62 files changed, 2207 insertions, 1027 deletions

diff --git a/net/ipv4/af_inet.c b/net/ipv4/af_inet.c
index 57737b8d1711..7d12c6a9b19b 100644
--- a/net/ipv4/af_inet.c
+++ b/net/ipv4/af_inet.c
@@ -174,12 +174,12 @@ static int inet_autobind(struct sock *sk)
         /* We may need to bind the socket. */
         lock_sock(sk);
         inet = inet_sk(sk);
-        if (!inet->num) {
+        if (!inet->inet_num) {
                 if (sk->sk_prot->get_port(sk, 0)) {
                         release_sock(sk);
                         return -EAGAIN;
                 }
-                inet->sport = htons(inet->num);
+                inet->inet_sport = htons(inet->inet_num);
         }
         release_sock(sk);
         return 0;
@@ -262,7 +262,8 @@ static inline int inet_netns_ok(struct net *net, int protocol)
  *      Create an inet socket.
  */
 
-static int inet_create(struct net *net, struct socket *sock, int protocol)
+static int inet_create(struct net *net, struct socket *sock, int protocol,
+                       int kern)
 {
         struct sock *sk;
         struct inet_protosw *answer;
@@ -325,7 +326,7 @@ lookup_protocol:
         }
 
         err = -EPERM;
-        if (answer->capability > 0 && !capable(answer->capability))
+        if (sock->type == SOCK_RAW && !kern && !capable(CAP_NET_RAW))
                 goto out_rcu_unlock;
 
         err = -EAFNOSUPPORT;
@@ -354,7 +355,7 @@ lookup_protocol:
         inet->is_icsk = (INET_PROTOSW_ICSK & answer_flags) != 0;
 
         if (SOCK_RAW == sock->type) {
-                inet->num = protocol;
+                inet->inet_num = protocol;
                 if (IPPROTO_RAW == protocol)
                         inet->hdrincl = 1;
         }
@@ -364,7 +365,7 @@ lookup_protocol:
         else
                 inet->pmtudisc = IP_PMTUDISC_WANT;
 
-        inet->id = 0;
+        inet->inet_id = 0;
 
         sock_init_data(sock, sk);
 
@@ -381,13 +382,13 @@ lookup_protocol:
 
         sk_refcnt_debug_inc(sk);
 
-        if (inet->num) {
+        if (inet->inet_num) {
                 /* It assumes that any protocol which allows
                  * the user to assign a number at socket
                  * creation time automatically
                  * shares.
                  */
-                inet->sport = htons(inet->num);
+                inet->inet_sport = htons(inet->inet_num);
                 /* Add to protocol hash chains. */
                 sk->sk_prot->hash(sk);
         }
@@ -494,27 +495,27 @@ int inet_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
 
         /* Check these errors (active socket, double bind). */
         err = -EINVAL;
-        if (sk->sk_state != TCP_CLOSE || inet->num)
+        if (sk->sk_state != TCP_CLOSE || inet->inet_num)
                 goto out_release_sock;
 
-        inet->rcv_saddr = inet->saddr = addr->sin_addr.s_addr;
+        inet->inet_rcv_saddr = inet->inet_saddr = addr->sin_addr.s_addr;
         if (chk_addr_ret == RTN_MULTICAST || chk_addr_ret == RTN_BROADCAST)
-                inet->saddr = 0;  /* Use device */
+                inet->inet_saddr = 0;  /* Use device */
 
         /* Make sure we are allowed to bind here. */
         if (sk->sk_prot->get_port(sk, snum)) {
-                inet->saddr = inet->rcv_saddr = 0;
+                inet->inet_saddr = inet->inet_rcv_saddr = 0;
                 err = -EADDRINUSE;
                 goto out_release_sock;
         }
 
-        if (inet->rcv_saddr)
+        if (inet->inet_rcv_saddr)
                 sk->sk_userlocks |= SOCK_BINDADDR_LOCK;
         if (snum)
                 sk->sk_userlocks |= SOCK_BINDPORT_LOCK;
-        inet->sport = htons(inet->num);
-        inet->daddr = 0;
-        inet->dport = 0;
+        inet->inet_sport = htons(inet->inet_num);
+        inet->inet_daddr = 0;
+        inet->inet_dport = 0;
         sk_dst_reset(sk);
         err = 0;
 out_release_sock:
@@ -532,7 +533,7 @@ int inet_dgram_connect(struct socket *sock, struct sockaddr * uaddr,
         if (uaddr->sa_family == AF_UNSPEC)
                 return sk->sk_prot->disconnect(sk, flags);
 
-        if (!inet_sk(sk)->num && inet_autobind(sk))
+        if (!inet_sk(sk)->inet_num && inet_autobind(sk))
                 return -EAGAIN;
         return sk->sk_prot->connect(sk, (struct sockaddr *)uaddr, addr_len);
 }
@@ -685,21 +686,21 @@ int inet_getname(struct socket *sock, struct sockaddr *uaddr,
 {
         struct sock *sk         = sock->sk;
         struct inet_sock *inet  = inet_sk(sk);
-        struct sockaddr_in *sin = (struct sockaddr_in *)uaddr;
+        DECLARE_SOCKADDR(struct sockaddr_in *, sin, uaddr);
 
         sin->sin_family = AF_INET;
         if (peer) {
-                if (!inet->dport ||
+                if (!inet->inet_dport ||
                     (((1 << sk->sk_state) & (TCPF_CLOSE | TCPF_SYN_SENT)) &&
                      peer == 1))
                         return -ENOTCONN;
-                sin->sin_port = inet->dport;
-                sin->sin_addr.s_addr = inet->daddr;
+                sin->sin_port = inet->inet_dport;
+                sin->sin_addr.s_addr = inet->inet_daddr;
         } else {
-                __be32 addr = inet->rcv_saddr;
+                __be32 addr = inet->inet_rcv_saddr;
                 if (!addr)
-                        addr = inet->saddr;
-                sin->sin_port = inet->sport;
+                        addr = inet->inet_saddr;
+                sin->sin_port = inet->inet_sport;
                 sin->sin_addr.s_addr = addr;
         }
         memset(sin->sin_zero, 0, sizeof(sin->sin_zero));
@@ -714,7 +715,7 @@ int inet_sendmsg(struct kiocb *iocb, struct socket *sock, struct msghdr *msg,
         struct sock *sk = sock->sk;
 
         /* We may need to bind the socket. */
-        if (!inet_sk(sk)->num && inet_autobind(sk))
+        if (!inet_sk(sk)->inet_num && inet_autobind(sk))
                 return -EAGAIN;
 
         return sk->sk_prot->sendmsg(iocb, sk, msg, size);
@@ -728,7 +729,7 @@ static ssize_t inet_sendpage(struct socket *sock, struct page *page, int offset,
         struct sock *sk = sock->sk;
 
         /* We may need to bind the socket. */
-        if (!inet_sk(sk)->num && inet_autobind(sk))
+        if (!inet_sk(sk)->inet_num && inet_autobind(sk))
                 return -EAGAIN;
 
         if (sk->sk_prot->sendpage)
@@ -931,7 +932,7 @@ static const struct proto_ops inet_sockraw_ops = {
 #endif
 };
 
-static struct net_proto_family inet_family_ops = {
+static const struct net_proto_family inet_family_ops = {
         .family = PF_INET,
         .create = inet_create,
         .owner  = THIS_MODULE,
@@ -947,7 +948,6 @@ static struct inet_protosw inetsw_array[] =
                 .protocol =   IPPROTO_TCP,
                 .prot =       &tcp_prot,
                 .ops =        &inet_stream_ops,
-                .capability = -1,
                 .no_check =   0,
                 .flags =      INET_PROTOSW_PERMANENT |
                               INET_PROTOSW_ICSK,
@@ -958,7 +958,6 @@ static struct inet_protosw inetsw_array[] =
                 .protocol =   IPPROTO_UDP,
                 .prot =       &udp_prot,
                 .ops =        &inet_dgram_ops,
-                .capability = -1,
                 .no_check =   UDP_CSUM_DEFAULT,
                 .flags =      INET_PROTOSW_PERMANENT,
        },
@@ -969,7 +968,6 @@ static struct inet_protosw inetsw_array[] =
                .protocol =   IPPROTO_IP,        /* wild card */
                .prot =       &raw_prot,
                .ops =        &inet_sockraw_ops,
-               .capability = CAP_NET_RAW,
                .no_check =   UDP_CSUM_DEFAULT,
                .flags =      INET_PROTOSW_REUSE,
        }
@@ -1059,9 +1057,9 @@ static int inet_sk_reselect_saddr(struct sock *sk)
         struct inet_sock *inet = inet_sk(sk);
         int err;
         struct rtable *rt;
-        __be32 old_saddr = inet->saddr;
+        __be32 old_saddr = inet->inet_saddr;
         __be32 new_saddr;
-        __be32 daddr = inet->daddr;
+        __be32 daddr = inet->inet_daddr;
 
         if (inet->opt && inet->opt->srr)
                 daddr = inet->opt->faddr;
@@ -1071,7 +1069,7 @@ static int inet_sk_reselect_saddr(struct sock *sk)
                                RT_CONN_FLAGS(sk),
                                sk->sk_bound_dev_if,
                                sk->sk_protocol,
-                               inet->sport, inet->dport, sk, 0);
+                               inet->inet_sport, inet->inet_dport, sk, 0);
         if (err)
                 return err;
 
@@ -1087,7 +1085,7 @@ static int inet_sk_reselect_saddr(struct sock *sk)
                        __func__, &old_saddr, &new_saddr);
         }
 
-        inet->saddr = inet->rcv_saddr = new_saddr;
+        inet->inet_saddr = inet->inet_rcv_saddr = new_saddr;
 
         /*
          * XXX The only one ugly spot where we need to
@@ -1113,7 +1111,7 @@ int inet_sk_rebuild_header(struct sock *sk)
                 return 0;
 
         /* Reroute. */
-        daddr = inet->daddr;
+        daddr = inet->inet_daddr;
         if (inet->opt && inet->opt->srr)
                 daddr = inet->opt->faddr;
 {
@@ -1123,7 +1121,7 @@ int inet_sk_rebuild_header(struct sock *sk)
                 .nl_u = {
                         .ip4_u = {
                                 .daddr  = daddr,
-                                .saddr  = inet->saddr,
+                                .saddr  = inet->inet_saddr,
                                 .tos    = RT_CONN_FLAGS(sk),
                         },
                 },
@@ -1131,8 +1129,8 @@ int inet_sk_rebuild_header(struct sock *sk)
                 .flags = inet_sk_flowi_flags(sk),
                 .uli_u = {
                         .ports = {
-                                .sport = inet->sport,
-                                .dport = inet->dport,
+                                .sport = inet->inet_sport,
+                                .dport = inet->inet_dport,
                         },
                 },
         };
diff --git a/net/ipv4/ah4.c b/net/ipv4/ah4.c
index 5c662703eb1e..7ed3e4ae93ae 100644
--- a/net/ipv4/ah4.c
+++ b/net/ipv4/ah4.c
@@ -1,3 +1,4 @@
+#include <crypto/hash.h>
 #include <linux/err.h>
 #include <linux/module.h>
 #include <net/ip.h>
@@ -5,10 +6,67 @@
 #include <net/ah.h>
 #include <linux/crypto.h>
 #include <linux/pfkeyv2.h>
-#include <linux/spinlock.h>
+#include <linux/scatterlist.h>
 #include <net/icmp.h>
 #include <net/protocol.h>
 
+struct ah_skb_cb {
+        struct xfrm_skb_cb xfrm;
+        void *tmp;
+};
+
+#define AH_SKB_CB(__skb) ((struct ah_skb_cb *)&((__skb)->cb[0]))
+
+static void *ah_alloc_tmp(struct crypto_ahash *ahash, int nfrags,
+                          unsigned int size)
+{
+        unsigned int len;
+
+        len = size + crypto_ahash_digestsize(ahash) +
+              (crypto_ahash_alignmask(ahash) &
+               ~(crypto_tfm_ctx_alignment() - 1));
+
+        len = ALIGN(len, crypto_tfm_ctx_alignment());
+
+        len += sizeof(struct ahash_request) + crypto_ahash_reqsize(ahash);
+        len = ALIGN(len, __alignof__(struct scatterlist));
+
+        len += sizeof(struct scatterlist) * nfrags;
+
+        return kmalloc(len, GFP_ATOMIC);
+}
+
+static inline u8 *ah_tmp_auth(void *tmp, unsigned int offset)
+{
+        return tmp + offset;
+}
+
+static inline u8 *ah_tmp_icv(struct crypto_ahash *ahash, void *tmp,
+                             unsigned int offset)
+{
+        return PTR_ALIGN((u8 *)tmp + offset, crypto_ahash_alignmask(ahash) + 1);
+}
+
+static inline struct ahash_request *ah_tmp_req(struct crypto_ahash *ahash,
+                                               u8 *icv)
+{
+        struct ahash_request *req;
+
+        req = (void *)PTR_ALIGN(icv + crypto_ahash_digestsize(ahash),
+                                crypto_tfm_ctx_alignment());
+
+        ahash_request_set_tfm(req, ahash);
+
+        return req;
+}
+
+static inline struct scatterlist *ah_req_sg(struct crypto_ahash *ahash,
+                                             struct ahash_request *req)
+{
+        return (void *)ALIGN((unsigned long)(req + 1) +
+                             crypto_ahash_reqsize(ahash),
+                             __alignof__(struct scatterlist));
+}
 
 /* Clear mutable options and find final destination to substitute
  * into IP header for icv calculation. Options are already checked
@@ -54,20 +112,72 @@ static int ip_clear_mutable_options(struct iphdr *iph, __be32 *daddr)
         return 0;
 }
 
+static void ah_output_done(struct crypto_async_request *base, int err)
+{
+        u8 *icv;
+        struct iphdr *iph;
+        struct sk_buff *skb = base->data;
+        struct xfrm_state *x = skb_dst(skb)->xfrm;
+        struct ah_data *ahp = x->data;
+        struct iphdr *top_iph = ip_hdr(skb);
+        struct ip_auth_hdr *ah = ip_auth_hdr(skb);
+        int ihl = ip_hdrlen(skb);
+
+        iph = AH_SKB_CB(skb)->tmp;
+        icv = ah_tmp_icv(ahp->ahash, iph, ihl);
+        memcpy(ah->auth_data, icv, ahp->icv_trunc_len);
+
+        top_iph->tos = iph->tos;
+        top_iph->ttl = iph->ttl;
+        top_iph->frag_off = iph->frag_off;
+        if (top_iph->ihl != 5) {
+                top_iph->daddr = iph->daddr;
+                memcpy(top_iph+1, iph+1, top_iph->ihl*4 - sizeof(struct iphdr));
+        }
+
+        err = ah->nexthdr;
+
+        kfree(AH_SKB_CB(skb)->tmp);
+        xfrm_output_resume(skb, err);
+}
+
 static int ah_output(struct xfrm_state *x, struct sk_buff *skb)
 {
         int err;
+        int nfrags;
+        int ihl;
+        u8 *icv;
+        struct sk_buff *trailer;
+        struct crypto_ahash *ahash;
+        struct ahash_request *req;
+        struct scatterlist *sg;
         struct iphdr *iph, *top_iph;
         struct ip_auth_hdr *ah;
         struct ah_data *ahp;
-        union {
-                struct iphdr    iph;
-                char            buf[60];
-        } tmp_iph;
+
+        ahp = x->data;
+        ahash = ahp->ahash;
+
+        if ((err = skb_cow_data(skb, 0, &trailer)) < 0)
+                goto out;
+        nfrags = err;
 
         skb_push(skb, -skb_network_offset(skb));
+        ah = ip_auth_hdr(skb);
+        ihl = ip_hdrlen(skb);
+
+        err = -ENOMEM;
+        iph = ah_alloc_tmp(ahash, nfrags, ihl);
+        if (!iph)
+                goto out;
+
+        icv = ah_tmp_icv(ahash, iph, ihl);
+        req = ah_tmp_req(ahash, icv);
+        sg = ah_req_sg(ahash, req);
+
+        memset(ah->auth_data, 0, ahp->icv_trunc_len);
+
         top_iph = ip_hdr(skb);
-        iph = &tmp_iph.iph;
 
         iph->tos = top_iph->tos;
         iph->ttl = top_iph->ttl;
@@ -78,10 +188,9 @@ static int ah_output(struct xfrm_state *x, struct sk_buff *skb)
                 memcpy(iph+1, top_iph+1, top_iph->ihl*4 - sizeof(struct iphdr));
                 err = ip_clear_mutable_options(top_iph, &top_iph->daddr);
                 if (err)
-                        goto error;
+                        goto out_free;
         }
 
-        ah = ip_auth_hdr(skb);
         ah->nexthdr = *skb_mac_header(skb);
         *skb_mac_header(skb) = IPPROTO_AH;
 
@@ -91,20 +200,31 @@ static int ah_output(struct xfrm_state *x, struct sk_buff *skb)
         top_iph->ttl = 0;
         top_iph->check = 0;
 
-        ahp = x->data;
         ah->hdrlen  = (XFRM_ALIGN8(sizeof(*ah) + ahp->icv_trunc_len) >> 2) - 2;
 
         ah->reserved = 0;
         ah->spi = x->id.spi;
         ah->seq_no = htonl(XFRM_SKB_CB(skb)->seq.output);
 
-        spin_lock_bh(&x->lock);
-        err = ah_mac_digest(ahp, skb, ah->auth_data);
-        memcpy(ah->auth_data, ahp->work_icv, ahp->icv_trunc_len);
-        spin_unlock_bh(&x->lock);
+        sg_init_table(sg, nfrags);
+        skb_to_sgvec(skb, sg, 0, skb->len);
 
-        if (err)
-                goto error;
+        ahash_request_set_crypt(req, sg, icv, skb->len);
+        ahash_request_set_callback(req, 0, ah_output_done, skb);
+
+        AH_SKB_CB(skb)->tmp = iph;
+
+        err = crypto_ahash_digest(req);
+        if (err) {
+                if (err == -EINPROGRESS)
+                        goto out;
+
+                if (err == -EBUSY)
+                        err = NET_XMIT_DROP;
+                goto out_free;
+        }
+
+        memcpy(ah->auth_data, icv, ahp->icv_trunc_len);
 
         top_iph->tos = iph->tos;
         top_iph->ttl = iph->ttl;
@@ -114,28 +234,67 @@ static int ah_output(struct xfrm_state *x, struct sk_buff *skb)
                 memcpy(top_iph+1, iph+1, top_iph->ihl*4 - sizeof(struct iphdr));
         }
 
-        err = 0;
-
-error:
+out_free:
+        kfree(iph);
+out:
         return err;
 }
 
+static void ah_input_done(struct crypto_async_request *base, int err)
+{
+        u8 *auth_data;
+        u8 *icv;
+        struct iphdr *work_iph;
+        struct sk_buff *skb = base->data;
+        struct xfrm_state *x = xfrm_input_state(skb);
+        struct ah_data *ahp = x->data;
+        struct ip_auth_hdr *ah = ip_auth_hdr(skb);
+        int ihl = ip_hdrlen(skb);
+        int ah_hlen = (ah->hdrlen + 2) << 2;
+
+        work_iph = AH_SKB_CB(skb)->tmp;
+        auth_data = ah_tmp_auth(work_iph, ihl);
+        icv = ah_tmp_icv(ahp->ahash, auth_data, ahp->icv_trunc_len);
+
+        err = memcmp(icv, auth_data, ahp->icv_trunc_len) ? -EBADMSG: 0;
+        if (err)
+                goto out;
+
+        skb->network_header += ah_hlen;
+        memcpy(skb_network_header(skb), work_iph, ihl);
+        __skb_pull(skb, ah_hlen + ihl);
+        skb_set_transport_header(skb, -ihl);
+
+        err = ah->nexthdr;
+out:
+        kfree(AH_SKB_CB(skb)->tmp);
+        xfrm_input_resume(skb, err);
+}
+
 static int ah_input(struct xfrm_state *x, struct sk_buff *skb)
 {
         int ah_hlen;
         int ihl;
         int nexthdr;
-        int err = -EINVAL;
-        struct iphdr *iph;
+        int nfrags;
+        u8 *auth_data;
+        u8 *icv;
+        struct sk_buff *trailer;
+        struct crypto_ahash *ahash;
+        struct ahash_request *req;
+        struct scatterlist *sg;
+        struct iphdr *iph, *work_iph;
         struct ip_auth_hdr *ah;
         struct ah_data *ahp;
-        char work_buf[60];
+        int err = -ENOMEM;
 
         if (!pskb_may_pull(skb, sizeof(*ah)))
                 goto out;
 
         ah = (struct ip_auth_hdr *)skb->data;
         ahp = x->data;
+        ahash = ahp->ahash;
+
         nexthdr = ah->nexthdr;
         ah_hlen = (ah->hdrlen + 2) << 2;
 
@@ -156,9 +315,24 @@ static int ah_input(struct xfrm_state *x, struct sk_buff *skb)
 
         ah = (struct ip_auth_hdr *)skb->data;
         iph = ip_hdr(skb);
+        ihl = ip_hdrlen(skb);
+
+        if ((err = skb_cow_data(skb, 0, &trailer)) < 0)
+                goto out;
+        nfrags = err;
+
+        work_iph = ah_alloc_tmp(ahash, nfrags, ihl + ahp->icv_trunc_len);
+        if (!work_iph)
+                goto out;
+
+        auth_data = ah_tmp_auth(work_iph, ihl);
+        icv = ah_tmp_icv(ahash, auth_data, ahp->icv_trunc_len);
+        req = ah_tmp_req(ahash, icv);
+        sg = ah_req_sg(ahash, req);
 
-        ihl = skb->data - skb_network_header(skb);
-        memcpy(work_buf, iph, ihl);
+        memcpy(work_iph, iph, ihl);
+        memcpy(auth_data, ah->auth_data, ahp->icv_trunc_len);
+        memset(ah->auth_data, 0, ahp->icv_trunc_len);
 
         iph->ttl = 0;
         iph->tos = 0;
@@ -166,35 +340,44 @@ static int ah_input(struct xfrm_state *x, struct sk_buff *skb)
         iph->check = 0;
         if (ihl > sizeof(*iph)) {
                 __be32 dummy;
-                if (ip_clear_mutable_options(iph, &dummy))
-                        goto out;
+                err = ip_clear_mutable_options(iph, &dummy);
+                if (err)
+                        goto out_free;
         }
 
-        spin_lock(&x->lock);
-        {
-                u8 auth_data[MAX_AH_AUTH_LEN];
+        skb_push(skb, ihl);
 
-                memcpy(auth_data, ah->auth_data, ahp->icv_trunc_len);
-                skb_push(skb, ihl);
-                err = ah_mac_digest(ahp, skb, ah->auth_data);
-                if (err)
-                        goto unlock;
-                if (memcmp(ahp->work_icv, auth_data, ahp->icv_trunc_len))
-                        err = -EBADMSG;
+        sg_init_table(sg, nfrags);
+        skb_to_sgvec(skb, sg, 0, skb->len);
+
+        ahash_request_set_crypt(req, sg, icv, skb->len);
+        ahash_request_set_callback(req, 0, ah_input_done, skb);
+
+        AH_SKB_CB(skb)->tmp = work_iph;
+
+        err = crypto_ahash_digest(req);
+        if (err) {
+                if (err == -EINPROGRESS)
+                        goto out;
+
+                if (err == -EBUSY)
+                        err = NET_XMIT_DROP;
+                goto out_free;
         }
-unlock:
-        spin_unlock(&x->lock);
 
+        err = memcmp(icv, auth_data, ahp->icv_trunc_len) ? -EBADMSG: 0;
         if (err)
-                goto out;
+                goto out_free;
 
         skb->network_header += ah_hlen;
-        memcpy(skb_network_header(skb), work_buf, ihl);
-        skb->transport_header = skb->network_header;
+        memcpy(skb_network_header(skb), work_iph, ihl);
         __skb_pull(skb, ah_hlen + ihl);
+        skb_set_transport_header(skb, -ihl);
 
-        return nexthdr;
+        err = nexthdr;
 
+out_free:
+        kfree (work_iph);
 out:
         return err;
 }
@@ -222,7 +405,7 @@ static int ah_init_state(struct xfrm_state *x)
 {
         struct ah_data *ahp = NULL;
         struct xfrm_algo_desc *aalg_desc;
-        struct crypto_hash *tfm;
+        struct crypto_ahash *ahash;
 
         if (!x->aalg)
                 goto error;
@@ -231,44 +414,40 @@ static int ah_init_state(struct xfrm_state *x)
                 goto error;
 
         ahp = kzalloc(sizeof(*ahp), GFP_KERNEL);
-        if (ahp == NULL)
+        if (!ahp)
                 return -ENOMEM;
 
-        tfm = crypto_alloc_hash(x->aalg->alg_name, 0, CRYPTO_ALG_ASYNC);
-        if (IS_ERR(tfm))
+        ahash = crypto_alloc_ahash(x->aalg->alg_name, 0, 0);
+        if (IS_ERR(ahash))
                 goto error;
 
-        ahp->tfm = tfm;
-        if (crypto_hash_setkey(tfm, x->aalg->alg_key,
-                               (x->aalg->alg_key_len + 7) / 8))
+        ahp->ahash = ahash;
+        if (crypto_ahash_setkey(ahash, x->aalg->alg_key,
+                                (x->aalg->alg_key_len + 7) / 8))
                 goto error;
 
         /*
          * Lookup the algorithm description maintained by xfrm_algo,
          * verify crypto transform properties, and store information
          * we need for AH processing.  This lookup cannot fail here
-         * after a successful crypto_alloc_hash().
+         * after a successful crypto_alloc_ahash().
          */
         aalg_desc = xfrm_aalg_get_byname(x->aalg->alg_name, 0);
         BUG_ON(!aalg_desc);
 
         if (aalg_desc->uinfo.auth.icv_fullbits/8 !=
-            crypto_hash_digestsize(tfm)) {
+            crypto_ahash_digestsize(ahash)) {
                 printk(KERN_INFO "AH: %s digestsize %u != %hu\n",
-                       x->aalg->alg_name, crypto_hash_digestsize(tfm),
+                       x->aalg->alg_name, crypto_ahash_digestsize(ahash),
                        aalg_desc->uinfo.auth.icv_fullbits/8);
                 goto error;
         }
 
         ahp->icv_full_len = aalg_desc->uinfo.auth.icv_fullbits/8;
-        ahp->icv_trunc_len = aalg_desc->uinfo.auth.icv_truncbits/8;
+        ahp->icv_trunc_len = x->aalg->alg_trunc_len/8;
 
         BUG_ON(ahp->icv_trunc_len > MAX_AH_AUTH_LEN);
 
-        ahp->work_icv = kmalloc(ahp->icv_full_len, GFP_KERNEL);
-        if (!ahp->work_icv)
-                goto error;
-
         x->props.header_len = XFRM_ALIGN8(sizeof(struct ip_auth_hdr) +
                                           ahp->icv_trunc_len);
         if (x->props.mode == XFRM_MODE_TUNNEL)
@@ -279,8 +458,7 @@ static int ah_init_state(struct xfrm_state *x)
 
 error:
         if (ahp) {
-                kfree(ahp->work_icv);
-                crypto_free_hash(ahp->tfm);
+                crypto_free_ahash(ahp->ahash);
                 kfree(ahp);
         }
         return -EINVAL;
@@ -293,8 +471,7 @@ static void ah_destroy(struct xfrm_state *x)
         if (!ahp)
                 return;
 
