx->info[idx],
-                                                                bus), len,
-                                                 PCI_DMA_TODEVICE);
-                        else
-                                pci_unmap_page(mgp->pdev,
-                                               dma_unmap_addr(&tx->info[idx],
-                                                              bus), len,
-                                               PCI_DMA_TODEVICE);
-                        dma_unmap_len_set(&tx->info[idx], len, 0);
-                        tx->info[idx].skb = NULL;
-                }
-                idx = (idx + 1) & tx->mask;
-        } while (idx != last_idx);
         if (skb_is_gso(skb)) {
                 netdev_err(mgp->dev, "TSO but wanted to linearize?!?!?\n");
                 goto drop;
diff --git a/drivers/net/ethernet/sun/sunvnet.c b/drivers/net/ethernet/sun/sunvnet.c
index d813bfb1a847..23c89ab5a6ad 100644
--- a/drivers/net/ethernet/sun/sunvnet.c
+++ b/drivers/net/ethernet/sun/sunvnet.c
@@ -32,6 +32,11 @@ MODULE_DESCRIPTION("Sun LDOM virtual network driver");
 MODULE_LICENSE("GPL");
 MODULE_VERSION(DRV_MODULE_VERSION);
 
+/* Heuristic for the number of times to exponentially backoff and
+ * retry sending an LDC trigger when EAGAIN is encountered
+ */
+#define VNET_MAX_RETRIES        10
+
 /* Ordered from largest major to lowest */
 static struct vio_version vnet_versions[] = {
         { .major = 1, .minor = 0 },
@@ -260,6 +265,7 @@ static int vnet_send_ack(struct vnet_port *port, struct vio_dring_state *dr,
                 .state                  = vio_dring_state,
         };
         int err, delay;
+        int retries = 0;
 
         hdr.seq = dr->snd_nxt;
         delay = 1;
@@ -272,6 +278,13 @@ static int vnet_send_ack(struct vnet_port *port, struct vio_dring_state *dr,
                 udelay(delay);
                 if ((delay <<= 1) > 128)
                         delay = 128;
+                if (retries++ > VNET_MAX_RETRIES) {
+                        pr_info("ECONNRESET %x:%x:%x:%x:%x:%x\n",
+                                port->raddr[0], port->raddr[1],
+                                port->raddr[2], port->raddr[3],
+                                port->raddr[4], port->raddr[5]);
+                        err = -ECONNRESET;
+                }
         } while (err == -EAGAIN);
 
         return err;
@@ -475,8 +488,9 @@ static int handle_mcast(struct vnet_port *port, void *msgbuf)
         return 0;
 }
 
-static void maybe_tx_wakeup(struct vnet *vp)
+static void maybe_tx_wakeup(unsigned long param)
 {
+        struct vnet *vp = (struct vnet *)param;
         struct net_device *dev = vp->dev;
 
         netif_tx_lock(dev);
@@ -573,8 +587,13 @@ static void vnet_event(void *arg, int event)
                         break;
         }
         spin_unlock(&vio->lock);
+        /* Kick off a tasklet to wake the queue.  We cannot call
+         * maybe_tx_wakeup directly here because we could deadlock on
+         * netif_tx_lock() with dev_watchdog()
+         */
         if (unlikely(tx_wakeup && err != -ECONNRESET))
-                maybe_tx_wakeup(port->vp);
+                tasklet_schedule(&port->vp->vnet_tx_wakeup);
+
         local_irq_restore(flags);
 }
 
@@ -593,6 +612,7 @@ static int __vnet_tx_trigger(struct vnet_port *port)
                 .end_idx                = (u32) -1,
         };
         int err, delay;
+        int retries = 0;
 
         hdr.seq = dr->snd_nxt;
         delay = 1;
@@ -605,6 +625,8 @@ static int __vnet_tx_trigger(struct vnet_port *port)
                 udelay(delay);
                 if ((delay <<= 1) > 128)
                         delay = 128;
+                if (retries++ > VNET_MAX_RETRIES)
+                        break;
         } while (err == -EAGAIN);
 
         return err;
@@ -691,7 +713,15 @@ static int vnet_start_xmit(struct sk_buff *skb, struct net_device *dev)
                 memset(tx_buf+VNET_PACKET_SKIP+skb->len, 0, len - skb->len);
         }
 
-        d->hdr.ack = VIO_ACK_ENABLE;
+        /* We don't rely on the ACKs to free the skb in vnet_start_xmit(),
+         * thus it is safe to not set VIO_ACK_ENABLE for each transmission:
+         * the protocol itself does not require it as long as the peer
+         * sends a VIO_SUBTYPE_ACK for VIO_DRING_STOPPED.
+         *
+         * An ACK for every packet in the ring is expensive as the
+         * sending of LDC messages is slow and affects performance.
+         */
+        d->hdr.ack = VIO_ACK_DISABLE;
         d->size = len;
         d->ncookies = port->tx_bufs[dr->prod].ncookies;
         for (i = 0; i < d->ncookies; i++)
@@ -1046,6 +1076,7 @@ static struct vnet *vnet_new(const u64 *local_mac)
         vp = netdev_priv(dev);
 
         spin_lock_init(&vp->lock);
+        tasklet_init(&vp->vnet_tx_wakeup, maybe_tx_wakeup, (unsigned long)vp);
         vp->dev = dev;
 
         INIT_LIST_HEAD(&vp->port_list);
@@ -1105,6 +1136,7 @@ static void vnet_cleanup(void)
                 vp = list_first_entry(&vnet_list, struct vnet, list);
                 list_del(&vp->list);
                 dev = vp->dev;
+                tasklet_kill(&vp->vnet_tx_wakeup);
                 /* vio_unregister_driver() should have cleaned up port_list */
                 BUG_ON(!list_empty(&vp->port_list));
                 unregister_netdev(dev);
diff --git a/drivers/net/ethernet/sun/sunvnet.h b/drivers/net/ethernet/sun/sunvnet.h
index d347a5bf24b0..de5c2c64996f 100644
--- a/drivers/net/ethernet/sun/sunvnet.h
+++ b/drivers/net/ethernet/sun/sunvnet.h
@@ -1,6 +1,8 @@
 #ifndef _SUNVNET_H
 #define _SUNVNET_H
 
+#include <linux/interrupt.h>
+
 #define DESC_NCOOKIES(entry_size)       \
         ((entry_size) - sizeof(struct vio_net_desc))
 
@@ -78,6 +80,8 @@ struct vnet {
 
         struct list_head        list;
         u64                     local_mac;
+
+        struct tasklet_struct   vnet_tx_wakeup;
 };
 
 #endif /* _SUNVNET_H */
diff --git a/drivers/net/ethernet/xilinx/ll_temac_main.c b/drivers/net/ethernet/xilinx/ll_temac_main.c
index 36f4459520c3..fda5891835d4 100644
--- a/drivers/net/ethernet/xilinx/ll_temac_main.c
+++ b/drivers/net/ethernet/xilinx/ll_temac_main.c
@@ -1170,7 +1170,6 @@ static struct platform_driver temac_of_driver = {
         .probe = temac_of_probe,
         .remove = temac_of_remove,
         .driver = {
-                .owner = THIS_MODULE,
                 .name = "xilinx_temac",
                 .of_match_table = temac_of_match,
         },
diff --git a/drivers/net/ethernet/xilinx/xilinx_axienet_main.c b/drivers/net/ethernet/xilinx/xilinx_axienet_main.c
index 30e8608ff050..c8fd94133ecd 100644
--- a/drivers/net/ethernet/xilinx/xilinx_axienet_main.c
+++ b/drivers/net/ethernet/xilinx/xilinx_axienet_main.c
@@ -1645,7 +1645,6 @@ static struct platform_driver axienet_of_driver = {
         .probe = axienet_of_probe,
         .remove = axienet_of_remove,
         .driver = {
-                 .owner = THIS_MODULE,
                  .name = "xilinx_axienet",
                  .of_match_table = axienet_of_match,
         },
diff --git a/drivers/net/ethernet/xilinx/xilinx_emaclite.c b/drivers/net/ethernet/xilinx/xilinx_emaclite.c
index 782bb9373cd8..28dbbdc393eb 100644
--- a/drivers/net/ethernet/xilinx/xilinx_emaclite.c
+++ b/drivers/net/ethernet/xilinx/xilinx_emaclite.c
@@ -1245,7 +1245,6 @@ MODULE_DEVICE_TABLE(of, xemaclite_of_match);
 static struct platform_driver xemaclite_of_driver = {
         .driver = {
                 .name = DRIVER_NAME,
-                .owner = THIS_MODULE,
                 .of_match_table = xemaclite_of_match,
         },
         .probe          = xemaclite_of_probe,
diff --git a/drivers/net/irda/donauboe.c b/drivers/net/irda/donauboe.c
index 768dfe9a9315..6d3e2093bf7f 100644
--- a/drivers/net/irda/donauboe.c
+++ b/drivers/net/irda/donauboe.c
@@ -1755,17 +1755,4 @@ static struct pci_driver donauboe_pci_driver = {
         .resume         = toshoboe_wakeup 
 };
 
