17 files changed, 187 insertions, 130 deletions

diff --git a/net/core/datagram.c b/net/core/datagram.c
index 18ac112ea7ae..6449bed457d4 100644
--- a/net/core/datagram.c
+++ b/net/core/datagram.c
@@ -332,7 +332,7 @@ int skb_copy_datagram_iovec(const struct sk_buff *skb, int offset,
                         int err;
                         u8  *vaddr;
                         skb_frag_t *frag = &skb_shinfo(skb)->frags[i];
-                        struct page *page = frag->page;
+                        struct page *page = skb_frag_page(frag);
 
                         if (copy > len)
                                 copy = len;
@@ -418,7 +418,7 @@ int skb_copy_datagram_const_iovec(const struct sk_buff *skb, int offset,
                         int err;
                         u8  *vaddr;
                         skb_frag_t *frag = &skb_shinfo(skb)->frags[i];
-                        struct page *page = frag->page;
+                        struct page *page = skb_frag_page(frag);
 
                         if (copy > len)
                                 copy = len;
@@ -508,7 +508,7 @@ int skb_copy_datagram_from_iovec(struct sk_buff *skb, int offset,
                         int err;
                         u8  *vaddr;
                         skb_frag_t *frag = &skb_shinfo(skb)->frags[i];
-                        struct page *page = frag->page;
+                        struct page *page = skb_frag_page(frag);
 
                         if (copy > len)
                                 copy = len;
@@ -594,7 +594,7 @@ static int skb_copy_and_csum_datagram(const struct sk_buff *skb, int offset,
                         int err = 0;
                         u8  *vaddr;
                         skb_frag_t *frag = &skb_shinfo(skb)->frags[i];
-                        struct page *page = frag->page;
+                        struct page *page = skb_frag_page(frag);
 
                         if (copy > len)
                                 copy = len;
diff --git a/net/core/dev.c b/net/core/dev.c
index b10ff0a71855..bf49a47ddfdb 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -133,6 +133,8 @@
 #include <linux/pci.h>
 #include <linux/inetdevice.h>
 #include <linux/cpu_rmap.h>
+#include <linux/if_tunnel.h>
+#include <linux/if_pppox.h>
 
 #include "net-sysfs.h"
 
@@ -1955,9 +1957,11 @@ static int illegal_highdma(struct net_device *dev, struct sk_buff *skb)
 #ifdef CONFIG_HIGHMEM
         int i;
         if (!(dev->features & NETIF_F_HIGHDMA)) {
-                for (i = 0; i < skb_shinfo(skb)->nr_frags; i++)
-                        if (PageHighMem(skb_shinfo(skb)->frags[i].page))
+                for (i = 0; i < skb_shinfo(skb)->nr_frags; i++) {
+                        skb_frag_t *frag = &skb_shinfo(skb)->frags[i];
+                        if (PageHighMem(skb_frag_page(frag)))
                                 return 1;
+                }
         }
 
         if (PCI_DMA_BUS_IS_PHYS) {
@@ -1966,7 +1970,8 @@ static int illegal_highdma(struct net_device *dev, struct sk_buff *skb)
                 if (!pdev)
                         return 0;
                 for (i = 0; i < skb_shinfo(skb)->nr_frags; i++) {
-                        dma_addr_t addr = page_to_phys(skb_shinfo(skb)->frags[i].page);
+                        skb_frag_t *frag = &skb_shinfo(skb)->frags[i];
+                        dma_addr_t addr = page_to_phys(skb_frag_page(frag));
                         if (!pdev->dma_mask || addr + PAGE_SIZE - 1 > *pdev->dma_mask)
                                 return 1;
                 }
@@ -2527,24 +2532,29 @@ static inline void ____napi_schedule(struct softnet_data *sd,
 
 /*
  * __skb_get_rxhash: calculate a flow hash based on src/dst addresses
- * and src/dst port numbers. Returns a non-zero hash number on success
- * and 0 on failure.
+ * and src/dst port numbers.  Sets rxhash in skb to non-zero hash value
+ * on success, zero indicates no valid hash.  Also, sets l4_rxhash in skb
+ * if hash is a canonical 4-tuple hash over transport ports.
  */
-__u32 __skb_get_rxhash(struct sk_buff *skb)
+void __skb_get_rxhash(struct sk_buff *skb)
 {
         int nhoff, hash = 0, poff;
         const struct ipv6hdr *ip6;
         const struct iphdr *ip;
+        const struct vlan_hdr *vlan;
         u8 ip_proto;
-        u32 addr1, addr2, ihl;
+        u32 addr1, addr2;
+        u16 proto;
         union {
                 u32 v32;
                 u16 v16[2];
         } ports;
 
         nhoff = skb_network_offset(skb);
+        proto = skb->protocol;
 
