7 files changed, 114 insertions, 106 deletions

diff --git a/net/ipv4/syncookies.c b/net/ipv4/syncookies.c
index e923d2f021aa..dd47e6da6fb3 100644
--- a/net/ipv4/syncookies.c
+++ b/net/ipv4/syncookies.c
@@ -190,6 +190,8 @@ static inline struct sock *get_cookie_sock(struct sock *sk, struct sk_buff *skb,
 struct sock *cookie_v4_check(struct sock *sk, struct sk_buff *skb,
                              struct ip_options *opt)
 {
+        struct inet_request_sock *ireq;
+        struct tcp_request_sock *treq;
         struct tcp_sock *tp = tcp_sk(sk);
         __u32 cookie = ntohl(skb->h.th->ack_seq) - 1; 
         struct sock *ret = sk;
@@ -209,19 +211,20 @@ struct sock *cookie_v4_check(struct sock *sk, struct sk_buff *skb,
 
         NET_INC_STATS_BH(LINUX_MIB_SYNCOOKIESRECV);
 
-        req = tcp_openreq_alloc();
         ret = NULL;
+        req = tcp_openreq_alloc(&or_ipv4); /* for safety */
         if (!req)
                 goto out;
 
-        req->rcv_isn            = htonl(skb->h.th->seq) - 1;
-        req->snt_isn            = cookie; 
+        ireq = inet_rsk(req);
+        treq = tcp_rsk(req);
+        treq->rcv_isn           = htonl(skb->h.th->seq) - 1;
+        treq->snt_isn           = cookie; 
         req->mss                = mss;
-        req->rmt_port           = skb->h.th->source;
-        req->af.v4_req.loc_addr = skb->nh.iph->daddr;
-        req->af.v4_req.rmt_addr = skb->nh.iph->saddr;
-        req->class              = &or_ipv4; /* for savety */
-        req->af.v4_req.opt      = NULL;
+        ireq->rmt_port          = skb->h.th->source;
+        ireq->loc_addr          = skb->nh.iph->daddr;
+        ireq->rmt_addr          = skb->nh.iph->saddr;
+        ireq->opt               = NULL;
 
         /* We throwed the options of the initial SYN away, so we hope
          * the ACK carries the same options again (see RFC1122 4.2.3.8)
@@ -229,17 +232,15 @@ struct sock *cookie_v4_check(struct sock *sk, struct sk_buff *skb,
         if (opt && opt->optlen) {
                 int opt_size = sizeof(struct ip_options) + opt->optlen;
 
-                req->af.v4_req.opt = kmalloc(opt_size, GFP_ATOMIC);
-                if (req->af.v4_req.opt) {
-                        if (ip_options_echo(req->af.v4_req.opt, skb)) {
-                                kfree(req->af.v4_req.opt);
-                                req->af.v4_req.opt = NULL;
-                        }
+                ireq->opt = kmalloc(opt_size, GFP_ATOMIC);
+                if (ireq->opt != NULL && ip_options_echo(ireq->opt, skb)) {
+                        kfree(ireq->opt);
+                        ireq->opt = NULL;
                 }
         }
 
-        req->snd_wscale = req->rcv_wscale = req->tstamp_ok = 0;
-        req->wscale_ok  = req->sack_ok = 0; 
+        ireq->snd_wscale = ireq->rcv_wscale = ireq->tstamp_ok = 0;
+        ireq->wscale_ok  = ireq->sack_ok = 0; 
         req->expires    = 0UL; 
         req->retrans    = 0; 
         
@@ -253,8 +254,8 @@ struct sock *cookie_v4_check(struct sock *sk, struct sk_buff *skb,
                 struct flowi fl = { .nl_u = { .ip4_u =
                                               { .daddr = ((opt && opt->srr) ?
                                                           opt->faddr :
-                                                          req->af.v4_req.rmt_addr),
-                                                .saddr = req->af.v4_req.loc_addr,
+                                                          ireq->rmt_addr),
+                                                .saddr = ireq->loc_addr,
                                                 .tos = RT_CONN_FLAGS(sk) } },
                                     .proto = IPPROTO_TCP,
                                     .uli_u = { .ports =
@@ -272,7 +273,7 @@ struct sock *cookie_v4_check(struct sock *sk, struct sk_buff *skb,
                                   &req->rcv_wnd, &req->window_clamp, 
                                   0, &rcv_wscale);
         /* BTW win scale with syncookies is 0 by definition */
-        req->rcv_wscale   = rcv_wscale; 
+        ireq->rcv_wscale  = rcv_wscale; 
 
         ret = get_cookie_sock(sk, skb, req, &rt->u.dst);
 out:    return ret;
diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
index 0d9a4fd5f1a4..a3cabfa2022a 100644
--- a/net/ipv4/tcp.c
+++ b/net/ipv4/tcp.c
@@ -271,7 +271,6 @@ int sysctl_tcp_fin_timeout = TCP_FIN_TIMEOUT;
 