-static int __init
-donauboe_init (void)
-{
-  return pci_register_driver(&donauboe_pci_driver);
-}
-
-static void __exit
-donauboe_cleanup (void)
-{
-  pci_unregister_driver(&donauboe_pci_driver);
-}
-
-module_init(donauboe_init);
-module_exit(donauboe_cleanup);
+module_pci_driver(donauboe_pci_driver);
diff --git a/drivers/net/macvlan.c b/drivers/net/macvlan.c
index ef8a5c20236a..60e4ca01ccbb 100644
--- a/drivers/net/macvlan.c
+++ b/drivers/net/macvlan.c
@@ -45,10 +45,9 @@ struct macvlan_port {
         struct sk_buff_head     bc_queue;
         struct work_struct      bc_work;
         bool                    passthru;
+        int                     count;
 };
 
-#define MACVLAN_PORT_IS_EMPTY(port)    list_empty(&port->vlans)
-
 struct macvlan_skb_cb {
         const struct macvlan_dev *src;
 };
@@ -667,7 +666,8 @@ static void macvlan_uninit(struct net_device *dev)
 
         free_percpu(vlan->pcpu_stats);
 
-        if (MACVLAN_PORT_IS_EMPTY(port))
+        port->count -= 1;
+        if (!port->count)
                 macvlan_port_destroy(port->dev);
 }
 
@@ -1020,12 +1020,13 @@ int macvlan_common_newlink(struct net *src_net, struct net_device *dev,
                 vlan->flags = nla_get_u16(data[IFLA_MACVLAN_FLAGS]);
 
         if (vlan->mode == MACVLAN_MODE_PASSTHRU) {
-                if (!MACVLAN_PORT_IS_EMPTY(port))
+                if (port->count)
                         return -EINVAL;
                 port->passthru = true;
                 eth_hw_addr_inherit(dev, lowerdev);
         }
 
+        port->count += 1;
         err = register_netdevice(dev);
         if (err < 0)
                 goto destroy_port;
@@ -1043,7 +1044,8 @@ int macvlan_common_newlink(struct net *src_net, struct net_device *dev,
 unregister_netdev:
         unregister_netdevice(dev);
 destroy_port:
-        if (MACVLAN_PORT_IS_EMPTY(port))
+        port->count -= 1;
+        if (!port->count)
                 macvlan_port_destroy(lowerdev);
 
         return err;
diff --git a/drivers/net/wireless/ath/carl9170/carl9170.h b/drivers/net/wireless/ath/carl9170/carl9170.h
index 8596aba34f96..237d0cda1bcb 100644
--- a/drivers/net/wireless/ath/carl9170/carl9170.h
+++ b/drivers/net/wireless/ath/carl9170/carl9170.h
@@ -256,6 +256,7 @@ struct ar9170 {
         atomic_t rx_work_urbs;
         atomic_t rx_pool_urbs;
         kernel_ulong_t features;
+        bool usb_ep_cmd_is_bulk;
 
         /* firmware settings */
         struct completion fw_load_wait;
diff --git a/drivers/net/wireless/ath/carl9170/usb.c b/drivers/net/wireless/ath/carl9170/usb.c
index f35c7f30f9a6..c9f93310c0d6 100644
--- a/drivers/net/wireless/ath/carl9170/usb.c
+++ b/drivers/net/wireless/ath/carl9170/usb.c
@@ -621,9 +621,16 @@ int __carl9170_exec_cmd(struct ar9170 *ar, struct carl9170_cmd *cmd,
                 goto err_free;
         }
 
-        usb_fill_int_urb(urb, ar->udev, usb_sndintpipe(ar->udev,
-                AR9170_USB_EP_CMD), cmd, cmd->hdr.len + 4,
-                carl9170_usb_cmd_complete, ar, 1);
+        if (ar->usb_ep_cmd_is_bulk)
+                usb_fill_bulk_urb(urb, ar->udev,
+                                  usb_sndbulkpipe(ar->udev, AR9170_USB_EP_CMD),
+                                  cmd, cmd->hdr.len + 4,
+                                  carl9170_usb_cmd_complete, ar);
+        else
+                usb_fill_int_urb(urb, ar->udev,
+                                 usb_sndintpipe(ar->udev, AR9170_USB_EP_CMD),
+                                 cmd, cmd->hdr.len + 4,
+                                 carl9170_usb_cmd_complete, ar, 1);
 
         if (free_buf)
                 urb->transfer_flags |= URB_FREE_BUFFER;
@@ -1032,9 +1039,10 @@ static void carl9170_usb_firmware_step2(const struct firmware *fw,
 static int carl9170_usb_probe(struct usb_interface *intf,
                               const struct usb_device_id *id)
 {
+        struct usb_endpoint_descriptor *ep;
         struct ar9170 *ar;
         struct usb_device *udev;
-        int err;
+        int i, err;
 
         err = usb_reset_device(interface_to_usbdev(intf));
         if (err)
@@ -1050,6 +1058,21 @@ static int carl9170_usb_probe(struct usb_interface *intf,
         ar->intf = intf;
         ar->features = id->driver_info;
 
+        /* We need to remember the type of endpoint 4 because it differs
+         * between high- and full-speed configuration. The high-speed
+         * configuration specifies it as interrupt and the full-speed
+         * configuration as bulk endpoint. This information is required
+         * later when sending urbs to that endpoint.
+         */
+        for (i = 0; i < intf->cur_altsetting->desc.bNumEndpoints; ++i) {
+                ep = &intf->cur_altsetting->endpoint[i].desc;
+
+                if (usb_endpoint_num(ep) == AR9170_USB_EP_CMD &&
+                    usb_endpoint_dir_out(ep) &&
+                    usb_endpoint_type(ep) == USB_ENDPOINT_XFER_BULK)
+                        ar->usb_ep_cmd_is_bulk = true;
+        }
+
         usb_set_intfdata(intf, ar);
         SET_IEEE80211_DEV(ar->hw, &intf->dev);
 
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/msgbuf.c b/drivers/net/wireless/brcm80211/brcmfmac/msgbuf.c
index 535c7eb01b3a..8f8b9373de95 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/msgbuf.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/msgbuf.c
@@ -1318,6 +1318,8 @@ int brcmf_proto_msgbuf_attach(struct brcmf_pub *drvr)
         msgbuf->nrof_flowrings = if_msgbuf->nrof_flowrings;
         msgbuf->flowring_dma_handle = kzalloc(msgbuf->nrof_flowrings *
                 sizeof(*msgbuf->flowring_dma_handle), GFP_ATOMIC);
+        if (!msgbuf->flowring_dma_handle)
+                goto fail;
 
         msgbuf->rx_dataoffset = if_msgbuf->rx_dataoffset;
         msgbuf->max_rxbufpost = if_msgbuf->max_rxbufpost;
@@ -1362,6 +1364,7 @@ fail:
                 kfree(msgbuf->flow_map);
                 kfree(msgbuf->txstatus_done_map);
                 brcmf_msgbuf_release_pktids(msgbuf);
+                kfree(msgbuf->flowring_dma_handle);
                 if (msgbuf->ioctbuf)
                         dma_free_coherent(drvr->bus_if->dev,
                                           BRCMF_TX_IOCTL_MAX_MSG_SIZE,
@@ -1391,6 +1394,7 @@ void brcmf_proto_msgbuf_detach(struct brcmf_pub *drvr)
                                   BRCMF_TX_IOCTL_MAX_MSG_SIZE,
                                   msgbuf->ioctbuf, msgbuf->ioctbuf_handle);
                 brcmf_msgbuf_release_pktids(msgbuf);
+                kfree(msgbuf->flowring_dma_handle);
                 kfree(msgbuf);
                 drvr->proto->pd = NULL;
         }
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/pcie.c b/drivers/net/wireless/brcm80211/brcmfmac/pcie.c
index bc972c0ba5f8..e5101b287e4e 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/pcie.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/pcie.c
@@ -591,12 +591,13 @@ static void brcmf_pcie_handle_mb_data(struct brcmf_pciedev_info *devinfo)
         }
         if (dtoh_mb_data & BRCMF_D2H_DEV_DS_EXIT_NOTE)
                 brcmf_dbg(PCIE, "D2H_MB_DATA: DEEP SLEEP EXIT\n");
-        if (dtoh_mb_data & BRCMF_D2H_DEV_D3_ACK)
+        if (dtoh_mb_data & BRCMF_D2H_DEV_D3_ACK) {
                 brcmf_dbg(PCIE, "D2H_MB_DATA: D3 ACK\n");
                 if (waitqueue_active(&devinfo->mbdata_resp_wait)) {
                         devinfo->mbdata_completed = true;
                         wake_up(&devinfo->mbdata_resp_wait);
                 }
+        }
 }
 