-        switch (skb->protocol) {
+again:
+        switch (proto) {
         case __constant_htons(ETH_P_IP):
                 if (!pskb_may_pull(skb, sizeof(*ip) + nhoff))
                         goto done;
@@ -2556,7 +2566,7 @@ __u32 __skb_get_rxhash(struct sk_buff *skb)
                         ip_proto = ip->protocol;
                 addr1 = (__force u32) ip->saddr;
                 addr2 = (__force u32) ip->daddr;
-                ihl = ip->ihl;
+                nhoff += ip->ihl * 4;
                 break;
         case __constant_htons(ETH_P_IPV6):
                 if (!pskb_may_pull(skb, sizeof(*ip6) + nhoff))
@@ -2566,20 +2576,64 @@ __u32 __skb_get_rxhash(struct sk_buff *skb)
                 ip_proto = ip6->nexthdr;
                 addr1 = (__force u32) ip6->saddr.s6_addr32[3];
                 addr2 = (__force u32) ip6->daddr.s6_addr32[3];
-                ihl = (40 >> 2);
+                nhoff += 40;
                 break;
+        case __constant_htons(ETH_P_8021Q):
+                if (!pskb_may_pull(skb, sizeof(*vlan) + nhoff))
+                        goto done;
+                vlan = (const struct vlan_hdr *) (skb->data + nhoff);
+                proto = vlan->h_vlan_encapsulated_proto;
+                nhoff += sizeof(*vlan);
+                goto again;
+        case __constant_htons(ETH_P_PPP_SES):
+                if (!pskb_may_pull(skb, PPPOE_SES_HLEN + nhoff))
+                        goto done;
+                proto = *((__be16 *) (skb->data + nhoff +
+                                      sizeof(struct pppoe_hdr)));
+                nhoff += PPPOE_SES_HLEN;
+                goto again;
         default:
                 goto done;
         }
 
+        switch (ip_proto) {
+        case IPPROTO_GRE:
+                if (pskb_may_pull(skb, nhoff + 16)) {
+                        u8 *h = skb->data + nhoff;
+                        __be16 flags = *(__be16 *)h;
+
+                        /*
+                         * Only look inside GRE if version zero and no
+                         * routing
+                         */
+                        if (!(flags & (GRE_VERSION|GRE_ROUTING))) {
+                                proto = *(__be16 *)(h + 2);
+                                nhoff += 4;
+                                if (flags & GRE_CSUM)
+                                        nhoff += 4;
+                                if (flags & GRE_KEY)
+                                        nhoff += 4;
+                                if (flags & GRE_SEQ)
+                                        nhoff += 4;
+                                goto again;
+                        }
+                }
+                break;
+        case IPPROTO_IPIP:
+                goto again;
+        default:
+                break;
+        }
+
         ports.v32 = 0;
         poff = proto_ports_offset(ip_proto);
         if (poff >= 0) {
-                nhoff += ihl * 4 + poff;
+                nhoff += poff;
                 if (pskb_may_pull(skb, nhoff + 4)) {
                         ports.v32 = * (__force u32 *) (skb->data + nhoff);
                         if (ports.v16[1] < ports.v16[0])
                                 swap(ports.v16[0], ports.v16[1]);
+                        skb->l4_rxhash = 1;
                 }
         }
 
@@ -2592,7 +2646,7 @@ __u32 __skb_get_rxhash(struct sk_buff *skb)
                 hash = 1;
 
 done:
-        return hash;
+        skb->rxhash = hash;
 }
 EXPORT_SYMBOL(__skb_get_rxhash);
 
@@ -2681,13 +2735,13 @@ static int get_rps_cpu(struct net_device *dev, struct sk_buff *skb,
         map = rcu_dereference(rxqueue->rps_map);
         if (map) {
                 if (map->len == 1 &&
-                    !rcu_dereference_raw(rxqueue->rps_flow_table)) {
+                    !rcu_access_pointer(rxqueue->rps_flow_table)) {
                         tcpu = map->cpus[0];
                         if (cpu_online(tcpu))
                                 cpu = tcpu;
                         goto done;
                 }
-        } else if (!rcu_dereference_raw(rxqueue->rps_flow_table)) {
+        } else if (!rcu_access_pointer(rxqueue->rps_flow_table)) {
                 goto done;
         }
 
@@ -3102,8 +3156,8 @@ void netdev_rx_handler_unregister(struct net_device *dev)
 {
 
         ASSERT_RTNL();
-        rcu_assign_pointer(dev->rx_handler, NULL);
-        rcu_assign_pointer(dev->rx_handler_data, NULL);
+        RCU_INIT_POINTER(dev->rx_handler, NULL);
+        RCU_INIT_POINTER(dev->rx_handler_data, NULL);
 }
 EXPORT_SYMBOL_GPL(netdev_rx_handler_unregister);
 
@@ -3195,10 +3249,9 @@ ncls:
                         ret = deliver_skb(skb, pt_prev, orig_dev);
                         pt_prev = NULL;
                 }
-                if (vlan_do_receive(&skb)) {
-                        ret = __netif_receive_skb(skb);
-                        goto out;
-                } else if (unlikely(!skb))
+                if (vlan_do_receive(&skb))
+                        goto another_round;
+                else if (unlikely(!skb))
                         goto out;
         }
 
