29 files changed, 235 insertions, 36 deletions

diff --git a/include/drm/drmP.h b/include/drm/drmP.h
index 8190b9bcc2d9..e5f4ae989abf 100644
--- a/include/drm/drmP.h
+++ b/include/drm/drmP.h
@@ -1321,6 +1321,8 @@ void drm_gem_object_free(struct kref *kref);
 struct drm_gem_object *drm_gem_object_alloc(struct drm_device *dev,
                                             size_t size);
 void drm_gem_object_handle_free(struct kref *kref);
+void drm_gem_vm_open(struct vm_area_struct *vma);
+void drm_gem_vm_close(struct vm_area_struct *vma);
 int drm_gem_mmap(struct file *filp, struct vm_area_struct *vma);
 
 static inline void
diff --git a/include/drm/drm_crtc.h b/include/drm/drm_crtc.h
index d54de24bf371..5ded1acfb543 100644
--- a/include/drm/drm_crtc.h
+++ b/include/drm/drm_crtc.h
@@ -609,7 +609,7 @@ extern char *drm_get_dvi_i_subconnector_name(int val);
 extern char *drm_get_dvi_i_select_name(int val);
 extern char *drm_get_tv_subconnector_name(int val);
 extern char *drm_get_tv_select_name(int val);
-extern void drm_fb_release(struct file *filp);
+extern void drm_fb_release(struct drm_file *file_priv);
 extern int drm_mode_group_init_legacy_group(struct drm_device *dev, struct drm_mode_group *group);
 extern struct edid *drm_get_edid(struct drm_connector *connector,
                                  struct i2c_adapter *adapter);
diff --git a/include/drm/drm_crtc_helper.h b/include/drm/drm_crtc_helper.h
index 0c6f0e11b41b..c7d4b2e606a5 100644
--- a/include/drm/drm_crtc_helper.h
+++ b/include/drm/drm_crtc_helper.h
@@ -54,13 +54,13 @@ struct drm_crtc_helper_funcs {
                            struct drm_display_mode *mode,
                            struct drm_display_mode *adjusted_mode);
         /* Actually set the mode */
-        void (*mode_set)(struct drm_crtc *crtc, struct drm_display_mode *mode,
-                         struct drm_display_mode *adjusted_mode, int x, int y,
-                         struct drm_framebuffer *old_fb);
+        int (*mode_set)(struct drm_crtc *crtc, struct drm_display_mode *mode,
+                        struct drm_display_mode *adjusted_mode, int x, int y,
+                        struct drm_framebuffer *old_fb);
 
         /* Move the crtc on the current fb to the given position *optional* */
-        void (*mode_set_base)(struct drm_crtc *crtc, int x, int y,
-                              struct drm_framebuffer *old_fb);
+        int (*mode_set_base)(struct drm_crtc *crtc, int x, int y,
+                             struct drm_framebuffer *old_fb);
 };
 