 
diff --git a/drivers/net/wireless/ipw2x00/ipw2200.c b/drivers/net/wireless/ipw2x00/ipw2200.c
index c5aa404069f3..389656bd1a74 100644
--- a/drivers/net/wireless/ipw2x00/ipw2200.c
+++ b/drivers/net/wireless/ipw2x00/ipw2200.c
@@ -9853,6 +9853,7 @@ static int ipw_wx_get_wireless_mode(struct net_device *dev,
                 strncpy(extra, "unknown", MAX_WX_STRING);
                 break;
         }
+        extra[MAX_WX_STRING - 1] = '\0';
 
         IPW_DEBUG_WX("PRIV GET MODE: %s\n", extra);
 
diff --git a/drivers/net/wireless/iwlwifi/mvm/mac80211.c b/drivers/net/wireless/iwlwifi/mvm/mac80211.c
index 0d6a8b768a68..7c8796584c25 100644
--- a/drivers/net/wireless/iwlwifi/mvm/mac80211.c
+++ b/drivers/net/wireless/iwlwifi/mvm/mac80211.c
@@ -396,7 +396,8 @@ int iwl_mvm_mac_setup_register(struct iwl_mvm *mvm)
         else
                 hw->wiphy->flags &= ~WIPHY_FLAG_PS_ON_BY_DEFAULT;
 
-        hw->wiphy->flags |= WIPHY_FLAG_SUPPORTS_SCHED_SCAN;
+        /* TODO: enable that only for firmwares that don't crash */
+        /* hw->wiphy->flags |= WIPHY_FLAG_SUPPORTS_SCHED_SCAN; */
         hw->wiphy->max_sched_scan_ssids = PROBE_OPTION_MAX;
         hw->wiphy->max_match_sets = IWL_SCAN_MAX_PROFILES;
         /* we create the 802.11 header and zero length SSID IE. */
diff --git a/drivers/net/xen-netback/common.h b/drivers/net/xen-netback/common.h
index ef3026f46a37..d4eb8d2e9cb7 100644
--- a/drivers/net/xen-netback/common.h
+++ b/drivers/net/xen-netback/common.h
@@ -165,6 +165,7 @@ struct xenvif_queue { /* Per-queue data for xenvif */
         u16 dealloc_ring[MAX_PENDING_REQS];
         struct task_struct *dealloc_task;
         wait_queue_head_t dealloc_wq;
+        atomic_t inflight_packets;
 
         /* Use kthread for guest RX */
         struct task_struct *task;
@@ -329,4 +330,8 @@ extern unsigned int xenvif_max_queues;
 extern struct dentry *xen_netback_dbg_root;
 #endif
 
+void xenvif_skb_zerocopy_prepare(struct xenvif_queue *queue,
+                                 struct sk_buff *skb);
+void xenvif_skb_zerocopy_complete(struct xenvif_queue *queue);
+
 #endif /* __XEN_NETBACK__COMMON_H__ */
diff --git a/drivers/net/xen-netback/interface.c b/drivers/net/xen-netback/interface.c
index bfd10cb9c8de..e29e15dca86e 100644
--- a/drivers/net/xen-netback/interface.c
+++ b/drivers/net/xen-netback/interface.c
@@ -43,6 +43,23 @@
 #define XENVIF_QUEUE_LENGTH 32
 #define XENVIF_NAPI_WEIGHT  64
 
+/* This function is used to set SKBTX_DEV_ZEROCOPY as well as
+ * increasing the inflight counter. We need to increase the inflight
+ * counter because core driver calls into xenvif_zerocopy_callback
+ * which calls xenvif_skb_zerocopy_complete.
+ */
+void xenvif_skb_zerocopy_prepare(struct xenvif_queue *queue,
+                                 struct sk_buff *skb)
+{
+        skb_shinfo(skb)->tx_flags |= SKBTX_DEV_ZEROCOPY;
+        atomic_inc(&queue->inflight_packets);
+}
+
+void xenvif_skb_zerocopy_complete(struct xenvif_queue *queue)
+{
+        atomic_dec(&queue->inflight_packets);
+}
+
 static inline void xenvif_stop_queue(struct xenvif_queue *queue)
 {
         struct net_device *dev = queue->vif->dev;
@@ -524,9 +541,6 @@ int xenvif_init_queue(struct xenvif_queue *queue)
 
         init_timer(&queue->rx_stalled);
 
-        netif_napi_add(queue->vif->dev, &queue->napi, xenvif_poll,
-                        XENVIF_NAPI_WEIGHT);
-
         return 0;
 }
 
@@ -560,6 +574,7 @@ int xenvif_connect(struct xenvif_queue *queue, unsigned long tx_ring_ref,
 
         init_waitqueue_head(&queue->wq);
         init_waitqueue_head(&queue->dealloc_wq);
+        atomic_set(&queue->inflight_packets, 0);
 
         if (tx_evtchn == rx_evtchn) {
                 /* feature-split-event-channels == 0 */
@@ -614,6 +629,9 @@ int xenvif_connect(struct xenvif_queue *queue, unsigned long tx_ring_ref,
         wake_up_process(queue->task);
         wake_up_process(queue->dealloc_task);
 
+        netif_napi_add(queue->vif->dev, &queue->napi, xenvif_poll,
+                        XENVIF_NAPI_WEIGHT);
+
         return 0;
 
 err_rx_unbind:
@@ -642,25 +660,6 @@ void xenvif_carrier_off(struct xenvif *vif)
         rtnl_unlock();
 }
 
-static void xenvif_wait_unmap_timeout(struct xenvif_queue *queue,
-                                      unsigned int worst_case_skb_lifetime)
-{
-        int i, unmap_timeout = 0;
-
-        for (i = 0; i < MAX_PENDING_REQS; ++i) {
-                if (queue->grant_tx_handle[i] != NETBACK_INVALID_HANDLE) {
-                        unmap_timeout++;
-                        schedule_timeout(msecs_to_jiffies(1000));
-                        if (unmap_timeout > worst_case_skb_lifetime &&
-                            net_ratelimit())
-                                netdev_err(queue->vif->dev,
-                                           "Page still granted! Index: %x\n",
-                                           i);
-                        i = -1;
-                }
-        }
-}
-
 void xenvif_disconnect(struct xenvif *vif)
 {
         struct xenvif_queue *queue = NULL;
@@ -672,6 +671,8 @@ void xenvif_disconnect(struct xenvif *vif)
         for (queue_index = 0; queue_index < num_queues; ++queue_index) {
                 queue = &vif->queues[queue_index];
 