@@ -3432,7 +3485,7 @@ pull:
                 skb_shinfo(skb)->frags[0].size -= grow;
 
                 if (unlikely(!skb_shinfo(skb)->frags[0].size)) {
-                        put_page(skb_shinfo(skb)->frags[0].page);
+                        skb_frag_unref(skb, 0);
                         memmove(skb_shinfo(skb)->frags,
                                 skb_shinfo(skb)->frags + 1,
                                 --skb_shinfo(skb)->nr_frags * sizeof(skb_frag_t));
@@ -3496,10 +3549,9 @@ void skb_gro_reset_offset(struct sk_buff *skb)
         NAPI_GRO_CB(skb)->frag0_len = 0;
 
         if (skb->mac_header == skb->tail &&
-            !PageHighMem(skb_shinfo(skb)->frags[0].page)) {
+            !PageHighMem(skb_frag_page(&skb_shinfo(skb)->frags[0]))) {
                 NAPI_GRO_CB(skb)->frag0 =
-                        page_address(skb_shinfo(skb)->frags[0].page) +
-                        skb_shinfo(skb)->frags[0].page_offset;
+                        skb_frag_address(&skb_shinfo(skb)->frags[0]);
                 NAPI_GRO_CB(skb)->frag0_len = skb_shinfo(skb)->frags[0].size;
         }
 }
@@ -4497,9 +4549,7 @@ void __dev_set_rx_mode(struct net_device *dev)
         if (!netif_device_present(dev))
                 return;
 
-        if (ops->ndo_set_rx_mode)
-                ops->ndo_set_rx_mode(dev);
-        else {
+        if (!(dev->priv_flags & IFF_UNICAST_FLT)) {
                 /* Unicast addresses changes may only happen under the rtnl,
                  * therefore calling __dev_set_promiscuity here is safe.
                  */
@@ -4510,10 +4560,10 @@ void __dev_set_rx_mode(struct net_device *dev)
                         __dev_set_promiscuity(dev, -1);
                         dev->uc_promisc = false;
                 }
-
-                if (ops->ndo_set_multicast_list)
-                        ops->ndo_set_multicast_list(dev);
         }
+
+        if (ops->ndo_set_rx_mode)
+                ops->ndo_set_rx_mode(dev);
 }
 
 void dev_set_rx_mode(struct net_device *dev)
@@ -4524,30 +4574,6 @@ void dev_set_rx_mode(struct net_device *dev)
 }
 
 /**
- *      dev_ethtool_get_settings - call device's ethtool_ops::get_settings()
- *      @dev: device
- *      @cmd: memory area for ethtool_ops::get_settings() result
- *
- *      The cmd arg is initialized properly (cleared and
- *      ethtool_cmd::cmd field set to ETHTOOL_GSET).
- *
- *      Return device's ethtool_ops::get_settings() result value or
- *      -EOPNOTSUPP when device doesn't expose
- *      ethtool_ops::get_settings() operation.
- */
-int dev_ethtool_get_settings(struct net_device *dev,
-                             struct ethtool_cmd *cmd)
-{
-        if (!dev->ethtool_ops || !dev->ethtool_ops->get_settings)
-                return -EOPNOTSUPP;
-
-        memset(cmd, 0, sizeof(struct ethtool_cmd));
-        cmd->cmd = ETHTOOL_GSET;
-        return dev->ethtool_ops->get_settings(dev, cmd);
-}
-EXPORT_SYMBOL(dev_ethtool_get_settings);
-
-/**
  *      dev_get_flags - get flags reported to userspace
  *      @dev: device
  *
@@ -4863,7 +4889,7 @@ static int dev_ifsioc(struct net *net, struct ifreq *ifr, unsigned int cmd)
                 return -EOPNOTSUPP;
 
         case SIOCADDMULTI:
-                if ((!ops->ndo_set_multicast_list && !ops->ndo_set_rx_mode) ||
+                if (!ops->ndo_set_rx_mode ||
                     ifr->ifr_hwaddr.sa_family != AF_UNSPEC)
                         return -EINVAL;
                 if (!netif_device_present(dev))
@@ -4871,7 +4897,7 @@ static int dev_ifsioc(struct net *net, struct ifreq *ifr, unsigned int cmd)
                 return dev_mc_add_global(dev, ifr->ifr_hwaddr.sa_data);
 
         case SIOCDELMULTI:
-                if ((!ops->ndo_set_multicast_list && !ops->ndo_set_rx_mode) ||
+                if (!ops->ndo_set_rx_mode ||
                     ifr->ifr_hwaddr.sa_family != AF_UNSPEC)
                         return -EINVAL;
                 if (!netif_device_present(dev))
@@ -5735,8 +5761,8 @@ void netdev_run_todo(void)
 
                 /* paranoia */
                 BUG_ON(netdev_refcnt_read(dev));
-                WARN_ON(rcu_dereference_raw(dev->ip_ptr));
-                WARN_ON(rcu_dereference_raw(dev->ip6_ptr));
+                WARN_ON(rcu_access_pointer(dev->ip_ptr));
+                WARN_ON(rcu_access_pointer(dev->ip6_ptr));
                 WARN_ON(dev->dn_ptr);
 
                 if (dev->destructor)
@@ -5940,7 +5966,7 @@ void free_netdev(struct net_device *dev)
         kfree(dev->_rx);
 #endif
 