 struct drm_encoder_helper_funcs {
@@ -76,6 +76,7 @@ struct drm_encoder_helper_funcs {
         void (*mode_set)(struct drm_encoder *encoder,
                          struct drm_display_mode *mode,
                          struct drm_display_mode *adjusted_mode);
+        struct drm_crtc *(*get_crtc)(struct drm_encoder *encoder);
         /* detect for DAC style encoders */
         enum drm_connector_status (*detect)(struct drm_encoder *encoder,
                                             struct drm_connector *connector);
diff --git a/include/drm/drm_edid.h b/include/drm/drm_edid.h
index c707c15f5164..ff8d27af4786 100644
--- a/include/drm/drm_edid.h
+++ b/include/drm/drm_edid.h
@@ -58,10 +58,10 @@ struct detailed_pixel_timing {
         u8 hsync_pulse_width_lo;
         u8 vsync_pulse_width_lo:4;
         u8 vsync_offset_lo:4;
-        u8 hsync_pulse_width_hi:2;
-        u8 hsync_offset_hi:2;
         u8 vsync_pulse_width_hi:2;
         u8 vsync_offset_hi:2;
+        u8 hsync_pulse_width_hi:2;
+        u8 hsync_offset_hi:2;
         u8 width_mm_lo;
         u8 height_mm_lo;
         u8 height_mm_hi:4;
diff --git a/include/linux/Kbuild b/include/linux/Kbuild
index b97cdc516a8f..106c3ba50844 100644
--- a/include/linux/Kbuild
+++ b/include/linux/Kbuild
@@ -52,6 +52,7 @@ header-y += const.h
 header-y += cgroupstats.h
 header-y += cramfs_fs.h
 header-y += cycx_cfm.h
+header-y += dcbnl.h
 header-y += dlmconstants.h
 header-y += dlm_device.h
 header-y += dlm_netlink.h
diff --git a/include/linux/blkdev.h b/include/linux/blkdev.h
index dcaa0fd84b02..465d6babc847 100644
--- a/include/linux/blkdev.h
+++ b/include/linux/blkdev.h
@@ -708,6 +708,8 @@ struct req_iterator {
 };
 
 /* This should not be used directly - use rq_for_each_segment */
+#define for_each_bio(_bio)              \
+        for (; _bio; _bio = _bio->bi_next)
 #define __rq_for_each_bio(_bio, rq)     \
         if ((rq->bio))                  \
                 for (_bio = (rq)->bio; _bio; _bio = _bio->bi_next)
diff --git a/include/linux/dcbnl.h b/include/linux/dcbnl.h
index b0ef274e0031..7d2e10006188 100644
--- a/include/linux/dcbnl.h
+++ b/include/linux/dcbnl.h
@@ -20,10 +20,12 @@
 #ifndef __LINUX_DCBNL_H__
 #define __LINUX_DCBNL_H__
 