 DEFINE_SNMP_STAT(struct tcp_mib, tcp_statistics);
 
-kmem_cache_t *tcp_openreq_cachep;
 kmem_cache_t *tcp_bucket_cachep;
 kmem_cache_t *tcp_timewait_cachep;
 
@@ -2271,13 +2270,6 @@ void __init tcp_init(void)
                 __skb_cb_too_small_for_tcp(sizeof(struct tcp_skb_cb),
                                            sizeof(skb->cb));
 
-        tcp_openreq_cachep = kmem_cache_create("tcp_open_request",
-                                                   sizeof(struct open_request),
-                                               0, SLAB_HWCACHE_ALIGN,
-                                               NULL, NULL);
-        if (!tcp_openreq_cachep)
-                panic("tcp_init: Cannot alloc open_request cache.");
-
         tcp_bucket_cachep = kmem_cache_create("tcp_bind_bucket",
                                               sizeof(struct tcp_bind_bucket),
                                               0, SLAB_HWCACHE_ALIGN,
@@ -2374,7 +2366,6 @@ EXPORT_SYMBOL(tcp_destroy_sock);
 EXPORT_SYMBOL(tcp_disconnect);
 EXPORT_SYMBOL(tcp_getsockopt);
 EXPORT_SYMBOL(tcp_ioctl);
-EXPORT_SYMBOL(tcp_openreq_cachep);
 EXPORT_SYMBOL(tcp_poll);
 EXPORT_SYMBOL(tcp_read_sock);
 EXPORT_SYMBOL(tcp_recvmsg);
diff --git a/net/ipv4/tcp_diag.c b/net/ipv4/tcp_diag.c
index 8faa8948f75c..700ff2413588 100644
--- a/net/ipv4/tcp_diag.c
+++ b/net/ipv4/tcp_diag.c
@@ -458,6 +458,7 @@ static int tcpdiag_fill_req(struct sk_buff *skb, struct sock *sk,
                             struct open_request *req,
                             u32 pid, u32 seq)
 {
+        const struct inet_request_sock *ireq = inet_rsk(req);
         struct inet_sock *inet = inet_sk(sk);
         unsigned char *b = skb->tail;
         struct tcpdiagmsg *r;
@@ -482,9 +483,9 @@ static int tcpdiag_fill_req(struct sk_buff *skb, struct sock *sk,
                 tmo = 0;
 
         r->id.tcpdiag_sport = inet->sport;
-        r->id.tcpdiag_dport = req->rmt_port;
-        r->id.tcpdiag_src[0] = req->af.v4_req.loc_addr;
-        r->id.tcpdiag_dst[0] = req->af.v4_req.rmt_addr;
+        r->id.tcpdiag_dport = ireq->rmt_port;
+        r->id.tcpdiag_src[0] = ireq->loc_addr;
+        r->id.tcpdiag_dst[0] = ireq->rmt_addr;
         r->tcpdiag_expires = jiffies_to_msecs(tmo),
         r->tcpdiag_rqueue = 0;
         r->tcpdiag_wqueue = 0;
@@ -493,9 +494,9 @@ static int tcpdiag_fill_req(struct sk_buff *skb, struct sock *sk,
 #ifdef CONFIG_IP_TCPDIAG_IPV6
         if (r->tcpdiag_family == AF_INET6) {
                 ipv6_addr_copy((struct in6_addr *)r->id.tcpdiag_src,
-                               &req->af.v6_req.loc_addr);
+                               &tcp6_rsk(req)->loc_addr);
                 ipv6_addr_copy((struct in6_addr *)r->id.tcpdiag_dst,
-                               &req->af.v6_req.rmt_addr);
+                               &tcp6_rsk(req)->rmt_addr);
         }
 #endif
         nlh->nlmsg_len = skb->tail - b;
@@ -545,9 +546,11 @@ static int tcpdiag_dump_reqs(struct sk_buff *skb, struct sock *sk,
 
                 reqnum = 0;
                 for (req = head; req; reqnum++, req = req->dl_next) {
+                        struct inet_request_sock *ireq = inet_rsk(req);
+
                         if (reqnum < s_reqnum)
                                 continue;
-                        if (r->id.tcpdiag_dport != req->rmt_port &&
+                        if (r->id.tcpdiag_dport != ireq->rmt_port &&
                             r->id.tcpdiag_dport)
                                 continue;
 