-        kfree(rcu_dereference_raw(dev->ingress_queue));
+        kfree(rcu_dereference_protected(dev->ingress_queue, 1));
 
         /* Flush device addresses */
         dev_addr_flush(dev);
diff --git a/net/core/dev_addr_lists.c b/net/core/dev_addr_lists.c
index e2e66939ed00..283d1b863876 100644
--- a/net/core/dev_addr_lists.c
+++ b/net/core/dev_addr_lists.c
@@ -591,8 +591,8 @@ EXPORT_SYMBOL(dev_mc_del_global);
  *      addresses that have no users left. The source device must be
  *      locked by netif_tx_lock_bh.
  *
- *      This function is intended to be called from the dev->set_multicast_list
- *      or dev->set_rx_mode function of layered software devices.
+ *      This function is intended to be called from the ndo_set_rx_mode
+ *      function of layered software devices.
  */
 int dev_mc_sync(struct net_device *to, struct net_device *from)
 {
diff --git a/net/core/dst.c b/net/core/dst.c
index 14b33baf0733..d5e2c4c09107 100644
--- a/net/core/dst.c
+++ b/net/core/dst.c
@@ -171,7 +171,7 @@ void *dst_alloc(struct dst_ops *ops, struct net_device *dev,
         dst_init_metrics(dst, dst_default_metrics, true);
         dst->expires = 0UL;
         dst->path = dst;
-        dst->_neighbour = NULL;
+        RCU_INIT_POINTER(dst->_neighbour, NULL);
 #ifdef CONFIG_XFRM
         dst->xfrm = NULL;
 #endif
@@ -229,11 +229,11 @@ struct dst_entry *dst_destroy(struct dst_entry * dst)
         smp_rmb();
 
 again:
-        neigh = dst->_neighbour;
+        neigh = rcu_dereference_protected(dst->_neighbour, 1);
         child = dst->child;
 
         if (neigh) {
-                dst->_neighbour = NULL;
+                RCU_INIT_POINTER(dst->_neighbour, NULL);
                 neigh_release(neigh);
         }
 
@@ -360,14 +360,19 @@ static void dst_ifdown(struct dst_entry *dst, struct net_device *dev,
         if (!unregister) {
                 dst->input = dst->output = dst_discard;
         } else {
+                struct neighbour *neigh;
+
                 dst->dev = dev_net(dst->dev)->loopback_dev;
                 dev_hold(dst->dev);
                 dev_put(dev);
-                if (dst->_neighbour && dst->_neighbour->dev == dev) {
-                        dst->_neighbour->dev = dst->dev;
+                rcu_read_lock();
+                neigh = dst_get_neighbour(dst);
+                if (neigh && neigh->dev == dev) {
+                        neigh->dev = dst->dev;
                         dev_hold(dst->dev);
                         dev_put(dev);
                 }
+                rcu_read_unlock();
         }
 }
 
diff --git a/net/core/ethtool.c b/net/core/ethtool.c
index 6cdba5fc2bed..f44481707124 100644
--- a/net/core/ethtool.c
+++ b/net/core/ethtool.c
@@ -569,15 +569,25 @@ int __ethtool_set_flags(struct net_device *dev, u32 data)
         return 0;
 }
 
-static int ethtool_get_settings(struct net_device *dev, void __user *useraddr)
+int __ethtool_get_settings(struct net_device *dev, struct ethtool_cmd *cmd)
 {
-        struct ethtool_cmd cmd = { .cmd = ETHTOOL_GSET };
-        int err;
+        ASSERT_RTNL();
 
-        if (!dev->ethtool_ops->get_settings)
+        if (!dev->ethtool_ops || !dev->ethtool_ops->get_settings)
                 return -EOPNOTSUPP;
 
-        err = dev->ethtool_ops->get_settings(dev, &cmd);
+        memset(cmd, 0, sizeof(struct ethtool_cmd));
+        cmd->cmd = ETHTOOL_GSET;
+        return dev->ethtool_ops->get_settings(dev, cmd);
+}
+EXPORT_SYMBOL(__ethtool_get_settings);
+
+static int ethtool_get_settings(struct net_device *dev, void __user *useraddr)
+{
+        int err;
+        struct ethtool_cmd cmd;
+
+        err = __ethtool_get_settings(dev, &cmd);
         if (err < 0)
                 return err;
 
diff --git a/net/core/fib_rules.c b/net/core/fib_rules.c
index 3231b468bb72..38be4744133f 100644
--- a/net/core/fib_rules.c
+++ b/net/core/fib_rules.c
@@ -487,7 +487,7 @@ static int fib_nl_delrule(struct sk_buff *skb, struct nlmsghdr* nlh, void *arg)
                 if (ops->nr_goto_rules > 0) {
                         list_for_each_entry(tmp, &ops->rules_list, list) {
                                 if (rtnl_dereference(tmp->ctarget) == rule) {
-                                        rcu_assign_pointer(tmp->ctarget, NULL);
+                                        RCU_INIT_POINTER(tmp->ctarget, NULL);
                                         ops->unresolved_rules++;
                                 }
                         }
@@ -545,7 +545,7 @@ static int fib_nl_fill_rule(struct sk_buff *skb, struct fib_rule *rule,
         frh->flags = rule->flags;
 