+#include <linux/types.h>
+
 #define DCB_PROTO_VERSION 1
 
 struct dcbmsg {
-        unsigned char      dcb_family;
+        __u8               dcb_family;
         __u8               cmd;
         __u16              dcb_pad;
 };
diff --git a/include/linux/decompress/bunzip2.h b/include/linux/decompress/bunzip2.h
new file mode 100644
index 000000000000..115272137a9c
--- /dev/null
+++ b/include/linux/decompress/bunzip2.h
@@ -0,0 +1,10 @@
+#ifndef DECOMPRESS_BUNZIP2_H
+#define DECOMPRESS_BUNZIP2_H
+
+int bunzip2(unsigned char *inbuf, int len,
+            int(*fill)(void*, unsigned int),
+            int(*flush)(void*, unsigned int),
+            unsigned char *output,
+            int *pos,
+            void(*error)(char *x));
+#endif
diff --git a/include/linux/decompress/generic.h b/include/linux/decompress/generic.h
new file mode 100644
index 000000000000..6dfb856327bb
--- /dev/null
+++ b/include/linux/decompress/generic.h
@@ -0,0 +1,33 @@
+#ifndef DECOMPRESS_GENERIC_H
+#define DECOMPRESS_GENERIC_H
+
+/* Minimal chunksize to be read.
+ *Bzip2 prefers at least 4096
+ *Lzma prefers 0x10000 */
+#define COMPR_IOBUF_SIZE        4096
+
+typedef int (*decompress_fn) (unsigned char *inbuf, int len,
+                              int(*fill)(void*, unsigned int),
+                              int(*writebb)(void*, unsigned int),
+                              unsigned char *output,
+                              int *posp,
+                              void(*error)(char *x));
+
+/* inbuf   - input buffer
+ *len     - len of pre-read data in inbuf
+ *fill    - function to fill inbuf if empty
+ *writebb - function to write out outbug
+ *posp    - if non-null, input position (number of bytes read) will be
+ *        returned here
+ *
+ *If len != 0, the inbuf is initialized (with as much data), and fill
+ *should not be called
+ *If len = 0, the inbuf is allocated, but empty. Its size is IOBUF_SIZE
+ *fill should be called (repeatedly...) to read data, at most IOBUF_SIZE
+ */
+
+/* Utility routine to detect the decompression method */
+decompress_fn decompress_method(const unsigned char *inbuf, int len,
+                                const char **name);
+
+#endif
diff --git a/include/linux/decompress/inflate.h b/include/linux/decompress/inflate.h
new file mode 100644
index 000000000000..f9b06ccc3e5c
--- /dev/null
+++ b/include/linux/decompress/inflate.h
@@ -0,0 +1,13 @@
+#ifndef INFLATE_H
+#define INFLATE_H
+
+/* Other housekeeping constants */
+#define INBUFSIZ 4096
+
+int gunzip(unsigned char *inbuf, int len,
+           int(*fill)(void*, unsigned int),
+           int(*flush)(void*, unsigned int),
+           unsigned char *output,
+           int *pos,
+           void(*error_fn)(char *x));
+#endif
diff --git a/include/linux/decompress/mm.h b/include/linux/decompress/mm.h
new file mode 100644
index 000000000000..12ff8c3f1d05
--- /dev/null
+++ b/include/linux/decompress/mm.h
@@ -0,0 +1,87 @@
+/*
+ * linux/compr_mm.h
+ *
+ * Memory management for pre-boot and ramdisk uncompressors
+ *
+ * Authors: Alain Knaff <alain@knaff.lu>
+ *
+ */
+
+#ifndef DECOMPR_MM_H
+#define DECOMPR_MM_H
+
+#ifdef STATIC
+
+/* Code active when included from pre-boot environment: */
+
+/* A trivial malloc implementation, adapted from
+ *  malloc by Hannu Savolainen 1993 and Matthias Urlichs 1994
+ */
+static unsigned long malloc_ptr;
+static int malloc_count;
+
+static void *malloc(int size)
+{
+        void *p;
+
+        if (size < 0)
+                error("Malloc error");
+        if (!malloc_ptr)
+                malloc_ptr = free_mem_ptr;
+
+        malloc_ptr = (malloc_ptr + 3) & ~3;     /* Align */
+
+        p = (void *)malloc_ptr;
+        malloc_ptr += size;
+
+        if (free_mem_end_ptr && malloc_ptr >= free_mem_end_ptr)
+                error("Out of memory");
+
+        malloc_count++;
+        return p;
+}
+
+static void free(void *where)
+{
+        malloc_count--;
+        if (!malloc_count)
+                malloc_ptr = free_mem_ptr;
+}
+
+#define large_malloc(a) malloc(a)
+#define large_free(a) free(a)
+
+#define set_error_fn(x)
+
+#define INIT
+
+#else /* STATIC */
+
+/* Code active when compiled standalone for use when loading ramdisk: */
+
+#include <linux/kernel.h>
+#include <linux/fs.h>
+#include <linux/string.h>
+#include <linux/vmalloc.h>
+
+/* Use defines rather than static inline in order to avoid spurious
+ * warnings when not needed (indeed large_malloc / large_free are not
+ * needed by inflate */
+
+#define malloc(a) kmalloc(a, GFP_KERNEL)
+#define free(a) kfree(a)
+
+#define large_malloc(a) vmalloc(a)
+#define large_free(a) vfree(a)
+
+static void(*error)(char *m);
+#define set_error_fn(x) error = x;
+
+#define INIT __init
+#define STATIC
+
+#include <linux/init.h>
+
+#endif /* STATIC */
+
+#endif /* DECOMPR_MM_H */
diff --git a/include/linux/decompress/unlzma.h b/include/linux/decompress/unlzma.h
new file mode 100644
index 000000000000..7796538f1bf4
--- /dev/null
+++ b/include/linux/decompress/unlzma.h
@@ -0,0 +1,12 @@
+#ifndef DECOMPRESS_UNLZMA_H
+#define DECOMPRESS_UNLZMA_H
+
+int unlzma(unsigned char *, int,
+           int(*fill)(void*, unsigned int),
+           int(*flush)(void*, unsigned int),
+           unsigned char *output,
+           int *posp,
+           void(*error)(char *x)
+        );
+
+#endif
diff --git a/include/linux/device.h b/include/linux/device.h
index 45e5b1921fbb..47f343c7bdda 100644
--- a/include/linux/device.h
+++ b/include/linux/device.h
@@ -147,6 +147,8 @@ extern void put_driver(struct device_driver *drv);
 extern struct device_driver *driver_find(const char *name,
                                          struct bus_type *bus);
 extern int driver_probe_done(void);
+extern int wait_for_device_probe(void);
+
 