+                netif_napi_del(&queue->napi);
+
                 if (queue->task) {
                         del_timer_sync(&queue->rx_stalled);
                         kthread_stop(queue->task);
@@ -704,7 +705,6 @@ void xenvif_disconnect(struct xenvif *vif)
 void xenvif_deinit_queue(struct xenvif_queue *queue)
 {
         free_xenballooned_pages(MAX_PENDING_REQS, queue->mmap_pages);
-        netif_napi_del(&queue->napi);
 }
 
 void xenvif_free(struct xenvif *vif)
@@ -712,21 +712,11 @@ void xenvif_free(struct xenvif *vif)
         struct xenvif_queue *queue = NULL;
         unsigned int num_queues = vif->num_queues;
         unsigned int queue_index;
-        /* Here we want to avoid timeout messages if an skb can be legitimately
-         * stuck somewhere else. Realistically this could be an another vif's
-         * internal or QDisc queue. That another vif also has this
-         * rx_drain_timeout_msecs timeout, so give it time to drain out.
-         * Although if that other guest wakes up just before its timeout happens
-         * and takes only one skb from QDisc, it can hold onto other skbs for a
-         * longer period.
-         */
-        unsigned int worst_case_skb_lifetime = (rx_drain_timeout_msecs/1000);
 
         unregister_netdev(vif->dev);
 
         for (queue_index = 0; queue_index < num_queues; ++queue_index) {
                 queue = &vif->queues[queue_index];
-                xenvif_wait_unmap_timeout(queue, worst_case_skb_lifetime);
                 xenvif_deinit_queue(queue);
         }
 
diff --git a/drivers/net/xen-netback/netback.c b/drivers/net/xen-netback/netback.c
index 4734472aa620..08f65996534c 100644
--- a/drivers/net/xen-netback/netback.c
+++ b/drivers/net/xen-netback/netback.c
@@ -1525,10 +1525,12 @@ static int xenvif_handle_frag_list(struct xenvif_queue *queue, struct sk_buff *s
         /* remove traces of mapped pages and frag_list */
         skb_frag_list_init(skb);
         uarg = skb_shinfo(skb)->destructor_arg;
+        /* increase inflight counter to offset decrement in callback */
+        atomic_inc(&queue->inflight_packets);
         uarg->callback(uarg, true);
         skb_shinfo(skb)->destructor_arg = NULL;
 
-        skb_shinfo(nskb)->tx_flags |= SKBTX_DEV_ZEROCOPY;
+        xenvif_skb_zerocopy_prepare(queue, nskb);
         kfree_skb(nskb);
 
         return 0;
@@ -1589,7 +1591,7 @@ static int xenvif_tx_submit(struct xenvif_queue *queue)
                                 if (net_ratelimit())
                                         netdev_err(queue->vif->dev,
                                                    "Not enough memory to consolidate frag_list!\n");
-                                skb_shinfo(skb)->tx_flags |= SKBTX_DEV_ZEROCOPY;
+                                xenvif_skb_zerocopy_prepare(queue, skb);
                                 kfree_skb(skb);
                                 continue;
                         }
@@ -1609,7 +1611,7 @@ static int xenvif_tx_submit(struct xenvif_queue *queue)
                                    "Can't setup checksum in net_tx_action\n");
                         /* We have to set this flag to trigger the callback */
                         if (skb_shinfo(skb)->destructor_arg)
-                                skb_shinfo(skb)->tx_flags |= SKBTX_DEV_ZEROCOPY;
+                                xenvif_skb_zerocopy_prepare(queue, skb);
                         kfree_skb(skb);
                         continue;
                 }
@@ -1641,7 +1643,7 @@ static int xenvif_tx_submit(struct xenvif_queue *queue)
                  * skb. E.g. the __pskb_pull_tail earlier can do such thing.
                  */
                 if (skb_shinfo(skb)->destructor_arg) {
-                        skb_shinfo(skb)->tx_flags |= SKBTX_DEV_ZEROCOPY;
+                        xenvif_skb_zerocopy_prepare(queue, skb);
                         queue->stats.tx_zerocopy_sent++;
                 }
 
@@ -1681,6 +1683,7 @@ void xenvif_zerocopy_callback(struct ubuf_info *ubuf, bool zerocopy_success)
                 queue->stats.tx_zerocopy_success++;
         else
                 queue->stats.tx_zerocopy_fail++;
+        xenvif_skb_zerocopy_complete(queue);
 }
 
 static inline void xenvif_tx_dealloc_action(struct xenvif_queue *queue)
@@ -2058,15 +2061,24 @@ int xenvif_kthread_guest_rx(void *data)
         return 0;
 }
 
+static bool xenvif_dealloc_kthread_should_stop(struct xenvif_queue *queue)
+{
+        /* Dealloc thread must remain running until all inflight
+         * packets complete.
+         */
+        return kthread_should_stop() &&
+                !atomic_read(&queue->inflight_packets);
+}
+
 int xenvif_dealloc_kthread(void *data)
 {
         struct xenvif_queue *queue = data;
 
-        while (!kthread_should_stop()) {
+        for (;;) {
                 wait_event_interruptible(queue->dealloc_wq,
                                          tx_dealloc_work_todo(queue) ||
-                                         kthread_should_stop());
-                if (kthread_should_stop())
+                                         xenvif_dealloc_kthread_should_stop(queue));
+                if (xenvif_dealloc_kthread_should_stop(queue))
                         break;
 
                 xenvif_tx_dealloc_action(queue);
diff --git a/drivers/net/xen-netback/xenbus.c b/drivers/net/xen-netback/xenbus.c
index 580517d857bf..9c47b897b6d2 100644
--- a/drivers/net/xen-netback/xenbus.c
+++ b/drivers/net/xen-netback/xenbus.c
@@ -116,6 +116,7 @@ static int xenvif_read_io_ring(struct seq_file *m, void *v)
 }
 
 #define XENVIF_KICK_STR "kick"
+#define BUFFER_SIZE     32
 
 static ssize_t
 xenvif_write_io_ring(struct file *filp, const char __user *buf, size_t count,
@@ -124,22 +125,24 @@ xenvif_write_io_ring(struct file *filp, const char __user *buf, size_t count,
         struct xenvif_queue *queue =
                 ((struct seq_file *)filp->private_data)->private;
         int len;
-        char write[sizeof(XENVIF_KICK_STR)];
+        char write[BUFFER_SIZE];
 
         /* don't allow partial writes and check the length */
         if (*ppos != 0)
                 return 0;
-        if (count < sizeof(XENVIF_KICK_STR) - 1)
+        if (count >= sizeof(write))
                 return -ENOSPC;
 
         len = simple_write_to_buffer(write,
-                                     sizeof(write),
+                                     sizeof(write) - 1,
                                      ppos,
                                      buf,
                                      count);
         if (len < 0)
                 return len;
 
+        write[len] = '\0';
+
         if (!strncmp(write, XENVIF_KICK_STR, sizeof(XENVIF_KICK_STR) - 1))
                 xenvif_interrupt(0, (void *)queue);
         else {
@@ -171,10 +174,9 @@ static const struct file_operations xenvif_dbg_io_ring_ops_fops = {
         .write = xenvif_write_io_ring,
 };
 
-static void xenvif_debugfs_addif(struct xenvif_queue *queue)
+static void xenvif_debugfs_addif(struct xenvif *vif)
 {
         struct dentry *pfile;
-        struct xenvif *vif = queue->vif;
         int i;
 
         if (IS_ERR_OR_NULL(xen_netback_dbg_root))
@@ -733,10 +735,11 @@ static void connect(struct backend_info *be)
                         be->vif->num_queues = queue_index;
                         goto err;
                 }
+        }
+
 #ifdef CONFIG_DEBUG_FS
-                xenvif_debugfs_addif(queue);
+        xenvif_debugfs_addif(be->vif);
 #endif /* CONFIG_DEBUG_FS */
-        }
 
         /* Initialisation completed, tell core driver the number of
          * active queues.
diff --git a/drivers/scsi/cxgbi/cxgb3i/Kconfig b/drivers/scsi/cxgbi/cxgb3i/Kconfig
index 6bbc36fbd6ec..e4603985dce3 100644
--- a/drivers/scsi/cxgbi/cxgb3i/Kconfig
+++ b/drivers/scsi/cxgbi/cxgb3i/Kconfig
@@ -1,6 +1,6 @@
 config SCSI_CXGB3_ISCSI
         tristate "Chelsio T3 iSCSI support"
-        depends on PCI && INET
+        depends on PCI && INET && (IPV6 || IPV6=n)
         select NETDEVICES
         select ETHERNET
         select NET_VENDOR_CHELSIO
diff --git a/drivers/scsi/cxgbi/cxgb4i/Kconfig b/drivers/scsi/cxgbi/cxgb4i/Kconfig
index 16b2c7d26617..8c4e423037b6 100644
--- a/drivers/scsi/cxgbi/cxgb4i/Kconfig
+++ b/drivers/scsi/cxgbi/cxgb4i/Kconfig
@@ -1,6 +1,6 @@
 config SCSI_CXGB4_ISCSI
         tristate "Chelsio T4 iSCSI support"
-        depends on PCI && INET
+        depends on PCI && INET && (IPV6 || IPV6=n)
         select NETDEVICES
         select ETHERNET
         select NET_VENDOR_CHELSIO
diff --git a/include/linux/rhashtable.h b/include/linux/rhashtable.h
index 9cda293c867d..36826c0166c5 100644
--- a/include/linux/rhashtable.h
+++ b/include/linux/rhashtable.h
@@ -21,7 +21,7 @@
 #include <linux/rculist.h>
 
 struct rhash_head {
-        struct rhash_head               *next;
+        struct rhash_head __rcu         *next;
 };
 