-        kfree(ahp->work_icv);
-        crypto_free_hash(ahp->tfm);
+        crypto_free_ahash(ahp->ahash);
         kfree(ahp);
 }
 
diff --git a/net/ipv4/cipso_ipv4.c b/net/ipv4/cipso_ipv4.c
index 039cc1ffe977..1e029dc75455 100644
--- a/net/ipv4/cipso_ipv4.c
+++ b/net/ipv4/cipso_ipv4.c
@@ -2017,7 +2017,7 @@ req_setattr_failure:
  * values on failure.
  *
  */
-int cipso_v4_delopt(struct ip_options **opt_ptr)
+static int cipso_v4_delopt(struct ip_options **opt_ptr)
 {
         int hdr_delta = 0;
         struct ip_options *opt = *opt_ptr;
diff --git a/net/ipv4/datagram.c b/net/ipv4/datagram.c
index 5e6c5a0f3fde..fb2465811b48 100644
--- a/net/ipv4/datagram.c
+++ b/net/ipv4/datagram.c
@@ -39,7 +39,7 @@ int ip4_datagram_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len)
         sk_dst_reset(sk);
 
         oif = sk->sk_bound_dev_if;
-        saddr = inet->saddr;
+        saddr = inet->inet_saddr;
         if (ipv4_is_multicast(usin->sin_addr.s_addr)) {
                 if (!oif)
                         oif = inet->mc_index;
@@ -49,7 +49,7 @@ int ip4_datagram_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len)
         err = ip_route_connect(&rt, usin->sin_addr.s_addr, saddr,
                                RT_CONN_FLAGS(sk), oif,
                                sk->sk_protocol,
-                               inet->sport, usin->sin_port, sk, 1);
+                               inet->inet_sport, usin->sin_port, sk, 1);
         if (err) {
                 if (err == -ENETUNREACH)
                         IP_INC_STATS_BH(sock_net(sk), IPSTATS_MIB_OUTNOROUTES);
@@ -60,14 +60,14 @@ int ip4_datagram_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len)
                 ip_rt_put(rt);
                 return -EACCES;
         }
-        if (!inet->saddr)
-                inet->saddr = rt->rt_src;       /* Update source address */
-        if (!inet->rcv_saddr)
-                inet->rcv_saddr = rt->rt_src;
-        inet->daddr = rt->rt_dst;
-        inet->dport = usin->sin_port;
+        if (!inet->inet_saddr)
+                inet->inet_saddr = rt->rt_src;  /* Update source address */
+        if (!inet->inet_rcv_saddr)
+                inet->inet_rcv_saddr = rt->rt_src;
+        inet->inet_daddr = rt->rt_dst;
+        inet->inet_dport = usin->sin_port;
         sk->sk_state = TCP_ESTABLISHED;
-        inet->id = jiffies;
+        inet->inet_id = jiffies;
 
         sk_dst_set(sk, &rt->u.dst);
         return(0);
diff --git a/net/ipv4/devinet.c b/net/ipv4/devinet.c
index e049da8311b5..5cdbc102a418 100644
--- a/net/ipv4/devinet.c
+++ b/net/ipv4/devinet.c
@@ -140,11 +140,11 @@ void in_dev_finish_destroy(struct in_device *idev)
 #endif
         dev_put(dev);
         if (!idev->dead)
-                printk("Freeing alive in_device %p\n", idev);
-        else {
+                pr_err("Freeing alive in_device %p\n", idev);
+        else
                 kfree(idev);
-        }
 }
+EXPORT_SYMBOL(in_dev_finish_destroy);
 
 static struct in_device *inetdev_init(struct net_device *dev)
 {
@@ -159,7 +159,8 @@ static struct in_device *inetdev_init(struct net_device *dev)
                         sizeof(in_dev->cnf));
         in_dev->cnf.sysctl = NULL;
         in_dev->dev = dev;
-        if ((in_dev->arp_parms = neigh_parms_alloc(dev, &arp_tbl)) == NULL)
+        in_dev->arp_parms = neigh_parms_alloc(dev, &arp_tbl);
+        if (!in_dev->arp_parms)
                 goto out_kfree;
         if (IPV4_DEVCONF(in_dev->cnf, FORWARDING))
                 dev_disable_lro(dev);
@@ -405,13 +406,15 @@ struct in_device *inetdev_by_index(struct net *net, int ifindex)
 {
         struct net_device *dev;
         struct in_device *in_dev = NULL;
-        read_lock(&dev_base_lock);
-        dev = __dev_get_by_index(net, ifindex);
+
+        rcu_read_lock();
+        dev = dev_get_by_index_rcu(net, ifindex);
         if (dev)
                 in_dev = in_dev_get(dev);
-        read_unlock(&dev_base_lock);
+        rcu_read_unlock();
         return in_dev;
 }
+EXPORT_SYMBOL(inetdev_by_index);
 
 /* Called only from RTNL semaphored context. No locks. */
 
@@ -557,7 +560,7 @@ static int inet_rtm_newaddr(struct sk_buff *skb, struct nlmsghdr *nlh, void *arg
  *      Determine a default network mask, based on the IP address.
  */
 
-static __inline__ int inet_abc_len(__be32 addr)
+static inline int inet_abc_len(__be32 addr)
 {
         int rc = -1;    /* Something else, probably a multicast. */
 
@@ -646,13 +649,15 @@ int devinet_ioctl(struct net *net, unsigned int cmd, void __user *arg)
         rtnl_lock();
 
         ret = -ENODEV;
-        if ((dev = __dev_get_by_name(net, ifr.ifr_name)) == NULL)
+        dev = __dev_get_by_name(net, ifr.ifr_name);
+        if (!dev)
                 goto done;
 
         if (colon)
                 *colon = ':';
 
-        if ((in_dev = __in_dev_get_rtnl(dev)) != NULL) {
+        in_dev = __in_dev_get_rtnl(dev);
+        if (in_dev) {
                 if (tryaddrmatch) {
                         /* Matthias Andree */
                         /* compare label and address (4.4BSD style) */
@@ -720,7 +725,8 @@ int devinet_ioctl(struct net *net, unsigned int cmd, void __user *arg)
 
                 if (!ifa) {
                         ret = -ENOBUFS;
-                        if ((ifa = inet_alloc_ifa()) == NULL)
+                        ifa = inet_alloc_ifa();
+                        if (!ifa)
                                 break;
                         if (colon)
                                 memcpy(ifa->ifa_label, ifr.ifr_name, IFNAMSIZ);
@@ -822,10 +828,10 @@ static int inet_gifconf(struct net_device *dev, char __user *buf, int len)
         struct ifreq ifr;
         int done = 0;
 
-        if (!in_dev || (ifa = in_dev->ifa_list) == NULL)
+        if (!in_dev)
                 goto out;
 
-        for (; ifa; ifa = ifa->ifa_next) {
+        for (ifa = in_dev->ifa_list; ifa; ifa = ifa->ifa_next) {
                 if (!buf) {
                         done += sizeof(ifr);
                         continue;
@@ -875,36 +881,33 @@ __be32 inet_select_addr(const struct net_device *dev, __be32 dst, int scope)
                 if (!addr)
                         addr = ifa->ifa_local;
         } endfor_ifa(in_dev);
-no_in_dev:
-        rcu_read_unlock();
 
         if (addr)
-                goto out;
+                goto out_unlock;
+no_in_dev:
 
         /* Not loopback addresses on loopback should be preferred
            in this case. It is importnat that lo is the first interface
            in dev_base list.
          */
-        read_lock(&dev_base_lock);
-        rcu_read_lock();
-        for_each_netdev(net, dev) {
-                if ((in_dev = __in_dev_get_rcu(dev)) == NULL)
+        for_each_netdev_rcu(net, dev) {
+                in_dev = __in_dev_get_rcu(dev);
+                if (!in_dev)
                         continue;
 
                 for_primary_ifa(in_dev) {
                         if (ifa->ifa_scope != RT_SCOPE_LINK &&
                             ifa->ifa_scope <= scope) {
                                 addr = ifa->ifa_local;
-                                goto out_unlock_both;
+                                goto out_unlock;
                         }
                 } endfor_ifa(in_dev);
         }
-out_unlock_both:
-        read_unlock(&dev_base_lock);
+out_unlock:
         rcu_read_unlock();
-out:
         return addr;
 }
+EXPORT_SYMBOL(inet_select_addr);
 
 static __be32 confirm_addr_indev(struct in_device *in_dev, __be32 dst,
                               __be32 local, int scope)
@@ -940,7 +943,7 @@ static __be32 confirm_addr_indev(struct in_device *in_dev, __be32 dst,
                 }
         } endfor_ifa(in_dev);
 
-        return same? addr : 0;
+        return same ? addr : 0;
 }
 
 /*
@@ -961,17 +964,16 @@ __be32 inet_confirm_addr(struct in_device *in_dev,
                 return confirm_addr_indev(in_dev, dst, local, scope);
 
         net = dev_net(in_dev->dev);
-        read_lock(&dev_base_lock);
         rcu_read_lock();
-        for_each_netdev(net, dev) {
-                if ((in_dev = __in_dev_get_rcu(dev))) {
+        for_each_netdev_rcu(net, dev) {
+                in_dev = __in_dev_get_rcu(dev);
+                if (in_dev) {
                         addr = confirm_addr_indev(in_dev, dst, local, scope);
                         if (addr)
                                 break;
                 }
         }
         rcu_read_unlock();
-        read_unlock(&dev_base_lock);
 
         return addr;
 }
@@ -984,14 +986,16 @@ int register_inetaddr_notifier(struct notifier_block *nb)
 {
         return blocking_notifier_chain_register(&inetaddr_chain, nb);
 }
+EXPORT_SYMBOL(register_inetaddr_notifier);
 
 int unregister_inetaddr_notifier(struct notifier_block *nb)
 {
         return blocking_notifier_chain_unregister(&inetaddr_chain, nb);
 }
+EXPORT_SYMBOL(unregister_inetaddr_notifier);
 
-/* Rename ifa_labels for a device name change. Make some effort to preserve existing
- * alias numbering and to create unique labels if possible.
+/* Rename ifa_labels for a device name change. Make some effort to preserve
+ * existing alias numbering and to create unique labels if possible.
 */
 static void inetdev_changename(struct net_device *dev, struct in_device *in_dev)
 {
@@ -1010,11 +1014,10 @@ static void inetdev_changename(struct net_device *dev, struct in_device *in_dev)
                         sprintf(old, ":%d", named);
                         dot = old;
                 }
-                if (strlen(dot) + strlen(dev->name) < IFNAMSIZ) {
+                if (strlen(dot) + strlen(dev->name) < IFNAMSIZ)
                         strcat(ifa->ifa_label, dot);
-                } else {
+                else
                         strcpy(ifa->ifa_label + (IFNAMSIZ - strlen(dot) - 1), dot);
-                }
 skip:
                 rtmsg_ifa(RTM_NEWADDR, ifa, NULL, 0);
         }
@@ -1061,8 +1064,9 @@ static int inetdev_event(struct notifier_block *this, unsigned long event,
                 if (!inetdev_valid_mtu(dev->mtu))
                         break;
                 if (dev->flags & IFF_LOOPBACK) {
-                        struct in_ifaddr *ifa;
-                        if ((ifa = inet_alloc_ifa()) != NULL) {
+                        struct in_ifaddr *ifa = inet_alloc_ifa();
+
+                        if (ifa) {
                                 ifa->ifa_local =
                                   ifa->ifa_address = htonl(INADDR_LOOPBACK);
                                 ifa->ifa_prefixlen = 8;
@@ -1170,38 +1174,54 @@ nla_put_failure:
 static int inet_dump_ifaddr(struct sk_buff *skb, struct netlink_callback *cb)
 {
         struct net *net = sock_net(skb->sk);
-        int idx, ip_idx;
+        int h, s_h;
+        int idx, s_idx;
+        int ip_idx, s_ip_idx;
         struct net_device *dev;
         struct in_device *in_dev;
         struct in_ifaddr *ifa;
-        int s_ip_idx, s_idx = cb->args[0];
+        struct hlist_head *head;
+        struct hlist_node *node;
 
-        s_ip_idx = ip_idx = cb->args[1];
-        idx = 0;
-        for_each_netdev(net, dev) {
-                if (idx < s_idx)
-                        goto cont;
-                if (idx > s_idx)
-                        s_ip_idx = 0;
-                if ((in_dev = __in_dev_get_rtnl(dev)) == NULL)
-                        goto cont;
-
-                for (ifa = in_dev->ifa_list, ip_idx = 0; ifa;
-                     ifa = ifa->ifa_next, ip_idx++) {
-                        if (ip_idx < s_ip_idx)
-                                continue;
-                        if (inet_fill_ifaddr(skb, ifa, NETLINK_CB(cb->skb).pid,
+        s_h = cb->args[0];
+        s_idx = idx = cb->args[1];
+        s_ip_idx = ip_idx = cb->args[2];
+
+        for (h = s_h; h < NETDEV_HASHENTRIES; h++, s_idx = 0) {
+                idx = 0;
+                head = &net->dev_index_head[h];
+                rcu_read_lock();
+                hlist_for_each_entry_rcu(dev, node, head, index_hlist) {
+                        if (idx < s_idx)
+                                goto cont;
+                        if (idx > s_idx)
+                                s_ip_idx = 0;
+                        in_dev = __in_dev_get_rcu(dev);
+                        if (!in_dev)
+                                goto cont;
+
+                        for (ifa = in_dev->ifa_list, ip_idx = 0; ifa;
+                             ifa = ifa->ifa_next, ip_idx++) {
+                                if (ip_idx < s_ip_idx)
+                                        continue;
+                                if (inet_fill_ifaddr(skb, ifa,
+                                             NETLINK_CB(cb->skb).pid,
                                              cb->nlh->nlmsg_seq,
-                                             RTM_NEWADDR, NLM_F_MULTI) <= 0)
-                                goto done;
-                }
+                                             RTM_NEWADDR, NLM_F_MULTI) <= 0) {
+                                        rcu_read_unlock();
+                                        goto done;
+                                }
+                        }
 cont:
-                idx++;
+                        idx++;
+                }
+                rcu_read_unlock();
         }
 
 done:
-        cb->args[0] = idx;
-        cb->args[1] = ip_idx;
+        cb->args[0] = h;
+        cb->args[1] = idx;
+        cb->args[2] = ip_idx;
 
         return skb->len;
 }
@@ -1239,18 +1259,18 @@ static void devinet_copy_dflt_conf(struct net *net, int i)
 {
         struct net_device *dev;
 
-        read_lock(&dev_base_lock);
-        for_each_netdev(net, dev) {
+        rcu_read_lock();
+        for_each_netdev_rcu(net, dev) {
                 struct in_device *in_dev;
-                rcu_read_lock();
+
                 in_dev = __in_dev_get_rcu(dev);
                 if (in_dev && !test_bit(i, in_dev->cnf.state))
                         in_dev->cnf.data[i] = net->ipv4.devconf_dflt->data[i];
-                rcu_read_unlock();
         }
-        read_unlock(&dev_base_lock);
+        rcu_read_unlock();
 }
 
+/* called with RTNL locked */
 static void inet_forward_change(struct net *net)
 {
         struct net_device *dev;
@@ -1259,7 +1279,6 @@ static void inet_forward_change(struct net *net)
         IPV4_DEVCONF_ALL(net, ACCEPT_REDIRECTS) = !on;
         IPV4_DEVCONF_DFLT(net, FORWARDING) = on;
 
-        read_lock(&dev_base_lock);
         for_each_netdev(net, dev) {
                 struct in_device *in_dev;
                 if (on)
@@ -1270,7 +1289,6 @@ static void inet_forward_change(struct net *net)
                         IN_DEV_CONF_SET(in_dev, FORWARDING, on);
                 rcu_read_unlock();
         }
-        read_unlock(&dev_base_lock);
 }
 
 static int devinet_conf_proc(ctl_table *ctl, int write,
@@ -1378,6 +1396,7 @@ static struct devinet_sysctl_table {
                 DEVINET_SYSCTL_RW_ENTRY(SEND_REDIRECTS, "send_redirects"),
                 DEVINET_SYSCTL_RW_ENTRY(ACCEPT_SOURCE_ROUTE,
                                         "accept_source_route"),
+                DEVINET_SYSCTL_RW_ENTRY(ACCEPT_LOCAL, "accept_local"),
                 DEVINET_SYSCTL_RW_ENTRY(PROXY_ARP, "proxy_arp"),
                 DEVINET_SYSCTL_RW_ENTRY(MEDIUM_ID, "medium_id"),
                 DEVINET_SYSCTL_RW_ENTRY(BOOTP_RELAY, "bootp_relay"),
@@ -1512,7 +1531,7 @@ static __net_init int devinet_init_net(struct net *net)
         all = &ipv4_devconf;
         dflt = &ipv4_devconf_dflt;
 
-        if (net != &init_net) {
+        if (!net_eq(net, &init_net)) {
                 all = kmemdup(all, sizeof(ipv4_devconf), GFP_KERNEL);
                 if (all == NULL)
                         goto err_alloc_all;
@@ -1603,8 +1622,3 @@ void __init devinet_init(void)
         rtnl_register(PF_INET, RTM_GETADDR, NULL, inet_dump_ifaddr);
 }
 
-EXPORT_SYMBOL(in_dev_finish_destroy);
-EXPORT_SYMBOL(inet_select_addr);
-EXPORT_SYMBOL(inetdev_by_index);
-EXPORT_SYMBOL(register_inetaddr_notifier);
-EXPORT_SYMBOL(unregister_inetaddr_notifier);
diff --git a/net/ipv4/esp4.c b/net/ipv4/esp4.c
index 12f7287e902d..1948895beb6d 100644
--- a/net/ipv4/esp4.c
+++ b/net/ipv4/esp4.c
@@ -530,7 +530,7 @@ static int esp_init_authenc(struct xfrm_state *x)
                 }
 
                 err = crypto_aead_setauthsize(
-                        aead, aalg_desc->uinfo.auth.icv_truncbits / 8);
+                        aead, x->aalg->alg_trunc_len / 8);
                 if (err)
                         goto free_key;
         }
diff --git a/net/ipv4/fib_frontend.c b/net/ipv4/fib_frontend.c
index aa00398be80e..3323168ee52d 100644
--- a/net/ipv4/fib_frontend.c
+++ b/net/ipv4/fib_frontend.c
@@ -125,7 +125,7 @@ void fib_select_default(struct net *net,
 #endif
         tb = fib_get_table(net, table);
         if (FIB_RES_GW(*res) && FIB_RES_NH(*res).nh_scope == RT_SCOPE_LINK)
-                tb->tb_select_default(tb, flp, res);
+                fib_table_select_default(tb, flp, res);
 }
 
 static void fib_flush(struct net *net)
@@ -139,7 +139,7 @@ static void fib_flush(struct net *net)
         for (h = 0; h < FIB_TABLE_HASHSZ; h++) {
                 head = &net->ipv4.fib_table_hash[h];
                 hlist_for_each_entry(tb, node, head, tb_hlist)
-                        flushed += tb->tb_flush(tb);
+                        flushed += fib_table_flush(tb);
         }
 
         if (flushed)
@@ -162,7 +162,7 @@ struct net_device * ip_dev_find(struct net *net, __be32 addr)
 #endif
 
         local_table = fib_get_table(net, RT_TABLE_LOCAL);
-        if (!local_table || local_table->tb_lookup(local_table, &fl, &res))
+        if (!local_table || fib_table_lookup(local_table, &fl, &res))
                 return NULL;
         if (res.type != RTN_LOCAL)
                 goto out;
@@ -200,7 +200,7 @@ static inline unsigned __inet_dev_addr_type(struct net *net,
         local_table = fib_get_table(net, RT_TABLE_LOCAL);
         if (local_table) {
                 ret = RTN_UNICAST;
-                if (!local_table->tb_lookup(local_table, &fl, &res)) {
+                if (!fib_table_lookup(local_table, &fl, &res)) {
                         if (!dev || dev == res.fi->fib_dev)
                                 ret = res.type;
                         fib_res_put(&res);
@@ -241,16 +241,17 @@ int fib_validate_source(__be32 src, __be32 dst, u8 tos, int oif,
                             .iif = oif };
 
         struct fib_result res;
-        int no_addr, rpf;
+        int no_addr, rpf, accept_local;
         int ret;
         struct net *net;
 
-        no_addr = rpf = 0;
+        no_addr = rpf = accept_local = 0;
         rcu_read_lock();
         in_dev = __in_dev_get_rcu(dev);
         if (in_dev) {
                 no_addr = in_dev->ifa_list == NULL;
                 rpf = IN_DEV_RPFILTER(in_dev);
+                accept_local = IN_DEV_ACCEPT_LOCAL(in_dev);
         }
         rcu_read_unlock();
 
@@ -260,8 +261,10 @@ int fib_validate_source(__be32 src, __be32 dst, u8 tos, int oif,
         net = dev_net(dev);
         if (fib_lookup(net, &fl, &res))
                 goto last_resort;
-        if (res.type != RTN_UNICAST)
-                goto e_inval_res;
+        if (res.type != RTN_UNICAST) {
+                if (res.type != RTN_LOCAL || !accept_local)
+                        goto e_inval_res;
+        }
         *spec_dst = FIB_RES_PREFSRC(res);
         fib_combine_itag(itag, &res);
 #ifdef CONFIG_IP_ROUTE_MULTIPATH
@@ -476,13 +479,13 @@ int ip_rt_ioctl(struct net *net, unsigned int cmd, void __user *arg)
                         if (cmd == SIOCDELRT) {
                                 tb = fib_get_table(net, cfg.fc_table);
                                 if (tb)
-                                        err = tb->tb_delete(tb, &cfg);
+                                        err = fib_table_delete(tb, &cfg);
                                 else
                                         err = -ESRCH;
                         } else {
                                 tb = fib_new_table(net, cfg.fc_table);
                                 if (tb)
-                                        err = tb->tb_insert(tb, &cfg);
+                                        err = fib_table_insert(tb, &cfg);
                                 else
                                         err = -ENOBUFS;
                         }
@@ -597,7 +600,7 @@ static int inet_rtm_delroute(struct sk_buff *skb, struct nlmsghdr *nlh, void *ar
                 goto errout;
         }
 
-        err = tb->tb_delete(tb, &cfg);
+        err = fib_table_delete(tb, &cfg);
 errout:
         return err;
 }
@@ -619,7 +622,7 @@ static int inet_rtm_newroute(struct sk_buff *skb, struct nlmsghdr *nlh, void *ar
                 goto errout;
         }
 
-        err = tb->tb_insert(tb, &cfg);
+        err = fib_table_insert(tb, &cfg);
 errout:
         return err;
 }
@@ -650,7 +653,7 @@ static int inet_dump_fib(struct sk_buff *skb, struct netlink_callback *cb)
                         if (dumped)
                                 memset(&cb->args[2], 0, sizeof(cb->args) -
                                                  2 * sizeof(cb->args[0]));
-                        if (tb->tb_dump(tb, skb, cb) < 0)
+                        if (fib_table_dump(tb, skb, cb) < 0)
                                 goto out;
                         dumped = 1;
 next:
@@ -704,9 +707,9 @@ static void fib_magic(int cmd, int type, __be32 dst, int dst_len, struct in_ifad
                 cfg.fc_scope = RT_SCOPE_HOST;
 
         if (cmd == RTM_NEWROUTE)
-                tb->tb_insert(tb, &cfg);
+                fib_table_insert(tb, &cfg);
         else
-                tb->tb_delete(tb, &cfg);
+                fib_table_delete(tb, &cfg);
 }
 
 void fib_add_ifaddr(struct in_ifaddr *ifa)
@@ -835,7 +838,7 @@ static void nl_fib_lookup(struct fib_result_nl *frn, struct fib_table *tb )
                 local_bh_disable();
 
                 frn->tb_id = tb->tb_id;
-                frn->err = tb->tb_lookup(tb, &fl, &res);
+                frn->err = fib_table_lookup(tb, &fl, &res);
 
                 if (!frn->err) {
                         frn->prefixlen = res.prefixlen;
@@ -895,11 +898,11 @@ static void nl_fib_lookup_exit(struct net *net)
         net->ipv4.fibnl = NULL;
 }
 
-static void fib_disable_ip(struct net_device *dev, int force)
+static void fib_disable_ip(struct net_device *dev, int force, int delay)
 {
         if (fib_sync_down_dev(dev, force))
                 fib_flush(dev_net(dev));
-        rt_cache_flush(dev_net(dev), 0);
+        rt_cache_flush(dev_net(dev), delay);
         arp_ifdown(dev);
 }
 
@@ -922,7 +925,7 @@ static int fib_inetaddr_event(struct notifier_block *this, unsigned long event,
                         /* Last address was deleted from this interface.
                            Disable IP.
                          */
-                        fib_disable_ip(dev, 1);
+                        fib_disable_ip(dev, 1, 0);
                 } else {
                         rt_cache_flush(dev_net(dev), -1);
                 }
@@ -937,7 +940,7 @@ static int fib_netdev_event(struct notifier_block *this, unsigned long event, vo
         struct in_device *in_dev = __in_dev_get_rtnl(dev);
 
         if (event == NETDEV_UNREGISTER) {
-                fib_disable_ip(dev, 2);
+                fib_disable_ip(dev, 2, -1);
                 return NOTIFY_DONE;
         }
 
@@ -955,12 +958,15 @@ static int fib_netdev_event(struct notifier_block *this, unsigned long event, vo
                 rt_cache_flush(dev_net(dev), -1);
                 break;
         case NETDEV_DOWN:
-                fib_disable_ip(dev, 0);
+                fib_disable_ip(dev, 0, 0);
                 break;
         case NETDEV_CHANGEMTU:
         case NETDEV_CHANGE:
                 rt_cache_flush(dev_net(dev), 0);
                 break;
+        case NETDEV_UNREGISTER_BATCH:
+                rt_cache_flush_batch();
+                break;
         }
         return NOTIFY_DONE;
 }
@@ -1012,7 +1018,7 @@ static void __net_exit ip_fib_net_exit(struct net *net)
                 head = &net->ipv4.fib_table_hash[i];
                 hlist_for_each_entry_safe(tb, node, tmp, head, tb_hlist) {
                         hlist_del(node);
-                        tb->tb_flush(tb);
+                        fib_table_flush(tb);
                         kfree(tb);
                 }
         }
diff --git a/net/ipv4/fib_hash.c b/net/ipv4/fib_hash.c
index ecd39454235c..14972017b9c2 100644
--- a/net/ipv4/fib_hash.c
+++ b/net/ipv4/fib_hash.c
@@ -242,8 +242,8 @@ fn_new_zone(struct fn_hash *table, int z)
         return fz;
 }
 
-static int
-fn_hash_lookup(struct fib_table *tb, const struct flowi *flp, struct fib_result *res)
+int fib_table_lookup(struct fib_table *tb,
+                     const struct flowi *flp, struct fib_result *res)
 {
         int err;
         struct fn_zone *fz;
@@ -274,8 +274,8 @@ out:
         return err;
 }
 
-static void
-fn_hash_select_default(struct fib_table *tb, const struct flowi *flp, struct fib_result *res)
+void fib_table_select_default(struct fib_table *tb,
+                              const struct flowi *flp, struct fib_result *res)
 {
         int order, last_idx;
         struct hlist_node *node;
@@ -366,7 +366,7 @@ static struct fib_node *fib_find_node(struct fn_zone *fz, __be32 key)
         return NULL;
 }
 
-static int fn_hash_insert(struct fib_table *tb, struct fib_config *cfg)
+int fib_table_insert(struct fib_table *tb, struct fib_config *cfg)
 {
         struct fn_hash *table = (struct fn_hash *) tb->tb_data;
         struct fib_node *new_f = NULL;
@@ -544,8 +544,7 @@ out:
         return err;
 }
 
-
-static int fn_hash_delete(struct fib_table *tb, struct fib_config *cfg)
+int fib_table_delete(struct fib_table *tb, struct fib_config *cfg)
 {
         struct fn_hash *table = (struct fn_hash *)tb->tb_data;
         struct fib_node *f;
@@ -662,7 +661,7 @@ static int fn_flush_list(struct fn_zone *fz, int idx)
         return found;
 }
 
-static int fn_hash_flush(struct fib_table *tb)
+int fib_table_flush(struct fib_table *tb)
 {
         struct fn_hash *table = (struct fn_hash *) tb->tb_data;
         struct fn_zone *fz;
@@ -743,7 +742,8 @@ fn_hash_dump_zone(struct sk_buff *skb, struct netlink_callback *cb,
         return skb->len;
 }
 
-static int fn_hash_dump(struct fib_table *tb, struct sk_buff *skb, struct netlink_callback *cb)
+int fib_table_dump(struct fib_table *tb, struct sk_buff *skb,
+                   struct netlink_callback *cb)
 {
         int m, s_m;
         struct fn_zone *fz;
@@ -787,12 +787,7 @@ struct fib_table *fib_hash_table(u32 id)
 
         tb->tb_id = id;
         tb->tb_default = -1;
-        tb->tb_lookup = fn_hash_lookup;
-        tb->tb_insert = fn_hash_insert;
-        tb->tb_delete = fn_hash_delete;
-        tb->tb_flush = fn_hash_flush;
-        tb->tb_select_default = fn_hash_select_default;
-        tb->tb_dump = fn_hash_dump;
+
         memset(tb->tb_data, 0, sizeof(struct fn_hash));
         return tb;
 }
diff --git a/net/ipv4/fib_rules.c b/net/ipv4/fib_rules.c
index 92d9d97ec5e3..ca2d07b1c706 100644
--- a/net/ipv4/fib_rules.c
+++ b/net/ipv4/fib_rules.c
@@ -94,7 +94,7 @@ static int fib4_rule_action(struct fib_rule *rule, struct flowi *flp,
         if ((tbl = fib_get_table(rule->fr_net, rule->table)) == NULL)
                 goto errout;
 
-        err = tbl->tb_lookup(tbl, flp, (struct fib_result *) arg->result);
+        err = fib_table_lookup(tbl, flp, (struct fib_result *) arg->result);
         if (err > 0)
                 err = -EAGAIN;
 errout:
@@ -284,7 +284,7 @@ static int fib_default_rules_init(struct fib_rules_ops *ops)
 {
         int err;
 
-        err = fib_default_rule_add(ops, 0, RT_TABLE_LOCAL, FIB_RULE_PERMANENT);
+        err = fib_default_rule_add(ops, 0, RT_TABLE_LOCAL, 0);
         if (err < 0)
                 return err;
         err = fib_default_rule_add(ops, 0x7FFE, RT_TABLE_MAIN, 0);
@@ -301,13 +301,9 @@ int __net_init fib4_rules_init(struct net *net)
         int err;
         struct fib_rules_ops *ops;
 