@@ -555,16 +558,16 @@ static int tcpdiag_dump_reqs(struct sk_buff *skb, struct sock *sk,
                                 entry.saddr =
 #ifdef CONFIG_IP_TCPDIAG_IPV6
                                         (entry.family == AF_INET6) ?
-                                        req->af.v6_req.loc_addr.s6_addr32 :
+                                        tcp6_rsk(req)->loc_addr.s6_addr32 :
 #endif
-                                        &req->af.v4_req.loc_addr;
+                                        &ireq->loc_addr;
                                 entry.daddr = 
 #ifdef CONFIG_IP_TCPDIAG_IPV6
                                         (entry.family == AF_INET6) ?
-                                        req->af.v6_req.rmt_addr.s6_addr32 :
+                                        tcp6_rsk(req)->rmt_addr.s6_addr32 :
 #endif
-                                        &req->af.v4_req.rmt_addr;
-                                entry.dport = ntohs(req->rmt_port);
+                                        &ireq->rmt_addr;
+                                entry.dport = ntohs(ireq->rmt_port);
 
                                 if (!tcpdiag_bc_run(RTA_DATA(bc),
                                                     RTA_PAYLOAD(bc), &entry))
diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
index dad98e4a5043..e156be90df14 100644
--- a/net/ipv4/tcp_ipv4.c
+++ b/net/ipv4/tcp_ipv4.c
@@ -880,9 +880,11 @@ static struct open_request *tcp_v4_search_req(struct tcp_sock *tp,
         for (prev = &lopt->syn_table[tcp_v4_synq_hash(raddr, rport, lopt->hash_rnd)];
              (req = *prev) != NULL;
              prev = &req->dl_next) {
-                if (req->rmt_port == rport &&
-                    req->af.v4_req.rmt_addr == raddr &&
-                    req->af.v4_req.loc_addr == laddr &&
+                const struct inet_request_sock *ireq = inet_rsk(req);
+
+                if (ireq->rmt_port == rport &&
+                    ireq->rmt_addr == raddr &&
+                    ireq->loc_addr == laddr &&
                     TCP_INET_FAMILY(req->class->family)) {
                         BUG_TRAP(!req->sk);
                         *prevp = prev;
@@ -897,7 +899,7 @@ static void tcp_v4_synq_add(struct sock *sk, struct open_request *req)
 {
         struct tcp_sock *tp = tcp_sk(sk);
         struct tcp_listen_opt *lopt = tp->listen_opt;
-        u32 h = tcp_v4_synq_hash(req->af.v4_req.rmt_addr, req->rmt_port, lopt->hash_rnd);
+        u32 h = tcp_v4_synq_hash(inet_rsk(req)->rmt_addr, inet_rsk(req)->rmt_port, lopt->hash_rnd);
 
         req->expires = jiffies + TCP_TIMEOUT_INIT;
         req->retrans = 0;
@@ -1065,7 +1067,7 @@ void tcp_v4_err(struct sk_buff *skb, u32 info)
                  */
                 BUG_TRAP(!req->sk);
 
-                if (seq != req->snt_isn) {
+                if (seq != tcp_rsk(req)->snt_isn) {
                         NET_INC_STATS_BH(LINUX_MIB_OUTOFWINDOWICMPS);
                         goto out;
                 }
@@ -1256,7 +1258,7 @@ static void tcp_v4_timewait_ack(struct sock *sk, struct sk_buff *skb)
 
 static void tcp_v4_or_send_ack(struct sk_buff *skb, struct open_request *req)
 {
-        tcp_v4_send_ack(skb, req->snt_isn + 1, req->rcv_isn + 1, req->rcv_wnd,
+        tcp_v4_send_ack(skb, tcp_rsk(req)->snt_isn + 1, tcp_rsk(req)->rcv_isn + 1, req->rcv_wnd,
                         req->ts_recent);
 }
 