 /* sysfs interface for exporting driver attributes */
 
diff --git a/include/linux/i2c-dev.h b/include/linux/i2c-dev.h
index 311315b56b61..fd53bfd26470 100644
--- a/include/linux/i2c-dev.h
+++ b/include/linux/i2c-dev.h
@@ -33,7 +33,7 @@
  */
 #define I2C_RETRIES     0x0701  /* number of times a device address should
                                    be polled when not acknowledging */
-#define I2C_TIMEOUT     0x0702  /* set timeout in jiffies - call with int */
+#define I2C_TIMEOUT     0x0702  /* set timeout in units of 10 ms */
 
 /* NOTE: Slave address is 7 or 10 bits, but 10-bit addresses
  * are NOT supported! (due to code brokenness)
diff --git a/include/linux/i2c.h b/include/linux/i2c.h
index fcfbfea3af72..c86c3b07604c 100644
--- a/include/linux/i2c.h
+++ b/include/linux/i2c.h
@@ -361,7 +361,7 @@ struct i2c_adapter {
         struct mutex bus_lock;
         struct mutex clist_lock;
 
-        int timeout;
+        int timeout;                    /* in jiffies */
         int retries;
         struct device dev;              /* the adapter device */
 
diff --git a/include/linux/ide.h b/include/linux/ide.h
index 194da5a4b0d6..fe235b65207e 100644
--- a/include/linux/ide.h
+++ b/include/linux/ide.h
@@ -663,7 +663,7 @@ typedef struct ide_drive_s ide_drive_t;
 #define to_ide_device(dev)              container_of(dev, ide_drive_t, gendev)
 
 #define to_ide_drv(obj, cont_type)      \
-        container_of(obj, struct cont_type, kref)
+        container_of(obj, struct cont_type, dev)
 
 #define ide_drv_g(disk, cont_type)      \
         container_of((disk)->private_data, struct cont_type, driver)
diff --git a/include/linux/if_vlan.h b/include/linux/if_vlan.h
index f8ff918c208f..e1ff5b14310e 100644
--- a/include/linux/if_vlan.h
+++ b/include/linux/if_vlan.h
@@ -210,6 +210,7 @@ static inline struct sk_buff *__vlan_put_tag(struct sk_buff *skb, u16 vlan_tci)
 
         /* Move the mac addresses to the beginning of the new header. */
         memmove(skb->data, skb->data + VLAN_HLEN, 2 * VLAN_ETH_ALEN);
+        skb->mac_header -= VLAN_HLEN;
 
         /* first, the ethernet type */
         veth->h_vlan_proto = htons(ETH_P_8021Q);
diff --git a/include/linux/intel-iommu.h b/include/linux/intel-iommu.h
index c4f6c101dbcd..d2e3cbfba14f 100644
--- a/include/linux/intel-iommu.h
+++ b/include/linux/intel-iommu.h
@@ -194,6 +194,7 @@ static inline void dmar_writeq(void __iomem *addr, u64 val)
 /* FSTS_REG */
 #define DMA_FSTS_PPF ((u32)2)
 #define DMA_FSTS_PFO ((u32)1)
+#define DMA_FSTS_IQE (1 << 4)
 #define dma_fsts_fault_record_index(s) (((s) >> 8) & 0xff)
 