-        ops = kmemdup(&fib4_rules_ops_template, sizeof(*ops), GFP_KERNEL);
-        if (ops == NULL)
-                return -ENOMEM;
-        INIT_LIST_HEAD(&ops->rules_list);
-        ops->fro_net = net;
-
-        fib_rules_register(ops);
+        ops = fib_rules_register(&fib4_rules_ops_template, net);
+        if (IS_ERR(ops))
+                return PTR_ERR(ops);
 
         err = fib_default_rules_init(ops);
         if (err < 0)
@@ -318,12 +314,10 @@ int __net_init fib4_rules_init(struct net *net)
 fail:
         /* also cleans all rules already added */
         fib_rules_unregister(ops);
-        kfree(ops);
         return err;
 }
 
 void __net_exit fib4_rules_exit(struct net *net)
 {
         fib_rules_unregister(net->ipv4.rules_ops);
-        kfree(net->ipv4.rules_ops);
 }
diff --git a/net/ipv4/fib_semantics.c b/net/ipv4/fib_semantics.c
index 9b096d6ff3f2..ed19aa6919c2 100644
--- a/net/ipv4/fib_semantics.c
+++ b/net/ipv4/fib_semantics.c
@@ -228,7 +228,7 @@ static struct fib_info *fib_find_info(const struct fib_info *nfi)
         head = &fib_info_hash[hash];
 
         hlist_for_each_entry(fi, node, head, fib_hash) {
-                if (fi->fib_net != nfi->fib_net)
+                if (!net_eq(fi->fib_net, nfi->fib_net))
                         continue;
                 if (fi->fib_nhs != nfi->fib_nhs)
                         continue;
@@ -1047,7 +1047,7 @@ int fib_sync_down_addr(struct net *net, __be32 local)
                 return 0;
 
         hlist_for_each_entry(fi, node, head, fib_lhash) {
-                if (fi->fib_net != net)
+                if (!net_eq(fi->fib_net, net))
                         continue;
                 if (fi->fib_prefsrc == local) {
                         fi->fib_flags |= RTNH_F_DEAD;
diff --git a/net/ipv4/fib_trie.c b/net/ipv4/fib_trie.c
index 291bdf50a21f..af5d89792860 100644
--- a/net/ipv4/fib_trie.c
+++ b/net/ipv4/fib_trie.c
@@ -1174,7 +1174,7 @@ done:
 /*
  * Caller must hold RTNL.
  */
-static int fn_trie_insert(struct fib_table *tb, struct fib_config *cfg)
+int fib_table_insert(struct fib_table *tb, struct fib_config *cfg)
 {
         struct trie *t = (struct trie *) tb->tb_data;
         struct fib_alias *fa, *new_fa;
@@ -1373,8 +1373,8 @@ static int check_leaf(struct trie *t, struct leaf *l,
         return 1;
 }
 
-static int fn_trie_lookup(struct fib_table *tb, const struct flowi *flp,
-                          struct fib_result *res)
+int fib_table_lookup(struct fib_table *tb, const struct flowi *flp,
+                     struct fib_result *res)
 {
         struct trie *t = (struct trie *) tb->tb_data;
         int ret;
@@ -1595,7 +1595,7 @@ static void trie_leaf_remove(struct trie *t, struct leaf *l)
 /*
  * Caller must hold RTNL.
  */
-static int fn_trie_delete(struct fib_table *tb, struct fib_config *cfg)
+int fib_table_delete(struct fib_table *tb, struct fib_config *cfg)
 {
         struct trie *t = (struct trie *) tb->tb_data;
         u32 key, mask;
@@ -1786,7 +1786,7 @@ static struct leaf *trie_leafindex(struct trie *t, int index)
 /*
  * Caller must hold RTNL.
  */
-static int fn_trie_flush(struct fib_table *tb)
+int fib_table_flush(struct fib_table *tb)
 {
         struct trie *t = (struct trie *) tb->tb_data;
         struct leaf *l, *ll = NULL;
@@ -1807,9 +1807,9 @@ static int fn_trie_flush(struct fib_table *tb)
         return found;
 }
 
-static void fn_trie_select_default(struct fib_table *tb,
-                                   const struct flowi *flp,
-                                   struct fib_result *res)
+void fib_table_select_default(struct fib_table *tb,
+                              const struct flowi *flp,
+                              struct fib_result *res)
 {
         struct trie *t = (struct trie *) tb->tb_data;
         int order, last_idx;
@@ -1952,8 +1952,8 @@ static int fn_trie_dump_leaf(struct leaf *l, struct fib_table *tb,
         return skb->len;
 }
 
-static int fn_trie_dump(struct fib_table *tb, struct sk_buff *skb,
-                        struct netlink_callback *cb)
+int fib_table_dump(struct fib_table *tb, struct sk_buff *skb,
+                   struct netlink_callback *cb)
 {
         struct leaf *l;
         struct trie *t = (struct trie *) tb->tb_data;
@@ -2020,12 +2020,6 @@ struct fib_table *fib_hash_table(u32 id)
 
         tb->tb_id = id;
         tb->tb_default = -1;
-        tb->tb_lookup = fn_trie_lookup;
-        tb->tb_insert = fn_trie_insert;
-        tb->tb_delete = fn_trie_delete;
-        tb->tb_flush = fn_trie_flush;
-        tb->tb_select_default = fn_trie_select_default;
-        tb->tb_dump = fn_trie_dump;
 
         t = (struct trie *) tb->tb_data;
         memset(t, 0, sizeof(*t));
diff --git a/net/ipv4/icmp.c b/net/ipv4/icmp.c
index 5bc13fe816d1..fe11f60ce41b 100644
--- a/net/ipv4/icmp.c
+++ b/net/ipv4/icmp.c
@@ -501,15 +501,16 @@ void icmp_send(struct sk_buff *skb_in, int type, int code, __be32 info)
         if (!(rt->rt_flags & RTCF_LOCAL)) {
                 struct net_device *dev = NULL;
 
+                rcu_read_lock();
                 if (rt->fl.iif &&
                         net->ipv4.sysctl_icmp_errors_use_inbound_ifaddr)
-                        dev = dev_get_by_index(net, rt->fl.iif);
+                        dev = dev_get_by_index_rcu(net, rt->fl.iif);
 
-                if (dev) {
+                if (dev)
                         saddr = inet_select_addr(dev, 0, RT_SCOPE_LINK);
-                        dev_put(dev);
-                } else
+                else
                         saddr = 0;
+                rcu_read_unlock();
         }
 
         tos = icmp_pointers[type].error ? ((iph->tos & IPTOS_TOS_MASK) |
@@ -1165,6 +1166,10 @@ static int __net_init icmp_sk_init(struct net *net)
                 sk->sk_sndbuf =
                         (2 * ((64 * 1024) + sizeof(struct sk_buff)));
 
+                /*
+                 * Speedup sock_wfree()
+                 */
+                sock_set_flag(sk, SOCK_USE_WRITE_QUEUE);
                 inet_sk(sk)->pmtudisc = IP_PMTUDISC_DONT;
         }
 
diff --git a/net/ipv4/igmp.c b/net/ipv4/igmp.c
index d41e5de79a82..76c08402c933 100644
--- a/net/ipv4/igmp.c
+++ b/net/ipv4/igmp.c
@@ -1899,8 +1899,9 @@ int ip_mc_source(int add, int omode, struct sock *sk, struct
         err = -EADDRNOTAVAIL;
 
         for (pmc=inet->mc_list; pmc; pmc=pmc->next) {
-                if (pmc->multi.imr_multiaddr.s_addr == imr.imr_multiaddr.s_addr
-                    && pmc->multi.imr_ifindex == imr.imr_ifindex)
+                if ((pmc->multi.imr_multiaddr.s_addr ==
+                     imr.imr_multiaddr.s_addr) &&
+                    (pmc->multi.imr_ifindex == imr.imr_ifindex))
                         break;
         }
         if (!pmc) {             /* must have a prior join */
@@ -2311,9 +2312,10 @@ static inline struct ip_mc_list *igmp_mc_get_first(struct seq_file *seq)
         struct igmp_mc_iter_state *state = igmp_mc_seq_private(seq);
 
         state->in_dev = NULL;
-        for_each_netdev(net, state->dev) {
+        for_each_netdev_rcu(net, state->dev) {
                 struct in_device *in_dev;
-                in_dev = in_dev_get(state->dev);
+
+                in_dev = __in_dev_get_rcu(state->dev);
                 if (!in_dev)
                         continue;
                 read_lock(&in_dev->mc_list_lock);
@@ -2323,7 +2325,6 @@ static inline struct ip_mc_list *igmp_mc_get_first(struct seq_file *seq)
                         break;
                 }
                 read_unlock(&in_dev->mc_list_lock);
-                in_dev_put(in_dev);
         }
         return im;
 }
@@ -2333,16 +2334,15 @@ static struct ip_mc_list *igmp_mc_get_next(struct seq_file *seq, struct ip_mc_li
         struct igmp_mc_iter_state *state = igmp_mc_seq_private(seq);
         im = im->next;
         while (!im) {
-                if (likely(state->in_dev != NULL)) {
+                if (likely(state->in_dev != NULL))
                         read_unlock(&state->in_dev->mc_list_lock);
-                        in_dev_put(state->in_dev);
-                }
-                state->dev = next_net_device(state->dev);
+
+                state->dev = next_net_device_rcu(state->dev);
                 if (!state->dev) {
                         state->in_dev = NULL;
                         break;
                 }
-                state->in_dev = in_dev_get(state->dev);
+                state->in_dev = __in_dev_get_rcu(state->dev);
                 if (!state->in_dev)
                         continue;
                 read_lock(&state->in_dev->mc_list_lock);
@@ -2361,9 +2361,9 @@ static struct ip_mc_list *igmp_mc_get_idx(struct seq_file *seq, loff_t pos)
 }
 
 static void *igmp_mc_seq_start(struct seq_file *seq, loff_t *pos)
-        __acquires(dev_base_lock)
+        __acquires(rcu)
 {
-        read_lock(&dev_base_lock);
+        rcu_read_lock();
         return *pos ? igmp_mc_get_idx(seq, *pos - 1) : SEQ_START_TOKEN;
 }
 
@@ -2379,16 +2379,15 @@ static void *igmp_mc_seq_next(struct seq_file *seq, void *v, loff_t *pos)
 }
 
 static void igmp_mc_seq_stop(struct seq_file *seq, void *v)
-        __releases(dev_base_lock)
+        __releases(rcu)
 {
         struct igmp_mc_iter_state *state = igmp_mc_seq_private(seq);
         if (likely(state->in_dev != NULL)) {
                 read_unlock(&state->in_dev->mc_list_lock);
-                in_dev_put(state->in_dev);
                 state->in_dev = NULL;
         }
         state->dev = NULL;
-        read_unlock(&dev_base_lock);
+        rcu_read_unlock();
 }
 
 static int igmp_mc_seq_show(struct seq_file *seq, void *v)
@@ -2462,9 +2461,9 @@ static inline struct ip_sf_list *igmp_mcf_get_first(struct seq_file *seq)
 
         state->idev = NULL;
         state->im = NULL;
-        for_each_netdev(net, state->dev) {
+        for_each_netdev_rcu(net, state->dev) {
                 struct in_device *idev;
-                idev = in_dev_get(state->dev);
+                idev = __in_dev_get_rcu(state->dev);
                 if (unlikely(idev == NULL))
                         continue;
                 read_lock(&idev->mc_list_lock);
@@ -2480,7 +2479,6 @@ static inline struct ip_sf_list *igmp_mcf_get_first(struct seq_file *seq)
                         spin_unlock_bh(&im->lock);
                 }
                 read_unlock(&idev->mc_list_lock);
-                in_dev_put(idev);
         }
         return psf;
 }
@@ -2494,16 +2492,15 @@ static struct ip_sf_list *igmp_mcf_get_next(struct seq_file *seq, struct ip_sf_l
                 spin_unlock_bh(&state->im->lock);
                 state->im = state->im->next;
                 while (!state->im) {
-                        if (likely(state->idev != NULL)) {
+                        if (likely(state->idev != NULL))
                                 read_unlock(&state->idev->mc_list_lock);
-                                in_dev_put(state->idev);
-                        }
-                        state->dev = next_net_device(state->dev);
+
+                        state->dev = next_net_device_rcu(state->dev);
                         if (!state->dev) {
                                 state->idev = NULL;
                                 goto out;
                         }
-                        state->idev = in_dev_get(state->dev);
+                        state->idev = __in_dev_get_rcu(state->dev);
                         if (!state->idev)
                                 continue;
                         read_lock(&state->idev->mc_list_lock);
@@ -2528,8 +2525,9 @@ static struct ip_sf_list *igmp_mcf_get_idx(struct seq_file *seq, loff_t pos)
 }
 
 static void *igmp_mcf_seq_start(struct seq_file *seq, loff_t *pos)
+        __acquires(rcu)
 {
-        read_lock(&dev_base_lock);
+        rcu_read_lock();
         return *pos ? igmp_mcf_get_idx(seq, *pos - 1) : SEQ_START_TOKEN;
 }
 
@@ -2545,6 +2543,7 @@ static void *igmp_mcf_seq_next(struct seq_file *seq, void *v, loff_t *pos)
 }
 
 static void igmp_mcf_seq_stop(struct seq_file *seq, void *v)
+        __releases(rcu)
 {
         struct igmp_mcf_iter_state *state = igmp_mcf_seq_private(seq);
         if (likely(state->im != NULL)) {
@@ -2553,11 +2552,10 @@ static void igmp_mcf_seq_stop(struct seq_file *seq, void *v)
         }
         if (likely(state->idev != NULL)) {
                 read_unlock(&state->idev->mc_list_lock);
-                in_dev_put(state->idev);
                 state->idev = NULL;
         }
         state->dev = NULL;
-        read_unlock(&dev_base_lock);
+        rcu_read_unlock();
 }
 
 static int igmp_mcf_seq_show(struct seq_file *seq, void *v)
diff --git a/net/ipv4/inet_connection_sock.c b/net/ipv4/inet_connection_sock.c
index 537731b3bcb3..ee16475f8fc3 100644
--- a/net/ipv4/inet_connection_sock.c
+++ b/net/ipv4/inet_connection_sock.c
@@ -112,7 +112,7 @@ again:
                                         hashinfo->bhash_size)];
                         spin_lock(&head->lock);
                         inet_bind_bucket_for_each(tb, node, &head->chain)
-                                if (ib_net(tb) == net && tb->port == rover) {
+                                if (net_eq(ib_net(tb), net) && tb->port == rover) {
                                         if (tb->fastreuse > 0 &&
                                             sk->sk_reuse &&
                                             sk->sk_state != TCP_LISTEN &&
@@ -158,7 +158,7 @@ have_snum:
                                 hashinfo->bhash_size)];
                 spin_lock(&head->lock);
                 inet_bind_bucket_for_each(tb, node, &head->chain)
-                        if (ib_net(tb) == net && tb->port == snum)
+                        if (net_eq(ib_net(tb), net) && tb->port == snum)
                                 goto tb_found;
         }
         tb = NULL;
@@ -358,6 +358,7 @@ struct dst_entry *inet_csk_route_req(struct sock *sk,
         const struct inet_request_sock *ireq = inet_rsk(req);
         struct ip_options *opt = inet_rsk(req)->opt;
         struct flowi fl = { .oif = sk->sk_bound_dev_if,
+                            .mark = sk->sk_mark,
                             .nl_u = { .ip4_u =
                                       { .daddr = ((opt && opt->srr) ?
                                                   opt->faddr :
@@ -367,7 +368,7 @@ struct dst_entry *inet_csk_route_req(struct sock *sk,
                             .proto = sk->sk_protocol,
                             .flags = inet_sk_flowi_flags(sk),
                             .uli_u = { .ports =
-                                       { .sport = inet_sk(sk)->sport,
+                                       { .sport = inet_sk(sk)->inet_sport,
                                          .dport = ireq->rmt_port } } };
         struct net *net = sock_net(sk);
 
@@ -530,7 +531,7 @@ void inet_csk_reqsk_queue_prune(struct sock *parent,
                                                &expire, &resend);
                                 if (!expire &&
                                     (!resend ||
-                                     !req->rsk_ops->rtx_syn_ack(parent, req) ||
+                                     !req->rsk_ops->rtx_syn_ack(parent, req, NULL) ||
                                      inet_rsk(req)->acked)) {
                                         unsigned long timeo;
 
@@ -574,9 +575,9 @@ struct sock *inet_csk_clone(struct sock *sk, const struct request_sock *req,
                 newsk->sk_state = TCP_SYN_RECV;
                 newicsk->icsk_bind_hash = NULL;
 
-                inet_sk(newsk)->dport = inet_rsk(req)->rmt_port;
-                inet_sk(newsk)->num = ntohs(inet_rsk(req)->loc_port);
-                inet_sk(newsk)->sport = inet_rsk(req)->loc_port;
+                inet_sk(newsk)->inet_dport = inet_rsk(req)->rmt_port;
+                inet_sk(newsk)->inet_num = ntohs(inet_rsk(req)->loc_port);
+                inet_sk(newsk)->inet_sport = inet_rsk(req)->loc_port;
                 newsk->sk_write_space = sk_stream_write_space;
 
                 newicsk->icsk_retransmits = 0;
@@ -607,8 +608,8 @@ void inet_csk_destroy_sock(struct sock *sk)
         /* It cannot be in hash table! */
         WARN_ON(!sk_unhashed(sk));
 
-        /* If it has not 0 inet_sk(sk)->num, it must be bound */
-        WARN_ON(inet_sk(sk)->num && !inet_csk(sk)->icsk_bind_hash);
+        /* If it has not 0 inet_sk(sk)->inet_num, it must be bound */
+        WARN_ON(inet_sk(sk)->inet_num && !inet_csk(sk)->icsk_bind_hash);
 
         sk->sk_prot->destroy(sk);
 
@@ -643,8 +644,8 @@ int inet_csk_listen_start(struct sock *sk, const int nr_table_entries)
          * after validation is complete.
          */
         sk->sk_state = TCP_LISTEN;
-        if (!sk->sk_prot->get_port(sk, inet->num)) {
-                inet->sport = htons(inet->num);
+        if (!sk->sk_prot->get_port(sk, inet->inet_num)) {
+                inet->inet_sport = htons(inet->inet_num);
 
                 sk_dst_reset(sk);
                 sk->sk_prot->hash(sk);
@@ -720,8 +721,8 @@ void inet_csk_addr2sockaddr(struct sock *sk, struct sockaddr *uaddr)
         const struct inet_sock *inet = inet_sk(sk);
 
         sin->sin_family         = AF_INET;
-        sin->sin_addr.s_addr    = inet->daddr;
-        sin->sin_port           = inet->dport;
+        sin->sin_addr.s_addr    = inet->inet_daddr;
+        sin->sin_port           = inet->inet_dport;
 }
 
 EXPORT_SYMBOL_GPL(inet_csk_addr2sockaddr);
diff --git a/net/ipv4/inet_diag.c b/net/ipv4/inet_diag.c
index a706a47f4dbb..bdb78dd180ce 100644
--- a/net/ipv4/inet_diag.c
+++ b/net/ipv4/inet_diag.c
@@ -116,10 +116,10 @@ static int inet_csk_diag_fill(struct sock *sk,
         r->id.idiag_cookie[0] = (u32)(unsigned long)sk;
         r->id.idiag_cookie[1] = (u32)(((unsigned long)sk >> 31) >> 1);
 
-        r->id.idiag_sport = inet->sport;
-        r->id.idiag_dport = inet->dport;
-        r->id.idiag_src[0] = inet->rcv_saddr;
-        r->id.idiag_dst[0] = inet->daddr;
+        r->id.idiag_sport = inet->inet_sport;
+        r->id.idiag_dport = inet->inet_dport;
+        r->id.idiag_src[0] = inet->inet_rcv_saddr;
+        r->id.idiag_dst[0] = inet->inet_daddr;
 
 #if defined(CONFIG_IPV6) || defined (CONFIG_IPV6_MODULE)
         if (r->idiag_family == AF_INET6) {
@@ -504,11 +504,11 @@ static int inet_csk_diag_dump(struct sock *sk,
                 } else
 #endif
                 {
-                        entry.saddr = &inet->rcv_saddr;
-                        entry.daddr = &inet->daddr;
+                        entry.saddr = &inet->inet_rcv_saddr;
+                        entry.daddr = &inet->inet_daddr;
                 }
-                entry.sport = inet->num;
-                entry.dport = ntohs(inet->dport);
+                entry.sport = inet->inet_num;
+                entry.dport = ntohs(inet->inet_dport);
                 entry.userlocks = sk->sk_userlocks;
 
                 if (!inet_diag_bc_run(RTA_DATA(bc), RTA_PAYLOAD(bc), &entry))
@@ -584,7 +584,7 @@ static int inet_diag_fill_req(struct sk_buff *skb, struct sock *sk,
         if (tmo < 0)
                 tmo = 0;
 
-        r->id.idiag_sport = inet->sport;
+        r->id.idiag_sport = inet->inet_sport;
         r->id.idiag_dport = ireq->rmt_port;
         r->id.idiag_src[0] = ireq->loc_addr;
         r->id.idiag_dst[0] = ireq->rmt_addr;
@@ -639,7 +639,7 @@ static int inet_diag_dump_reqs(struct sk_buff *skb, struct sock *sk,
 
         if (cb->nlh->nlmsg_len > 4 + NLMSG_SPACE(sizeof(*r))) {
                 bc = (struct rtattr *)(r + 1);
-                entry.sport = inet->num;
+                entry.sport = inet->inet_num;
                 entry.userlocks = sk->sk_userlocks;
         }
 
@@ -732,7 +732,7 @@ static int inet_diag_dump(struct sk_buff *skb, struct netlink_callback *cb)
                                         continue;
                                 }
 
-                                if (r->id.idiag_sport != inet->sport &&
+                                if (r->id.idiag_sport != inet->inet_sport &&
                                     r->id.idiag_sport)
                                         goto next_listen;
 
@@ -774,7 +774,7 @@ skip_listen_ht:
         if (!(r->idiag_states & ~(TCPF_LISTEN | TCPF_SYN_RECV)))
                 goto unlock;
 
-        for (i = s_i; i < hashinfo->ehash_size; i++) {
+        for (i = s_i; i <= hashinfo->ehash_mask; i++) {
                 struct inet_ehash_bucket *head = &hashinfo->ehash[i];
                 spinlock_t *lock = inet_ehash_lockp(hashinfo, i);
                 struct sock *sk;
@@ -797,10 +797,10 @@ skip_listen_ht:
                                 goto next_normal;
                         if (!(r->idiag_states & (1 << sk->sk_state)))
                                 goto next_normal;
-                        if (r->id.idiag_sport != inet->sport &&
+                        if (r->id.idiag_sport != inet->inet_sport &&
                             r->id.idiag_sport)
                                 goto next_normal;
-                        if (r->id.idiag_dport != inet->dport &&
+                        if (r->id.idiag_dport != inet->inet_dport &&
                             r->id.idiag_dport)
                                 goto next_normal;
                         if (inet_csk_diag_dump(sk, skb, cb) < 0) {
diff --git a/net/ipv4/inet_hashtables.c b/net/ipv4/inet_hashtables.c
index 625cc5f64c94..21e5e32d8c60 100644
--- a/net/ipv4/inet_hashtables.c
+++ b/net/ipv4/inet_hashtables.c
@@ -64,7 +64,7 @@ void inet_bind_hash(struct sock *sk, struct inet_bind_bucket *tb,
 
         atomic_inc(&hashinfo->bsockets);
 
-        inet_sk(sk)->num = snum;
+        inet_sk(sk)->inet_num = snum;
         sk_add_bind_node(sk, &tb->owners);
         tb->num_owners++;
         inet_csk(sk)->icsk_bind_hash = tb;
@@ -76,7 +76,7 @@ void inet_bind_hash(struct sock *sk, struct inet_bind_bucket *tb,
 static void __inet_put_port(struct sock *sk)
 {
         struct inet_hashinfo *hashinfo = sk->sk_prot->h.hashinfo;
-        const int bhash = inet_bhashfn(sock_net(sk), inet_sk(sk)->num,
+        const int bhash = inet_bhashfn(sock_net(sk), inet_sk(sk)->inet_num,
                         hashinfo->bhash_size);
         struct inet_bind_hashbucket *head = &hashinfo->bhash[bhash];
         struct inet_bind_bucket *tb;
@@ -88,7 +88,7 @@ static void __inet_put_port(struct sock *sk)
         __sk_del_bind_node(sk);
         tb->num_owners--;
         inet_csk(sk)->icsk_bind_hash = NULL;
-        inet_sk(sk)->num = 0;
+        inet_sk(sk)->inet_num = 0;
         inet_bind_bucket_destroy(hashinfo->bind_bucket_cachep, tb);
         spin_unlock(&head->lock);
 }
@@ -105,7 +105,7 @@ EXPORT_SYMBOL(inet_put_port);
 void __inet_inherit_port(struct sock *sk, struct sock *child)
 {
         struct inet_hashinfo *table = sk->sk_prot->h.hashinfo;
-        const int bhash = inet_bhashfn(sock_net(sk), inet_sk(child)->num,
+        const int bhash = inet_bhashfn(sock_net(sk), inet_sk(child)->inet_num,
                         table->bhash_size);
         struct inet_bind_hashbucket *head = &table->bhash[bhash];
         struct inet_bind_bucket *tb;
@@ -126,9 +126,9 @@ static inline int compute_score(struct sock *sk, struct net *net,
         int score = -1;
         struct inet_sock *inet = inet_sk(sk);
 
-        if (net_eq(sock_net(sk), net) && inet->num == hnum &&
+        if (net_eq(sock_net(sk), net) && inet->inet_num == hnum &&
                         !ipv6_only_sock(sk)) {
-                __be32 rcv_saddr = inet->rcv_saddr;
+                __be32 rcv_saddr = inet->inet_rcv_saddr;
                 score = sk->sk_family == PF_INET ? 1 : 0;
                 if (rcv_saddr) {
                         if (rcv_saddr != daddr)
@@ -209,7 +209,7 @@ struct sock * __inet_lookup_established(struct net *net,
          * have wildcards anyways.
          */
         unsigned int hash = inet_ehashfn(net, daddr, hnum, saddr, sport);
-        unsigned int slot = hash & (hashinfo->ehash_size - 1);
+        unsigned int slot = hash & hashinfo->ehash_mask;
         struct inet_ehash_bucket *head = &hashinfo->ehash[slot];
 
         rcu_read_lock();
@@ -273,18 +273,20 @@ static int __inet_check_established(struct inet_timewait_death_row *death_row,
 {
         struct inet_hashinfo *hinfo = death_row->hashinfo;
         struct inet_sock *inet = inet_sk(sk);
-        __be32 daddr = inet->rcv_saddr;
-        __be32 saddr = inet->daddr;
+        __be32 daddr = inet->inet_rcv_saddr;
+        __be32 saddr = inet->inet_daddr;
         int dif = sk->sk_bound_dev_if;
         INET_ADDR_COOKIE(acookie, saddr, daddr)
-        const __portpair ports = INET_COMBINED_PORTS(inet->dport, lport);
+        const __portpair ports = INET_COMBINED_PORTS(inet->inet_dport, lport);
         struct net *net = sock_net(sk);
-        unsigned int hash = inet_ehashfn(net, daddr, lport, saddr, inet->dport);
+        unsigned int hash = inet_ehashfn(net, daddr, lport,
+                                         saddr, inet->inet_dport);
         struct inet_ehash_bucket *head = inet_ehash_bucket(hinfo, hash);
         spinlock_t *lock = inet_ehash_lockp(hinfo, hash);
         struct sock *sk2;
         const struct hlist_nulls_node *node;
         struct inet_timewait_sock *tw;
+        int twrefcnt = 0;
 
         spin_lock(lock);
 