@@ -1264,18 +1266,19 @@ static struct dst_entry* tcp_v4_route_req(struct sock *sk,
                                           struct open_request *req)
 {
         struct rtable *rt;
-        struct ip_options *opt = req->af.v4_req.opt;
+        const struct inet_request_sock *ireq = inet_rsk(req);
+        struct ip_options *opt = inet_rsk(req)->opt;
         struct flowi fl = { .oif = sk->sk_bound_dev_if,
                             .nl_u = { .ip4_u =
                                       { .daddr = ((opt && opt->srr) ?
                                                   opt->faddr :
-                                                  req->af.v4_req.rmt_addr),
-                                        .saddr = req->af.v4_req.loc_addr,
+                                                  ireq->rmt_addr),
+                                        .saddr = ireq->loc_addr,
                                         .tos = RT_CONN_FLAGS(sk) } },
                             .proto = IPPROTO_TCP,
                             .uli_u = { .ports =
                                        { .sport = inet_sk(sk)->sport,
-                                         .dport = req->rmt_port } } };
+                                         .dport = ireq->rmt_port } } };
 
         if (ip_route_output_flow(&rt, &fl, sk, 0)) {
                 IP_INC_STATS_BH(IPSTATS_MIB_OUTNOROUTES);
@@ -1297,6 +1300,7 @@ static struct dst_entry* tcp_v4_route_req(struct sock *sk,
 static int tcp_v4_send_synack(struct sock *sk, struct open_request *req,
                               struct dst_entry *dst)
 {
+        const struct inet_request_sock *ireq = inet_rsk(req);
         int err = -1;
         struct sk_buff * skb;
 
@@ -1310,14 +1314,14 @@ static int tcp_v4_send_synack(struct sock *sk, struct open_request *req,
                 struct tcphdr *th = skb->h.th;
 
                 th->check = tcp_v4_check(th, skb->len,
-                                         req->af.v4_req.loc_addr,
-                                         req->af.v4_req.rmt_addr,
+                                         ireq->loc_addr,
+                                         ireq->rmt_addr,
                                          csum_partial((char *)th, skb->len,
                                                       skb->csum));
 
-                err = ip_build_and_send_pkt(skb, sk, req->af.v4_req.loc_addr,
-                                            req->af.v4_req.rmt_addr,
-                                            req->af.v4_req.opt);
+                err = ip_build_and_send_pkt(skb, sk, ireq->loc_addr,
+                                            ireq->rmt_addr,
+                                            ireq->opt);
                 if (err == NET_XMIT_CN)
                         err = 0;
         }
@@ -1332,8 +1336,8 @@ out:
  */
 static void tcp_v4_or_free(struct open_request *req)
 {
-        if (req->af.v4_req.opt)
-                kfree(req->af.v4_req.opt);
+        if (inet_rsk(req)->opt)
+                kfree(inet_rsk(req)->opt);
 }
 
 static inline void syn_flood_warning(struct sk_buff *skb)
@@ -1387,6 +1391,7 @@ int sysctl_max_syn_backlog = 256;
 
 struct or_calltable or_ipv4 = {
         .family         =       PF_INET,
+        .obj_size       =       sizeof(struct tcp_request_sock),
         .rtx_syn_ack    =       tcp_v4_send_synack,
         .send_ack       =       tcp_v4_or_send_ack,
         .destructor     =       tcp_v4_or_free,
@@ -1395,6 +1400,7 @@ struct or_calltable or_ipv4 = {
 
 int tcp_v4_conn_request(struct sock *sk, struct sk_buff *skb)
 {
+        struct inet_request_sock *ireq;
         struct tcp_options_received tmp_opt;
         struct open_request *req;
         __u32 saddr = skb->nh.iph->saddr;
@@ -1433,7 +1439,7 @@ int tcp_v4_conn_request(struct sock *sk, struct sk_buff *skb)
         if (sk_acceptq_is_full(sk) && tcp_synq_young(sk) > 1)
                 goto drop;
 
-        req = tcp_openreq_alloc();
+        req = tcp_openreq_alloc(&or_ipv4);
         if (!req)
                 goto drop;
 