         if (rule->action == FR_ACT_GOTO &&
-            rcu_dereference_raw(rule->ctarget) == NULL)
+            rcu_access_pointer(rule->ctarget) == NULL)
                 frh->flags |= FIB_RULE_UNRESOLVED;
 
         if (rule->iifname[0]) {
diff --git a/net/core/filter.c b/net/core/filter.c
index 36f975fa87cb..8fcc2d776e09 100644
--- a/net/core/filter.c
+++ b/net/core/filter.c
@@ -645,7 +645,7 @@ int sk_detach_filter(struct sock *sk)
         filter = rcu_dereference_protected(sk->sk_filter,
                                            sock_owned_by_user(sk));
         if (filter) {
-                rcu_assign_pointer(sk->sk_filter, NULL);
+                RCU_INIT_POINTER(sk->sk_filter, NULL);
                 sk_filter_uncharge(sk, filter);
                 ret = 0;
         }
diff --git a/net/core/kmap_skb.h b/net/core/kmap_skb.h
index 283c2b993fb8..81e1ed7c8383 100644
--- a/net/core/kmap_skb.h
+++ b/net/core/kmap_skb.h
@@ -7,7 +7,7 @@ static inline void *kmap_skb_frag(const skb_frag_t *frag)
 
         local_bh_disable();
 #endif
-        return kmap_atomic(frag->page, KM_SKB_DATA_SOFTIRQ);
+        return kmap_atomic(skb_frag_page(frag), KM_SKB_DATA_SOFTIRQ);
 }
 
 static inline void kunmap_skb_frag(void *vaddr)
diff --git a/net/core/link_watch.c b/net/core/link_watch.c
index 357bd4ee4baa..c3519c6d1b16 100644
--- a/net/core/link_watch.c
+++ b/net/core/link_watch.c
@@ -78,8 +78,13 @@ static void rfc2863_policy(struct net_device *dev)
 
 static bool linkwatch_urgent_event(struct net_device *dev)
 {
-        return netif_running(dev) && netif_carrier_ok(dev) &&
-                qdisc_tx_changing(dev);
+        if (!netif_running(dev))
+                return false;
+
+        if (dev->ifindex != dev->iflink)
+                return true;
+
+        return netif_carrier_ok(dev) && qdisc_tx_changing(dev);
 }
 
 
diff --git a/net/core/neighbour.c b/net/core/neighbour.c
index 1334d7e56f02..43449649cf73 100644
--- a/net/core/neighbour.c
+++ b/net/core/neighbour.c
@@ -844,6 +844,19 @@ static void neigh_invalidate(struct neighbour *neigh)
         skb_queue_purge(&neigh->arp_queue);
 }
 
+static void neigh_probe(struct neighbour *neigh)
+        __releases(neigh->lock)
+{
+        struct sk_buff *skb = skb_peek(&neigh->arp_queue);
+        /* keep skb alive even if arp_queue overflows */
+        if (skb)
+                skb = skb_copy(skb, GFP_ATOMIC);
+        write_unlock(&neigh->lock);
+        neigh->ops->solicit(neigh, skb);
+        atomic_inc(&neigh->probes);
+        kfree_skb(skb);
+}
+
 /* Called when a timer expires for a neighbour entry. */
 
 static void neigh_timer_handler(unsigned long arg)
@@ -920,14 +933,7 @@ static void neigh_timer_handler(unsigned long arg)
                         neigh_hold(neigh);
         }
         if (neigh->nud_state & (NUD_INCOMPLETE | NUD_PROBE)) {
-                struct sk_buff *skb = skb_peek(&neigh->arp_queue);
-                /* keep skb alive even if arp_queue overflows */
-                if (skb)
-                        skb = skb_copy(skb, GFP_ATOMIC);
-                write_unlock(&neigh->lock);
-                neigh->ops->solicit(neigh, skb);
-                atomic_inc(&neigh->probes);
-                kfree_skb(skb);
+                neigh_probe(neigh);
         } else {
 out:
                 write_unlock(&neigh->lock);
@@ -942,7 +948,7 @@ out:
 int __neigh_event_send(struct neighbour *neigh, struct sk_buff *skb)
 {
         int rc;
-        unsigned long now;
+        bool immediate_probe = false;
 
         write_lock_bh(&neigh->lock);
 
@@ -950,14 +956,16 @@ int __neigh_event_send(struct neighbour *neigh, struct sk_buff *skb)
         if (neigh->nud_state & (NUD_CONNECTED | NUD_DELAY | NUD_PROBE))
                 goto out_unlock_bh;
 