@@ -312,25 +314,28 @@ static int __inet_check_established(struct inet_timewait_death_row *death_row,
 unique:
         /* Must record num and sport now. Otherwise we will see
          * in hash table socket with a funny identity. */
-        inet->num = lport;
-        inet->sport = htons(lport);
+        inet->inet_num = lport;
+        inet->inet_sport = htons(lport);
         sk->sk_hash = hash;
         WARN_ON(!sk_unhashed(sk));
         __sk_nulls_add_node_rcu(sk, &head->chain);
+        if (tw) {
+                twrefcnt = inet_twsk_unhash(tw);
+                NET_INC_STATS_BH(net, LINUX_MIB_TIMEWAITRECYCLED);
+        }
         spin_unlock(lock);
+        if (twrefcnt)
+                inet_twsk_put(tw);
         sock_prot_inuse_add(sock_net(sk), sk->sk_prot, 1);
 
         if (twp) {
                 *twp = tw;
-                NET_INC_STATS_BH(net, LINUX_MIB_TIMEWAITRECYCLED);
         } else if (tw) {
                 /* Silly. Should hash-dance instead... */
                 inet_twsk_deschedule(tw, death_row);
-                NET_INC_STATS_BH(net, LINUX_MIB_TIMEWAITRECYCLED);
 
                 inet_twsk_put(tw);
         }
-
         return 0;
 
 not_unique:
@@ -341,8 +346,9 @@ not_unique:
 static inline u32 inet_sk_port_offset(const struct sock *sk)
 {
         const struct inet_sock *inet = inet_sk(sk);
-        return secure_ipv4_port_ephemeral(inet->rcv_saddr, inet->daddr,
-                                          inet->dport);
+        return secure_ipv4_port_ephemeral(inet->inet_rcv_saddr,
+                                          inet->inet_daddr,
+                                          inet->inet_dport);
 }
 
 void __inet_hash_nolisten(struct sock *sk)
@@ -424,7 +430,7 @@ int __inet_hash_connect(struct inet_timewait_death_row *death_row,
                 void (*hash)(struct sock *sk))
 {
         struct inet_hashinfo *hinfo = death_row->hashinfo;
-        const unsigned short snum = inet_sk(sk)->num;
+        const unsigned short snum = inet_sk(sk)->inet_num;
         struct inet_bind_hashbucket *head;
         struct inet_bind_bucket *tb;
         int ret;
@@ -452,7 +458,8 @@ int __inet_hash_connect(struct inet_timewait_death_row *death_row,
                          * unique enough.
                          */
                         inet_bind_bucket_for_each(tb, node, &head->chain) {
-                                if (ib_net(tb) == net && tb->port == port) {
+                                if (net_eq(ib_net(tb), net) &&
+                                    tb->port == port) {
                                         if (tb->fastreuse >= 0)
                                                 goto next_port;
                                         WARN_ON(hlist_empty(&tb->owners));
@@ -485,7 +492,7 @@ ok:
                 /* Head lock still held and bh's disabled */
                 inet_bind_hash(sk, tb, port);
                 if (sk_unhashed(sk)) {
-                        inet_sk(sk)->sport = htons(port);
+                        inet_sk(sk)->inet_sport = htons(port);
                         hash(sk);
                 }
                 spin_unlock(&head->lock);
diff --git a/net/ipv4/inet_lro.c b/net/ipv4/inet_lro.c
index 6a667dae315e..47038cb6c138 100644
--- a/net/ipv4/inet_lro.c
+++ b/net/ipv4/inet_lro.c
@@ -64,15 +64,15 @@ static int lro_tcp_ip_check(struct iphdr *iph, struct tcphdr *tcph,
         if (iph->ihl != IPH_LEN_WO_OPTIONS)
                 return -1;
 
-        if (tcph->cwr || tcph->ece || tcph->urg || !tcph->ack
-            || tcph->rst || tcph->syn || tcph->fin)
+        if (tcph->cwr || tcph->ece || tcph->urg || !tcph->ack ||
+            tcph->rst || tcph->syn || tcph->fin)
                 return -1;
 
         if (INET_ECN_is_ce(ipv4_get_dsfield(iph)))
                 return -1;
 
-        if (tcph->doff != TCPH_LEN_WO_OPTIONS
-            && tcph->doff != TCPH_LEN_W_TIMESTAMP)
+        if (tcph->doff != TCPH_LEN_WO_OPTIONS &&
+            tcph->doff != TCPH_LEN_W_TIMESTAMP)
                 return -1;
 
         /* check tcp options (only timestamp allowed) */
@@ -262,10 +262,10 @@ static int lro_check_tcp_conn(struct net_lro_desc *lro_desc,
                               struct iphdr *iph,
                               struct tcphdr *tcph)
 {
-        if ((lro_desc->iph->saddr != iph->saddr)
-            || (lro_desc->iph->daddr != iph->daddr)
-            || (lro_desc->tcph->source != tcph->source)
-            || (lro_desc->tcph->dest != tcph->dest))
+        if ((lro_desc->iph->saddr != iph->saddr) ||
+            (lro_desc->iph->daddr != iph->daddr) ||
+            (lro_desc->tcph->source != tcph->source) ||
+            (lro_desc->tcph->dest != tcph->dest))
                 return -1;
         return 0;
 }
@@ -339,9 +339,9 @@ static int __lro_proc_skb(struct net_lro_mgr *lro_mgr, struct sk_buff *skb,
         u64 flags;
         int vlan_hdr_len = 0;
 
-        if (!lro_mgr->get_skb_header
-            || lro_mgr->get_skb_header(skb, (void *)&iph, (void *)&tcph,
-                                       &flags, priv))
+        if (!lro_mgr->get_skb_header ||
+            lro_mgr->get_skb_header(skb, (void *)&iph, (void *)&tcph,
+                                    &flags, priv))
                 goto out;
 
         if (!(flags & LRO_IPV4) || !(flags & LRO_TCP))
@@ -351,8 +351,8 @@ static int __lro_proc_skb(struct net_lro_mgr *lro_mgr, struct sk_buff *skb,
         if (!lro_desc)
                 goto out;
 
-        if ((skb->protocol == htons(ETH_P_8021Q))
-            && !(lro_mgr->features & LRO_F_EXTRACT_VLAN_ID))
+        if ((skb->protocol == htons(ETH_P_8021Q)) &&
+            !(lro_mgr->features & LRO_F_EXTRACT_VLAN_ID))
                 vlan_hdr_len = VLAN_HLEN;
 
         if (!lro_desc->active) { /* start new lro session */
@@ -446,9 +446,9 @@ static struct sk_buff *__lro_proc_segment(struct net_lro_mgr *lro_mgr,
         int hdr_len = LRO_MAX_PG_HLEN;
         int vlan_hdr_len = 0;
 
-        if (!lro_mgr->get_frag_header
-            || lro_mgr->get_frag_header(frags, (void *)&mac_hdr, (void *)&iph,
-                                        (void *)&tcph, &flags, priv)) {
+        if (!lro_mgr->get_frag_header ||
+            lro_mgr->get_frag_header(frags, (void *)&mac_hdr, (void *)&iph,
+                                     (void *)&tcph, &flags, priv)) {
                 mac_hdr = page_address(frags->page) + frags->page_offset;
                 goto out1;
         }
@@ -472,8 +472,8 @@ static struct sk_buff *__lro_proc_segment(struct net_lro_mgr *lro_mgr,
                 if (!skb)
                         goto out;
 
-                if ((skb->protocol == htons(ETH_P_8021Q))
-                    && !(lro_mgr->features & LRO_F_EXTRACT_VLAN_ID))
+                if ((skb->protocol == htons(ETH_P_8021Q)) &&
+                    !(lro_mgr->features & LRO_F_EXTRACT_VLAN_ID))
                         vlan_hdr_len = VLAN_HLEN;
 
                 iph = (void *)(skb->data + vlan_hdr_len);
diff --git a/net/ipv4/inet_timewait_sock.c b/net/ipv4/inet_timewait_sock.c
index 13f0781f35cd..0fdf45e4c90c 100644
--- a/net/ipv4/inet_timewait_sock.c
+++ b/net/ipv4/inet_timewait_sock.c
@@ -14,22 +14,33 @@
 #include <net/inet_timewait_sock.h>
 #include <net/ip.h>
 
+
+/*
+ * unhash a timewait socket from established hash
+ * lock must be hold by caller
+ */
+int inet_twsk_unhash(struct inet_timewait_sock *tw)
+{
+        if (hlist_nulls_unhashed(&tw->tw_node))
+                return 0;
+
+        hlist_nulls_del_rcu(&tw->tw_node);
+        sk_nulls_node_init(&tw->tw_node);
+        return 1;
+}
+
 /* Must be called with locally disabled BHs. */
 static void __inet_twsk_kill(struct inet_timewait_sock *tw,
                              struct inet_hashinfo *hashinfo)
 {
         struct inet_bind_hashbucket *bhead;
         struct inet_bind_bucket *tb;
+        int refcnt;
         /* Unlink from established hashes. */
         spinlock_t *lock = inet_ehash_lockp(hashinfo, tw->tw_hash);
 
         spin_lock(lock);
-        if (hlist_nulls_unhashed(&tw->tw_node)) {
-                spin_unlock(lock);
-                return;
-        }
-        hlist_nulls_del_rcu(&tw->tw_node);
-        sk_nulls_node_init(&tw->tw_node);
+        refcnt = inet_twsk_unhash(tw);
         spin_unlock(lock);
 
         /* Disassociate with bind bucket. */
@@ -37,9 +48,12 @@ static void __inet_twsk_kill(struct inet_timewait_sock *tw,
                         hashinfo->bhash_size)];
         spin_lock(&bhead->lock);
         tb = tw->tw_tb;
-        __hlist_del(&tw->tw_bind_node);
-        tw->tw_tb = NULL;
-        inet_bind_bucket_destroy(hashinfo->bind_bucket_cachep, tb);
+        if (tb) {
+                __hlist_del(&tw->tw_bind_node);
+                tw->tw_tb = NULL;
+                inet_bind_bucket_destroy(hashinfo->bind_bucket_cachep, tb);
+                refcnt++;
+        }
         spin_unlock(&bhead->lock);
 #ifdef SOCK_REFCNT_DEBUG
         if (atomic_read(&tw->tw_refcnt) != 1) {
@@ -47,7 +61,10 @@ static void __inet_twsk_kill(struct inet_timewait_sock *tw,
                        tw->tw_prot->name, tw, atomic_read(&tw->tw_refcnt));
         }
 #endif
-        inet_twsk_put(tw);
+        while (refcnt) {
+                inet_twsk_put(tw);
+                refcnt--;
+        }
 }
 
 static noinline void inet_twsk_free(struct inet_timewait_sock *tw)
@@ -86,7 +103,7 @@ void __inet_twsk_hashdance(struct inet_timewait_sock *tw, struct sock *sk,
            Note, that any socket with inet->num != 0 MUST be bound in
            binding cache, even if it is closed.
          */
-        bhead = &hashinfo->bhash[inet_bhashfn(twsk_net(tw), inet->num,
+        bhead = &hashinfo->bhash[inet_bhashfn(twsk_net(tw), inet->inet_num,
                         hashinfo->bhash_size)];
         spin_lock(&bhead->lock);
         tw->tw_tb = icsk->icsk_bind_hash;
@@ -101,13 +118,22 @@ void __inet_twsk_hashdance(struct inet_timewait_sock *tw, struct sock *sk,
          * Should be done before removing sk from established chain
          * because readers are lockless and search established first.
          */
-        atomic_inc(&tw->tw_refcnt);
         inet_twsk_add_node_rcu(tw, &ehead->twchain);
 
         /* Step 3: Remove SK from established hash. */
         if (__sk_nulls_del_node_init_rcu(sk))
                 sock_prot_inuse_add(sock_net(sk), sk->sk_prot, -1);
 
+        /*
+         * Notes :
+         * - We initially set tw_refcnt to 0 in inet_twsk_alloc()
+         * - We add one reference for the bhash link
+         * - We add one reference for the ehash link
+         * - We want this refcnt update done before allowing other
+         *   threads to find this tw in ehash chain.
+         */
+        atomic_add(1 + 1 + 1, &tw->tw_refcnt);
+
         spin_unlock(lock);
 }
 
@@ -124,14 +150,14 @@ struct inet_timewait_sock *inet_twsk_alloc(const struct sock *sk, const int stat
                 kmemcheck_annotate_bitfield(tw, flags);
 
                 /* Give us an identity. */
-                tw->tw_daddr        = inet->daddr;
-                tw->tw_rcv_saddr    = inet->rcv_saddr;
+                tw->tw_daddr        = inet->inet_daddr;
+                tw->tw_rcv_saddr    = inet->inet_rcv_saddr;
                 tw->tw_bound_dev_if = sk->sk_bound_dev_if;
-                tw->tw_num          = inet->num;
+                tw->tw_num          = inet->inet_num;
                 tw->tw_state        = TCP_TIME_WAIT;
                 tw->tw_substate     = state;
-                tw->tw_sport        = inet->sport;
-                tw->tw_dport        = inet->dport;
+                tw->tw_sport        = inet->inet_sport;
+                tw->tw_dport        = inet->inet_dport;
                 tw->tw_family       = sk->sk_family;
                 tw->tw_reuse        = sk->sk_reuse;
                 tw->tw_hash         = sk->sk_hash;
@@ -139,7 +165,12 @@ struct inet_timewait_sock *inet_twsk_alloc(const struct sock *sk, const int stat
                 tw->tw_transparent  = inet->transparent;
                 tw->tw_prot         = sk->sk_prot_creator;
                 twsk_net_set(tw, hold_net(sock_net(sk)));
-                atomic_set(&tw->tw_refcnt, 1);
+                /*
+                 * Because we use RCU lookups, we should not set tw_refcnt
+                 * to a non null value before everything is setup for this
+                 * timewait socket.
+                 */
+                atomic_set(&tw->tw_refcnt, 0);
                 inet_twsk_dead_node_init(tw);
                 __module_get(tw->tw_prot->owner);
         }
@@ -421,37 +452,46 @@ out:
 
 EXPORT_SYMBOL_GPL(inet_twdr_twcal_tick);
 
-void inet_twsk_purge(struct net *net, struct inet_hashinfo *hashinfo,
+void inet_twsk_purge(struct inet_hashinfo *hashinfo,
                      struct inet_timewait_death_row *twdr, int family)
 {
         struct inet_timewait_sock *tw;
         struct sock *sk;
         struct hlist_nulls_node *node;
-        int h;
+        unsigned int slot;
 
-        local_bh_disable();
-        for (h = 0; h < (hashinfo->ehash_size); h++) {
-                struct inet_ehash_bucket *head =
-                        inet_ehash_bucket(hashinfo, h);
-                spinlock_t *lock = inet_ehash_lockp(hashinfo, h);
+        for (slot = 0; slot <= hashinfo->ehash_mask; slot++) {
+                struct inet_ehash_bucket *head = &hashinfo->ehash[slot];
+restart_rcu:
+                rcu_read_lock();
 restart:
-                spin_lock(lock);
-                sk_nulls_for_each(sk, node, &head->twchain) {
-
+                sk_nulls_for_each_rcu(sk, node, &head->twchain) {
                         tw = inet_twsk(sk);
-                        if (!net_eq(twsk_net(tw), net) ||
-                            tw->tw_family != family)
+                        if ((tw->tw_family != family) ||
+                                atomic_read(&twsk_net(tw)->count))
+                                continue;
+
+                        if (unlikely(!atomic_inc_not_zero(&tw->tw_refcnt)))
                                 continue;
 
-                        atomic_inc(&tw->tw_refcnt);
-                        spin_unlock(lock);
+                        if (unlikely((tw->tw_family != family) ||
+                                     atomic_read(&twsk_net(tw)->count))) {
+                                inet_twsk_put(tw);
+                                goto restart;
+                        }
+
+                        rcu_read_unlock();
                         inet_twsk_deschedule(tw, twdr);
                         inet_twsk_put(tw);
-
-                        goto restart;
+                        goto restart_rcu;
                 }
-                spin_unlock(lock);
+                /* If the nulls value we got at the end of this lookup is
+                 * not the expected one, we must restart lookup.
+                 * We probably met an item that was moved to another chain.
+                 */
+                if (get_nulls_value(node) != slot)
+                        goto restart;
+                rcu_read_unlock();
         }
-        local_bh_enable();
 }
 EXPORT_SYMBOL_GPL(inet_twsk_purge);
diff --git a/net/ipv4/inetpeer.c b/net/ipv4/inetpeer.c
index b1fbe18feb5a..6bcfe52a9c87 100644
--- a/net/ipv4/inetpeer.c
+++ b/net/ipv4/inetpeer.c
@@ -67,9 +67,6 @@
  *              ip_id_count: idlock
  */
 
-/* Exported for inet_getid inline function.  */
-DEFINE_SPINLOCK(inet_peer_idlock);
-
 static struct kmem_cache *peer_cachep __read_mostly;
 
 #define node_height(x) x->avl_height
@@ -390,7 +387,7 @@ struct inet_peer *inet_getpeer(__be32 daddr, int create)
         n->v4daddr = daddr;
         atomic_set(&n->refcnt, 1);
         atomic_set(&n->rid, 0);
-        n->ip_id_count = secure_ip_id(daddr);
+        atomic_set(&n->ip_id_count, secure_ip_id(daddr));
         n->tcp_ts_stamp = 0;
 
         write_lock_bh(&peer_pool_lock);
diff --git a/net/ipv4/ip_fragment.c b/net/ipv4/ip_fragment.c
index 301a389fa7fa..86964b353c31 100644
--- a/net/ipv4/ip_fragment.c
+++ b/net/ipv4/ip_fragment.c
@@ -206,10 +206,11 @@ static void ip_expire(unsigned long arg)
                 struct sk_buff *head = qp->q.fragments;
 
                 /* Send an ICMP "Fragment Reassembly Timeout" message. */
-                if ((head->dev = dev_get_by_index(net, qp->iif)) != NULL) {
+                rcu_read_lock();
+                head->dev = dev_get_by_index_rcu(net, qp->iif);
+                if (head->dev)
                         icmp_send(head, ICMP_TIME_EXCEEDED, ICMP_EXC_FRAGTIME, 0);
-                        dev_put(head->dev);
-                }
+                rcu_read_unlock();
         }
 out:
         spin_unlock(&qp->q.lock);
@@ -651,7 +652,7 @@ static int ip4_frags_ns_ctl_register(struct net *net)
         struct ctl_table_header *hdr;
 
         table = ip4_frags_ns_ctl_table;
-        if (net != &init_net) {
+        if (!net_eq(net, &init_net)) {
                 table = kmemdup(table, sizeof(ip4_frags_ns_ctl_table), GFP_KERNEL);
                 if (table == NULL)
                         goto err_alloc;
@@ -669,7 +670,7 @@ static int ip4_frags_ns_ctl_register(struct net *net)
         return 0;
 
 err_reg:
-        if (net != &init_net)
+        if (!net_eq(net, &init_net))
                 kfree(table);
 err_alloc:
         return -ENOMEM;
diff --git a/net/ipv4/ip_gre.c b/net/ipv4/ip_gre.c
index 143333852624..f36ce156cac6 100644
--- a/net/ipv4/ip_gre.c
+++ b/net/ipv4/ip_gre.c
@@ -125,7 +125,7 @@ static int ipgre_tunnel_bind_dev(struct net_device *dev);
 
 #define HASH_SIZE  16
 
-static int ipgre_net_id;
+static int ipgre_net_id __read_mostly;
 struct ipgre_net {
         struct ip_tunnel *tunnels[4][HASH_SIZE];
 
@@ -156,8 +156,13 @@ struct ipgre_net {
 #define tunnels_r       tunnels[2]
 #define tunnels_l       tunnels[1]
 #define tunnels_wc      tunnels[0]
+/*
+ * Locking : hash tables are protected by RCU and a spinlock
+ */
+static DEFINE_SPINLOCK(ipgre_lock);
 
-static DEFINE_RWLOCK(ipgre_lock);
+#define for_each_ip_tunnel_rcu(start) \
+        for (t = rcu_dereference(start); t; t = rcu_dereference(t->next))
 
 /* Given src, dst and key, find appropriate for input tunnel. */
 
@@ -175,7 +180,7 @@ static struct ip_tunnel * ipgre_tunnel_lookup(struct net_device *dev,
                        ARPHRD_ETHER : ARPHRD_IPGRE;
         int score, cand_score = 4;
 
-        for (t = ign->tunnels_r_l[h0^h1]; t; t = t->next) {
+        for_each_ip_tunnel_rcu(ign->tunnels_r_l[h0 ^ h1]) {
                 if (local != t->parms.iph.saddr ||
                     remote != t->parms.iph.daddr ||
                     key != t->parms.i_key ||
@@ -200,7 +205,7 @@ static struct ip_tunnel * ipgre_tunnel_lookup(struct net_device *dev,
                 }
         }
 
-        for (t = ign->tunnels_r[h0^h1]; t; t = t->next) {
+        for_each_ip_tunnel_rcu(ign->tunnels_r[h0 ^ h1]) {
                 if (remote != t->parms.iph.daddr ||
                     key != t->parms.i_key ||
                     !(t->dev->flags & IFF_UP))
@@ -224,7 +229,7 @@ static struct ip_tunnel * ipgre_tunnel_lookup(struct net_device *dev,
                 }
         }
 
-        for (t = ign->tunnels_l[h1]; t; t = t->next) {
+        for_each_ip_tunnel_rcu(ign->tunnels_l[h1]) {
                 if ((local != t->parms.iph.saddr &&
                      (local != t->parms.iph.daddr ||
                       !ipv4_is_multicast(local))) ||
@@ -250,7 +255,7 @@ static struct ip_tunnel * ipgre_tunnel_lookup(struct net_device *dev,
                 }
         }
 
-        for (t = ign->tunnels_wc[h1]; t; t = t->next) {
+        for_each_ip_tunnel_rcu(ign->tunnels_wc[h1]) {
                 if (t->parms.i_key != key ||
                     !(t->dev->flags & IFF_UP))
                         continue;
@@ -276,8 +281,9 @@ static struct ip_tunnel * ipgre_tunnel_lookup(struct net_device *dev,
         if (cand != NULL)
                 return cand;
 
-        if (ign->fb_tunnel_dev->flags & IFF_UP)
-                return netdev_priv(ign->fb_tunnel_dev);
+        dev = ign->fb_tunnel_dev;
+        if (dev->flags & IFF_UP)
+                return netdev_priv(dev);
 
         return NULL;
 }
@@ -311,10 +317,10 @@ static void ipgre_tunnel_link(struct ipgre_net *ign, struct ip_tunnel *t)
 {
         struct ip_tunnel **tp = ipgre_bucket(ign, t);
 
+        spin_lock_bh(&ipgre_lock);
         t->next = *tp;
-        write_lock_bh(&ipgre_lock);
-        *tp = t;
-        write_unlock_bh(&ipgre_lock);
+        rcu_assign_pointer(*tp, t);
+        spin_unlock_bh(&ipgre_lock);
 }
 
 static void ipgre_tunnel_unlink(struct ipgre_net *ign, struct ip_tunnel *t)
@@ -323,9 +329,9 @@ static void ipgre_tunnel_unlink(struct ipgre_net *ign, struct ip_tunnel *t)
 
         for (tp = ipgre_bucket(ign, t); *tp; tp = &(*tp)->next) {
                 if (t == *tp) {
-                        write_lock_bh(&ipgre_lock);
+                        spin_lock_bh(&ipgre_lock);
                         *tp = t->next;
-                        write_unlock_bh(&ipgre_lock);
+                        spin_unlock_bh(&ipgre_lock);
                         break;
                 }
         }
@@ -476,7 +482,7 @@ static void ipgre_err(struct sk_buff *skb, u32 info)
                 break;
         }
 
-        read_lock(&ipgre_lock);
+        rcu_read_lock();
         t = ipgre_tunnel_lookup(skb->dev, iph->daddr, iph->saddr,
                                 flags & GRE_KEY ?
                                 *(((__be32 *)p) + (grehlen / 4) - 1) : 0,
@@ -494,7 +500,7 @@ static void ipgre_err(struct sk_buff *skb, u32 info)
                 t->err_count = 1;
         t->err_time = jiffies;
 out:
-        read_unlock(&ipgre_lock);
+        rcu_read_unlock();
         return;
 }
 
@@ -573,7 +579,7 @@ static int ipgre_rcv(struct sk_buff *skb)
 
         gre_proto = *(__be16 *)(h + 2);
 
-        read_lock(&ipgre_lock);
+        rcu_read_lock();
         if ((tunnel = ipgre_tunnel_lookup(skb->dev,
                                           iph->saddr, iph->daddr, key,
                                           gre_proto))) {
@@ -647,13 +653,13 @@ static int ipgre_rcv(struct sk_buff *skb)
                 ipgre_ecn_decapsulate(iph, skb);
 
                 netif_rx(skb);
-                read_unlock(&ipgre_lock);
+                rcu_read_unlock();
                 return(0);
         }
         icmp_send(skb, ICMP_DEST_UNREACH, ICMP_PORT_UNREACH, 0);
 
 drop:
-        read_unlock(&ipgre_lock);
+        rcu_read_unlock();
 drop_nolock:
         kfree_skb(skb);
         return(0);
@@ -662,7 +668,8 @@ drop_nolock:
 static netdev_tx_t ipgre_tunnel_xmit(struct sk_buff *skb, struct net_device *dev)
 {
         struct ip_tunnel *tunnel = netdev_priv(dev);
-        struct net_device_stats *stats = &tunnel->dev->stats;
+        struct net_device_stats *stats = &dev->stats;
+        struct netdev_queue *txq = netdev_get_tx_queue(dev, 0);
         struct iphdr  *old_iph = ip_hdr(skb);
         struct iphdr  *tiph;
         u8     tos;
@@ -810,7 +817,7 @@ static netdev_tx_t ipgre_tunnel_xmit(struct sk_buff *skb, struct net_device *dev
                 struct sk_buff *new_skb = skb_realloc_headroom(skb, max_headroom);
                 if (!new_skb) {
                         ip_rt_put(rt);
-                        stats->tx_dropped++;
+                        txq->tx_dropped++;
                         dev_kfree_skb(skb);
                         return NETDEV_TX_OK;
                 }
@@ -1283,33 +1290,27 @@ static const struct net_protocol ipgre_protocol = {
         .netns_ok       =       1,
 };
 
-static void ipgre_destroy_tunnels(struct ipgre_net *ign)
+static void ipgre_destroy_tunnels(struct ipgre_net *ign, struct list_head *head)
 {
         int prio;
 
         for (prio = 0; prio < 4; prio++) {
                 int h;
                 for (h = 0; h < HASH_SIZE; h++) {
-                        struct ip_tunnel *t;
-                        while ((t = ign->tunnels[prio][h]) != NULL)
-                                unregister_netdevice(t->dev);
+                        struct ip_tunnel *t = ign->tunnels[prio][h];
+
+                        while (t != NULL) {
+                                unregister_netdevice_queue(t->dev, head);
+                                t = t->next;
+                        }
                 }
         }
 }
 
 static int ipgre_init_net(struct net *net)
 {
+        struct ipgre_net *ign = net_generic(net, ipgre_net_id);
         int err;
-        struct ipgre_net *ign;
-
-        err = -ENOMEM;
-        ign = kzalloc(sizeof(struct ipgre_net), GFP_KERNEL);
-        if (ign == NULL)
-                goto err_alloc;
-
-        err = net_assign_generic(net, ipgre_net_id, ign);
-        if (err < 0)
-                goto err_assign;
 
         ign->fb_tunnel_dev = alloc_netdev(sizeof(struct ip_tunnel), "gre0",
                                            ipgre_tunnel_setup);
@@ -1330,27 +1331,26 @@ static int ipgre_init_net(struct net *net)
 err_reg_dev:
         free_netdev(ign->fb_tunnel_dev);
 err_alloc_dev:
-        /* nothing */
-err_assign:
-        kfree(ign);
-err_alloc:
         return err;
 }
 
 static void ipgre_exit_net(struct net *net)
 {
         struct ipgre_net *ign;
+        LIST_HEAD(list);
 
         ign = net_generic(net, ipgre_net_id);
         rtnl_lock();
-        ipgre_destroy_tunnels(ign);
+        ipgre_destroy_tunnels(ign, &list);
+        unregister_netdevice_many(&list);
         rtnl_unlock();
-        kfree(ign);
 }
 
 static struct pernet_operations ipgre_net_ops = {
         .init = ipgre_init_net,
         .exit = ipgre_exit_net,
+        .id   = &ipgre_net_id,
+        .size = sizeof(struct ipgre_net),
 };
 
 static int ipgre_tunnel_validate(struct nlattr *tb[], struct nlattr *data[])
@@ -1471,7 +1471,7 @@ static void ipgre_tap_setup(struct net_device *dev)
         dev->features           |= NETIF_F_NETNS_LOCAL;
 }
 
-static int ipgre_newlink(struct net_device *dev, struct nlattr *tb[],
+static int ipgre_newlink(struct net *src_net, struct net_device *dev, struct nlattr *tb[],
                          struct nlattr *data[])
 {
         struct ip_tunnel *nt;
@@ -1670,7 +1670,7 @@ static int __init ipgre_init(void)
                 return -EAGAIN;
         }
 
-        err = register_pernet_gen_device(&ipgre_net_id, &ipgre_net_ops);
+        err = register_pernet_device(&ipgre_net_ops);
         if (err < 0)
                 goto gen_device_failed;
 