@@ -1461,10 +1467,10 @@ int tcp_v4_conn_request(struct sock *sk, struct sk_buff *skb)
 
         tcp_openreq_init(req, &tmp_opt, skb);
 
-        req->af.v4_req.loc_addr = daddr;
-        req->af.v4_req.rmt_addr = saddr;
-        req->af.v4_req.opt = tcp_v4_save_options(sk, skb);
-        req->class = &or_ipv4;
+        ireq = inet_rsk(req);
+        ireq->loc_addr = daddr;
+        ireq->rmt_addr = saddr;
+        ireq->opt = tcp_v4_save_options(sk, skb);
         if (!want_cookie)
                 TCP_ECN_create_request(req, skb->h.th);
 
@@ -1523,7 +1529,7 @@ int tcp_v4_conn_request(struct sock *sk, struct sk_buff *skb)
 
                 isn = tcp_v4_init_sequence(sk, skb);
         }
-        req->snt_isn = isn;
+        tcp_rsk(req)->snt_isn = isn;
 
         if (tcp_v4_send_synack(sk, req, dst))
                 goto drop_and_free;
@@ -1551,6 +1557,7 @@ struct sock *tcp_v4_syn_recv_sock(struct sock *sk, struct sk_buff *skb,
                                   struct open_request *req,
                                   struct dst_entry *dst)
 {
+        struct inet_request_sock *ireq;
         struct inet_sock *newinet;
         struct tcp_sock *newtp;
         struct sock *newsk;
@@ -1570,11 +1577,12 @@ struct sock *tcp_v4_syn_recv_sock(struct sock *sk, struct sk_buff *skb,
 
         newtp                 = tcp_sk(newsk);
         newinet               = inet_sk(newsk);
-        newinet->daddr        = req->af.v4_req.rmt_addr;
-        newinet->rcv_saddr    = req->af.v4_req.loc_addr;
-        newinet->saddr        = req->af.v4_req.loc_addr;
-        newinet->opt          = req->af.v4_req.opt;
-        req->af.v4_req.opt    = NULL;
+        ireq                  = inet_rsk(req);
+        newinet->daddr        = ireq->rmt_addr;
+        newinet->rcv_saddr    = ireq->loc_addr;
+        newinet->saddr        = ireq->loc_addr;
+        newinet->opt          = ireq->opt;
+        ireq->opt             = NULL;
         newinet->mc_index     = tcp_v4_iif(skb);
         newinet->mc_ttl       = skb->nh.iph->ttl;
         newtp->ext_header_len = 0;
@@ -2454,15 +2462,16 @@ void tcp_proc_unregister(struct tcp_seq_afinfo *afinfo)
 static void get_openreq4(struct sock *sk, struct open_request *req,
                          char *tmpbuf, int i, int uid)
 {
+        const struct inet_request_sock *ireq = inet_rsk(req);
         int ttd = req->expires - jiffies;
 
         sprintf(tmpbuf, "%4d: %08X:%04X %08X:%04X"
                 " %02X %08X:%08X %02X:%08lX %08X %5d %8d %u %d %p",
                 i,
-                req->af.v4_req.loc_addr,
+                ireq->loc_addr,
                 ntohs(inet_sk(sk)->sport),
-                req->af.v4_req.rmt_addr,
-                ntohs(req->rmt_port),
+                ireq->rmt_addr,
+                ntohs(ireq->rmt_port),
                 TCP_SYN_RECV,
                 0, 0, /* could print option size, but that is af dependent. */
                 1,    /* timers active (only the expire timer) */
@@ -2618,6 +2627,7 @@ struct proto tcp_prot = {
         .sysctl_rmem            = sysctl_tcp_rmem,
         .max_header             = MAX_TCP_HEADER,
         .obj_size               = sizeof(struct tcp_sock),
+        .rsk_prot               = &or_ipv4,
 };
 
 
diff --git a/net/ipv4/tcp_minisocks.c b/net/ipv4/tcp_minisocks.c
index eea1a17a9ac2..1037401c7cc8 100644
--- a/net/ipv4/tcp_minisocks.c
+++ b/net/ipv4/tcp_minisocks.c
@@ -692,6 +692,8 @@ struct sock *tcp_create_openreq_child(struct sock *sk, struct open_request *req,
         struct sock *newsk = sk_alloc(PF_INET, GFP_ATOMIC, sk->sk_prot, 0);
 
         if(newsk != NULL) {
+                struct inet_request_sock *ireq = inet_rsk(req);
+                struct tcp_request_sock *treq = tcp_rsk(req);
                 struct tcp_sock *newtp;
                 struct sk_filter *filter;
 