-        now = jiffies;
-
         if (!(neigh->nud_state & (NUD_STALE | NUD_INCOMPLETE))) {
                 if (neigh->parms->mcast_probes + neigh->parms->app_probes) {
+                        unsigned long next, now = jiffies;
+
                         atomic_set(&neigh->probes, neigh->parms->ucast_probes);
                         neigh->nud_state     = NUD_INCOMPLETE;
-                        neigh->updated = jiffies;
-                        neigh_add_timer(neigh, now + 1);
+                        neigh->updated = now;
+                        next = now + max(neigh->parms->retrans_time, HZ/2);
+                        neigh_add_timer(neigh, next);
+                        immediate_probe = true;
                 } else {
                         neigh->nud_state = NUD_FAILED;
                         neigh->updated = jiffies;
@@ -989,7 +997,11 @@ int __neigh_event_send(struct neighbour *neigh, struct sk_buff *skb)
                 rc = 1;
         }
 out_unlock_bh:
-        write_unlock_bh(&neigh->lock);
+        if (immediate_probe)
+                neigh_probe(neigh);
+        else
+                write_unlock(&neigh->lock);
+        local_bh_enable();
         return rc;
 }
 EXPORT_SYMBOL(__neigh_event_send);
diff --git a/net/core/net-sysfs.c b/net/core/net-sysfs.c
index 1683e5db2f27..7604a635376b 100644
--- a/net/core/net-sysfs.c
+++ b/net/core/net-sysfs.c
@@ -147,7 +147,7 @@ static ssize_t show_speed(struct device *dev,
 
         if (netif_running(netdev)) {
                 struct ethtool_cmd cmd;
-                if (!dev_ethtool_get_settings(netdev, &cmd))
+                if (!__ethtool_get_settings(netdev, &cmd))
                         ret = sprintf(buf, fmt_udec, ethtool_cmd_speed(&cmd));
         }
         rtnl_unlock();
@@ -165,7 +165,7 @@ static ssize_t show_duplex(struct device *dev,
 
         if (netif_running(netdev)) {
                 struct ethtool_cmd cmd;
-                if (!dev_ethtool_get_settings(netdev, &cmd))
+                if (!__ethtool_get_settings(netdev, &cmd))
                         ret = sprintf(buf, "%s\n",
                                       cmd.duplex ? "full" : "half");
         }
@@ -712,13 +712,13 @@ static void rx_queue_release(struct kobject *kobj)
         struct rps_dev_flow_table *flow_table;
 
 
-        map = rcu_dereference_raw(queue->rps_map);
+        map = rcu_dereference_protected(queue->rps_map, 1);
         if (map) {
                 RCU_INIT_POINTER(queue->rps_map, NULL);
                 kfree_rcu(map, rcu);
         }
 
-        flow_table = rcu_dereference_raw(queue->rps_flow_table);
+        flow_table = rcu_dereference_protected(queue->rps_flow_table, 1);
         if (flow_table) {
                 RCU_INIT_POINTER(queue->rps_flow_table, NULL);
                 call_rcu(&flow_table->rcu, rps_dev_flow_table_release);
@@ -987,10 +987,10 @@ static ssize_t store_xps_map(struct netdev_queue *queue,
         }
 
         if (nonempty)
-                rcu_assign_pointer(dev->xps_maps, new_dev_maps);
+                RCU_INIT_POINTER(dev->xps_maps, new_dev_maps);
         else {
                 kfree(new_dev_maps);
-                rcu_assign_pointer(dev->xps_maps, NULL);
+                RCU_INIT_POINTER(dev->xps_maps, NULL);
         }
 
         if (dev_maps)
diff --git a/net/core/netpoll.c b/net/core/netpoll.c
index 52622517e0d8..f57d94627a2a 100644
--- a/net/core/netpoll.c
+++ b/net/core/netpoll.c
@@ -762,7 +762,7 @@ int __netpoll_setup(struct netpoll *np)
         }
 
         /* last thing to do is link it to the net device structure */
-        rcu_assign_pointer(ndev->npinfo, npinfo);
+        RCU_INIT_POINTER(ndev->npinfo, npinfo);
 
         return 0;
 
@@ -903,7 +903,7 @@ void __netpoll_cleanup(struct netpoll *np)
                 if (ops->ndo_netpoll_cleanup)
                         ops->ndo_netpoll_cleanup(np->dev);
 
-                rcu_assign_pointer(np->dev->npinfo, NULL);
+                RCU_INIT_POINTER(np->dev->npinfo, NULL);
 