@@ -1688,7 +1688,7 @@ out:
 tap_ops_failed:
         rtnl_link_unregister(&ipgre_link_ops);
 rtnl_link_failed:
-        unregister_pernet_gen_device(ipgre_net_id, &ipgre_net_ops);
+        unregister_pernet_device(&ipgre_net_ops);
 gen_device_failed:
         inet_del_protocol(&ipgre_protocol, IPPROTO_GRE);
         goto out;
@@ -1698,7 +1698,7 @@ static void __exit ipgre_fini(void)
 {
         rtnl_link_unregister(&ipgre_tap_ops);
         rtnl_link_unregister(&ipgre_link_ops);
-        unregister_pernet_gen_device(ipgre_net_id, &ipgre_net_ops);
+        unregister_pernet_device(&ipgre_net_ops);
         if (inet_del_protocol(&ipgre_protocol, IPPROTO_GRE) < 0)
                 printk(KERN_INFO "ipgre close: can't remove protocol\n");
 }
diff --git a/net/ipv4/ip_input.c b/net/ipv4/ip_input.c
index 6c98b43badf4..c29de9879fda 100644
--- a/net/ipv4/ip_input.c
+++ b/net/ipv4/ip_input.c
@@ -161,10 +161,10 @@ int ip_call_ra_chain(struct sk_buff *skb)
                 /* If socket is bound to an interface, only report
                  * the packet if it came  from that interface.
                  */
-                if (sk && inet_sk(sk)->num == protocol &&
+                if (sk && inet_sk(sk)->inet_num == protocol &&
                     (!sk->sk_bound_dev_if ||
                      sk->sk_bound_dev_if == dev->ifindex) &&
-                    sock_net(sk) == dev_net(dev)) {
+                    net_eq(sock_net(sk), dev_net(dev))) {
                         if (ip_hdr(skb)->frag_off & htons(IP_MF | IP_OFFSET)) {
                                 if (ip_defrag(skb, IP_DEFRAG_CALL_RA_CHAIN)) {
                                         read_unlock(&ip_ra_lock);
diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c
index f9895180f481..e34013a78ef4 100644
--- a/net/ipv4/ip_output.c
+++ b/net/ipv4/ip_output.c
@@ -264,9 +264,11 @@ int ip_mc_output(struct sk_buff *skb)
 
                    This check is duplicated in ip_mr_input at the moment.
                  */
-                    && ((rt->rt_flags&RTCF_LOCAL) || !(IPCB(skb)->flags&IPSKB_FORWARDED))
+                    &&
+                    ((rt->rt_flags & RTCF_LOCAL) ||
+                     !(IPCB(skb)->flags & IPSKB_FORWARDED))
 #endif
-                ) {
+                   ) {
                         struct sk_buff *newskb = skb_clone(skb, GFP_ATOMIC);
                         if (newskb)
                                 NF_HOOK(PF_INET, NF_INET_POST_ROUTING, newskb,
@@ -329,7 +331,7 @@ int ip_queue_xmit(struct sk_buff *skb, int ipfragok)
                 __be32 daddr;
 
                 /* Use correct destination address if we have options. */
-                daddr = inet->daddr;
+                daddr = inet->inet_daddr;
                 if(opt && opt->srr)
                         daddr = opt->faddr;
 
@@ -338,13 +340,13 @@ int ip_queue_xmit(struct sk_buff *skb, int ipfragok)
                                             .mark = sk->sk_mark,
                                             .nl_u = { .ip4_u =
                                                       { .daddr = daddr,
-                                                        .saddr = inet->saddr,
+                                                        .saddr = inet->inet_saddr,
                                                         .tos = RT_CONN_FLAGS(sk) } },
                                             .proto = sk->sk_protocol,
                                             .flags = inet_sk_flowi_flags(sk),
                                             .uli_u = { .ports =
-                                                       { .sport = inet->sport,
-                                                         .dport = inet->dport } } };
+                                                       { .sport = inet->inet_sport,
+                                                         .dport = inet->inet_dport } } };
 
                         /* If this fails, retransmit mechanism of transport layer will
                          * keep trying until route appears or the connection times
@@ -379,7 +381,7 @@ packet_routed:
 
         if (opt && opt->optlen) {
                 iph->ihl += opt->optlen >> 2;
-                ip_options_build(skb, opt, inet->daddr, rt, 0);
+                ip_options_build(skb, opt, inet->inet_daddr, rt, 0);
         }
 
         ip_select_ident_more(iph, &rt->u.dst, sk,
@@ -501,8 +503,8 @@ int ip_fragment(struct sk_buff *skb, int (*output)(struct sk_buff *))
                         if (skb->sk) {
                                 frag->sk = skb->sk;
                                 frag->destructor = sock_wfree;
-                                truesizes += frag->truesize;
                         }
+                        truesizes += frag->truesize;
                 }
 
                 /* Everything is OK. Generate! */
@@ -846,7 +848,8 @@ int ip_append_data(struct sock *sk,
         maxfraglen = ((mtu - fragheaderlen) & ~7) + fragheaderlen;
 
         if (inet->cork.length + length > 0xFFFF - fragheaderlen) {
-                ip_local_error(sk, EMSGSIZE, rt->rt_dst, inet->dport, mtu-exthdrlen);
+                ip_local_error(sk, EMSGSIZE, rt->rt_dst, inet->inet_dport,
+                               mtu-exthdrlen);
                 return -EMSGSIZE;
         }
 
@@ -1100,7 +1103,7 @@ ssize_t	ip_append_page(struct sock *sk, struct page *page,
         maxfraglen = ((mtu - fragheaderlen) & ~7) + fragheaderlen;
 
         if (inet->cork.length + size > 0xFFFF - fragheaderlen) {
-                ip_local_error(sk, EMSGSIZE, rt->rt_dst, inet->dport, mtu);
+                ip_local_error(sk, EMSGSIZE, rt->rt_dst, inet->inet_dport, mtu);
                 return -EMSGSIZE;
         }
 
diff --git a/net/ipv4/ip_sockglue.c b/net/ipv4/ip_sockglue.c
index e982b5c1ee17..cafad9baff03 100644
--- a/net/ipv4/ip_sockglue.c
+++ b/net/ipv4/ip_sockglue.c
@@ -245,7 +245,7 @@ int ip_ra_control(struct sock *sk, unsigned char on,
 {
         struct ip_ra_chain *ra, *new_ra, **rap;
 
-        if (sk->sk_type != SOCK_RAW || inet_sk(sk)->num == IPPROTO_RAW)
+        if (sk->sk_type != SOCK_RAW || inet_sk(sk)->inet_num == IPPROTO_RAW)
                 return -EINVAL;
 
         new_ra = on ? kmalloc(sizeof(*new_ra), GFP_KERNEL) : NULL;
@@ -480,7 +480,7 @@ static int do_ip_setsockopt(struct sock *sk, int level,
         case IP_OPTIONS:
         {
                 struct ip_options *opt = NULL;
-                if (optlen > 40 || optlen < 0)
+                if (optlen > 40)
                         goto e_inval;
                 err = ip_options_get_from_user(sock_net(sk), &opt,
                                                optval, optlen);
@@ -492,7 +492,7 @@ static int do_ip_setsockopt(struct sock *sk, int level,
                         if (sk->sk_family == PF_INET ||
                             (!((1 << sk->sk_state) &
                                (TCPF_LISTEN | TCPF_CLOSE)) &&
-                             inet->daddr != LOOPBACK4_IPV6)) {
+                             inet->inet_daddr != LOOPBACK4_IPV6)) {
 #endif
                                 if (inet->opt)
                                         icsk->icsk_ext_hdr_len -= inet->opt->optlen;
@@ -575,7 +575,7 @@ static int do_ip_setsockopt(struct sock *sk, int level,
                 inet->hdrincl = val ? 1 : 0;
                 break;
         case IP_MTU_DISCOVER:
-                if (val < 0 || val > 3)
+                if (val < IP_PMTUDISC_DONT || val > IP_PMTUDISC_PROBE)
                         goto e_inval;
                 inet->pmtudisc = val;
                 break;
@@ -1180,8 +1180,8 @@ static int do_ip_getsockopt(struct sock *sk, int level, int optname,
                 if (inet->cmsg_flags & IP_CMSG_PKTINFO) {
                         struct in_pktinfo info;
 
-                        info.ipi_addr.s_addr = inet->rcv_saddr;
-                        info.ipi_spec_dst.s_addr = inet->rcv_saddr;
+                        info.ipi_addr.s_addr = inet->inet_rcv_saddr;
+                        info.ipi_spec_dst.s_addr = inet->inet_rcv_saddr;
                         info.ipi_ifindex = inet->mc_index;
                         put_cmsg(&msg, SOL_IP, IP_PKTINFO, sizeof(info), &info);
                 }
diff --git a/net/ipv4/ipconfig.c b/net/ipv4/ipconfig.c
index f8d04c256454..4e08b7f2331c 100644
--- a/net/ipv4/ipconfig.c
+++ b/net/ipv4/ipconfig.c
@@ -1172,10 +1172,9 @@ static int __init ic_dynamic(void)
                         schedule_timeout_uninterruptible(1);
 #ifdef IPCONFIG_DHCP
                 /* DHCP isn't done until we get a DHCPACK. */
-                if ((ic_got_reply & IC_BOOTP)
-                    && (ic_proto_enabled & IC_USE_DHCP)
-                    && ic_dhcp_msgtype != DHCPACK)
-                {
+                if ((ic_got_reply & IC_BOOTP) &&
+                    (ic_proto_enabled & IC_USE_DHCP) &&
+                    ic_dhcp_msgtype != DHCPACK) {
                         ic_got_reply = 0;
                         printk(",");
                         continue;
@@ -1344,9 +1343,9 @@ static int __init ip_auto_config(void)
          */
         if (ic_myaddr == NONE ||
 #ifdef CONFIG_ROOT_NFS
-            (root_server_addr == NONE
-             && ic_servaddr == NONE
-             && ROOT_DEV == Root_NFS) ||
+            (root_server_addr == NONE &&
+             ic_servaddr == NONE &&
+             ROOT_DEV == Root_NFS) ||
 #endif
             ic_first_dev->next) {
 #ifdef IPCONFIG_DYNAMIC
diff --git a/net/ipv4/ipip.c b/net/ipv4/ipip.c
index ae40ed1ba560..eda04fed3379 100644
--- a/net/ipv4/ipip.c
+++ b/net/ipv4/ipip.c
@@ -119,7 +119,7 @@
 #define HASH_SIZE  16
 #define HASH(addr) (((__force u32)addr^((__force u32)addr>>4))&0xF)
 
-static int ipip_net_id;
+static int ipip_net_id __read_mostly;
 struct ipip_net {
         struct ip_tunnel *tunnels_r_l[HASH_SIZE];
         struct ip_tunnel *tunnels_r[HASH_SIZE];
@@ -134,7 +134,13 @@ static void ipip_fb_tunnel_init(struct net_device *dev);
 static void ipip_tunnel_init(struct net_device *dev);
 static void ipip_tunnel_setup(struct net_device *dev);
 
-static DEFINE_RWLOCK(ipip_lock);
+/*
+ * Locking : hash tables are protected by RCU and a spinlock
+ */
+static DEFINE_SPINLOCK(ipip_lock);
+
+#define for_each_ip_tunnel_rcu(start) \
+        for (t = rcu_dereference(start); t; t = rcu_dereference(t->next))
 
 static struct ip_tunnel * ipip_tunnel_lookup(struct net *net,
                 __be32 remote, __be32 local)
@@ -144,20 +150,21 @@ static struct ip_tunnel * ipip_tunnel_lookup(struct net *net,
         struct ip_tunnel *t;
         struct ipip_net *ipn = net_generic(net, ipip_net_id);
 
-        for (t = ipn->tunnels_r_l[h0^h1]; t; t = t->next) {
+        for_each_ip_tunnel_rcu(ipn->tunnels_r_l[h0 ^ h1])
                 if (local == t->parms.iph.saddr &&
                     remote == t->parms.iph.daddr && (t->dev->flags&IFF_UP))
                         return t;
-        }
-        for (t = ipn->tunnels_r[h0]; t; t = t->next) {
+
+        for_each_ip_tunnel_rcu(ipn->tunnels_r[h0])
                 if (remote == t->parms.iph.daddr && (t->dev->flags&IFF_UP))
                         return t;
-        }
-        for (t = ipn->tunnels_l[h1]; t; t = t->next) {
+
+        for_each_ip_tunnel_rcu(ipn->tunnels_l[h1])
                 if (local == t->parms.iph.saddr && (t->dev->flags&IFF_UP))
                         return t;
-        }
-        if ((t = ipn->tunnels_wc[0]) != NULL && (t->dev->flags&IFF_UP))
+
+        t = rcu_dereference(ipn->tunnels_wc[0]);
+        if (t && (t->dev->flags&IFF_UP))
                 return t;
         return NULL;
 }
@@ -193,9 +200,9 @@ static void ipip_tunnel_unlink(struct ipip_net *ipn, struct ip_tunnel *t)
 
         for (tp = ipip_bucket(ipn, t); *tp; tp = &(*tp)->next) {
                 if (t == *tp) {
-                        write_lock_bh(&ipip_lock);
+                        spin_lock_bh(&ipip_lock);
                         *tp = t->next;
-                        write_unlock_bh(&ipip_lock);
+                        spin_unlock_bh(&ipip_lock);
                         break;
                 }
         }
@@ -205,10 +212,10 @@ static void ipip_tunnel_link(struct ipip_net *ipn, struct ip_tunnel *t)
 {
         struct ip_tunnel **tp = ipip_bucket(ipn, t);
 
+        spin_lock_bh(&ipip_lock);
         t->next = *tp;
-        write_lock_bh(&ipip_lock);
-        *tp = t;
-        write_unlock_bh(&ipip_lock);
+        rcu_assign_pointer(*tp, t);
+        spin_unlock_bh(&ipip_lock);
 }
 
 static struct ip_tunnel * ipip_tunnel_locate(struct net *net,
@@ -267,9 +274,9 @@ static void ipip_tunnel_uninit(struct net_device *dev)
         struct ipip_net *ipn = net_generic(net, ipip_net_id);
 
         if (dev == ipn->fb_tunnel_dev) {
-                write_lock_bh(&ipip_lock);
+                spin_lock_bh(&ipip_lock);
                 ipn->tunnels_wc[0] = NULL;
-                write_unlock_bh(&ipip_lock);
+                spin_unlock_bh(&ipip_lock);
         } else
                 ipip_tunnel_unlink(ipn, netdev_priv(dev));
         dev_put(dev);
@@ -318,7 +325,7 @@ static int ipip_err(struct sk_buff *skb, u32 info)
 
         err = -ENOENT;
 
-        read_lock(&ipip_lock);
+        rcu_read_lock();
         t = ipip_tunnel_lookup(dev_net(skb->dev), iph->daddr, iph->saddr);
         if (t == NULL || t->parms.iph.daddr == 0)
                 goto out;
@@ -333,7 +340,7 @@ static int ipip_err(struct sk_buff *skb, u32 info)
                 t->err_count = 1;
         t->err_time = jiffies;
 out:
-        read_unlock(&ipip_lock);
+        rcu_read_unlock();
         return err;
 }
 
@@ -351,11 +358,11 @@ static int ipip_rcv(struct sk_buff *skb)
         struct ip_tunnel *tunnel;
         const struct iphdr *iph = ip_hdr(skb);
 
-        read_lock(&ipip_lock);
+        rcu_read_lock();
         if ((tunnel = ipip_tunnel_lookup(dev_net(skb->dev),
                                         iph->saddr, iph->daddr)) != NULL) {
                 if (!xfrm4_policy_check(NULL, XFRM_POLICY_IN, skb)) {
-                        read_unlock(&ipip_lock);
+                        rcu_read_unlock();
                         kfree_skb(skb);
                         return 0;
                 }
@@ -374,10 +381,10 @@ static int ipip_rcv(struct sk_buff *skb)
                 nf_reset(skb);
                 ipip_ecn_decapsulate(iph, skb);
                 netif_rx(skb);
-                read_unlock(&ipip_lock);
+                rcu_read_unlock();
                 return 0;
         }
-        read_unlock(&ipip_lock);
+        rcu_read_unlock();
 
         return -1;
 }
@@ -390,7 +397,8 @@ static int ipip_rcv(struct sk_buff *skb)
 static netdev_tx_t ipip_tunnel_xmit(struct sk_buff *skb, struct net_device *dev)
 {
         struct ip_tunnel *tunnel = netdev_priv(dev);
-        struct net_device_stats *stats = &tunnel->dev->stats;
+        struct net_device_stats *stats = &dev->stats;
+        struct netdev_queue *txq = netdev_get_tx_queue(dev, 0);
         struct iphdr  *tiph = &tunnel->parms.iph;
         u8     tos = tunnel->parms.iph.tos;
         __be16 df = tiph->frag_off;
@@ -480,7 +488,7 @@ static netdev_tx_t ipip_tunnel_xmit(struct sk_buff *skb, struct net_device *dev)
                 struct sk_buff *new_skb = skb_realloc_headroom(skb, max_headroom);
                 if (!new_skb) {
                         ip_rt_put(rt);
-                        stats->tx_dropped++;
+                        txq->tx_dropped++;
                         dev_kfree_skb(skb);
                         return NETDEV_TX_OK;
                 }
@@ -748,33 +756,27 @@ static struct xfrm_tunnel ipip_handler = {
 static const char banner[] __initconst =
         KERN_INFO "IPv4 over IPv4 tunneling driver\n";
 
-static void ipip_destroy_tunnels(struct ipip_net *ipn)
+static void ipip_destroy_tunnels(struct ipip_net *ipn, struct list_head *head)
 {
         int prio;
 
         for (prio = 1; prio < 4; prio++) {
                 int h;
                 for (h = 0; h < HASH_SIZE; h++) {
-                        struct ip_tunnel *t;
-                        while ((t = ipn->tunnels[prio][h]) != NULL)
-                                unregister_netdevice(t->dev);
+                        struct ip_tunnel *t = ipn->tunnels[prio][h];
+
+                        while (t != NULL) {
+                                unregister_netdevice_queue(t->dev, head);
+                                t = t->next;
+                        }
                 }
         }
 }
 
 static int ipip_init_net(struct net *net)
 {
+        struct ipip_net *ipn = net_generic(net, ipip_net_id);
         int err;
-        struct ipip_net *ipn;
-
-        err = -ENOMEM;
-        ipn = kzalloc(sizeof(struct ipip_net), GFP_KERNEL);
-        if (ipn == NULL)
-                goto err_alloc;
-
-        err = net_assign_generic(net, ipip_net_id, ipn);
-        if (err < 0)
-                goto err_assign;
 
         ipn->tunnels[0] = ipn->tunnels_wc;
         ipn->tunnels[1] = ipn->tunnels_l;
@@ -801,27 +803,26 @@ err_reg_dev:
         free_netdev(ipn->fb_tunnel_dev);
 err_alloc_dev:
         /* nothing */
-err_assign:
-        kfree(ipn);
-err_alloc:
         return err;
 }
 
 static void ipip_exit_net(struct net *net)
 {
-        struct ipip_net *ipn;
+        struct ipip_net *ipn = net_generic(net, ipip_net_id);
+        LIST_HEAD(list);
 
-        ipn = net_generic(net, ipip_net_id);
         rtnl_lock();
-        ipip_destroy_tunnels(ipn);
-        unregister_netdevice(ipn->fb_tunnel_dev);
+        ipip_destroy_tunnels(ipn, &list);
+        unregister_netdevice_queue(ipn->fb_tunnel_dev, &list);
+        unregister_netdevice_many(&list);
         rtnl_unlock();
-        kfree(ipn);
 }
 
 static struct pernet_operations ipip_net_ops = {
         .init = ipip_init_net,
         .exit = ipip_exit_net,
+        .id   = &ipip_net_id,
+        .size = sizeof(struct ipip_net),
 };
 
 static int __init ipip_init(void)
@@ -835,7 +836,7 @@ static int __init ipip_init(void)
                 return -EAGAIN;
         }
 
-        err = register_pernet_gen_device(&ipip_net_id, &ipip_net_ops);
+        err = register_pernet_device(&ipip_net_ops);
         if (err)
                 xfrm4_tunnel_deregister(&ipip_handler, AF_INET);
 
@@ -847,7 +848,7 @@ static void __exit ipip_fini(void)
         if (xfrm4_tunnel_deregister(&ipip_handler, AF_INET))
                 printk(KERN_INFO "ipip close: can't deregister tunnel\n");
 
-        unregister_pernet_gen_device(ipip_net_id, &ipip_net_ops);
+        unregister_pernet_device(&ipip_net_ops);
 }
 
 module_init(ipip_init);
diff --git a/net/ipv4/ipmr.c b/net/ipv4/ipmr.c
index 99508d66a642..54596f73eff5 100644
--- a/net/ipv4/ipmr.c
+++ b/net/ipv4/ipmr.c
@@ -275,7 +275,8 @@ failure:
  *      @notify: Set to 1, if the caller is a notifier_call
  */
 
-static int vif_delete(struct net *net, int vifi, int notify)
+static int vif_delete(struct net *net, int vifi, int notify,
+                      struct list_head *head)
 {
         struct vif_device *v;
         struct net_device *dev;
@@ -319,7 +320,7 @@ static int vif_delete(struct net *net, int vifi, int notify)
         }
 
         if (v->flags&(VIFF_TUNNEL|VIFF_REGISTER) && !notify)
-                unregister_netdevice(dev);
+                unregister_netdevice_queue(dev, head);
 
         dev_put(dev);
         return 0;
@@ -469,8 +470,18 @@ static int vif_add(struct net *net, struct vifctl *vifc, int mrtsock)
                         return err;
                 }
                 break;
+
+        case VIFF_USE_IFINDEX:
         case 0:
-                dev = ip_dev_find(net, vifc->vifc_lcl_addr.s_addr);
+                if (vifc->vifc_flags == VIFF_USE_IFINDEX) {
+                        dev = dev_get_by_index(net, vifc->vifc_lcl_ifindex);
+                        if (dev && dev->ip_ptr == NULL) {
+                                dev_put(dev);
+                                return -EADDRNOTAVAIL;
+                        }
+                } else
+                        dev = ip_dev_find(net, vifc->vifc_lcl_addr.s_addr);
+
                 if (!dev)
                         return -EADDRNOTAVAIL;
                 err = dev_set_allmulti(dev, 1);
@@ -862,14 +873,16 @@ static int ipmr_mfc_add(struct net *net, struct mfcctl *mfc, int mrtsock)
 static void mroute_clean_tables(struct net *net)
 {
         int i;
+        LIST_HEAD(list);
 
         /*
          *      Shut down all active vif entries
          */
         for (i = 0; i < net->ipv4.maxvif; i++) {
                 if (!(net->ipv4.vif_table[i].flags&VIFF_STATIC))
-                        vif_delete(net, i, 0);
+                        vif_delete(net, i, 0, &list);
         }
+        unregister_netdevice_many(&list);
 
         /*
          *      Wipe the cache
@@ -948,7 +961,7 @@ int ip_mroute_setsockopt(struct sock *sk, int optname, char __user *optval, unsi
         switch (optname) {
         case MRT_INIT:
                 if (sk->sk_type != SOCK_RAW ||
-                    inet_sk(sk)->num != IPPROTO_IGMP)
+                    inet_sk(sk)->inet_num != IPPROTO_IGMP)
                         return -EOPNOTSUPP;
                 if (optlen != sizeof(int))
                         return -ENOPROTOOPT;
@@ -985,7 +998,7 @@ int ip_mroute_setsockopt(struct sock *sk, int optname, char __user *optval, unsi
                 if (optname == MRT_ADD_VIF) {
                         ret = vif_add(net, &vif, sk == net->ipv4.mroute_sk);
                 } else {
-                        ret = vif_delete(net, vif.vifc_vifi, 0);
+                        ret = vif_delete(net, vif.vifc_vifi, 0, NULL);
                 }
                 rtnl_unlock();
                 return ret;
@@ -1148,6 +1161,7 @@ static int ipmr_device_event(struct notifier_block *this, unsigned long event, v
         struct net *net = dev_net(dev);
         struct vif_device *v;
         int ct;
+        LIST_HEAD(list);
 
         if (!net_eq(dev_net(dev), net))
                 return NOTIFY_DONE;
@@ -1157,8 +1171,9 @@ static int ipmr_device_event(struct notifier_block *this, unsigned long event, v
         v = &net->ipv4.vif_table[0];
         for (ct = 0; ct < net->ipv4.maxvif; ct++, v++) {
                 if (v->dev == dev)
-                        vif_delete(net, ct, 1);
+                        vif_delete(net, ct, 1, &list);
         }
+        unregister_netdevice_many(&list);
         return NOTIFY_DONE;
 }
 
diff --git a/net/ipv4/netfilter.c b/net/ipv4/netfilter.c
index db52c0cb0c11..c14623fc4d5e 100644
--- a/net/ipv4/netfilter.c
+++ b/net/ipv4/netfilter.c
@@ -155,10 +155,10 @@ static int nf_ip_reroute(struct sk_buff *skb,
         if (entry->hook == NF_INET_LOCAL_OUT) {
                 const struct iphdr *iph = ip_hdr(skb);
 
-                if (!(iph->tos == rt_info->tos
-                      && skb->mark == rt_info->mark
-                      && iph->daddr == rt_info->daddr
-                      && iph->saddr == rt_info->saddr))
+                if (!(iph->tos == rt_info->tos &&
+                      skb->mark == rt_info->mark &&
+                      iph->daddr == rt_info->daddr &&
+                      iph->saddr == rt_info->saddr))
                         return ip_route_me_harder(skb, RTN_UNSPEC);
         }
         return 0;
diff --git a/net/ipv4/netfilter/arp_tables.c b/net/ipv4/netfilter/arp_tables.c
index 27774c99d888..06632762ba5f 100644
--- a/net/ipv4/netfilter/arp_tables.c
+++ b/net/ipv4/netfilter/arp_tables.c
@@ -384,11 +384,11 @@ static int mark_source_chains(struct xt_table_info *newinfo,
                                 |= ((1 << hook) | (1 << NF_ARP_NUMHOOKS));
 
                         /* Unconditional return/END. */
-                        if ((e->target_offset == sizeof(struct arpt_entry)
-                            && (strcmp(t->target.u.user.name,
-                                       ARPT_STANDARD_TARGET) == 0)
-                            && t->verdict < 0
-                            && unconditional(&e->arp)) || visited) {
+                        if ((e->target_offset == sizeof(struct arpt_entry) &&
+                             (strcmp(t->target.u.user.name,
+                                     ARPT_STANDARD_TARGET) == 0) &&
+                             t->verdict < 0 && unconditional(&e->arp)) ||
+                            visited) {
                                 unsigned int oldpos, size;
 
                                 if ((strcmp(t->target.u.user.name,
@@ -427,8 +427,8 @@ static int mark_source_chains(struct xt_table_info *newinfo,
                                 int newpos = t->verdict;
 
                                 if (strcmp(t->target.u.user.name,
-                                           ARPT_STANDARD_TARGET) == 0
-                                    && newpos >= 0) {
+                                           ARPT_STANDARD_TARGET) == 0 &&
+                                    newpos >= 0) {
                                         if (newpos > newinfo->size -
                                                 sizeof(struct arpt_entry)) {
                                                 duprintf("mark_source_chains: "
@@ -559,8 +559,8 @@ static inline int check_entry_size_and_hooks(struct arpt_entry *e,
 {
         unsigned int h;
 
-        if ((unsigned long)e % __alignof__(struct arpt_entry) != 0
-            || (unsigned char *)e + sizeof(struct arpt_entry) >= limit) {
+        if ((unsigned long)e % __alignof__(struct arpt_entry) != 0 ||
+            (unsigned char *)e + sizeof(struct arpt_entry) >= limit) {
                 duprintf("Bad offset %p\n", e);
                 return -EINVAL;
         }
@@ -1251,8 +1251,8 @@ check_compat_entry_size_and_hooks(struct compat_arpt_entry *e,
         int ret, off, h;
 
         duprintf("check_compat_entry_size_and_hooks %p\n", e);
-        if ((unsigned long)e % __alignof__(struct compat_arpt_entry) != 0
-            || (unsigned char *)e + sizeof(struct compat_arpt_entry) >= limit) {
+        if ((unsigned long)e % __alignof__(struct compat_arpt_entry) != 0 ||
+            (unsigned char *)e + sizeof(struct compat_arpt_entry) >= limit) {
                 duprintf("Bad offset %p, limit = %p\n", e, limit);
                 return -EINVAL;
         }
diff --git a/net/ipv4/netfilter/ip_queue.c b/net/ipv4/netfilter/ip_queue.c
index c9f90e8c5191..2855f1f38cbc 100644
--- a/net/ipv4/netfilter/ip_queue.c
+++ b/net/ipv4/netfilter/ip_queue.c
@@ -497,10 +497,9 @@ ipq_rcv_nl_event(struct notifier_block *this,
 {
         struct netlink_notify *n = ptr;
 
-        if (event == NETLINK_URELEASE &&
-            n->protocol == NETLINK_FIREWALL && n->pid) {
+        if (event == NETLINK_URELEASE && n->protocol == NETLINK_FIREWALL) {
                 write_lock_bh(&queue_lock);
-                if ((n->net == &init_net) && (n->pid == peer_pid))
+                if ((net_eq(n->net, &init_net)) && (n->pid == peer_pid))
                         __ipq_reset();
                 write_unlock_bh(&queue_lock);
         }
@@ -621,7 +620,7 @@ cleanup_netlink_notifier:
 static void __exit ip_queue_fini(void)
 {
         nf_unregister_queue_handlers(&nfqh);
-        synchronize_net();
+
         ipq_flush(NULL, 0);
 