 #define INIT_HASH_HEAD(ptr) ((ptr)->next = NULL)
@@ -97,7 +97,7 @@ u32 rhashtable_obj_hashfn(const struct rhashtable *ht, void *ptr);
 void rhashtable_insert(struct rhashtable *ht, struct rhash_head *node, gfp_t);
 bool rhashtable_remove(struct rhashtable *ht, struct rhash_head *node, gfp_t);
 void rhashtable_remove_pprev(struct rhashtable *ht, struct rhash_head *obj,
-                             struct rhash_head **pprev, gfp_t flags);
+                             struct rhash_head __rcu **pprev, gfp_t flags);
 
 bool rht_grow_above_75(const struct rhashtable *ht, size_t new_size);
 bool rht_shrink_below_30(const struct rhashtable *ht, size_t new_size);
@@ -117,18 +117,12 @@ void rhashtable_destroy(const struct rhashtable *ht);
 #define rht_dereference_rcu(p, ht) \
         rcu_dereference_check(p, lockdep_rht_mutex_is_held(ht))
 
-/* Internal, use rht_obj() instead */
 #define rht_entry(ptr, type, member) container_of(ptr, type, member)
 #define rht_entry_safe(ptr, type, member) \
 ({ \
         typeof(ptr) __ptr = (ptr); \
            __ptr ? rht_entry(__ptr, type, member) : NULL; \
 })
-#define rht_entry_safe_rcu(ptr, type, member) \
-({ \
-        typeof(*ptr) __rcu *__ptr = (typeof(*ptr) __rcu __force *)ptr; \
-        __ptr ? container_of((typeof(ptr))rcu_dereference_raw(__ptr), type, member) : NULL; \
-})
 
 #define rht_next_entry_safe(pos, ht, member) \
 ({ \
@@ -205,9 +199,10 @@ void rhashtable_destroy(const struct rhashtable *ht);
  * traversal is guarded by rcu_read_lock().
  */
 #define rht_for_each_entry_rcu(pos, head, member) \
-        for (pos = rht_entry_safe_rcu(head, typeof(*(pos)), member); \
+        for (pos = rht_entry_safe(rcu_dereference_raw(head), \
+                                  typeof(*(pos)), member); \
              pos; \
-             pos = rht_entry_safe_rcu((pos)->member.next, \
-                                      typeof(*(pos)), member))
+             pos = rht_entry_safe(rcu_dereference_raw((pos)->member.next), \
+                                  typeof(*(pos)), member))
 
 #endif /* _LINUX_RHASHTABLE_H */
diff --git a/include/net/inet_connection_sock.h b/include/net/inet_connection_sock.h
index 7a4313887568..5fbe6568c3cf 100644
--- a/include/net/inet_connection_sock.h
+++ b/include/net/inet_connection_sock.h
@@ -62,6 +62,7 @@ struct inet_connection_sock_af_ops {
         void        (*addr2sockaddr)(struct sock *sk, struct sockaddr *);
         int         (*bind_conflict)(const struct sock *sk,
                                      const struct inet_bind_bucket *tb, bool relax);
+        void        (*mtu_reduced)(struct sock *sk);
 };
 
 /** inet_connection_sock - INET connection oriented sock
diff --git a/include/net/sock.h b/include/net/sock.h
index 38805fa02e48..7f2ab72f321a 100644
--- a/include/net/sock.h
+++ b/include/net/sock.h
@@ -987,7 +987,6 @@ struct proto {
                                                 struct sk_buff *skb);
 
         void            (*release_cb)(struct sock *sk);
-        void            (*mtu_reduced)(struct sock *sk);
 
         /* Keeping track of sk's, looking them up, and port selection methods. */
         void                    (*hash)(struct sock *sk);
diff --git a/include/net/tcp.h b/include/net/tcp.h
index dafa1cbc149b..590e01a476ac 100644
--- a/include/net/tcp.h
+++ b/include/net/tcp.h
@@ -417,7 +417,7 @@ void tcp_update_metrics(struct sock *sk);
 void tcp_init_metrics(struct sock *sk);
 void tcp_metrics_init(void);
 bool tcp_peer_is_proven(struct request_sock *req, struct dst_entry *dst,
-                        bool paws_check);
+                        bool paws_check, bool timestamps);
 bool tcp_remember_stamp(struct sock *sk);
 bool tcp_tw_remember_stamp(struct inet_timewait_sock *tw);
 void tcp_fetch_timewait_stamp(struct sock *sk, struct dst_entry *dst);
@@ -448,6 +448,7 @@ const u8 *tcp_parse_md5sig_option(const struct tcphdr *th);
  */
 
 void tcp_v4_send_check(struct sock *sk, struct sk_buff *skb);
+void tcp_v4_mtu_reduced(struct sock *sk);
 int tcp_v4_conn_request(struct sock *sk, struct sk_buff *skb);
 struct sock *tcp_create_openreq_child(struct sock *sk,
                                       struct request_sock *req,
@@ -705,8 +706,10 @@ struct tcp_skb_cb {
 #define TCPCB_SACKED_RETRANS    0x02    /* SKB retransmitted            */
 #define TCPCB_LOST              0x04    /* SKB is lost                  */
 #define TCPCB_TAGBITS           0x07    /* All tag bits                 */
+#define TCPCB_REPAIRED          0x10    /* SKB repaired (no skb_mstamp) */
 #define TCPCB_EVER_RETRANS      0x80    /* Ever retransmitted frame     */
-#define TCPCB_RETRANS           (TCPCB_SACKED_RETRANS|TCPCB_EVER_RETRANS)
+#define TCPCB_RETRANS           (TCPCB_SACKED_RETRANS|TCPCB_EVER_RETRANS| \
+                                TCPCB_REPAIRED)
 
         __u8            ip_dsfield;     /* IPv4 tos or IPv6 dsfield     */
         /* 1 byte hole */
diff --git a/lib/rhashtable.c b/lib/rhashtable.c
index e6940cf16628..a2c78810ebc1 100644
--- a/lib/rhashtable.c
+++ b/lib/rhashtable.c
@@ -38,16 +38,10 @@ int lockdep_rht_mutex_is_held(const struct rhashtable *ht)
 EXPORT_SYMBOL_GPL(lockdep_rht_mutex_is_held);
 #endif
 
-/**
- * rht_obj - cast hash head to outer object
- * @ht:         hash table
- * @he:         hashed node
- */
-void *rht_obj(const struct rhashtable *ht, const struct rhash_head *he)
+static void *rht_obj(const struct rhashtable *ht, const struct rhash_head *he)
 {
         return (void *) he - ht->p.head_offset;
 }
-EXPORT_SYMBOL_GPL(rht_obj);
 
 static u32 __hashfn(const struct rhashtable *ht, const void *key,
                       u32 len, u32 hsize)
@@ -386,7 +380,7 @@ EXPORT_SYMBOL_GPL(rhashtable_insert);
  * deletion when combined with walking or lookup.
  */
 void rhashtable_remove_pprev(struct rhashtable *ht, struct rhash_head *obj,
-                             struct rhash_head **pprev, gfp_t flags)
+                             struct rhash_head __rcu **pprev, gfp_t flags)
 {
         struct bucket_table *tbl = rht_dereference(ht->tbl, ht);
 
diff --git a/net/atm/lec.c b/net/atm/lec.c
index 4c5b8ba0f84f..e4853b50cf40 100644
--- a/net/atm/lec.c
+++ b/net/atm/lec.c
@@ -833,7 +833,6 @@ static void *lec_tbl_walk(struct lec_state *state, struct hlist_head *tbl,
                           loff_t *l)
 {
         struct hlist_node *e = state->node;
-        struct lec_arp_table *tmp;
 
         if (!e)
                 e = tbl->first;
@@ -842,9 +841,7 @@ static void *lec_tbl_walk(struct lec_state *state, struct hlist_head *tbl,
                 --*l;
         }
 