                 /* avoid racing with NAPI reading npinfo */
                 synchronize_rcu_bh();
diff --git a/net/core/pktgen.c b/net/core/pktgen.c
index e35a6fbb8110..796044ac0bf3 100644
--- a/net/core/pktgen.c
+++ b/net/core/pktgen.c
@@ -2602,8 +2602,7 @@ static void pktgen_finalize_skb(struct pktgen_dev *pkt_dev, struct sk_buff *skb,
                                 if (!pkt_dev->page)
                                         break;
                         }
-                        skb_shinfo(skb)->frags[i].page = pkt_dev->page;
-                        get_page(pkt_dev->page);
+                        skb_frag_set_page(skb, i, pkt_dev->page);
                         skb_shinfo(skb)->frags[i].page_offset = 0;
                         /*last fragment, fill rest of data*/
                         if (i == (frags - 1))
diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
index 99d9e953fe39..39f8dd6a2821 100644
--- a/net/core/rtnetlink.c
+++ b/net/core/rtnetlink.c
@@ -1604,7 +1604,6 @@ struct net_device *rtnl_create_link(struct net *src_net, struct net *net,
         dev_net_set(dev, net);
         dev->rtnl_link_ops = ops;
         dev->rtnl_link_state = RTNL_LINK_INITIALIZING;
-        dev->real_num_tx_queues = real_num_queues;
 
         if (tb[IFLA_MTU])
                 dev->mtu = nla_get_u32(tb[IFLA_MTU]);
diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index 387703f56fce..5b2c5f1d4dba 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -326,7 +326,7 @@ static void skb_release_data(struct sk_buff *skb)
                 if (skb_shinfo(skb)->nr_frags) {
                         int i;
                         for (i = 0; i < skb_shinfo(skb)->nr_frags; i++)
-                                put_page(skb_shinfo(skb)->frags[i].page);
+                                skb_frag_unref(skb, i);
                 }
 
                 /*
@@ -529,6 +529,8 @@ static void __copy_skb_header(struct sk_buff *new, const struct sk_buff *old)
         new->mac_header         = old->mac_header;
         skb_dst_copy(new, old);
         new->rxhash             = old->rxhash;
+        new->ooo_okay           = old->ooo_okay;
+        new->l4_rxhash          = old->l4_rxhash;
 #ifdef CONFIG_XFRM
         new->sp                 = secpath_get(old->sp);
 #endif
@@ -820,7 +822,7 @@ struct sk_buff *pskb_copy(struct sk_buff *skb, gfp_t gfp_mask)
                 }
                 for (i = 0; i < skb_shinfo(skb)->nr_frags; i++) {
                         skb_shinfo(n)->frags[i] = skb_shinfo(skb)->frags[i];
-                        get_page(skb_shinfo(n)->frags[i].page);
+                        skb_frag_ref(skb, i);
                 }
                 skb_shinfo(n)->nr_frags = i;
         }
@@ -911,7 +913,7 @@ int pskb_expand_head(struct sk_buff *skb, int nhead, int ntail,
                                 goto nofrags;
                 }
                 for (i = 0; i < skb_shinfo(skb)->nr_frags; i++)
-                        get_page(skb_shinfo(skb)->frags[i].page);
+                        skb_frag_ref(skb, i);
 
                 if (skb_has_frag_list(skb))
                         skb_clone_fraglist(skb);
@@ -1191,7 +1193,7 @@ drop_pages:
                 skb_shinfo(skb)->nr_frags = i;
 
                 for (; i < nfrags; i++)
-                        put_page(skb_shinfo(skb)->frags[i].page);
+                        skb_frag_unref(skb, i);
 
                 if (skb_has_frag_list(skb))
                         skb_drop_fraglist(skb);
@@ -1360,7 +1362,7 @@ pull_pages:
         k = 0;
         for (i = 0; i < skb_shinfo(skb)->nr_frags; i++) {
                 if (skb_shinfo(skb)->frags[i].size <= eat) {
-                        put_page(skb_shinfo(skb)->frags[i].page);
+                        skb_frag_unref(skb, i);
                         eat -= skb_shinfo(skb)->frags[i].size;
                 } else {
                         skb_shinfo(skb)->frags[k] = skb_shinfo(skb)->frags[i];
@@ -1619,7 +1621,8 @@ static int __skb_splice_bits(struct sk_buff *skb, struct pipe_inode_info *pipe,
         for (seg = 0; seg < skb_shinfo(skb)->nr_frags; seg++) {
                 const skb_frag_t *f = &skb_shinfo(skb)->frags[seg];
 
-                if (__splice_segment(f->page, f->page_offset, f->size,
+                if (__splice_segment(skb_frag_page(f),
+                                     f->page_offset, f->size,
                                      offset, len, skb, spd, 0, sk, pipe))
                         return 1;
         }
@@ -2164,7 +2167,7 @@ static inline void skb_split_no_header(struct sk_buff *skb,
                                  *    where splitting is expensive.
                                  * 2. Split is accurately. We make this.
                                  */
-                                get_page(skb_shinfo(skb)->frags[i].page);
+                                skb_frag_ref(skb, i);
                                 skb_shinfo(skb1)->frags[0].page_offset += len - pos;
                                 skb_shinfo(skb1)->frags[0].size -= len - pos;
                                 skb_shinfo(skb)->frags[i].size  = len - pos;
@@ -2239,7 +2242,8 @@ int skb_shift(struct sk_buff *tgt, struct sk_buff *skb, int shiftlen)
          * commit all, so that we don't have to undo partial changes
          */
         if (!to ||
-            !skb_can_coalesce(tgt, to, fragfrom->page, fragfrom->page_offset)) {
+            !skb_can_coalesce(tgt, to, skb_frag_page(fragfrom),
+                              fragfrom->page_offset)) {
                 merge = -1;
         } else {
                 merge = to - 1;
@@ -2286,7 +2290,7 @@ int skb_shift(struct sk_buff *tgt, struct sk_buff *skb, int shiftlen)
                         to++;
 