 #ifdef CONFIG_SYSCTL
diff --git a/net/ipv4/netfilter/ip_tables.c b/net/ipv4/netfilter/ip_tables.c
index cde755d5eeab..572330a552ef 100644
--- a/net/ipv4/netfilter/ip_tables.c
+++ b/net/ipv4/netfilter/ip_tables.c
@@ -89,9 +89,9 @@ ip_packet_match(const struct iphdr *ip,
 #define FWINV(bool, invflg) ((bool) ^ !!(ipinfo->invflags & (invflg)))
 
         if (FWINV((ip->saddr&ipinfo->smsk.s_addr) != ipinfo->src.s_addr,
-                  IPT_INV_SRCIP)
-            || FWINV((ip->daddr&ipinfo->dmsk.s_addr) != ipinfo->dst.s_addr,
-                     IPT_INV_DSTIP)) {
+                  IPT_INV_SRCIP) ||
+            FWINV((ip->daddr&ipinfo->dmsk.s_addr) != ipinfo->dst.s_addr,
+                  IPT_INV_DSTIP)) {
                 dprintf("Source or dest mismatch.\n");
 
                 dprintf("SRC: %pI4. Mask: %pI4. Target: %pI4.%s\n",
@@ -122,8 +122,8 @@ ip_packet_match(const struct iphdr *ip,
         }
 
         /* Check specific protocol */
-        if (ipinfo->proto
-            && FWINV(ip->protocol != ipinfo->proto, IPT_INV_PROTO)) {
+        if (ipinfo->proto &&
+            FWINV(ip->protocol != ipinfo->proto, IPT_INV_PROTO)) {
                 dprintf("Packet protocol %hi does not match %hi.%s\n",
                         ip->protocol, ipinfo->proto,
                         ipinfo->invflags&IPT_INV_PROTO ? " (INV)":"");
@@ -246,11 +246,11 @@ get_chainname_rulenum(struct ipt_entry *s, struct ipt_entry *e,
         } else if (s == e) {
                 (*rulenum)++;
 
-                if (s->target_offset == sizeof(struct ipt_entry)
-                   && strcmp(t->target.u.kernel.target->name,
-                             IPT_STANDARD_TARGET) == 0
-                   && t->verdict < 0
-                   && unconditional(&s->ip)) {
+                if (s->target_offset == sizeof(struct ipt_entry) &&
+                    strcmp(t->target.u.kernel.target->name,
+                           IPT_STANDARD_TARGET) == 0 &&
+                   t->verdict < 0 &&
+                   unconditional(&s->ip)) {
                         /* Tail of chains: STANDARD target (return/policy) */
                         *comment = *chainname == hookname
                                 ? comments[NF_IP_TRACE_COMMENT_POLICY]
@@ -388,8 +388,8 @@ ipt_do_table(struct sk_buff *skb,
                                 back = get_entry(table_base, back->comefrom);
                                 continue;
                         }
-                        if (table_base + v != ipt_next_entry(e)
-                            && !(e->ip.flags & IPT_F_GOTO)) {
+                        if (table_base + v != ipt_next_entry(e) &&
+                            !(e->ip.flags & IPT_F_GOTO)) {
                                 /* Save old back ptr in next entry */
                                 struct ipt_entry *next = ipt_next_entry(e);
                                 next->comefrom = (void *)back - table_base;
@@ -473,11 +473,11 @@ mark_source_chains(struct xt_table_info *newinfo,
                         e->comefrom |= ((1 << hook) | (1 << NF_INET_NUMHOOKS));
 
                         /* Unconditional return/END. */
-                        if ((e->target_offset == sizeof(struct ipt_entry)
-                            && (strcmp(t->target.u.user.name,
-                                       IPT_STANDARD_TARGET) == 0)
-                            && t->verdict < 0
-                            && unconditional(&e->ip)) || visited) {
+                        if ((e->target_offset == sizeof(struct ipt_entry) &&
+                             (strcmp(t->target.u.user.name,
+                                     IPT_STANDARD_TARGET) == 0) &&
+                             t->verdict < 0 && unconditional(&e->ip)) ||
+                            visited) {
                                 unsigned int oldpos, size;
 
                                 if ((strcmp(t->target.u.user.name,
@@ -524,8 +524,8 @@ mark_source_chains(struct xt_table_info *newinfo,
                                 int newpos = t->verdict;
 
                                 if (strcmp(t->target.u.user.name,
-                                           IPT_STANDARD_TARGET) == 0
-                                    && newpos >= 0) {
+                                           IPT_STANDARD_TARGET) == 0 &&
+                                    newpos >= 0) {
                                         if (newpos > newinfo->size -
                                                 sizeof(struct ipt_entry)) {
                                                 duprintf("mark_source_chains: "
@@ -735,8 +735,8 @@ check_entry_size_and_hooks(struct ipt_entry *e,
 {
         unsigned int h;
 
-        if ((unsigned long)e % __alignof__(struct ipt_entry) != 0
-            || (unsigned char *)e + sizeof(struct ipt_entry) >= limit) {
+        if ((unsigned long)e % __alignof__(struct ipt_entry) != 0 ||
+            (unsigned char *)e + sizeof(struct ipt_entry) >= limit) {
                 duprintf("Bad offset %p\n", e);
                 return -EINVAL;
         }
@@ -1548,8 +1548,8 @@ check_compat_entry_size_and_hooks(struct compat_ipt_entry *e,
         int ret, off, h;
 
         duprintf("check_compat_entry_size_and_hooks %p\n", e);
-        if ((unsigned long)e % __alignof__(struct compat_ipt_entry) != 0
-            || (unsigned char *)e + sizeof(struct compat_ipt_entry) >= limit) {
+        if ((unsigned long)e % __alignof__(struct compat_ipt_entry) != 0 ||
+            (unsigned char *)e + sizeof(struct compat_ipt_entry) >= limit) {
                 duprintf("Bad offset %p, limit = %p\n", e, limit);
                 return -EINVAL;
         }
diff --git a/net/ipv4/netfilter/ipt_CLUSTERIP.c b/net/ipv4/netfilter/ipt_CLUSTERIP.c
index 2e4f98b85524..40ca2d240abb 100644
--- a/net/ipv4/netfilter/ipt_CLUSTERIP.c
+++ b/net/ipv4/netfilter/ipt_CLUSTERIP.c
@@ -303,9 +303,9 @@ clusterip_tg(struct sk_buff *skb, const struct xt_target_param *par)
 
         /* special case: ICMP error handling. conntrack distinguishes between
          * error messages (RELATED) and information requests (see below) */
-        if (ip_hdr(skb)->protocol == IPPROTO_ICMP
-            && (ctinfo == IP_CT_RELATED
-                || ctinfo == IP_CT_RELATED+IP_CT_IS_REPLY))
+        if (ip_hdr(skb)->protocol == IPPROTO_ICMP &&
+            (ctinfo == IP_CT_RELATED ||
+             ctinfo == IP_CT_RELATED + IP_CT_IS_REPLY))
                 return XT_CONTINUE;
 
         /* ip_conntrack_icmp guarantees us that we only have ICMP_ECHO,
@@ -362,8 +362,8 @@ static bool clusterip_tg_check(const struct xt_tgchk_param *par)
                 return false;
 
         }
-        if (e->ip.dmsk.s_addr != htonl(0xffffffff)
-            || e->ip.dst.s_addr == 0) {
+        if (e->ip.dmsk.s_addr != htonl(0xffffffff) ||
+            e->ip.dst.s_addr == 0) {
                 printk(KERN_ERR "CLUSTERIP: Please specify destination IP\n");
                 return false;
         }
@@ -495,14 +495,14 @@ arp_mangle(unsigned int hook,
         struct clusterip_config *c;
 
         /* we don't care about non-ethernet and non-ipv4 ARP */
-        if (arp->ar_hrd != htons(ARPHRD_ETHER)
-            || arp->ar_pro != htons(ETH_P_IP)
-            || arp->ar_pln != 4 || arp->ar_hln != ETH_ALEN)
+        if (arp->ar_hrd != htons(ARPHRD_ETHER) ||
+            arp->ar_pro != htons(ETH_P_IP) ||
+            arp->ar_pln != 4 || arp->ar_hln != ETH_ALEN)
                 return NF_ACCEPT;
 
         /* we only want to mangle arp requests and replies */
-        if (arp->ar_op != htons(ARPOP_REPLY)
-            && arp->ar_op != htons(ARPOP_REQUEST))
+        if (arp->ar_op != htons(ARPOP_REPLY) &&
+            arp->ar_op != htons(ARPOP_REQUEST))
                 return NF_ACCEPT;
 
         payload = (void *)(arp+1);
diff --git a/net/ipv4/netfilter/ipt_ECN.c b/net/ipv4/netfilter/ipt_ECN.c
index f7e2fa0974dc..549e206cdd42 100644
--- a/net/ipv4/netfilter/ipt_ECN.c
+++ b/net/ipv4/netfilter/ipt_ECN.c
@@ -85,8 +85,8 @@ ecn_tg(struct sk_buff *skb, const struct xt_target_param *par)
                 if (!set_ect_ip(skb, einfo))
                         return NF_DROP;
 
-        if (einfo->operation & (IPT_ECN_OP_SET_ECE | IPT_ECN_OP_SET_CWR)
-            && ip_hdr(skb)->protocol == IPPROTO_TCP)
+        if (einfo->operation & (IPT_ECN_OP_SET_ECE | IPT_ECN_OP_SET_CWR) &&
+            ip_hdr(skb)->protocol == IPPROTO_TCP)
                 if (!set_ect_tcp(skb, einfo))
                         return NF_DROP;
 
@@ -108,8 +108,8 @@ static bool ecn_tg_check(const struct xt_tgchk_param *par)
                         einfo->ip_ect);
                 return false;
         }
-        if ((einfo->operation & (IPT_ECN_OP_SET_ECE|IPT_ECN_OP_SET_CWR))
-            && (e->ip.proto != IPPROTO_TCP || (e->ip.invflags & XT_INV_PROTO))) {
+        if ((einfo->operation & (IPT_ECN_OP_SET_ECE|IPT_ECN_OP_SET_CWR)) &&
+            (e->ip.proto != IPPROTO_TCP || (e->ip.invflags & XT_INV_PROTO))) {
                 printk(KERN_WARNING "ECN: cannot use TCP operations on a "
                        "non-tcp rule\n");
                 return false;
diff --git a/net/ipv4/netfilter/ipt_LOG.c b/net/ipv4/netfilter/ipt_LOG.c
index acc44c69eb68..ee128efa1c8d 100644
--- a/net/ipv4/netfilter/ipt_LOG.c
+++ b/net/ipv4/netfilter/ipt_LOG.c
@@ -74,8 +74,8 @@ static void dump_packet(const struct nf_loginfo *info,
         if (ntohs(ih->frag_off) & IP_OFFSET)
                 printk("FRAG:%u ", ntohs(ih->frag_off) & IP_OFFSET);
 
-        if ((logflags & IPT_LOG_IPOPT)
-            && ih->ihl * 4 > sizeof(struct iphdr)) {
+        if ((logflags & IPT_LOG_IPOPT) &&
+            ih->ihl * 4 > sizeof(struct iphdr)) {
                 const unsigned char *op;
                 unsigned char _opt[4 * 15 - sizeof(struct iphdr)];
                 unsigned int i, optsize;
@@ -146,8 +146,8 @@ static void dump_packet(const struct nf_loginfo *info,
                 /* Max length: 11 "URGP=65535 " */
                 printk("URGP=%u ", ntohs(th->urg_ptr));
 
-                if ((logflags & IPT_LOG_TCPOPT)
-                    && th->doff * 4 > sizeof(struct tcphdr)) {
+                if ((logflags & IPT_LOG_TCPOPT) &&
+                    th->doff * 4 > sizeof(struct tcphdr)) {
                         unsigned char _opt[4 * 15 - sizeof(struct tcphdr)];
                         const unsigned char *op;
                         unsigned int i, optsize;
@@ -238,9 +238,9 @@ static void dump_packet(const struct nf_loginfo *info,
                 printk("TYPE=%u CODE=%u ", ich->type, ich->code);
 
                 /* Max length: 25 "INCOMPLETE [65535 bytes] " */
-                if (ich->type <= NR_ICMP_TYPES
-                    && required_len[ich->type]
-                    && skb->len-iphoff-ih->ihl*4 < required_len[ich->type]) {
+                if (ich->type <= NR_ICMP_TYPES &&
+                    required_len[ich->type] &&
+                    skb->len-iphoff-ih->ihl*4 < required_len[ich->type]) {
                         printk("INCOMPLETE [%u bytes] ",
                                skb->len - iphoff - ih->ihl*4);
                         break;
@@ -276,8 +276,8 @@ static void dump_packet(const struct nf_loginfo *info,
                         }
 
                         /* Max length: 10 "MTU=65535 " */
-                        if (ich->type == ICMP_DEST_UNREACH
-                            && ich->code == ICMP_FRAG_NEEDED)
+                        if (ich->type == ICMP_DEST_UNREACH &&
+                            ich->code == ICMP_FRAG_NEEDED)
                                 printk("MTU=%u ", ntohs(ich->un.frag.mtu));
                 }
                 break;
@@ -407,8 +407,8 @@ ipt_log_packet(u_int8_t pf,
         if (in && !out) {
                 /* MAC logging for input chain only. */
                 printk("MAC=");
-                if (skb->dev && skb->dev->hard_header_len
-                    && skb->mac_header != skb->network_header) {
+                if (skb->dev && skb->dev->hard_header_len &&
+                    skb->mac_header != skb->network_header) {
                         int i;
                         const unsigned char *p = skb_mac_header(skb);
                         for (i = 0; i < skb->dev->hard_header_len; i++,p++)
diff --git a/net/ipv4/netfilter/ipt_MASQUERADE.c b/net/ipv4/netfilter/ipt_MASQUERADE.c
index dada0863946d..650b54042b01 100644
--- a/net/ipv4/netfilter/ipt_MASQUERADE.c
+++ b/net/ipv4/netfilter/ipt_MASQUERADE.c
@@ -59,8 +59,8 @@ masquerade_tg(struct sk_buff *skb, const struct xt_target_param *par)
         ct = nf_ct_get(skb, &ctinfo);
         nat = nfct_nat(ct);
 
-        NF_CT_ASSERT(ct && (ctinfo == IP_CT_NEW || ctinfo == IP_CT_RELATED
-                            || ctinfo == IP_CT_RELATED + IP_CT_IS_REPLY));
+        NF_CT_ASSERT(ct && (ctinfo == IP_CT_NEW || ctinfo == IP_CT_RELATED ||
+                            ctinfo == IP_CT_RELATED + IP_CT_IS_REPLY));
 
         /* Source address is 0.0.0.0 - locally generated packet that is
          * probably not supposed to be masqueraded.
diff --git a/net/ipv4/netfilter/ipt_REJECT.c b/net/ipv4/netfilter/ipt_REJECT.c
index c93ae44bff2a..5113b8f1a379 100644
--- a/net/ipv4/netfilter/ipt_REJECT.c
+++ b/net/ipv4/netfilter/ipt_REJECT.c
@@ -184,8 +184,8 @@ static bool reject_tg_check(const struct xt_tgchk_param *par)
                 return false;
         } else if (rejinfo->with == IPT_TCP_RESET) {
                 /* Must specify that it's a TCP packet */
-                if (e->ip.proto != IPPROTO_TCP
-                    || (e->ip.invflags & XT_INV_PROTO)) {
+                if (e->ip.proto != IPPROTO_TCP ||
+                    (e->ip.invflags & XT_INV_PROTO)) {
                         printk("ipt_REJECT: TCP_RESET invalid for non-tcp\n");
                         return false;
                 }
diff --git a/net/ipv4/netfilter/ipt_ULOG.c b/net/ipv4/netfilter/ipt_ULOG.c
index d32cc4bb328a..399061c3fd7d 100644
--- a/net/ipv4/netfilter/ipt_ULOG.c
+++ b/net/ipv4/netfilter/ipt_ULOG.c
@@ -226,9 +226,9 @@ static void ipt_ulog_packet(unsigned int hooknum,
         else
                 *(pm->prefix) = '\0';
 
-        if (in && in->hard_header_len > 0
-            && skb->mac_header != skb->network_header
-            && in->hard_header_len <= ULOG_MAC_LEN) {
+        if (in && in->hard_header_len > 0 &&
+            skb->mac_header != skb->network_header &&
+            in->hard_header_len <= ULOG_MAC_LEN) {
                 memcpy(pm->mac, skb_mac_header(skb), in->hard_header_len);
                 pm->mac_len = in->hard_header_len;
         } else
diff --git a/net/ipv4/netfilter/ipt_ecn.c b/net/ipv4/netfilter/ipt_ecn.c
index 6289b64144c6..2a1e56b71908 100644
--- a/net/ipv4/netfilter/ipt_ecn.c
+++ b/net/ipv4/netfilter/ipt_ecn.c
@@ -96,8 +96,8 @@ static bool ecn_mt_check(const struct xt_mtchk_param *par)
         if (info->invert & IPT_ECN_OP_MATCH_MASK)
                 return false;
 
-        if (info->operation & (IPT_ECN_OP_MATCH_ECE|IPT_ECN_OP_MATCH_CWR)
-            && ip->proto != IPPROTO_TCP) {
+        if (info->operation & (IPT_ECN_OP_MATCH_ECE|IPT_ECN_OP_MATCH_CWR) &&
+            ip->proto != IPPROTO_TCP) {
                 printk(KERN_WARNING "ipt_ecn: can't match TCP bits in rule for"
                        " non-tcp packets\n");
                 return false;
diff --git a/net/ipv4/netfilter/iptable_mangle.c b/net/ipv4/netfilter/iptable_mangle.c
index 036047f9b0f2..fae78c3076c4 100644
--- a/net/ipv4/netfilter/iptable_mangle.c
+++ b/net/ipv4/netfilter/iptable_mangle.c
@@ -130,8 +130,8 @@ ipt_local_hook(unsigned int hook,
         u_int32_t mark;
 
         /* root is playing with raw sockets. */
-        if (skb->len < sizeof(struct iphdr)
-            || ip_hdrlen(skb) < sizeof(struct iphdr))
+        if (skb->len < sizeof(struct iphdr) ||
+            ip_hdrlen(skb) < sizeof(struct iphdr))
                 return NF_ACCEPT;
 
         /* Save things which could affect route */
diff --git a/net/ipv4/netfilter/iptable_security.c b/net/ipv4/netfilter/iptable_security.c
index 99eb76c65d25..3bd3d6388da5 100644
--- a/net/ipv4/netfilter/iptable_security.c
+++ b/net/ipv4/netfilter/iptable_security.c
@@ -94,8 +94,8 @@ ipt_local_out_hook(unsigned int hook,
                    int (*okfn)(struct sk_buff *))
 {
         /* Somebody is playing with raw sockets. */
-        if (skb->len < sizeof(struct iphdr)
-            || ip_hdrlen(skb) < sizeof(struct iphdr))
+        if (skb->len < sizeof(struct iphdr) ||
+            ip_hdrlen(skb) < sizeof(struct iphdr))
                 return NF_ACCEPT;
         return ipt_do_table(skb, hook, in, out,
                             dev_net(out)->ipv4.iptable_security);
diff --git a/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c b/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c
index 092d68f916e6..d171b123a656 100644
--- a/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c
+++ b/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c
@@ -247,10 +247,10 @@ getorigdst(struct sock *sk, int optval, void __user *user, int *len)
         struct nf_conntrack_tuple tuple;
 
         memset(&tuple, 0, sizeof(tuple));
-        tuple.src.u3.ip = inet->rcv_saddr;
-        tuple.src.u.tcp.port = inet->sport;
-        tuple.dst.u3.ip = inet->daddr;
-        tuple.dst.u.tcp.port = inet->dport;
+        tuple.src.u3.ip = inet->inet_rcv_saddr;
+        tuple.src.u.tcp.port = inet->inet_sport;
+        tuple.dst.u3.ip = inet->inet_daddr;
+        tuple.dst.u.tcp.port = inet->inet_dport;
         tuple.src.l3num = PF_INET;
         tuple.dst.protonum = sk->sk_protocol;
 
diff --git a/net/ipv4/netfilter/nf_conntrack_proto_icmp.c b/net/ipv4/netfilter/nf_conntrack_proto_icmp.c
index 9072058778b8..7afd39b5b781 100644
--- a/net/ipv4/netfilter/nf_conntrack_proto_icmp.c
+++ b/net/ipv4/netfilter/nf_conntrack_proto_icmp.c
@@ -54,8 +54,8 @@ static const u_int8_t invmap[] = {
 static bool icmp_invert_tuple(struct nf_conntrack_tuple *tuple,
                               const struct nf_conntrack_tuple *orig)
 {
-        if (orig->dst.u.icmp.type >= sizeof(invmap)
-            || !invmap[orig->dst.u.icmp.type])
+        if (orig->dst.u.icmp.type >= sizeof(invmap) ||
+            !invmap[orig->dst.u.icmp.type])
                 return false;
 
         tuple->src.u.icmp.id = orig->src.u.icmp.id;
@@ -101,8 +101,8 @@ static bool icmp_new(struct nf_conn *ct, const struct sk_buff *skb,
                 [ICMP_ADDRESS] = 1
         };
 
-        if (ct->tuplehash[0].tuple.dst.u.icmp.type >= sizeof(valid_new)
-            || !valid_new[ct->tuplehash[0].tuple.dst.u.icmp.type]) {
+        if (ct->tuplehash[0].tuple.dst.u.icmp.type >= sizeof(valid_new) ||
+            !valid_new[ct->tuplehash[0].tuple.dst.u.icmp.type]) {
                 /* Can't create a new ICMP `conn' with this. */
                 pr_debug("icmp: can't create new conn with type %u\n",
                          ct->tuplehash[0].tuple.dst.u.icmp.type);
@@ -201,11 +201,11 @@ icmp_error(struct net *net, struct sk_buff *skb, unsigned int dataoff,
         }
 
         /* Need to track icmp error message? */
-        if (icmph->type != ICMP_DEST_UNREACH
-            && icmph->type != ICMP_SOURCE_QUENCH
-            && icmph->type != ICMP_TIME_EXCEEDED
-            && icmph->type != ICMP_PARAMETERPROB
-            && icmph->type != ICMP_REDIRECT)
+        if (icmph->type != ICMP_DEST_UNREACH &&
+            icmph->type != ICMP_SOURCE_QUENCH &&
+            icmph->type != ICMP_TIME_EXCEEDED &&
+            icmph->type != ICMP_PARAMETERPROB &&
+            icmph->type != ICMP_REDIRECT)
                 return NF_ACCEPT;
 
         return icmp_error_message(net, skb, ctinfo, hooknum);
@@ -238,17 +238,17 @@ static const struct nla_policy icmp_nla_policy[CTA_PROTO_MAX+1] = {
 static int icmp_nlattr_to_tuple(struct nlattr *tb[],
                                 struct nf_conntrack_tuple *tuple)
 {
-        if (!tb[CTA_PROTO_ICMP_TYPE]
-            || !tb[CTA_PROTO_ICMP_CODE]
-            || !tb[CTA_PROTO_ICMP_ID])
+        if (!tb[CTA_PROTO_ICMP_TYPE] ||
+            !tb[CTA_PROTO_ICMP_CODE] ||
+            !tb[CTA_PROTO_ICMP_ID])
                 return -EINVAL;
 
         tuple->dst.u.icmp.type = nla_get_u8(tb[CTA_PROTO_ICMP_TYPE]);
         tuple->dst.u.icmp.code = nla_get_u8(tb[CTA_PROTO_ICMP_CODE]);
         tuple->src.u.icmp.id = nla_get_be16(tb[CTA_PROTO_ICMP_ID]);
 
-        if (tuple->dst.u.icmp.type >= sizeof(invmap)
-            || !invmap[tuple->dst.u.icmp.type])
+        if (tuple->dst.u.icmp.type >= sizeof(invmap) ||
+            !invmap[tuple->dst.u.icmp.type])
                 return -EINVAL;
 
         return 0;
diff --git a/net/ipv4/netfilter/nf_nat_helper.c b/net/ipv4/netfilter/nf_nat_helper.c
index f9520fa3aba9..7f10a6be0191 100644
--- a/net/ipv4/netfilter/nf_nat_helper.c
+++ b/net/ipv4/netfilter/nf_nat_helper.c
@@ -41,18 +41,14 @@ adjust_tcp_sequence(u32 seq,
                     struct nf_conn *ct,
                     enum ip_conntrack_info ctinfo)
 {
-        int dir;
-        struct nf_nat_seq *this_way, *other_way;
+        enum ip_conntrack_dir dir = CTINFO2DIR(ctinfo);
         struct nf_conn_nat *nat = nfct_nat(ct);
+        struct nf_nat_seq *this_way = &nat->seq[dir];
 
-        pr_debug("adjust_tcp_sequence: seq = %u, sizediff = %d\n", seq, seq);
-
-        dir = CTINFO2DIR(ctinfo);
-
-        this_way = &nat->seq[dir];
-        other_way = &nat->seq[!dir];
+        pr_debug("adjust_tcp_sequence: seq = %u, sizediff = %d\n",
+                 seq, sizediff);
 
-        pr_debug("nf_nat_resize_packet: Seq_offset before: ");
+        pr_debug("adjust_tcp_sequence: Seq_offset before: ");
         DUMP_OFFSET(this_way);
 
         spin_lock_bh(&nf_nat_seqofs_lock);
@@ -63,13 +59,13 @@ adjust_tcp_sequence(u32 seq,
          * retransmit */
         if (this_way->offset_before == this_way->offset_after ||
             before(this_way->correction_pos, seq)) {
-                   this_way->correction_pos = seq;
-                   this_way->offset_before = this_way->offset_after;
-                   this_way->offset_after += sizediff;
+                this_way->correction_pos = seq;
+                this_way->offset_before = this_way->offset_after;
+                this_way->offset_after += sizediff;
         }
         spin_unlock_bh(&nf_nat_seqofs_lock);
 
-        pr_debug("nf_nat_resize_packet: Seq_offset after: ");
+        pr_debug("adjust_tcp_sequence: Seq_offset after: ");
         DUMP_OFFSET(this_way);
 }
 
diff --git a/net/ipv4/netfilter/nf_nat_standalone.c b/net/ipv4/netfilter/nf_nat_standalone.c
index 5f41d017ddd8..5678e9562c15 100644
--- a/net/ipv4/netfilter/nf_nat_standalone.c
+++ b/net/ipv4/netfilter/nf_nat_standalone.c
@@ -197,11 +197,11 @@ nf_nat_out(unsigned int hooknum,
             (ct = nf_ct_get(skb, &ctinfo)) != NULL) {
                 enum ip_conntrack_dir dir = CTINFO2DIR(ctinfo);
 
-                if (ct->tuplehash[dir].tuple.src.u3.ip !=
-                    ct->tuplehash[!dir].tuple.dst.u3.ip
-                    || ct->tuplehash[dir].tuple.src.u.all !=
-                       ct->tuplehash[!dir].tuple.dst.u.all
-                    )
+                if ((ct->tuplehash[dir].tuple.src.u3.ip !=
+                     ct->tuplehash[!dir].tuple.dst.u3.ip) ||
+                    (ct->tuplehash[dir].tuple.src.u.all !=
+                     ct->tuplehash[!dir].tuple.dst.u.all)
+                   )
                         return ip_xfrm_me_harder(skb) == 0 ? ret : NF_DROP;
         }
 #endif
diff --git a/net/ipv4/raw.c b/net/ipv4/raw.c
index ab996f9c0fe0..ce154b47f1da 100644
--- a/net/ipv4/raw.c
+++ b/net/ipv4/raw.c
@@ -87,7 +87,7 @@ void raw_hash_sk(struct sock *sk)
         struct raw_hashinfo *h = sk->sk_prot->h.raw_hash;
         struct hlist_head *head;
 
-        head = &h->ht[inet_sk(sk)->num & (RAW_HTABLE_SIZE - 1)];
+        head = &h->ht[inet_sk(sk)->inet_num & (RAW_HTABLE_SIZE - 1)];
 
         write_lock_bh(&h->lock);
         sk_add_node(sk, head);
@@ -115,9 +115,9 @@ static struct sock *__raw_v4_lookup(struct net *net, struct sock *sk,
         sk_for_each_from(sk, node) {
                 struct inet_sock *inet = inet_sk(sk);
 
-                if (net_eq(sock_net(sk), net) && inet->num == num       &&
-                    !(inet->daddr && inet->daddr != raddr)              &&
-                    !(inet->rcv_saddr && inet->rcv_saddr != laddr)      &&
+                if (net_eq(sock_net(sk), net) && inet->inet_num == num  &&
+                    !(inet->inet_daddr && inet->inet_daddr != raddr)    &&
+                    !(inet->inet_rcv_saddr && inet->inet_rcv_saddr != laddr) &&
                     !(sk->sk_bound_dev_if && sk->sk_bound_dev_if != dif))
                         goto found; /* gotcha */
         }
@@ -292,7 +292,6 @@ static int raw_rcv_skb(struct sock * sk, struct sk_buff * skb)
         /* Charge it to the socket. */
 
         if (sock_queue_rcv_skb(sk, skb) < 0) {
-                atomic_inc(&sk->sk_drops);
                 kfree_skb(skb);
                 return NET_RX_DROP;
         }
@@ -327,7 +326,7 @@ static int raw_send_hdrinc(struct sock *sk, void *from, size_t length,
         int err;
 
         if (length > rt->u.dst.dev->mtu) {
-                ip_local_error(sk, EMSGSIZE, rt->rt_dst, inet->dport,
+                ip_local_error(sk, EMSGSIZE, rt->rt_dst, inet->inet_dport,
                                rt->u.dst.dev->mtu);
                 return -EMSGSIZE;
         }
@@ -500,10 +499,10 @@ static int raw_sendmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
                 err = -EDESTADDRREQ;
                 if (sk->sk_state != TCP_ESTABLISHED)
                         goto out;
-                daddr = inet->daddr;
+                daddr = inet->inet_daddr;
         }
 