@@ -703,7 +705,7 @@ struct sock *tcp_create_openreq_child(struct sock *sk, struct open_request *req,
                 tcp_sk(newsk)->bind_hash = NULL;
 
                 /* Clone the TCP header template */
-                inet_sk(newsk)->dport = req->rmt_port;
+                inet_sk(newsk)->dport = ireq->rmt_port;
 
                 sock_lock_init(newsk);
                 bh_lock_sock(newsk);
@@ -739,14 +741,14 @@ struct sock *tcp_create_openreq_child(struct sock *sk, struct open_request *req,
                 /* Now setup tcp_sock */
                 newtp = tcp_sk(newsk);
                 newtp->pred_flags = 0;
-                newtp->rcv_nxt = req->rcv_isn + 1;
-                newtp->snd_nxt = req->snt_isn + 1;
-                newtp->snd_una = req->snt_isn + 1;
-                newtp->snd_sml = req->snt_isn + 1;
+                newtp->rcv_nxt = treq->rcv_isn + 1;
+                newtp->snd_nxt = treq->snt_isn + 1;
+                newtp->snd_una = treq->snt_isn + 1;
+                newtp->snd_sml = treq->snt_isn + 1;
 
                 tcp_prequeue_init(newtp);
 
-                tcp_init_wl(newtp, req->snt_isn, req->rcv_isn);
+                tcp_init_wl(newtp, treq->snt_isn, treq->rcv_isn);
 
                 newtp->retransmits = 0;
                 newtp->backoff = 0;
@@ -775,10 +777,10 @@ struct sock *tcp_create_openreq_child(struct sock *sk, struct open_request *req,
                 tcp_set_ca_state(newtp, TCP_CA_Open);
                 tcp_init_xmit_timers(newsk);
                 skb_queue_head_init(&newtp->out_of_order_queue);
-                newtp->rcv_wup = req->rcv_isn + 1;
-                newtp->write_seq = req->snt_isn + 1;
+                newtp->rcv_wup = treq->rcv_isn + 1;
+                newtp->write_seq = treq->snt_isn + 1;
                 newtp->pushed_seq = newtp->write_seq;
-                newtp->copied_seq = req->rcv_isn + 1;
+                newtp->copied_seq = treq->rcv_isn + 1;
 
                 newtp->rx_opt.saw_tstamp = 0;
 
@@ -808,18 +810,18 @@ struct sock *tcp_create_openreq_child(struct sock *sk, struct open_request *req,
                 newsk->sk_socket = NULL;
                 newsk->sk_sleep = NULL;
 
-                newtp->rx_opt.tstamp_ok = req->tstamp_ok;
-                if((newtp->rx_opt.sack_ok = req->sack_ok) != 0) {
+                newtp->rx_opt.tstamp_ok = ireq->tstamp_ok;
+                if((newtp->rx_opt.sack_ok = ireq->sack_ok) != 0) {
                         if (sysctl_tcp_fack)
                                 newtp->rx_opt.sack_ok |= 2;
                 }
                 newtp->window_clamp = req->window_clamp;
                 newtp->rcv_ssthresh = req->rcv_wnd;
                 newtp->rcv_wnd = req->rcv_wnd;
-                newtp->rx_opt.wscale_ok = req->wscale_ok;
+                newtp->rx_opt.wscale_ok = ireq->wscale_ok;
                 if (newtp->rx_opt.wscale_ok) {
-                        newtp->rx_opt.snd_wscale = req->snd_wscale;
-                        newtp->rx_opt.rcv_wscale = req->rcv_wscale;
+                        newtp->rx_opt.snd_wscale = ireq->snd_wscale;
+                        newtp->rx_opt.rcv_wscale = ireq->rcv_wscale;
                 } else {
                         newtp->rx_opt.snd_wscale = newtp->rx_opt.rcv_wscale = 0;
                         newtp->window_clamp = min(newtp->window_clamp, 65535U);
@@ -881,7 +883,7 @@ struct sock *tcp_check_req(struct sock *sk,struct sk_buff *skb,
         }
 