 /* FRCD_REG, 32 bits access */
@@ -328,7 +329,7 @@ extern int qi_flush_iotlb(struct intel_iommu *iommu, u16 did, u64 addr,
                           unsigned int size_order, u64 type,
                           int non_present_entry_flush);
 
-extern void qi_submit_sync(struct qi_desc *desc, struct intel_iommu *iommu);
+extern int qi_submit_sync(struct qi_desc *desc, struct intel_iommu *iommu);
 
 extern void *intel_alloc_coherent(struct device *, size_t, dma_addr_t *, gfp_t);
 extern void intel_free_coherent(struct device *, size_t, void *, dma_addr_t);
diff --git a/include/linux/io-mapping.h b/include/linux/io-mapping.h
index 82df31726a54..0adb0f91568c 100644
--- a/include/linux/io-mapping.h
+++ b/include/linux/io-mapping.h
@@ -30,11 +30,14 @@
  * See Documentation/io_mapping.txt
  */
 
-/* this struct isn't actually defined anywhere */
-struct io_mapping;
-
 #ifdef CONFIG_HAVE_ATOMIC_IOMAP
 
+struct io_mapping {
+        resource_size_t base;
+        unsigned long size;
+        pgprot_t prot;
+};
+
 /*
  * For small address space machines, mapping large objects
  * into the kernel virtual space isn't practical. Where
@@ -43,23 +46,40 @@ struct io_mapping;
  */
 
 static inline struct io_mapping *
-io_mapping_create_wc(unsigned long base, unsigned long size)
+io_mapping_create_wc(resource_size_t base, unsigned long size)
 {
-        return (struct io_mapping *) base;
+        struct io_mapping *iomap;
+
+        if (!is_io_mapping_possible(base, size))
+                return NULL;
+
+        iomap = kmalloc(sizeof(*iomap), GFP_KERNEL);
+        if (!iomap)
+                return NULL;
+
+        iomap->base = base;
+        iomap->size = size;
+        iomap->prot = pgprot_writecombine(__pgprot(__PAGE_KERNEL));
+        return iomap;
 }
 
 static inline void
 io_mapping_free(struct io_mapping *mapping)
 {
+        kfree(mapping);
 }
 
 /* Atomic map/unmap */
 static inline void *
 io_mapping_map_atomic_wc(struct io_mapping *mapping, unsigned long offset)
 {
-        offset += (unsigned long) mapping;
-        return iomap_atomic_prot_pfn(offset >> PAGE_SHIFT, KM_USER0,
-                                     __pgprot(__PAGE_KERNEL_WC));
+        resource_size_t phys_addr;
+        unsigned long pfn;
+
+        BUG_ON(offset >= mapping->size);
+        phys_addr = mapping->base + offset;
+        pfn = (unsigned long) (phys_addr >> PAGE_SHIFT);
+        return iomap_atomic_prot_pfn(pfn, KM_USER0, mapping->prot);
 }
 
 static inline void
@@ -71,8 +91,12 @@ io_mapping_unmap_atomic(void *vaddr)
 static inline void *
 io_mapping_map_wc(struct io_mapping *mapping, unsigned long offset)
 {
-        offset += (unsigned long) mapping;
-        return ioremap_wc(offset, PAGE_SIZE);
+        resource_size_t phys_addr;
+
+        BUG_ON(offset >= mapping->size);
+        phys_addr = mapping->base + offset;
+
+        return ioremap_wc(phys_addr, PAGE_SIZE);
 }
 
 static inline void
@@ -83,9 +107,12 @@ io_mapping_unmap(void *vaddr)
 