-        ipc.addr = inet->saddr;
+        ipc.addr = inet->inet_saddr;
         ipc.opt = NULL;
         ipc.shtx.flags = 0;
         ipc.oif = sk->sk_bound_dev_if;
@@ -645,9 +644,9 @@ static int raw_bind(struct sock *sk, struct sockaddr *uaddr, int addr_len)
         if (addr->sin_addr.s_addr && chk_addr_ret != RTN_LOCAL &&
             chk_addr_ret != RTN_MULTICAST && chk_addr_ret != RTN_BROADCAST)
                 goto out;
-        inet->rcv_saddr = inet->saddr = addr->sin_addr.s_addr;
+        inet->inet_rcv_saddr = inet->inet_saddr = addr->sin_addr.s_addr;
         if (chk_addr_ret == RTN_MULTICAST || chk_addr_ret == RTN_BROADCAST)
-                inet->saddr = 0;  /* Use device */
+                inet->inet_saddr = 0;  /* Use device */
         sk_dst_reset(sk);
         ret = 0;
 out:    return ret;
@@ -692,7 +691,7 @@ static int raw_recvmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
         if (err)
                 goto done;
 
-        sock_recv_timestamp(msg, sk, skb);
+        sock_recv_ts_and_drops(msg, sk, skb);
 
         /* Copy the address. */
         if (sin) {
@@ -717,7 +716,7 @@ static int raw_init(struct sock *sk)
 {
         struct raw_sock *rp = raw_sk(sk);
 
-        if (inet_sk(sk)->num == IPPROTO_ICMP)
+        if (inet_sk(sk)->inet_num == IPPROTO_ICMP)
                 memset(&rp->filter, 0, sizeof(rp->filter));
         return 0;
 }
@@ -754,7 +753,7 @@ static int do_raw_setsockopt(struct sock *sk, int level, int optname,
                           char __user *optval, unsigned int optlen)
 {
         if (optname == ICMP_FILTER) {
-                if (inet_sk(sk)->num != IPPROTO_ICMP)
+                if (inet_sk(sk)->inet_num != IPPROTO_ICMP)
                         return -EOPNOTSUPP;
                 else
                         return raw_seticmpfilter(sk, optval, optlen);
@@ -784,7 +783,7 @@ static int do_raw_getsockopt(struct sock *sk, int level, int optname,
                           char __user *optval, int __user *optlen)
 {
         if (optname == ICMP_FILTER) {
-                if (inet_sk(sk)->num != IPPROTO_ICMP)
+                if (inet_sk(sk)->inet_num != IPPROTO_ICMP)
                         return -EOPNOTSUPP;
                 else
                         return raw_geticmpfilter(sk, optval, optlen);
@@ -943,10 +942,10 @@ EXPORT_SYMBOL_GPL(raw_seq_stop);
 static void raw_sock_seq_show(struct seq_file *seq, struct sock *sp, int i)
 {
         struct inet_sock *inet = inet_sk(sp);
-        __be32 dest = inet->daddr,
-               src = inet->rcv_saddr;
+        __be32 dest = inet->inet_daddr,
+               src = inet->inet_rcv_saddr;
         __u16 destp = 0,
-              srcp  = inet->num;
+              srcp  = inet->inet_num;
 
         seq_printf(seq, "%4d: %08X:%04X %08X:%04X"
                 " %02X %08X:%08X %02X:%08lX %08X %5d %8d %lu %d %p %d\n",
diff --git a/net/ipv4/route.c b/net/ipv4/route.c
index 0d9f584a3811..e446496f564f 100644
--- a/net/ipv4/route.c
+++ b/net/ipv4/route.c
@@ -513,43 +513,42 @@ static const struct file_operations rt_cpu_seq_fops = {
 };
 
 #ifdef CONFIG_NET_CLS_ROUTE
-static int ip_rt_acct_read(char *buffer, char **start, off_t offset,
-                           int length, int *eof, void *data)
-{
-        unsigned int i;
-
-        if ((offset & 3) || (length & 3))
-                return -EIO;
-
-        if (offset >= sizeof(struct ip_rt_acct) * 256) {
-                *eof = 1;
-                return 0;
-        }
-
-        if (offset + length >= sizeof(struct ip_rt_acct) * 256) {
-                length = sizeof(struct ip_rt_acct) * 256 - offset;
-                *eof = 1;
+static int rt_acct_proc_show(struct seq_file *m, void *v)
+{
+        struct ip_rt_acct *dst, *src;
+        unsigned int i, j;
+
+        dst = kcalloc(256, sizeof(struct ip_rt_acct), GFP_KERNEL);
+        if (!dst)
+                return -ENOMEM;
+
+        for_each_possible_cpu(i) {
+                src = (struct ip_rt_acct *)per_cpu_ptr(ip_rt_acct, i);
+                for (j = 0; j < 256; j++) {
+                        dst[j].o_bytes   += src[j].o_bytes;
+                        dst[j].o_packets += src[j].o_packets;
+                        dst[j].i_bytes   += src[j].i_bytes;
+                        dst[j].i_packets += src[j].i_packets;
+                }
         }
 
-        offset /= sizeof(u32);
-
-        if (length > 0) {
-                u32 *dst = (u32 *) buffer;
-
-                *start = buffer;
-                memset(dst, 0, length);
-
-                for_each_possible_cpu(i) {
-                        unsigned int j;
-                        u32 *src;
+        seq_write(m, dst, 256 * sizeof(struct ip_rt_acct));
+        kfree(dst);
+        return 0;
+}
 
-                        src = ((u32 *) per_cpu_ptr(ip_rt_acct, i)) + offset;
-                        for (j = 0; j < length/4; j++)
-                                dst[j] += src[j];
-                }
-        }
-        return length;
+static int rt_acct_proc_open(struct inode *inode, struct file *file)
+{
+        return single_open(file, rt_acct_proc_show, NULL);
 }
+
+static const struct file_operations rt_acct_proc_fops = {
+        .owner          = THIS_MODULE,
+        .open           = rt_acct_proc_open,
+        .read           = seq_read,
+        .llseek         = seq_lseek,
+        .release        = single_release,
+};
 #endif
 
 static int __net_init ip_rt_do_proc_init(struct net *net)
@@ -567,8 +566,7 @@ static int __net_init ip_rt_do_proc_init(struct net *net)
                 goto err2;
 
 #ifdef CONFIG_NET_CLS_ROUTE
-        pde = create_proc_read_entry("rt_acct", 0, net->proc_net,
-                        ip_rt_acct_read, NULL);
+        pde = proc_create("rt_acct", 0, net->proc_net, &rt_acct_proc_fops);
         if (!pde)
                 goto err3;
 #endif
@@ -703,7 +701,7 @@ static inline int compare_keys(struct flowi *fl1, struct flowi *fl2)
 
 static inline int compare_netns(struct rtable *rt1, struct rtable *rt2)
 {
-        return dev_net(rt1->u.dst.dev) == dev_net(rt2->u.dst.dev);
+        return net_eq(dev_net(rt1->u.dst.dev), dev_net(rt2->u.dst.dev));
 }
 
 static inline int rt_is_expired(struct rtable *rth)
@@ -902,6 +900,12 @@ void rt_cache_flush(struct net *net, int delay)
                 rt_do_flush(!in_softirq());
 }
 
+/* Flush previous cache invalidated entries from the cache */
+void rt_cache_flush_batch(void)
+{
+        rt_do_flush(!in_softirq());
+}
+
 /*
  * We change rt_genid and let gc do the cleanup
  */
@@ -1346,9 +1350,9 @@ void ip_rt_redirect(__be32 old_gw, __be32 daddr, __be32 new_gw,
                 return;
 
         net = dev_net(dev);
-        if (new_gw == old_gw || !IN_DEV_RX_REDIRECTS(in_dev)
-            || ipv4_is_multicast(new_gw) || ipv4_is_lbcast(new_gw)
-            || ipv4_is_zeronet(new_gw))
+        if (new_gw == old_gw || !IN_DEV_RX_REDIRECTS(in_dev) ||
+            ipv4_is_multicast(new_gw) || ipv4_is_lbcast(new_gw) ||
+            ipv4_is_zeronet(new_gw))
                 goto reject_redirect;
 
         if (!rt_caching(net))
@@ -1628,9 +1632,6 @@ unsigned short ip_rt_frag_needed(struct net *net, struct iphdr *iph,
         __be32  daddr = iph->daddr;
         unsigned short est_mtu = 0;
 
-        if (ipv4_config.no_pmtu_disc)
-                return 0;
-
         for (k = 0; k < 2; k++) {
                 for (i = 0; i < 2; i++) {
                         unsigned hash = rt_hash(daddr, skeys[i], ikeys[k],
@@ -2314,10 +2315,11 @@ skip_cache:
                                 ip_hdr(skb)->protocol);
                         if (our
 #ifdef CONFIG_IP_MROUTE
-                            || (!ipv4_is_local_multicast(daddr) &&
-                                IN_DEV_MFORWARD(in_dev))
+                                ||
+                            (!ipv4_is_local_multicast(daddr) &&
+                             IN_DEV_MFORWARD(in_dev))
 #endif
-                            ) {
+                           ) {
                                 rcu_read_unlock();
                                 return ip_route_input_mc(skb, daddr, saddr,
                                                          tos, dev, our);
@@ -2514,9 +2516,9 @@ static int ip_route_output_slow(struct net *net, struct rtable **rp,
                       of another iface. --ANK
                  */
 
-                if (oldflp->oif == 0
-                    && (ipv4_is_multicast(oldflp->fl4_dst) ||
-                        oldflp->fl4_dst == htonl(0xFFFFFFFF))) {
+                if (oldflp->oif == 0 &&
+                    (ipv4_is_multicast(oldflp->fl4_dst) ||
+                     oldflp->fl4_dst == htonl(0xFFFFFFFF))) {
                         /* It is equivalent to inet_addr_type(saddr) == RTN_LOCAL */
                         dev_out = ip_dev_find(net, oldflp->fl4_src);
                         if (dev_out == NULL)
@@ -2855,7 +2857,7 @@ static int rt_fill_info(struct net *net,
         error = rt->u.dst.error;
         expires = rt->u.dst.expires ? rt->u.dst.expires - jiffies : 0;
         if (rt->peer) {
-                id = rt->peer->ip_id_count;
+                id = atomic_read(&rt->peer->ip_id_count) & 0xffff;
                 if (rt->peer->tcp_ts_stamp) {
                         ts = rt->peer->tcp_ts;
                         tsage = get_seconds() - rt->peer->tcp_ts_stamp;
@@ -3257,7 +3259,7 @@ static __net_init int sysctl_route_net_init(struct net *net)
         struct ctl_table *tbl;
 
         tbl = ipv4_route_flush_table;
-        if (net != &init_net) {
+        if (!net_eq(net, &init_net)) {
                 tbl = kmemdup(tbl, sizeof(ipv4_route_flush_table), GFP_KERNEL);
                 if (tbl == NULL)
                         goto err_dup;
diff --git a/net/ipv4/syncookies.c b/net/ipv4/syncookies.c
index a6e0e077ac33..26399ad2a289 100644
--- a/net/ipv4/syncookies.c
+++ b/net/ipv4/syncookies.c
@@ -253,6 +253,8 @@ EXPORT_SYMBOL(cookie_check_timestamp);
 struct sock *cookie_v4_check(struct sock *sk, struct sk_buff *skb,
                              struct ip_options *opt)
 {
+        struct tcp_options_received tcp_opt;
+        u8 *hash_location;
         struct inet_request_sock *ireq;
         struct tcp_request_sock *treq;
         struct tcp_sock *tp = tcp_sk(sk);
@@ -263,7 +265,6 @@ struct sock *cookie_v4_check(struct sock *sk, struct sk_buff *skb,
         int mss;
         struct rtable *rt;
         __u8 rcv_wscale;
-        struct tcp_options_received tcp_opt;
 
         if (!sysctl_tcp_syncookies || !th->ack)
                 goto out;
@@ -276,13 +277,6 @@ struct sock *cookie_v4_check(struct sock *sk, struct sk_buff *skb,
 
         NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_SYNCOOKIESRECV);
 
-        /* check for timestamp cookie support */
-        memset(&tcp_opt, 0, sizeof(tcp_opt));
-        tcp_parse_options(skb, &tcp_opt, 0);
-
-        if (tcp_opt.saw_tstamp)
-                cookie_check_timestamp(&tcp_opt);
-
         ret = NULL;
         req = inet_reqsk_alloc(&tcp_request_sock_ops); /* for safety */
         if (!req)
@@ -298,12 +292,6 @@ struct sock *cookie_v4_check(struct sock *sk, struct sk_buff *skb,
         ireq->loc_addr          = ip_hdr(skb)->daddr;
         ireq->rmt_addr          = ip_hdr(skb)->saddr;
         ireq->ecn_ok            = 0;
-        ireq->snd_wscale        = tcp_opt.snd_wscale;
-        ireq->rcv_wscale        = tcp_opt.rcv_wscale;
-        ireq->sack_ok           = tcp_opt.sack_ok;
-        ireq->wscale_ok         = tcp_opt.wscale_ok;
-        ireq->tstamp_ok         = tcp_opt.saw_tstamp;
-        req->ts_recent          = tcp_opt.saw_tstamp ? tcp_opt.rcv_tsval : 0;
 
         /* We throwed the options of the initial SYN away, so we hope
          * the ACK carries the same options again (see RFC1122 4.2.3.8)
@@ -333,7 +321,8 @@ struct sock *cookie_v4_check(struct sock *sk, struct sk_buff *skb,
          * no easy way to do this.
          */
         {
-                struct flowi fl = { .nl_u = { .ip4_u =
+                struct flowi fl = { .mark = sk->sk_mark,
+                                    .nl_u = { .ip4_u =
                                               { .daddr = ((opt && opt->srr) ?
                                                           opt->faddr :
                                                           ireq->rmt_addr),
@@ -351,6 +340,20 @@ struct sock *cookie_v4_check(struct sock *sk, struct sk_buff *skb,
                 }
         }
 
+        /* check for timestamp cookie support */
+        memset(&tcp_opt, 0, sizeof(tcp_opt));
+        tcp_parse_options(skb, &tcp_opt, &hash_location, 0, &rt->u.dst);
+
+        if (tcp_opt.saw_tstamp)
+                cookie_check_timestamp(&tcp_opt);
+
+        ireq->snd_wscale        = tcp_opt.snd_wscale;
+        ireq->rcv_wscale        = tcp_opt.rcv_wscale;
+        ireq->sack_ok           = tcp_opt.sack_ok;
+        ireq->wscale_ok         = tcp_opt.wscale_ok;
+        ireq->tstamp_ok         = tcp_opt.saw_tstamp;
+        req->ts_recent          = tcp_opt.saw_tstamp ? tcp_opt.rcv_tsval : 0;
+
         /* Try to redo what tcp_v4_send_synack did. */
         req->window_clamp = tp->window_clamp ? :dst_metric(&rt->u.dst, RTAX_WINDOW);
 
diff --git a/net/ipv4/sysctl_net_ipv4.c b/net/ipv4/sysctl_net_ipv4.c
index 300056732953..7e3712ce3994 100644
--- a/net/ipv4/sysctl_net_ipv4.c
+++ b/net/ipv4/sysctl_net_ipv4.c
@@ -569,6 +569,13 @@ static struct ctl_table ipv4_table[] = {
                 .proc_handler   = proc_dointvec,
         },
         {
+                .procname       = "tcp_cookie_size",
+                .data           = &sysctl_tcp_cookie_size,
+                .maxlen         = sizeof(int),
+                .mode           = 0644,
+                .proc_handler   = proc_dointvec
+        },
+        {
                 .procname       = "udp_mem",
                 .data           = &sysctl_udp_mem,
                 .maxlen         = sizeof(sysctl_udp_mem),
@@ -660,7 +667,7 @@ static __net_init int ipv4_sysctl_init_net(struct net *net)
         struct ctl_table *table;
 
         table = ipv4_net_table;
-        if (net != &init_net) {
+        if (!net_eq(net, &init_net)) {
                 table = kmemdup(table, sizeof(ipv4_net_table), GFP_KERNEL);
                 if (table == NULL)
                         goto err_alloc;
@@ -691,7 +698,7 @@ static __net_init int ipv4_sysctl_init_net(struct net *net)
         return 0;
 
 err_reg:
-        if (net != &init_net)
+        if (!net_eq(net, &init_net))
                 kfree(table);
 err_alloc:
         return -ENOMEM;
diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
index f1813bc71088..c8666b70cde0 100644
--- a/net/ipv4/tcp.c
+++ b/net/ipv4/tcp.c
@@ -264,6 +264,7 @@
 #include <linux/cache.h>
 #include <linux/err.h>
 #include <linux/crypto.h>
+#include <linux/time.h>
 
 #include <net/icmp.h>
 #include <net/tcp.h>
@@ -2042,7 +2043,7 @@ int tcp_disconnect(struct sock *sk, int flags)
         __skb_queue_purge(&sk->sk_async_wait_queue);
 #endif
 
-        inet->dport = 0;
+        inet->inet_dport = 0;
 
         if (!(sk->sk_userlocks & SOCK_BINDADDR_LOCK))
                 inet_reset_saddr(sk);
@@ -2059,6 +2060,7 @@ int tcp_disconnect(struct sock *sk, int flags)
         tp->snd_ssthresh = TCP_INFINITE_SSTHRESH;
         tp->snd_cwnd_cnt = 0;
         tp->bytes_acked = 0;
+        tp->window_clamp = 0;
         tcp_set_ca_state(sk, TCP_CA_Open);
         tcp_clear_retrans(tp);
         inet_csk_delack_init(sk);
@@ -2066,7 +2068,7 @@ int tcp_disconnect(struct sock *sk, int flags)
         memset(&tp->rx_opt, 0, sizeof(tp->rx_opt));
         __sk_dst_reset(sk);
 
-        WARN_ON(inet->num && !icsk->icsk_bind_hash);
+        WARN_ON(inet->inet_num && !icsk->icsk_bind_hash);
 
         sk->sk_error_report(sk);
         return err;
@@ -2083,8 +2085,9 @@ static int do_tcp_setsockopt(struct sock *sk, int level,
         int val;
         int err = 0;
 
-        /* This is a string value all the others are int's */
-        if (optname == TCP_CONGESTION) {
+        /* These are data/string values, all the others are ints */
+        switch (optname) {
+        case TCP_CONGESTION: {
                 char name[TCP_CA_NAME_MAX];
 
                 if (optlen < 1)
@@ -2101,6 +2104,93 @@ static int do_tcp_setsockopt(struct sock *sk, int level,
                 release_sock(sk);
                 return err;
         }
+        case TCP_COOKIE_TRANSACTIONS: {
+                struct tcp_cookie_transactions ctd;
+                struct tcp_cookie_values *cvp = NULL;
+
+                if (sizeof(ctd) > optlen)
+                        return -EINVAL;
+                if (copy_from_user(&ctd, optval, sizeof(ctd)))
+                        return -EFAULT;
+
+                if (ctd.tcpct_used > sizeof(ctd.tcpct_value) ||
+                    ctd.tcpct_s_data_desired > TCP_MSS_DESIRED)
+                        return -EINVAL;
+
+                if (ctd.tcpct_cookie_desired == 0) {
+                        /* default to global value */
+                } else if ((0x1 & ctd.tcpct_cookie_desired) ||
+                           ctd.tcpct_cookie_desired > TCP_COOKIE_MAX ||
+                           ctd.tcpct_cookie_desired < TCP_COOKIE_MIN) {
+                        return -EINVAL;
+                }
+
+                if (TCP_COOKIE_OUT_NEVER & ctd.tcpct_flags) {
+                        /* Supercedes all other values */
+                        lock_sock(sk);
+                        if (tp->cookie_values != NULL) {
+                                kref_put(&tp->cookie_values->kref,
+                                         tcp_cookie_values_release);
+                                tp->cookie_values = NULL;
+                        }
+                        tp->rx_opt.cookie_in_always = 0; /* false */
+                        tp->rx_opt.cookie_out_never = 1; /* true */
+                        release_sock(sk);
+                        return err;
+                }
+
+                /* Allocate ancillary memory before locking.
+                 */
+                if (ctd.tcpct_used > 0 ||
+                    (tp->cookie_values == NULL &&
+                     (sysctl_tcp_cookie_size > 0 ||
+                      ctd.tcpct_cookie_desired > 0 ||
+                      ctd.tcpct_s_data_desired > 0))) {
+                        cvp = kzalloc(sizeof(*cvp) + ctd.tcpct_used,
+                                      GFP_KERNEL);
+                        if (cvp == NULL)
+                                return -ENOMEM;
+                }
+                lock_sock(sk);
+                tp->rx_opt.cookie_in_always =
+                        (TCP_COOKIE_IN_ALWAYS & ctd.tcpct_flags);
+                tp->rx_opt.cookie_out_never = 0; /* false */
+
+                if (tp->cookie_values != NULL) {
+                        if (cvp != NULL) {
+                                /* Changed values are recorded by a changed
+                                 * pointer, ensuring the cookie will differ,
+                                 * without separately hashing each value later.
+                                 */
+                                kref_put(&tp->cookie_values->kref,
+                                         tcp_cookie_values_release);
+                                kref_init(&cvp->kref);
+                                tp->cookie_values = cvp;
+                        } else {
+                                cvp = tp->cookie_values;
+                        }
+                }
+                if (cvp != NULL) {
+                        cvp->cookie_desired = ctd.tcpct_cookie_desired;
+
+                        if (ctd.tcpct_used > 0) {
+                                memcpy(cvp->s_data_payload, ctd.tcpct_value,
+                                       ctd.tcpct_used);
+                                cvp->s_data_desired = ctd.tcpct_used;
+                                cvp->s_data_constant = 1; /* true */
+                        } else {
+                                /* No constant payload data. */
+                                cvp->s_data_desired = ctd.tcpct_s_data_desired;
+                                cvp->s_data_constant = 0; /* false */
+                        }
+                }
+                release_sock(sk);
+                return err;
+        }
+        default:
+                /* fallthru */
+                break;
+        };
 
         if (optlen < sizeof(int))
                 return -EINVAL;
@@ -2425,6 +2515,47 @@ static int do_tcp_getsockopt(struct sock *sk, int level,
                 if (copy_to_user(optval, icsk->icsk_ca_ops->name, len))
                         return -EFAULT;
                 return 0;
+
+        case TCP_COOKIE_TRANSACTIONS: {
+                struct tcp_cookie_transactions ctd;
+                struct tcp_cookie_values *cvp = tp->cookie_values;
+
+                if (get_user(len, optlen))
+                        return -EFAULT;
+                if (len < sizeof(ctd))
+                        return -EINVAL;
+
+                memset(&ctd, 0, sizeof(ctd));
+                ctd.tcpct_flags = (tp->rx_opt.cookie_in_always ?
+                                   TCP_COOKIE_IN_ALWAYS : 0)
+                                | (tp->rx_opt.cookie_out_never ?
+                                   TCP_COOKIE_OUT_NEVER : 0);
+
+                if (cvp != NULL) {
+                        ctd.tcpct_flags |= (cvp->s_data_in ?
+                                            TCP_S_DATA_IN : 0)
+                                         | (cvp->s_data_out ?
+                                            TCP_S_DATA_OUT : 0);
+
+                        ctd.tcpct_cookie_desired = cvp->cookie_desired;
+                        ctd.tcpct_s_data_desired = cvp->s_data_desired;
+
+                        /* Cookie(s) saved, return as nonce */
+                        if (sizeof(ctd.tcpct_value) < cvp->cookie_pair_size) {
+                                /* impossible? */
+                                return -EINVAL;
+                        }
+                        memcpy(&ctd.tcpct_value[0], &cvp->cookie_pair[0],
+                               cvp->cookie_pair_size);
+                        ctd.tcpct_used = cvp->cookie_pair_size;
+                }
+
+                if (put_user(sizeof(ctd), optlen))
+                        return -EFAULT;
+                if (copy_to_user(optval, &ctd, sizeof(ctd)))
+                        return -EFAULT;
+                return 0;
+        }
         default:
                 return -ENOPROTOOPT;
         }
@@ -2847,6 +2978,135 @@ EXPORT_SYMBOL(tcp_md5_hash_key);
 
 #endif
 
+/**
+ * Each Responder maintains up to two secret values concurrently for
+ * efficient secret rollover.  Each secret value has 4 states:
+ *
+ * Generating.  (tcp_secret_generating != tcp_secret_primary)
+ *    Generates new Responder-Cookies, but not yet used for primary
+ *    verification.  This is a short-term state, typically lasting only
+ *    one round trip time (RTT).
+ *
+ * Primary.  (tcp_secret_generating == tcp_secret_primary)
+ *    Used both for generation and primary verification.
+ *
+ * Retiring.  (tcp_secret_retiring != tcp_secret_secondary)
+ *    Used for verification, until the first failure that can be
+ *    verified by the newer Generating secret.  At that time, this
+ *    cookie's state is changed to Secondary, and the Generating
+ *    cookie's state is changed to Primary.  This is a short-term state,
+ *    typically lasting only one round trip time (RTT).
+ *
+ * Secondary.  (tcp_secret_retiring == tcp_secret_secondary)
+ *    Used for secondary verification, after primary verification
+ *    failures.  This state lasts no more than twice the Maximum Segment
+ *    Lifetime (2MSL).  Then, the secret is discarded.
+ */
+struct tcp_cookie_secret {
+        /* The secret is divided into two parts.  The digest part is the
+         * equivalent of previously hashing a secret and saving the state,
+         * and serves as an initialization vector (IV).  The message part
+         * serves as the trailing secret.
+         */
+        u32                             secrets[COOKIE_WORKSPACE_WORDS];
+        unsigned long                   expires;
+};
+
+#define TCP_SECRET_1MSL (HZ * TCP_PAWS_MSL)
+#define TCP_SECRET_2MSL (HZ * TCP_PAWS_MSL * 2)
+#define TCP_SECRET_LIFE (HZ * 600)
+
+static struct tcp_cookie_secret tcp_secret_one;
+static struct tcp_cookie_secret tcp_secret_two;
+
+/* Essentially a circular list, without dynamic allocation. */
+static struct tcp_cookie_secret *tcp_secret_generating;
+static struct tcp_cookie_secret *tcp_secret_primary;
+static struct tcp_cookie_secret *tcp_secret_retiring;
+static struct tcp_cookie_secret *tcp_secret_secondary;
+
+static DEFINE_SPINLOCK(tcp_secret_locker);
+
+/* Select a pseudo-random word in the cookie workspace.
+ */
+static inline u32 tcp_cookie_work(const u32 *ws, const int n)
+{
+        return ws[COOKIE_DIGEST_WORDS + ((COOKIE_MESSAGE_WORDS-1) & ws[n])];
+}
+
+/* Fill bakery[COOKIE_WORKSPACE_WORDS] with generator, updating as needed.
+ * Called in softirq context.
+ * Returns: 0 for success.
+ */
+int tcp_cookie_generator(u32 *bakery)
+{
+        unsigned long jiffy = jiffies;
+
+        if (unlikely(time_after_eq(jiffy, tcp_secret_generating->expires))) {
+                spin_lock_bh(&tcp_secret_locker);
+                if (!time_after_eq(jiffy, tcp_secret_generating->expires)) {
+                        /* refreshed by another */
+                        memcpy(bakery,
+                               &tcp_secret_generating->secrets[0],
+                               COOKIE_WORKSPACE_WORDS);
+                } else {
+                        /* still needs refreshing */
+                        get_random_bytes(bakery, COOKIE_WORKSPACE_WORDS);
+
+                        /* The first time, paranoia assumes that the
+                         * randomization function isn't as strong.  But,
+                         * this secret initialization is delayed until
+                         * the last possible moment (packet arrival).
+                         * Although that time is observable, it is
+                         * unpredictably variable.  Mash in the most
+                         * volatile clock bits available, and expire the
+                         * secret extra quickly.
+                         */
+                        if (unlikely(tcp_secret_primary->expires ==
+                                     tcp_secret_secondary->expires)) {
+                                struct timespec tv;
+
+                                getnstimeofday(&tv);
+                                bakery[COOKIE_DIGEST_WORDS+0] ^=
+                                        (u32)tv.tv_nsec;
+
+                                tcp_secret_secondary->expires = jiffy
+                                        + TCP_SECRET_1MSL
+                                        + (0x0f & tcp_cookie_work(bakery, 0));
+                        } else {
+                                tcp_secret_secondary->expires = jiffy
+                                        + TCP_SECRET_LIFE
+                                        + (0xff & tcp_cookie_work(bakery, 1));
+                                tcp_secret_primary->expires = jiffy
+                                        + TCP_SECRET_2MSL
+                                        + (0x1f & tcp_cookie_work(bakery, 2));
+                        }
+                        memcpy(&tcp_secret_secondary->secrets[0],
+                               bakery, COOKIE_WORKSPACE_WORDS);
+
+                        rcu_assign_pointer(tcp_secret_generating,
+                                           tcp_secret_secondary);
+                        rcu_assign_pointer(tcp_secret_retiring,
+                                           tcp_secret_primary);
+                        /*
+                         * Neither call_rcu() nor synchronize_rcu() needed.
+                         * Retiring data is not freed.  It is replaced after
+                         * further (locked) pointer updates, and a quiet time
+                         * (minimum 1MSL, maximum LIFE - 2MSL).
+                         */
+                }
+                spin_unlock_bh(&tcp_secret_locker);
+        } else {
+                rcu_read_lock_bh();
+                memcpy(bakery,
+                       &rcu_dereference(tcp_secret_generating)->secrets[0],
+                       COOKIE_WORKSPACE_WORDS);
+                rcu_read_unlock_bh();
+        }
+        return 0;
+}
+EXPORT_SYMBOL(tcp_cookie_generator);
+
 void tcp_done(struct sock *sk)
 {
         if (sk->sk_state == TCP_SYN_SENT || sk->sk_state == TCP_SYN_RECV)
@@ -2881,6 +3141,7 @@ void __init tcp_init(void)
         struct sk_buff *skb = NULL;
         unsigned long nr_pages, limit;
         int order, i, max_share;
+        unsigned long jiffy = jiffies;
 