-        tmp = container_of(e, struct lec_arp_table, next);
-
-        hlist_for_each_entry_from(tmp, next) {
+        for (; e; e = e->next) {
                 if (--*l < 0)
                         break;
         }
diff --git a/net/atm/svc.c b/net/atm/svc.c
index d8e5d0c2ebbc..1ba23f5018e7 100644
--- a/net/atm/svc.c
+++ b/net/atm/svc.c
@@ -50,12 +50,12 @@ static void svc_disconnect(struct atm_vcc *vcc)
 
         pr_debug("%p\n", vcc);
         if (test_bit(ATM_VF_REGIS, &vcc->flags)) {
-                prepare_to_wait(sk_sleep(sk), &wait, TASK_UNINTERRUPTIBLE);
                 sigd_enq(vcc, as_close, NULL, NULL, NULL);
-                while (!test_bit(ATM_VF_RELEASED, &vcc->flags) && sigd) {
+                for (;;) {
+                        prepare_to_wait(sk_sleep(sk), &wait, TASK_UNINTERRUPTIBLE);
+                        if (test_bit(ATM_VF_RELEASED, &vcc->flags) || !sigd)
+                                break;
                         schedule();
-                        prepare_to_wait(sk_sleep(sk), &wait,
-                                        TASK_UNINTERRUPTIBLE);
                 }
                 finish_wait(sk_sleep(sk), &wait);
         }
@@ -126,11 +126,12 @@ static int svc_bind(struct socket *sock, struct sockaddr *sockaddr,
         }
         vcc->local = *addr;
         set_bit(ATM_VF_WAITING, &vcc->flags);
-        prepare_to_wait(sk_sleep(sk), &wait, TASK_UNINTERRUPTIBLE);
         sigd_enq(vcc, as_bind, NULL, NULL, &vcc->local);
-        while (test_bit(ATM_VF_WAITING, &vcc->flags) && sigd) {
-                schedule();
+        for (;;) {
                 prepare_to_wait(sk_sleep(sk), &wait, TASK_UNINTERRUPTIBLE);
+                if (!test_bit(ATM_VF_WAITING, &vcc->flags) || !sigd)
+                        break;
+                schedule();
         }
         finish_wait(sk_sleep(sk), &wait);
         clear_bit(ATM_VF_REGIS, &vcc->flags); /* doesn't count */
@@ -202,15 +203,14 @@ static int svc_connect(struct socket *sock, struct sockaddr *sockaddr,
                 }
                 vcc->remote = *addr;
                 set_bit(ATM_VF_WAITING, &vcc->flags);
-                prepare_to_wait(sk_sleep(sk), &wait, TASK_INTERRUPTIBLE);
                 sigd_enq(vcc, as_connect, NULL, NULL, &vcc->remote);
                 if (flags & O_NONBLOCK) {
-                        finish_wait(sk_sleep(sk), &wait);
                         sock->state = SS_CONNECTING;
                         error = -EINPROGRESS;
                         goto out;
                 }
                 error = 0;
+                prepare_to_wait(sk_sleep(sk), &wait, TASK_INTERRUPTIBLE);
                 while (test_bit(ATM_VF_WAITING, &vcc->flags) && sigd) {
                         schedule();
                         if (!signal_pending(current)) {
@@ -297,11 +297,12 @@ static int svc_listen(struct socket *sock, int backlog)
                 goto out;
         }
         set_bit(ATM_VF_WAITING, &vcc->flags);
-        prepare_to_wait(sk_sleep(sk), &wait, TASK_UNINTERRUPTIBLE);
         sigd_enq(vcc, as_listen, NULL, NULL, &vcc->local);
-        while (test_bit(ATM_VF_WAITING, &vcc->flags) && sigd) {
-                schedule();
+        for (;;) {
                 prepare_to_wait(sk_sleep(sk), &wait, TASK_UNINTERRUPTIBLE);
+                if (!test_bit(ATM_VF_WAITING, &vcc->flags) || !sigd)
+                        break;
+                schedule();
         }
         finish_wait(sk_sleep(sk), &wait);
         if (!sigd) {
@@ -387,15 +388,15 @@ static int svc_accept(struct socket *sock, struct socket *newsock, int flags)
                 }
                 /* wait should be short, so we ignore the non-blocking flag */
                 set_bit(ATM_VF_WAITING, &new_vcc->flags);
-                prepare_to_wait(sk_sleep(sk_atm(new_vcc)), &wait,
-                                TASK_UNINTERRUPTIBLE);
                 sigd_enq(new_vcc, as_accept, old_vcc, NULL, NULL);
-                while (test_bit(ATM_VF_WAITING, &new_vcc->flags) && sigd) {
+                for (;;) {
+                        prepare_to_wait(sk_sleep(sk_atm(new_vcc)), &wait,
+                                        TASK_UNINTERRUPTIBLE);
+                        if (!test_bit(ATM_VF_WAITING, &new_vcc->flags) || !sigd)
+                                break;
                         release_sock(sk);
                         schedule();
                         lock_sock(sk);
-                        prepare_to_wait(sk_sleep(sk_atm(new_vcc)), &wait,
-                                        TASK_UNINTERRUPTIBLE);
                 }
                 finish_wait(sk_sleep(sk_atm(new_vcc)), &wait);
                 if (!sigd) {
@@ -433,12 +434,14 @@ int svc_change_qos(struct atm_vcc *vcc, struct atm_qos *qos)
         DEFINE_WAIT(wait);
 
         set_bit(ATM_VF_WAITING, &vcc->flags);
-        prepare_to_wait(sk_sleep(sk), &wait, TASK_UNINTERRUPTIBLE);
         sigd_enq2(vcc, as_modify, NULL, NULL, &vcc->local, qos, 0);
-        while (test_bit(ATM_VF_WAITING, &vcc->flags) &&
-               !test_bit(ATM_VF_RELEASED, &vcc->flags) && sigd) {
-                schedule();
+        for (;;) {
                 prepare_to_wait(sk_sleep(sk), &wait, TASK_UNINTERRUPTIBLE);
+                if (!test_bit(ATM_VF_WAITING, &vcc->flags) ||
+                    test_bit(ATM_VF_RELEASED, &vcc->flags) || !sigd) {
+                        break;
+                }
+                schedule();
         }
         finish_wait(sk_sleep(sk), &wait);
         if (!sigd)
@@ -529,18 +532,18 @@ static int svc_addparty(struct socket *sock, struct sockaddr *sockaddr,
 
         lock_sock(sk);
         set_bit(ATM_VF_WAITING, &vcc->flags);
-        prepare_to_wait(sk_sleep(sk), &wait, TASK_INTERRUPTIBLE);
         sigd_enq(vcc, as_addparty, NULL, NULL,
                  (struct sockaddr_atmsvc *) sockaddr);
         if (flags & O_NONBLOCK) {
-                finish_wait(sk_sleep(sk), &wait);
                 error = -EINPROGRESS;
                 goto out;
         }
         pr_debug("added wait queue\n");
-        while (test_bit(ATM_VF_WAITING, &vcc->flags) && sigd) {
-                schedule();
+        for (;;) {
                 prepare_to_wait(sk_sleep(sk), &wait, TASK_INTERRUPTIBLE);
+                if (!test_bit(ATM_VF_WAITING, &vcc->flags) || !sigd)
+                        break;
+                schedule();
         }
         finish_wait(sk_sleep(sk), &wait);
         error = xchg(&sk->sk_err_soft, 0);
@@ -558,11 +561,12 @@ static int svc_dropparty(struct socket *sock, int ep_ref)
 
         lock_sock(sk);
         set_bit(ATM_VF_WAITING, &vcc->flags);
-        prepare_to_wait(sk_sleep(sk), &wait, TASK_INTERRUPTIBLE);
         sigd_enq2(vcc, as_dropparty, NULL, NULL, NULL, NULL, ep_ref);
-        while (test_bit(ATM_VF_WAITING, &vcc->flags) && sigd) {
-                schedule();
+        for (;;) {
                 prepare_to_wait(sk_sleep(sk), &wait, TASK_INTERRUPTIBLE);
+                if (!test_bit(ATM_VF_WAITING, &vcc->flags) || !sigd)
+                        break;
+                schedule();
         }
         finish_wait(sk_sleep(sk), &wait);
         if (!sigd) {
diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
index 181b70ebd964..541f26a67ba2 100644
--- a/net/ipv4/tcp.c
+++ b/net/ipv4/tcp.c
@@ -1188,13 +1188,6 @@ new_segment:
                                         goto wait_for_memory;
 