         /* Check for pure retransmitted SYN. */
-        if (TCP_SKB_CB(skb)->seq == req->rcv_isn &&
+        if (TCP_SKB_CB(skb)->seq == tcp_rsk(req)->rcv_isn &&
             flg == TCP_FLAG_SYN &&
             !paws_reject) {
                 /*
@@ -959,7 +961,7 @@ struct sock *tcp_check_req(struct sock *sk,struct sk_buff *skb,
          * Invalid ACK: reset will be sent by listening socket
          */
         if ((flg & TCP_FLAG_ACK) &&
-            (TCP_SKB_CB(skb)->ack_seq != req->snt_isn+1))
+            (TCP_SKB_CB(skb)->ack_seq != tcp_rsk(req)->snt_isn + 1))
                 return sk;
 
         /* Also, it would be not so bad idea to check rcv_tsecr, which
@@ -970,7 +972,7 @@ struct sock *tcp_check_req(struct sock *sk,struct sk_buff *skb,
         /* RFC793: "first check sequence number". */
 
         if (paws_reject || !tcp_in_window(TCP_SKB_CB(skb)->seq, TCP_SKB_CB(skb)->end_seq,
-                                          req->rcv_isn+1, req->rcv_isn+1+req->rcv_wnd)) {
+                                          tcp_rsk(req)->rcv_isn + 1, tcp_rsk(req)->rcv_isn + 1 + req->rcv_wnd)) {
                 /* Out of window: send ACK and drop. */
                 if (!(flg & TCP_FLAG_RST))
                         req->class->send_ack(skb, req);
@@ -981,12 +983,12 @@ struct sock *tcp_check_req(struct sock *sk,struct sk_buff *skb,
 
         /* In sequence, PAWS is OK. */
 
-        if (tmp_opt.saw_tstamp && !after(TCP_SKB_CB(skb)->seq, req->rcv_isn+1))
+        if (tmp_opt.saw_tstamp && !after(TCP_SKB_CB(skb)->seq, tcp_rsk(req)->rcv_isn + 1))
                         req->ts_recent = tmp_opt.rcv_tsval;
 
-                if (TCP_SKB_CB(skb)->seq == req->rcv_isn) {
+                if (TCP_SKB_CB(skb)->seq == tcp_rsk(req)->rcv_isn) {
                         /* Truncate SYN, it is out of window starting
-                           at req->rcv_isn+1. */
+                           at tcp_rsk(req)->rcv_isn + 1. */
                         flg &= ~TCP_FLAG_SYN;
                 }
 
@@ -1003,8 +1005,8 @@ struct sock *tcp_check_req(struct sock *sk,struct sk_buff *skb,
                         return NULL;
 
                 /* If TCP_DEFER_ACCEPT is set, drop bare ACK. */
-                if (tp->defer_accept && TCP_SKB_CB(skb)->end_seq == req->rcv_isn+1) {
-                        req->acked = 1;
+                if (tp->defer_accept && TCP_SKB_CB(skb)->end_seq == tcp_rsk(req)->rcv_isn + 1) {
+                        inet_rsk(req)->acked = 1;
                         return NULL;
                 }
 
@@ -1026,7 +1028,7 @@ struct sock *tcp_check_req(struct sock *sk,struct sk_buff *skb,
 
         listen_overflow:
                 if (!sysctl_tcp_abort_on_overflow) {
-                        req->acked = 1;
+                        inet_rsk(req)->acked = 1;
                         return NULL;
                 }
 
diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
index fa24e7ae1f40..f3c8747caf91 100644
--- a/net/ipv4/tcp_output.c
+++ b/net/ipv4/tcp_output.c
@@ -1358,6 +1358,7 @@ int tcp_send_synack(struct sock *sk)
 struct sk_buff * tcp_make_synack(struct sock *sk, struct dst_entry *dst,
                                  struct open_request *req)
 {
+        struct inet_request_sock *ireq = inet_rsk(req);
         struct tcp_sock *tp = tcp_sk(sk);
         struct tcphdr *th;
         int tcp_header_size;
@@ -1373,47 +1374,47 @@ struct sk_buff * tcp_make_synack(struct sock *sk, struct dst_entry *dst,
         skb->dst = dst_clone(dst);
 