 #else
 
+/* this struct isn't actually defined anywhere */
+struct io_mapping;
+
 /* Create the io_mapping object*/
 static inline struct io_mapping *
-io_mapping_create_wc(unsigned long base, unsigned long size)
+io_mapping_create_wc(resource_size_t base, unsigned long size)
 {
         return (struct io_mapping *) ioremap_wc(base, size);
 }
diff --git a/include/linux/netfilter/xt_NFLOG.h b/include/linux/netfilter/xt_NFLOG.h
index cdcd0ed58f7a..4b36aeb46a10 100644
--- a/include/linux/netfilter/xt_NFLOG.h
+++ b/include/linux/netfilter/xt_NFLOG.h
@@ -2,7 +2,7 @@
 #define _XT_NFLOG_TARGET
 
 #define XT_NFLOG_DEFAULT_GROUP          0x1
-#define XT_NFLOG_DEFAULT_THRESHOLD      1
+#define XT_NFLOG_DEFAULT_THRESHOLD      0
 
 #define XT_NFLOG_MASK                   0x0
 
diff --git a/include/linux/pci_ids.h b/include/linux/pci_ids.h
index 114b8192eab9..aca8c458aa8a 100644
--- a/include/linux/pci_ids.h
+++ b/include/linux/pci_ids.h
@@ -2323,6 +2323,9 @@
 #define PCI_DEVICE_ID_INTEL_82378       0x0484
 #define PCI_DEVICE_ID_INTEL_I960        0x0960
 #define PCI_DEVICE_ID_INTEL_I960RM      0x0962
+#define PCI_DEVICE_ID_INTEL_8257X_SOL   0x1062
+#define PCI_DEVICE_ID_INTEL_82573E_SOL  0x1085
+#define PCI_DEVICE_ID_INTEL_82573L_SOL  0x108F
 #define PCI_DEVICE_ID_INTEL_82815_MC    0x1130
 #define PCI_DEVICE_ID_INTEL_82815_CGC   0x1132
 #define PCI_DEVICE_ID_INTEL_82092AA_0   0x1221
diff --git a/include/linux/pm.h b/include/linux/pm.h
index de2e0a8f6728..24ba5f67b3a3 100644
--- a/include/linux/pm.h
+++ b/include/linux/pm.h
@@ -381,10 +381,12 @@ struct dev_pm_info {
 
 #ifdef CONFIG_PM_SLEEP
 extern void device_pm_lock(void);
+extern int sysdev_resume(void);
 extern void device_power_up(pm_message_t state);
 extern void device_resume(pm_message_t state);
 
 extern void device_pm_unlock(void);
+extern int sysdev_suspend(pm_message_t state);
 extern int device_power_down(pm_message_t state);
 extern int device_suspend(pm_message_t state);
 extern int device_prepare_suspend(pm_message_t state);
diff --git a/include/linux/serial_core.h b/include/linux/serial_core.h
index 90bbbf0b1161..df9245c7bd3b 100644
--- a/include/linux/serial_core.h
+++ b/include/linux/serial_core.h
@@ -296,6 +296,7 @@ struct uart_port {
 #define UPF_HARDPPS_CD          ((__force upf_t) (1 << 11))
 #define UPF_LOW_LATENCY         ((__force upf_t) (1 << 13))
 #define UPF_BUGGY_UART          ((__force upf_t) (1 << 14))
+#define UPF_NO_TXEN_TEST        ((__force upf_t) (1 << 15))
 #define UPF_MAGIC_MULTIPLIER    ((__force upf_t) (1 << 16))
 #define UPF_CONS_FLOW           ((__force upf_t) (1 << 23))
 #define UPF_SHARE_IRQ           ((__force upf_t) (1 << 24))
diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h
index cf2cb50f77d1..9dcf956ad18a 100644
--- a/include/linux/skbuff.h
+++ b/include/linux/skbuff.h
@@ -416,15 +416,6 @@ extern void	      skb_over_panic(struct sk_buff *skb, int len,
                                      void *here);
 extern void           skb_under_panic(struct sk_buff *skb, int len,
                                       void *here);
-extern void           skb_truesize_bug(struct sk_buff *skb);
-
-static inline void skb_truesize_check(struct sk_buff *skb)
-{
-        int len = sizeof(struct sk_buff) + skb->len;
-
-        if (unlikely((int)skb->truesize < len))
-                skb_truesize_bug(skb);
-}
 