                                 /*
-                                 * All packets are restored as if they have
-                                 * already been sent.
-                                 */
-                                if (tp->repair)
-                                        TCP_SKB_CB(skb)->when = tcp_time_stamp;
-
-                                /*
                                  * Check whether we can use HW checksum.
                                  */
                                 if (sk->sk_route_caps & NETIF_F_ALL_CSUM)
@@ -1203,6 +1196,13 @@ new_segment:
                                 skb_entail(sk, skb);
                                 copy = size_goal;
                                 max = size_goal;
+
+                                /* All packets are restored as if they have
+                                 * already been sent. skb_mstamp isn't set to
+                                 * avoid wrong rtt estimation.
+                                 */
+                                if (tp->repair)
+                                        TCP_SKB_CB(skb)->sacked |= TCPCB_REPAIRED;
                         }
 
                         /* Try to append data to the end of skb. */
diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
index a3d47af01906..a906e0200ff2 100644
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -2687,7 +2687,6 @@ static void tcp_enter_recovery(struct sock *sk, bool ece_ack)
  */
 static void tcp_process_loss(struct sock *sk, int flag, bool is_dupack)
 {
-        struct inet_connection_sock *icsk = inet_csk(sk);
         struct tcp_sock *tp = tcp_sk(sk);
         bool recovered = !before(tp->snd_una, tp->high_seq);
 
@@ -2713,12 +2712,9 @@ static void tcp_process_loss(struct sock *sk, int flag, bool is_dupack)
 
         if (recovered) {
                 /* F-RTO RFC5682 sec 3.1 step 2.a and 1st part of step 3.a */
-                icsk->icsk_retransmits = 0;
                 tcp_try_undo_recovery(sk);
                 return;
         }
-        if (flag & FLAG_DATA_ACKED)
-                icsk->icsk_retransmits = 0;
         if (tcp_is_reno(tp)) {
                 /* A Reno DUPACK means new data in F-RTO step 2.b above are
                  * delivered. Lower inflight to clock out (re)tranmissions.
@@ -3050,10 +3046,15 @@ static int tcp_clean_rtx_queue(struct sock *sk, int prior_fackets,
         first_ackt.v64 = 0;
 
         while ((skb = tcp_write_queue_head(sk)) && skb != tcp_send_head(sk)) {
+                struct skb_shared_info *shinfo = skb_shinfo(skb);
                 struct tcp_skb_cb *scb = TCP_SKB_CB(skb);
                 u8 sacked = scb->sacked;
                 u32 acked_pcount;
 
+                if (unlikely(shinfo->tx_flags & SKBTX_ACK_TSTAMP) &&
+                    between(shinfo->tskey, prior_snd_una, tp->snd_una - 1))
+                        __skb_tstamp_tx(skb, NULL, sk, SCM_TSTAMP_ACK);
+
                 /* Determine how many packets and what bytes were acked, tso and else */
                 if (after(scb->end_seq, tp->snd_una)) {
                         if (tcp_skb_pcount(skb) == 1 ||
@@ -3107,11 +3108,6 @@ static int tcp_clean_rtx_queue(struct sock *sk, int prior_fackets,
                         tp->retrans_stamp = 0;
                 }
 
-                if (unlikely(skb_shinfo(skb)->tx_flags & SKBTX_ACK_TSTAMP) &&
-                    between(skb_shinfo(skb)->tskey, prior_snd_una,
-                            tp->snd_una + 1))
-                        __skb_tstamp_tx(skb, NULL, sk, SCM_TSTAMP_ACK);
-
                 if (!fully_acked)
                         break;
 
@@ -3405,8 +3401,10 @@ static int tcp_ack(struct sock *sk, const struct sk_buff *skb, int flag)
             icsk->icsk_pending == ICSK_TIME_LOSS_PROBE)
                 tcp_rearm_rto(sk);
 
-        if (after(ack, prior_snd_una))
+        if (after(ack, prior_snd_una)) {
                 flag |= FLAG_SND_UNA_ADVANCED;
+                icsk->icsk_retransmits = 0;
+        }
 
         prior_fackets = tp->fackets_out;
 
@@ -5979,12 +5977,14 @@ int tcp_conn_request(struct request_sock_ops *rsk_ops,
                  * timewait bucket, so that all the necessary checks
                  * are made in the function processing timewait state.
                  */
-                if (tmp_opt.saw_tstamp && tcp_death_row.sysctl_tw_recycle) {
+                if (tcp_death_row.sysctl_tw_recycle) {
                         bool strict;
 
                         dst = af_ops->route_req(sk, &fl, req, &strict);
+
                         if (dst && strict &&
-                            !tcp_peer_is_proven(req, dst, true)) {
+                            !tcp_peer_is_proven(req, dst, true,
+                                                tmp_opt.saw_tstamp)) {
                                 NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_PAWSPASSIVEREJECTED);
                                 goto drop_and_release;
                         }
@@ -5993,7 +5993,8 @@ int tcp_conn_request(struct request_sock_ops *rsk_ops,
                 else if (!sysctl_tcp_syncookies &&
                          (sysctl_max_syn_backlog - inet_csk_reqsk_queue_len(sk) <
                           (sysctl_max_syn_backlog >> 2)) &&
-                         !tcp_peer_is_proven(req, dst, false)) {
+                         !tcp_peer_is_proven(req, dst, false,
+                                             tmp_opt.saw_tstamp)) {
                         /* Without syncookies last quarter of
                          * backlog is filled with destinations,
                          * proven to be alive.
diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
index dceff5fe8e66..cd17f009aede 100644
--- a/net/ipv4/tcp_ipv4.c
+++ b/net/ipv4/tcp_ipv4.c
@@ -271,7 +271,7 @@ EXPORT_SYMBOL(tcp_v4_connect);
  * It can be called through tcp_release_cb() if socket was owned by user
  * at the time tcp_v4_err() was called to handle ICMP message.
  */
-static void tcp_v4_mtu_reduced(struct sock *sk)
+void tcp_v4_mtu_reduced(struct sock *sk)
 {
         struct dst_entry *dst;
         struct inet_sock *inet = inet_sk(sk);
@@ -302,6 +302,7 @@ static void tcp_v4_mtu_reduced(struct sock *sk)
                 tcp_simple_retransmit(sk);
         } /* else let the usual retransmit timer handle it */
 }
+EXPORT_SYMBOL(tcp_v4_mtu_reduced);
 
 static void do_redirect(struct sk_buff *skb, struct sock *sk)
 {
@@ -1787,6 +1788,7 @@ const struct inet_connection_sock_af_ops ipv4_specific = {
         .compat_setsockopt = compat_ip_setsockopt,
         .compat_getsockopt = compat_ip_getsockopt,
 #endif
+        .mtu_reduced       = tcp_v4_mtu_reduced,
 };
 EXPORT_SYMBOL(ipv4_specific);
 
@@ -2406,7 +2408,6 @@ struct proto tcp_prot = {
         .sendpage               = tcp_sendpage,
         .backlog_rcv            = tcp_v4_do_rcv,
         .release_cb             = tcp_release_cb,
-        .mtu_reduced            = tcp_v4_mtu_reduced,
         .hash                   = inet_hash,
         .unhash                 = inet_unhash,
         .get_port               = inet_csk_get_port,
diff --git a/net/ipv4/tcp_metrics.c b/net/ipv4/tcp_metrics.c
index 0d54e59b9ea8..ed9c9a91851c 100644
--- a/net/ipv4/tcp_metrics.c
+++ b/net/ipv4/tcp_metrics.c
@@ -576,7 +576,8 @@ reset:
         tp->snd_cwnd_stamp = tcp_time_stamp;
 }
 
-bool tcp_peer_is_proven(struct request_sock *req, struct dst_entry *dst, bool paws_check)
+bool tcp_peer_is_proven(struct request_sock *req, struct dst_entry *dst,
+                        bool paws_check, bool timestamps)
 {
         struct tcp_metrics_block *tm;
         bool ret;
@@ -589,7 +590,8 @@ bool tcp_peer_is_proven(struct request_sock *req, struct dst_entry *dst, bool pa
         if (paws_check) {
                 if (tm &&
                     (u32)get_seconds() - tm->tcpm_ts_stamp < TCP_PAWS_MSL &&
-                    (s32)(tm->tcpm_ts - req->ts_recent) > TCP_PAWS_WINDOW)
+                    ((s32)(tm->tcpm_ts - req->ts_recent) > TCP_PAWS_WINDOW ||
+                     !timestamps))
                         ret = false;
                 else
                         ret = true;
diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
index 8fcfc91964ec..5a7c41fbc6d3 100644
--- a/net/ipv4/tcp_output.c
+++ b/net/ipv4/tcp_output.c
@@ -800,7 +800,7 @@ void tcp_release_cb(struct sock *sk)
                 __sock_put(sk);
         }
         if (flags & (1UL << TCP_MTU_REDUCED_DEFERRED)) {
-                sk->sk_prot->mtu_reduced(sk);
+                inet_csk(sk)->icsk_af_ops->mtu_reduced(sk);
                 __sock_put(sk);
         }
 }
@@ -1069,6 +1069,21 @@ static void tcp_adjust_pcount(struct sock *sk, const struct sk_buff *skb, int de
         tcp_verify_left_out(tp);
 }
 