         tcp_header_size = (sizeof(struct tcphdr) + TCPOLEN_MSS +
-                           (req->tstamp_ok ? TCPOLEN_TSTAMP_ALIGNED : 0) +
-                           (req->wscale_ok ? TCPOLEN_WSCALE_ALIGNED : 0) +
+                           (ireq->tstamp_ok ? TCPOLEN_TSTAMP_ALIGNED : 0) +
+                           (ireq->wscale_ok ? TCPOLEN_WSCALE_ALIGNED : 0) +
                            /* SACK_PERM is in the place of NOP NOP of TS */
-                           ((req->sack_ok && !req->tstamp_ok) ? TCPOLEN_SACKPERM_ALIGNED : 0));
+                           ((ireq->sack_ok && !ireq->tstamp_ok) ? TCPOLEN_SACKPERM_ALIGNED : 0));
         skb->h.th = th = (struct tcphdr *) skb_push(skb, tcp_header_size);
 
         memset(th, 0, sizeof(struct tcphdr));
         th->syn = 1;
         th->ack = 1;
         if (dst->dev->features&NETIF_F_TSO)
-                req->ecn_ok = 0;
+                ireq->ecn_ok = 0;
         TCP_ECN_make_synack(req, th);
         th->source = inet_sk(sk)->sport;
-        th->dest = req->rmt_port;
-        TCP_SKB_CB(skb)->seq = req->snt_isn;
+        th->dest = ireq->rmt_port;
+        TCP_SKB_CB(skb)->seq = tcp_rsk(req)->snt_isn;
         TCP_SKB_CB(skb)->end_seq = TCP_SKB_CB(skb)->seq + 1;
         TCP_SKB_CB(skb)->sacked = 0;
         skb_shinfo(skb)->tso_segs = 1;
         skb_shinfo(skb)->tso_size = 0;
         th->seq = htonl(TCP_SKB_CB(skb)->seq);
-        th->ack_seq = htonl(req->rcv_isn + 1);
+        th->ack_seq = htonl(tcp_rsk(req)->rcv_isn + 1);
         if (req->rcv_wnd == 0) { /* ignored for retransmitted syns */
                 __u8 rcv_wscale; 
                 /* Set this up on the first call only */
                 req->window_clamp = tp->window_clamp ? : dst_metric(dst, RTAX_WINDOW);
                 /* tcp_full_space because it is guaranteed to be the first packet */
                 tcp_select_initial_window(tcp_full_space(sk), 
-                        dst_metric(dst, RTAX_ADVMSS) - (req->tstamp_ok ? TCPOLEN_TSTAMP_ALIGNED : 0),
+                        dst_metric(dst, RTAX_ADVMSS) - (ireq->tstamp_ok ? TCPOLEN_TSTAMP_ALIGNED : 0),
                         &req->rcv_wnd,
                         &req->window_clamp,
-                        req->wscale_ok,
+                        ireq->wscale_ok,
                         &rcv_wscale);
-                req->rcv_wscale = rcv_wscale; 
+                ireq->rcv_wscale = rcv_wscale; 
         }
 
         /* RFC1323: The window in SYN & SYN/ACK segments is never scaled. */
         th->window = htons(req->rcv_wnd);
 
         TCP_SKB_CB(skb)->when = tcp_time_stamp;
-        tcp_syn_build_options((__u32 *)(th + 1), dst_metric(dst, RTAX_ADVMSS), req->tstamp_ok,
-                              req->sack_ok, req->wscale_ok, req->rcv_wscale,
+        tcp_syn_build_options((__u32 *)(th + 1), dst_metric(dst, RTAX_ADVMSS), ireq->tstamp_ok,
+                              ireq->sack_ok, ireq->wscale_ok, ireq->rcv_wscale,
                               TCP_SKB_CB(skb)->when,
                               req->ts_recent);
 
diff --git a/net/ipv4/tcp_timer.c b/net/ipv4/tcp_timer.c
index 799ebe061e2c..ba30ca0aa6a3 100644
--- a/net/ipv4/tcp_timer.c
+++ b/net/ipv4/tcp_timer.c
@@ -513,7 +513,7 @@ static void tcp_synack_timer(struct sock *sk)
                 while ((req = *reqp) != NULL) {
                         if (time_after_eq(now, req->expires)) {
                                 if ((req->retrans < thresh ||
-                                     (req->acked && req->retrans < max_retries))
+                                     (inet_rsk(req)->acked && req->retrans < max_retries))
                                     && !req->class->rtx_syn_ack(sk, req, NULL)) {
                                         unsigned long timeo;