 extern int skb_append_datato_frags(struct sock *sk, struct sk_buff *skb,
                         int getfrag(void *from, char *to, int offset,
diff --git a/include/linux/slab.h b/include/linux/slab.h
index f96d13c281e8..24c5602bee99 100644
--- a/include/linux/slab.h
+++ b/include/linux/slab.h
@@ -127,6 +127,7 @@ int kmem_ptr_validate(struct kmem_cache *cachep, const void *ptr);
 void * __must_check __krealloc(const void *, size_t, gfp_t);
 void * __must_check krealloc(const void *, size_t, gfp_t);
 void kfree(const void *);
+void kzfree(const void *);
 size_t ksize(const void *);
 
 /*
diff --git a/include/linux/spi/spi_bitbang.h b/include/linux/spi/spi_bitbang.h
index bf8de281b4ed..eed4254bd503 100644
--- a/include/linux/spi/spi_bitbang.h
+++ b/include/linux/spi/spi_bitbang.h
@@ -83,6 +83,13 @@ extern int spi_bitbang_stop(struct spi_bitbang *spi);
  *  int getmiso(struct spi_device *);
  *  void spidelay(unsigned);
  *
+ * setsck()'s is_on parameter is a zero/nonzero boolean.
+ *
+ * setmosi()'s is_on parameter is a zero/nonzero boolean.
+ *
+ * getmiso() is required to return 0 or 1 only. Any other value is invalid
+ * and will result in improper operation.
+ *
  * A non-inlined routine would call bitbang_txrx_*() routines.  The
  * main loop could easily compile down to a handful of instructions,
  * especially if the delay is a NOP (to run at peak speed).
diff --git a/include/linux/user_namespace.h b/include/linux/user_namespace.h
index 315bcd375224..cc4f45361dbb 100644
--- a/include/linux/user_namespace.h
+++ b/include/linux/user_namespace.h
@@ -13,6 +13,7 @@ struct user_namespace {
         struct kref             kref;
         struct hlist_head       uidhash_table[UIDHASH_SZ];
         struct user_struct      *creator;
+        struct work_struct      destroyer;
 };
 
 extern struct user_namespace init_user_ns;
diff --git a/include/net/netfilter/nf_conntrack_core.h b/include/net/netfilter/nf_conntrack_core.h
index e78afe7f28e3..c25068e38516 100644
--- a/include/net/netfilter/nf_conntrack_core.h
+++ b/include/net/netfilter/nf_conntrack_core.h
@@ -59,7 +59,7 @@ static inline int nf_conntrack_confirm(struct sk_buff *skb)
         struct nf_conn *ct = (struct nf_conn *)skb->nfct;
         int ret = NF_ACCEPT;
 
-        if (ct) {
+        if (ct && ct != &nf_conntrack_untracked) {
                 if (!nf_ct_is_confirmed(ct) && !nf_ct_is_dying(ct))
                         ret = __nf_conntrack_confirm(skb);
                 nf_ct_deliver_cached_events(ct);
diff --git a/include/net/sock.h b/include/net/sock.h
index ce3b5b622683..eefeeaf7fc46 100644
--- a/include/net/sock.h
+++ b/include/net/sock.h
@@ -860,7 +860,6 @@ static inline void sk_mem_uncharge(struct sock *sk, int size)
 
 static inline void sk_wmem_free_skb(struct sock *sk, struct sk_buff *skb)
 {
-        skb_truesize_check(skb);
         sock_set_flag(sk, SOCK_QUEUE_SHRUNK);
         sk->sk_wmem_queued -= skb->truesize;
         sk_mem_uncharge(sk, skb->truesize);