                 } else {
-                        get_page(fragfrom->page);
+                        __skb_frag_ref(fragfrom);
                         fragto->page = fragfrom->page;
                         fragto->page_offset = fragfrom->page_offset;
                         fragto->size = todo;
@@ -2308,7 +2312,7 @@ int skb_shift(struct sk_buff *tgt, struct sk_buff *skb, int shiftlen)
                 fragto = &skb_shinfo(tgt)->frags[merge];
 
                 fragto->size += fragfrom->size;
-                put_page(fragfrom->page);
+                __skb_frag_unref(fragfrom);
         }
 
         /* Reposition in the original skb */
@@ -2553,8 +2557,7 @@ int skb_append_datato_frags(struct sock *sk, struct sk_buff *skb,
                 left = PAGE_SIZE - frag->page_offset;
                 copy = (length > left)? left : length;
 
-                ret = getfrag(from, (page_address(frag->page) +
-                            frag->page_offset + frag->size),
+                ret = getfrag(from, skb_frag_address(frag) + frag->size,
                             offset, copy, 0, skb);
                 if (ret < 0)
                         return -EFAULT;
@@ -2706,7 +2709,7 @@ struct sk_buff *skb_segment(struct sk_buff *skb, u32 features)
 
                 while (pos < offset + len && i < nfrags) {
                         *frag = skb_shinfo(skb)->frags[i];
-                        get_page(frag->page);
+                        __skb_frag_ref(frag);
                         size = frag->size;
 
                         if (pos < offset) {
@@ -2929,7 +2932,7 @@ __skb_to_sgvec(struct sk_buff *skb, struct scatterlist *sg, int offset, int len)
 
                         if (copy > len)
                                 copy = len;
-                        sg_set_page(&sg[elt], frag->page, copy,
+                        sg_set_page(&sg[elt], skb_frag_page(frag), copy,
                                         frag->page_offset+offset-start);
                         elt++;
                         if (!(len -= copy))
diff --git a/net/core/sock.c b/net/core/sock.c
index bc745d00ea4d..b29ab61b029c 100644
--- a/net/core/sock.c
+++ b/net/core/sock.c
@@ -387,7 +387,7 @@ struct dst_entry *__sk_dst_check(struct sock *sk, u32 cookie)
 
         if (dst && dst->obsolete && dst->ops->check(dst, cookie) == NULL) {
                 sk_tx_queue_clear(sk);
-                rcu_assign_pointer(sk->sk_dst_cache, NULL);
+                RCU_INIT_POINTER(sk->sk_dst_cache, NULL);
                 dst_release(dst);
                 return NULL;
         }
@@ -1158,7 +1158,7 @@ static void __sk_free(struct sock *sk)
                                        atomic_read(&sk->sk_wmem_alloc) == 0);
         if (filter) {
                 sk_filter_uncharge(sk, filter);
-                rcu_assign_pointer(sk->sk_filter, NULL);
+                RCU_INIT_POINTER(sk->sk_filter, NULL);
         }
 
         sock_disable_timestamp(sk, SOCK_TIMESTAMP);
@@ -1533,7 +1533,6 @@ struct sk_buff *sock_alloc_send_pskb(struct sock *sk, unsigned long header_len,
                                 skb_shinfo(skb)->nr_frags = npages;
                                 for (i = 0; i < npages; i++) {
                                         struct page *page;
-                                        skb_frag_t *frag;
 
                                         page = alloc_pages(sk->sk_allocation, 0);
                                         if (!page) {
@@ -1543,12 +1542,11 @@ struct sk_buff *sock_alloc_send_pskb(struct sock *sk, unsigned long header_len,
                                                 goto failure;
                                         }
 
-                                        frag = &skb_shinfo(skb)->frags[i];
-                                        frag->page = page;
-                                        frag->page_offset = 0;
-                                        frag->size = (data_len >= PAGE_SIZE ?
-                                                      PAGE_SIZE :
-                                                      data_len);
+                                        __skb_fill_page_desc(skb, i,
+                                                        page, 0,
+                                                        (data_len >= PAGE_SIZE ?
+                                                         PAGE_SIZE :
+                                                         data_len));
                                         data_len -= PAGE_SIZE;
                                 }
 
diff --git a/net/core/user_dma.c b/net/core/user_dma.c
index 25d717ebc92e..34e9664cae3b 100644
--- a/net/core/user_dma.c
+++ b/net/core/user_dma.c
@@ -78,7 +78,7 @@ int dma_skb_copy_datagram_iovec(struct dma_chan *chan,
                 copy = end - offset;
                 if (copy > 0) {
                         skb_frag_t *frag = &skb_shinfo(skb)->frags[i];
-                        struct page *page = frag->page;
+                        struct page *page = skb_frag_page(frag);
 
                         if (copy > len)
                                 copy = len;