+static void tcp_fragment_tstamp(struct sk_buff *skb, struct sk_buff *skb2)
+{
+        struct skb_shared_info *shinfo = skb_shinfo(skb);
+
+        if (unlikely(shinfo->tx_flags & SKBTX_ANY_TSTAMP) &&
+            !before(shinfo->tskey, TCP_SKB_CB(skb2)->seq)) {
+                struct skb_shared_info *shinfo2 = skb_shinfo(skb2);
+                u8 tsflags = shinfo->tx_flags & SKBTX_ANY_TSTAMP;
+
+                shinfo->tx_flags &= ~tsflags;
+                shinfo2->tx_flags |= tsflags;
+                swap(shinfo->tskey, shinfo2->tskey);
+        }
+}
+
 /* Function to create two new TCP segments.  Shrinks the given segment
  * to the specified size and appends a new segment with the rest of the
  * packet to the list.  This won't be called frequently, I hope.
@@ -1136,6 +1151,7 @@ int tcp_fragment(struct sock *sk, struct sk_buff *skb, u32 len,
          */
         TCP_SKB_CB(buff)->when = TCP_SKB_CB(skb)->when;
         buff->tstamp = skb->tstamp;
+        tcp_fragment_tstamp(skb, buff);
 
         old_factor = tcp_skb_pcount(skb);
 
@@ -1652,6 +1668,7 @@ static int tso_fragment(struct sock *sk, struct sk_buff *skb, unsigned int len,
 
         buff->ip_summed = skb->ip_summed = CHECKSUM_PARTIAL;
         skb_split(skb, buff, len);
+        tcp_fragment_tstamp(skb, buff);
 
         /* Fix up tso_factor for both original and new SKB.  */
         tcp_set_skb_tso_segs(sk, skb, mss_now);
@@ -1917,8 +1934,11 @@ static bool tcp_write_xmit(struct sock *sk, unsigned int mss_now, int nonagle,
                 tso_segs = tcp_init_tso_segs(sk, skb, mss_now);
                 BUG_ON(!tso_segs);
 
-                if (unlikely(tp->repair) && tp->repair_queue == TCP_SEND_QUEUE)
+                if (unlikely(tp->repair) && tp->repair_queue == TCP_SEND_QUEUE) {
+                        /* "when" is used as a start point for the retransmit timer */
+                        TCP_SKB_CB(skb)->when = tcp_time_stamp;
                         goto repair; /* Skip network transmission */
+                }
 
                 cwnd_quota = tcp_cwnd_test(tp, skb);
                 if (!cwnd_quota) {
diff --git a/net/ipv6/sit.c b/net/ipv6/sit.c
index 2e9ba035fb5f..6163f851dc01 100644
--- a/net/ipv6/sit.c
+++ b/net/ipv6/sit.c
@@ -101,19 +101,19 @@ static struct ip_tunnel *ipip6_tunnel_lookup(struct net *net,
         for_each_ip_tunnel_rcu(t, sitn->tunnels_r_l[h0 ^ h1]) {
                 if (local == t->parms.iph.saddr &&
                     remote == t->parms.iph.daddr &&
-                    (!dev || !t->parms.link || dev->iflink == t->parms.link) &&
+                    (!dev || !t->parms.link || dev->ifindex == t->parms.link) &&
                     (t->dev->flags & IFF_UP))
                         return t;
         }
         for_each_ip_tunnel_rcu(t, sitn->tunnels_r[h0]) {
                 if (remote == t->parms.iph.daddr &&
-                    (!dev || !t->parms.link || dev->iflink == t->parms.link) &&
+                    (!dev || !t->parms.link || dev->ifindex == t->parms.link) &&
                     (t->dev->flags & IFF_UP))
                         return t;
         }
         for_each_ip_tunnel_rcu(t, sitn->tunnels_l[h1]) {
                 if (local == t->parms.iph.saddr &&
-                    (!dev || !t->parms.link || dev->iflink == t->parms.link) &&
+                    (!dev || !t->parms.link || dev->ifindex == t->parms.link) &&
                     (t->dev->flags & IFF_UP))
                         return t;
         }
diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
index f2ce95502392..29964c3d363c 100644
--- a/net/ipv6/tcp_ipv6.c
+++ b/net/ipv6/tcp_ipv6.c
@@ -1595,6 +1595,7 @@ static const struct inet_connection_sock_af_ops ipv6_specific = {
         .compat_setsockopt = compat_ipv6_setsockopt,
         .compat_getsockopt = compat_ipv6_getsockopt,
 #endif
+        .mtu_reduced       = tcp_v6_mtu_reduced,
 };
 
 #ifdef CONFIG_TCP_MD5SIG
@@ -1625,6 +1626,7 @@ static const struct inet_connection_sock_af_ops ipv6_mapped = {
         .compat_setsockopt = compat_ipv6_setsockopt,
         .compat_getsockopt = compat_ipv6_getsockopt,
 #endif
+        .mtu_reduced       = tcp_v4_mtu_reduced,
 };
 
 #ifdef CONFIG_TCP_MD5SIG
@@ -1864,7 +1866,6 @@ struct proto tcpv6_prot = {
         .sendpage               = tcp_sendpage,
         .backlog_rcv            = tcp_v6_do_rcv,
         .release_cb             = tcp_release_cb,
-        .mtu_reduced            = tcp_v6_mtu_reduced,
         .hash                   = tcp_v6_hash,
         .unhash                 = inet_unhash,
         .get_port               = inet_csk_get_port,
diff --git a/net/irda/irlap_frame.c b/net/irda/irlap_frame.c
index 9ea0c933b9ff..a37998c6273d 100644
--- a/net/irda/irlap_frame.c
+++ b/net/irda/irlap_frame.c
@@ -622,7 +622,7 @@ void irlap_send_rd_frame(struct irlap_cb *self)
         frame = (struct rd_frame *)skb_put(tx_skb, 2);
 
         frame->caddr = self->caddr;
-        frame->caddr = RD_RSP | PF_BIT;
+        frame->control = RD_RSP | PF_BIT;
 
         irlap_queue_xmit(self, tx_skb);
 }
diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c
index 2e152e5f2186..c416725d28c4 100644
--- a/net/netlink/af_netlink.c
+++ b/net/netlink/af_netlink.c
@@ -2921,6 +2921,7 @@ static struct sock *netlink_seq_socket_idx(struct seq_file *seq, loff_t pos)
 }
 
 static void *netlink_seq_start(struct seq_file *seq, loff_t *pos)
+        __acquires(RCU)
 {
         rcu_read_lock();
         return *pos ? netlink_seq_socket_idx(seq, *pos - 1) : SEQ_START_TOKEN;
@@ -2970,6 +2971,7 @@ static void *netlink_seq_next(struct seq_file *seq, void *v, loff_t *pos)
 }
 
 static void netlink_seq_stop(struct seq_file *seq, void *v)
+        __releases(RCU)
 {
         rcu_read_unlock();
 }
diff --git a/net/openvswitch/vport.c b/net/openvswitch/vport.c
index 702fb21bfe15..6d8f2ec481d9 100644
--- a/net/openvswitch/vport.c
+++ b/net/openvswitch/vport.c
@@ -137,8 +137,10 @@ struct vport *ovs_vport_alloc(int priv_size, const struct vport_ops *ops,
         vport->ops = ops;
         INIT_HLIST_NODE(&vport->dp_hash_node);
 
-        if (ovs_vport_set_upcall_portids(vport, parms->upcall_portids))
+        if (ovs_vport_set_upcall_portids(vport, parms->upcall_portids)) {
+                kfree(vport);
                 return ERR_PTR(-EINVAL);
+        }
 
         vport->percpu_stats = netdev_alloc_pcpu_stats(struct pcpu_sw_netstats);
         if (!vport->percpu_stats) {