         BUILD_BUG_ON(sizeof(struct tcp_skb_cb) > sizeof(skb->cb));
 
@@ -2903,11 +3164,10 @@ void __init tcp_init(void)
                                         (totalram_pages >= 128 * 1024) ?
                                         13 : 15,
                                         0,
-                                        &tcp_hashinfo.ehash_size,
                                         NULL,
+                                        &tcp_hashinfo.ehash_mask,
                                         thash_entries ? 0 : 512 * 1024);
-        tcp_hashinfo.ehash_size = 1 << tcp_hashinfo.ehash_size;
-        for (i = 0; i < tcp_hashinfo.ehash_size; i++) {
+        for (i = 0; i <= tcp_hashinfo.ehash_mask; i++) {
                 INIT_HLIST_NULLS_HEAD(&tcp_hashinfo.ehash[i].chain, i);
                 INIT_HLIST_NULLS_HEAD(&tcp_hashinfo.ehash[i].twchain, i);
         }
@@ -2916,7 +3176,7 @@ void __init tcp_init(void)
         tcp_hashinfo.bhash =
                 alloc_large_system_hash("TCP bind",
                                         sizeof(struct inet_bind_hashbucket),
-                                        tcp_hashinfo.ehash_size,
+                                        tcp_hashinfo.ehash_mask + 1,
                                         (totalram_pages >= 128 * 1024) ?
                                         13 : 15,
                                         0,
@@ -2971,10 +3231,19 @@ void __init tcp_init(void)
         sysctl_tcp_rmem[2] = max(87380, max_share);
 
         printk(KERN_INFO "TCP: Hash tables configured "
-               "(established %d bind %d)\n",
-               tcp_hashinfo.ehash_size, tcp_hashinfo.bhash_size);
+               "(established %u bind %u)\n",
+               tcp_hashinfo.ehash_mask + 1, tcp_hashinfo.bhash_size);
 
         tcp_register_congestion_control(&tcp_reno);
+
+        memset(&tcp_secret_one.secrets[0], 0, sizeof(tcp_secret_one.secrets));
+        memset(&tcp_secret_two.secrets[0], 0, sizeof(tcp_secret_two.secrets));
+        tcp_secret_one.expires = jiffy; /* past due */
+        tcp_secret_two.expires = jiffy; /* past due */
+        tcp_secret_generating = &tcp_secret_one;
+        tcp_secret_primary = &tcp_secret_one;
+        tcp_secret_retiring = &tcp_secret_two;
+        tcp_secret_secondary = &tcp_secret_two;
 }
 
 EXPORT_SYMBOL(tcp_close);
diff --git a/net/ipv4/tcp_diag.c b/net/ipv4/tcp_diag.c
index fcbcd4ff6c5f..939edb3b8e4d 100644
--- a/net/ipv4/tcp_diag.c
+++ b/net/ipv4/tcp_diag.c
@@ -27,7 +27,7 @@ static void tcp_diag_get_info(struct sock *sk, struct inet_diag_msg *r,
                 r->idiag_rqueue = sk->sk_ack_backlog;
                 r->idiag_wqueue = sk->sk_max_ack_backlog;
         } else {
-                r->idiag_rqueue = tp->rcv_nxt - tp->copied_seq;
+                r->idiag_rqueue = max_t(int, tp->rcv_nxt - tp->copied_seq, 0);
                 r->idiag_wqueue = tp->write_seq - tp->snd_una;
         }
         if (info != NULL)
diff --git a/net/ipv4/tcp_htcp.c b/net/ipv4/tcp_htcp.c
index 26d5c7fc7de5..7c94a4955416 100644
--- a/net/ipv4/tcp_htcp.c
+++ b/net/ipv4/tcp_htcp.c
@@ -92,8 +92,8 @@ static inline void measure_rtt(struct sock *sk, u32 srtt)
         if (icsk->icsk_ca_state == TCP_CA_Open) {
                 if (ca->maxRTT < ca->minRTT)
                         ca->maxRTT = ca->minRTT;
-                if (ca->maxRTT < srtt
-                    && srtt <= ca->maxRTT + msecs_to_jiffies(20))
+                if (ca->maxRTT < srtt &&
+                    srtt <= ca->maxRTT + msecs_to_jiffies(20))
                         ca->maxRTT = srtt;
         }
 }
@@ -123,9 +123,9 @@ static void measure_achieved_throughput(struct sock *sk, u32 pkts_acked, s32 rtt
 
         ca->packetcount += pkts_acked;
 
-        if (ca->packetcount >= tp->snd_cwnd - (ca->alpha >> 7 ? : 1)
-            && now - ca->lasttime >= ca->minRTT
-            && ca->minRTT > 0) {
+        if (ca->packetcount >= tp->snd_cwnd - (ca->alpha >> 7 ? : 1) &&
+            now - ca->lasttime >= ca->minRTT &&
+            ca->minRTT > 0) {
                 __u32 cur_Bi = ca->packetcount * HZ / (now - ca->lasttime);
 
                 if (htcp_ccount(ca) <= 3) {
diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
index d86784be7ab3..57ae96a04220 100644
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -140,7 +140,7 @@ static void tcp_measure_rcv_mss(struct sock *sk, const struct sk_buff *skb)
                  * "len" is invariant segment length, including TCP header.
                  */
                 len += skb->data - skb_transport_header(skb);
-                if (len >= TCP_MIN_RCVMSS + sizeof(struct tcphdr) ||
+                if (len >= TCP_MSS_DEFAULT + sizeof(struct tcphdr) ||
                     /* If PSH is not set, packet should be
                      * full sized, provided peer TCP is not badly broken.
                      * This observation (if it is correct 8)) allows
@@ -411,7 +411,7 @@ void tcp_initialize_rcv_mss(struct sock *sk)
         unsigned int hint = min_t(unsigned int, tp->advmss, tp->mss_cache);
 
         hint = min(hint, tp->rcv_wnd / 2);
-        hint = min(hint, TCP_MIN_RCVMSS);
+        hint = min(hint, TCP_MSS_DEFAULT);
         hint = max(hint, TCP_MIN_MSS);
 
         inet_csk(sk)->icsk_ack.rcv_mss = hint;
@@ -2300,7 +2300,7 @@ static inline int tcp_fackets_out(struct tcp_sock *tp)
  * they differ. Since neither occurs due to loss, TCP should really
  * ignore them.
  */
-static inline int tcp_dupack_heurestics(struct tcp_sock *tp)
+static inline int tcp_dupack_heuristics(struct tcp_sock *tp)
 {
         return tcp_is_fack(tp) ? tp->fackets_out : tp->sacked_out + 1;
 }
@@ -2425,7 +2425,7 @@ static int tcp_time_to_recover(struct sock *sk)
                 return 1;
 
         /* Not-A-Trick#2 : Classic rule... */
-        if (tcp_dupack_heurestics(tp) > tp->reordering)
+        if (tcp_dupack_heuristics(tp) > tp->reordering)
                 return 1;
 
         /* Trick#3 : when we use RFC2988 timer restart, fast
@@ -3698,7 +3698,7 @@ old_ack:
  * the fast version below fails.
  */
 void tcp_parse_options(struct sk_buff *skb, struct tcp_options_received *opt_rx,
-                       int estab)
+                       u8 **hvpp, int estab,  struct dst_entry *dst)
 {
         unsigned char *ptr;
         struct tcphdr *th = tcp_hdr(skb);
@@ -3737,7 +3737,8 @@ void tcp_parse_options(struct sk_buff *skb, struct tcp_options_received *opt_rx,
                                 break;
                         case TCPOPT_WINDOW:
                                 if (opsize == TCPOLEN_WINDOW && th->syn &&
-                                    !estab && sysctl_tcp_window_scaling) {
+                                    !estab && sysctl_tcp_window_scaling &&
+                                    !dst_feature(dst, RTAX_FEATURE_NO_WSCALE)) {
                                         __u8 snd_wscale = *(__u8 *)ptr;
                                         opt_rx->wscale_ok = 1;
                                         if (snd_wscale > 14) {
@@ -3753,7 +3754,8 @@ void tcp_parse_options(struct sk_buff *skb, struct tcp_options_received *opt_rx,
                         case TCPOPT_TIMESTAMP:
                                 if ((opsize == TCPOLEN_TIMESTAMP) &&
                                     ((estab && opt_rx->tstamp_ok) ||
-                                     (!estab && sysctl_tcp_timestamps))) {
+                                     (!estab && sysctl_tcp_timestamps &&
+                                      !dst_feature(dst, RTAX_FEATURE_NO_TSTAMP)))) {
                                         opt_rx->saw_tstamp = 1;
                                         opt_rx->rcv_tsval = get_unaligned_be32(ptr);
                                         opt_rx->rcv_tsecr = get_unaligned_be32(ptr + 4);
@@ -3761,7 +3763,8 @@ void tcp_parse_options(struct sk_buff *skb, struct tcp_options_received *opt_rx,
                                 break;
                         case TCPOPT_SACK_PERM:
                                 if (opsize == TCPOLEN_SACK_PERM && th->syn &&
-                                    !estab && sysctl_tcp_sack) {
+                                    !estab && sysctl_tcp_sack &&
+                                    !dst_feature(dst, RTAX_FEATURE_NO_SACK)) {
                                         opt_rx->sack_ok = 1;
                                         tcp_sack_reset(opt_rx);
                                 }
@@ -3782,7 +3785,30 @@ void tcp_parse_options(struct sk_buff *skb, struct tcp_options_received *opt_rx,
                                  */
                                 break;
 #endif
-                        }
+                        case TCPOPT_COOKIE:
+                                /* This option is variable length.
+                                 */
+                                switch (opsize) {
+                                case TCPOLEN_COOKIE_BASE:
+                                        /* not yet implemented */
+                                        break;
+                                case TCPOLEN_COOKIE_PAIR:
+                                        /* not yet implemented */
+                                        break;
+                                case TCPOLEN_COOKIE_MIN+0:
+                                case TCPOLEN_COOKIE_MIN+2:
+                                case TCPOLEN_COOKIE_MIN+4:
+                                case TCPOLEN_COOKIE_MIN+6:
+                                case TCPOLEN_COOKIE_MAX:
+                                        /* 16-bit multiple */
+                                        opt_rx->cookie_plus = opsize;
+                                        *hvpp = ptr;
+                                default:
+                                        /* ignore option */
+                                        break;
+                                };
+                                break;
+                        };
 
                         ptr += opsize-2;
                         length -= opsize;
@@ -3810,17 +3836,20 @@ static int tcp_parse_aligned_timestamp(struct tcp_sock *tp, struct tcphdr *th)
  * If it is wrong it falls back on tcp_parse_options().
  */
 static int tcp_fast_parse_options(struct sk_buff *skb, struct tcphdr *th,
-                                  struct tcp_sock *tp)
+                                  struct tcp_sock *tp, u8 **hvpp)
 {
-        if (th->doff == sizeof(struct tcphdr) >> 2) {
+        /* In the spirit of fast parsing, compare doff directly to constant
+         * values.  Because equality is used, short doff can be ignored here.
+         */
+        if (th->doff == (sizeof(*th) / 4)) {
                 tp->rx_opt.saw_tstamp = 0;
                 return 0;
         } else if (tp->rx_opt.tstamp_ok &&
-                   th->doff == (sizeof(struct tcphdr)>>2)+(TCPOLEN_TSTAMP_ALIGNED>>2)) {
+                   th->doff == ((sizeof(*th) + TCPOLEN_TSTAMP_ALIGNED) / 4)) {
                 if (tcp_parse_aligned_timestamp(tp, th))
                         return 1;
         }
-        tcp_parse_options(skb, &tp->rx_opt, 1);
+        tcp_parse_options(skb, &tp->rx_opt, hvpp, 1, NULL);
         return 1;
 }
 
@@ -4075,8 +4104,10 @@ static inline int tcp_sack_extend(struct tcp_sack_block *sp, u32 seq,
 static void tcp_dsack_set(struct sock *sk, u32 seq, u32 end_seq)
 {
         struct tcp_sock *tp = tcp_sk(sk);
+        struct dst_entry *dst = __sk_dst_get(sk);
 
-        if (tcp_is_sack(tp) && sysctl_tcp_dsack) {
+        if (tcp_is_sack(tp) && sysctl_tcp_dsack &&
+            !dst_feature(dst, RTAX_FEATURE_NO_DSACK)) {
                 int mib_idx;
 
                 if (before(seq, tp->rcv_nxt))
@@ -4105,13 +4136,15 @@ static void tcp_dsack_extend(struct sock *sk, u32 seq, u32 end_seq)
 static void tcp_send_dupack(struct sock *sk, struct sk_buff *skb)
 {
         struct tcp_sock *tp = tcp_sk(sk);
+        struct dst_entry *dst = __sk_dst_get(sk);
 
         if (TCP_SKB_CB(skb)->end_seq != TCP_SKB_CB(skb)->seq &&
             before(TCP_SKB_CB(skb)->seq, tp->rcv_nxt)) {
                 NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_DELAYEDACKLOST);
                 tcp_enter_quickack_mode(sk);
 
-                if (tcp_is_sack(tp) && sysctl_tcp_dsack) {
+                if (tcp_is_sack(tp) && sysctl_tcp_dsack &&
+                    !dst_feature(dst, RTAX_FEATURE_NO_DSACK)) {
                         u32 end_seq = TCP_SKB_CB(skb)->end_seq;
 
                         if (after(TCP_SKB_CB(skb)->end_seq, tp->rcv_nxt))
@@ -4845,11 +4878,11 @@ static void __tcp_ack_snd_check(struct sock *sk, int ofo_possible)
         struct tcp_sock *tp = tcp_sk(sk);
 
             /* More than one full frame received... */
-        if (((tp->rcv_nxt - tp->rcv_wup) > inet_csk(sk)->icsk_ack.rcv_mss
+        if (((tp->rcv_nxt - tp->rcv_wup) > inet_csk(sk)->icsk_ack.rcv_mss &&
              /* ... and right edge of window advances far enough.
               * (tcp_recvmsg() will send ACK otherwise). Or...
               */
-             && __tcp_select_window(sk) >= tp->rcv_wnd) ||
+             __tcp_select_window(sk) >= tp->rcv_wnd) ||
             /* We ACK each frame or... */
             tcp_in_quickack_mode(sk) ||
             /* We have out of order data. */
@@ -5070,10 +5103,12 @@ out:
 static int tcp_validate_incoming(struct sock *sk, struct sk_buff *skb,
                               struct tcphdr *th, int syn_inerr)
 {
+        u8 *hash_location;
         struct tcp_sock *tp = tcp_sk(sk);
 
         /* RFC1323: H1. Apply PAWS check first. */
-        if (tcp_fast_parse_options(skb, th, tp) && tp->rx_opt.saw_tstamp &&
+        if (tcp_fast_parse_options(skb, th, tp, &hash_location) &&
+            tp->rx_opt.saw_tstamp &&
             tcp_paws_discard(sk, skb)) {
                 if (!th->rst) {
                         NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_PAWSESTABREJECTED);
@@ -5361,11 +5396,14 @@ discard:
 static int tcp_rcv_synsent_state_process(struct sock *sk, struct sk_buff *skb,
                                          struct tcphdr *th, unsigned len)
 {
-        struct tcp_sock *tp = tcp_sk(sk);
+        u8 *hash_location;
         struct inet_connection_sock *icsk = inet_csk(sk);
+        struct tcp_sock *tp = tcp_sk(sk);
+        struct dst_entry *dst = __sk_dst_get(sk);
+        struct tcp_cookie_values *cvp = tp->cookie_values;
         int saved_clamp = tp->rx_opt.mss_clamp;
 
-        tcp_parse_options(skb, &tp->rx_opt, 0);
+        tcp_parse_options(skb, &tp->rx_opt, &hash_location, 0, dst);
 
         if (th->ack) {
                 /* rfc793:
@@ -5462,6 +5500,31 @@ static int tcp_rcv_synsent_state_process(struct sock *sk, struct sk_buff *skb,
                  * Change state from SYN-SENT only after copied_seq
                  * is initialized. */
                 tp->copied_seq = tp->rcv_nxt;
+
+                if (cvp != NULL &&
+                    cvp->cookie_pair_size > 0 &&
+                    tp->rx_opt.cookie_plus > 0) {
+                        int cookie_size = tp->rx_opt.cookie_plus
+                                        - TCPOLEN_COOKIE_BASE;
+                        int cookie_pair_size = cookie_size
+                                             + cvp->cookie_desired;
+
+                        /* A cookie extension option was sent and returned.
+                         * Note that each incoming SYNACK replaces the
+                         * Responder cookie.  The initial exchange is most
+                         * fragile, as protection against spoofing relies
+                         * entirely upon the sequence and timestamp (above).
+                         * This replacement strategy allows the correct pair to
+                         * pass through, while any others will be filtered via
+                         * Responder verification later.
+                         */
+                        if (sizeof(cvp->cookie_pair) >= cookie_pair_size) {
+                                memcpy(&cvp->cookie_pair[cvp->cookie_desired],
+                                       hash_location, cookie_size);
+                                cvp->cookie_pair_size = cookie_pair_size;
+                        }
+                }
+
                 smp_mb();
                 tcp_set_state(sk, TCP_ESTABLISHED);
 
diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
index 7cda24b53f61..29002ab26e0d 100644
--- a/net/ipv4/tcp_ipv4.c
+++ b/net/ipv4/tcp_ipv4.c
@@ -165,10 +165,10 @@ int tcp_v4_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len)
                 nexthop = inet->opt->faddr;
         }
 
-        tmp = ip_route_connect(&rt, nexthop, inet->saddr,
+        tmp = ip_route_connect(&rt, nexthop, inet->inet_saddr,
                                RT_CONN_FLAGS(sk), sk->sk_bound_dev_if,
                                IPPROTO_TCP,
-                               inet->sport, usin->sin_port, sk, 1);
+                               inet->inet_sport, usin->sin_port, sk, 1);
         if (tmp < 0) {
                 if (tmp == -ENETUNREACH)
                         IP_INC_STATS_BH(sock_net(sk), IPSTATS_MIB_OUTNOROUTES);
@@ -183,11 +183,11 @@ int tcp_v4_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len)
         if (!inet->opt || !inet->opt->srr)
                 daddr = rt->rt_dst;
 
-        if (!inet->saddr)
-                inet->saddr = rt->rt_src;
-        inet->rcv_saddr = inet->saddr;
+        if (!inet->inet_saddr)
+                inet->inet_saddr = rt->rt_src;
+        inet->inet_rcv_saddr = inet->inet_saddr;
 
-        if (tp->rx_opt.ts_recent_stamp && inet->daddr != daddr) {
+        if (tp->rx_opt.ts_recent_stamp && inet->inet_daddr != daddr) {
                 /* Reset inherited state */
                 tp->rx_opt.ts_recent       = 0;
                 tp->rx_opt.ts_recent_stamp = 0;
@@ -204,20 +204,20 @@ int tcp_v4_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len)
                  * when trying new connection.
                  */
                 if (peer != NULL &&
-                    peer->tcp_ts_stamp + TCP_PAWS_MSL >= get_seconds()) {
+                    (u32)get_seconds() - peer->tcp_ts_stamp <= TCP_PAWS_MSL) {
                         tp->rx_opt.ts_recent_stamp = peer->tcp_ts_stamp;
                         tp->rx_opt.ts_recent = peer->tcp_ts;
                 }
         }
 
-        inet->dport = usin->sin_port;
-        inet->daddr = daddr;
+        inet->inet_dport = usin->sin_port;
+        inet->inet_daddr = daddr;
 
         inet_csk(sk)->icsk_ext_hdr_len = 0;
         if (inet->opt)
                 inet_csk(sk)->icsk_ext_hdr_len = inet->opt->optlen;
 
-        tp->rx_opt.mss_clamp = 536;
+        tp->rx_opt.mss_clamp = TCP_MSS_DEFAULT;
 
         /* Socket identity is still unknown (sport may be zero).
          * However we set state to SYN-SENT and not releasing socket
@@ -230,7 +230,7 @@ int tcp_v4_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len)
                 goto failure;
 
         err = ip_route_newports(&rt, IPPROTO_TCP,
-                                inet->sport, inet->dport, sk);
+                                inet->inet_sport, inet->inet_dport, sk);
         if (err)
                 goto failure;
 
@@ -239,12 +239,12 @@ int tcp_v4_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len)
         sk_setup_caps(sk, &rt->u.dst);
 
         if (!tp->write_seq)
-                tp->write_seq = secure_tcp_sequence_number(inet->saddr,
-                                                           inet->daddr,
-                                                           inet->sport,
+                tp->write_seq = secure_tcp_sequence_number(inet->inet_saddr,
+                                                           inet->inet_daddr,
+                                                           inet->inet_sport,
                                                            usin->sin_port);
 
-        inet->id = tp->write_seq ^ jiffies;
+        inet->inet_id = tp->write_seq ^ jiffies;
 
         err = tcp_connect(sk);
         rt = NULL;
@@ -261,7 +261,7 @@ failure:
         tcp_set_state(sk, TCP_CLOSE);
         ip_rt_put(rt);
         sk->sk_route_caps = 0;
-        inet->dport = 0;
+        inet->inet_dport = 0;
         return err;
 }
 
@@ -520,12 +520,13 @@ void tcp_v4_send_check(struct sock *sk, int len, struct sk_buff *skb)
         struct tcphdr *th = tcp_hdr(skb);
 
         if (skb->ip_summed == CHECKSUM_PARTIAL) {
-                th->check = ~tcp_v4_check(len, inet->saddr,
-                                          inet->daddr, 0);
+                th->check = ~tcp_v4_check(len, inet->inet_saddr,
+                                          inet->inet_daddr, 0);
                 skb->csum_start = skb_transport_header(skb) - skb->head;
                 skb->csum_offset = offsetof(struct tcphdr, check);
         } else {
-                th->check = tcp_v4_check(len, inet->saddr, inet->daddr,
+                th->check = tcp_v4_check(len, inet->inet_saddr,
+                                         inet->inet_daddr,
                                          csum_partial(th,
                                                       th->doff << 2,
                                                       skb->csum));
@@ -741,8 +742,9 @@ static void tcp_v4_reqsk_send_ack(struct sock *sk, struct sk_buff *skb,
  *      This still operates on a request_sock only, not on a big
  *      socket.
  */
-static int __tcp_v4_send_synack(struct sock *sk, struct request_sock *req,
-                                struct dst_entry *dst)
+static int __tcp_v4_send_synack(struct sock *sk, struct dst_entry *dst,
+                                struct request_sock *req,
+                                struct request_values *rvp)
 {
         const struct inet_request_sock *ireq = inet_rsk(req);
         int err = -1;
@@ -752,7 +754,7 @@ static int __tcp_v4_send_synack(struct sock *sk, struct request_sock *req,
         if (!dst && (dst = inet_csk_route_req(sk, req)) == NULL)
                 return -1;
 
-        skb = tcp_make_synack(sk, dst, req);
+        skb = tcp_make_synack(sk, dst, req, rvp);
 
         if (skb) {
                 struct tcphdr *th = tcp_hdr(skb);
@@ -773,9 +775,10 @@ static int __tcp_v4_send_synack(struct sock *sk, struct request_sock *req,
         return err;
 }
 
-static int tcp_v4_send_synack(struct sock *sk, struct request_sock *req)
+static int tcp_v4_send_synack(struct sock *sk, struct request_sock *req,
+                              struct request_values *rvp)
 {
-        return __tcp_v4_send_synack(sk, req, NULL);
+        return __tcp_v4_send_synack(sk, NULL, req, rvp);
 }
 
 /*
@@ -848,7 +851,7 @@ static struct tcp_md5sig_key *
 struct tcp_md5sig_key *tcp_v4_md5_lookup(struct sock *sk,
                                          struct sock *addr_sk)
 {
-        return tcp_v4_md5_do_lookup(sk, inet_sk(addr_sk)->daddr);
+        return tcp_v4_md5_do_lookup(sk, inet_sk(addr_sk)->inet_daddr);
 }
 
 EXPORT_SYMBOL(tcp_v4_md5_lookup);
@@ -923,7 +926,7 @@ EXPORT_SYMBOL(tcp_v4_md5_do_add);
 static int tcp_v4_md5_add_func(struct sock *sk, struct sock *addr_sk,
                                u8 *newkey, u8 newkeylen)
 {
-        return tcp_v4_md5_do_add(sk, inet_sk(addr_sk)->daddr,
+        return tcp_v4_md5_do_add(sk, inet_sk(addr_sk)->inet_daddr,
                                  newkey, newkeylen);
 }
 
@@ -1089,8 +1092,8 @@ int tcp_v4_md5_hash_skb(char *md5_hash, struct tcp_md5sig_key *key,
         __be32 saddr, daddr;
 
         if (sk) {
-                saddr = inet_sk(sk)->saddr;
-                daddr = inet_sk(sk)->daddr;
+                saddr = inet_sk(sk)->inet_saddr;
+                daddr = inet_sk(sk)->inet_daddr;
         } else if (req) {
                 saddr = inet_rsk(req)->loc_addr;
                 daddr = inet_rsk(req)->rmt_addr;
@@ -1210,13 +1213,16 @@ static struct timewait_sock_ops tcp_timewait_sock_ops = {
 
 int tcp_v4_conn_request(struct sock *sk, struct sk_buff *skb)
 {
-        struct inet_request_sock *ireq;
+        struct tcp_extend_values tmp_ext;
         struct tcp_options_received tmp_opt;
+        u8 *hash_location;
         struct request_sock *req;
+        struct inet_request_sock *ireq;
+        struct tcp_sock *tp = tcp_sk(sk);
+        struct dst_entry *dst = NULL;
         __be32 saddr = ip_hdr(skb)->saddr;
         __be32 daddr = ip_hdr(skb)->daddr;
         __u32 isn = TCP_SKB_CB(skb)->when;
-        struct dst_entry *dst = NULL;
 #ifdef CONFIG_SYN_COOKIES
         int want_cookie = 0;
 #else
@@ -1256,27 +1262,65 @@ int tcp_v4_conn_request(struct sock *sk, struct sk_buff *skb)
         tcp_rsk(req)->af_specific = &tcp_request_sock_ipv4_ops;
 #endif
 
+        ireq = inet_rsk(req);
+        ireq->loc_addr = daddr;
+        ireq->rmt_addr = saddr;
+        ireq->no_srccheck = inet_sk(sk)->transparent;
+        ireq->opt = tcp_v4_save_options(sk, skb);
+
+        dst = inet_csk_route_req(sk, req);
+        if(!dst)
+                goto drop_and_free;
+
         tcp_clear_options(&tmp_opt);
-        tmp_opt.mss_clamp = 536;
-        tmp_opt.user_mss  = tcp_sk(sk)->rx_opt.user_mss;
+        tmp_opt.mss_clamp = TCP_MSS_DEFAULT;
+        tmp_opt.user_mss  = tp->rx_opt.user_mss;
+        tcp_parse_options(skb, &tmp_opt, &hash_location, 0, dst);
+
+        if (tmp_opt.cookie_plus > 0 &&
+            tmp_opt.saw_tstamp &&
+            !tp->rx_opt.cookie_out_never &&
+            (sysctl_tcp_cookie_size > 0 ||
+             (tp->cookie_values != NULL &&
+              tp->cookie_values->cookie_desired > 0))) {
+                u8 *c;
+                u32 *mess = &tmp_ext.cookie_bakery[COOKIE_DIGEST_WORDS];
+                int l = tmp_opt.cookie_plus - TCPOLEN_COOKIE_BASE;
+
+                if (tcp_cookie_generator(&tmp_ext.cookie_bakery[0]) != 0)
+                        goto drop_and_release;
+
+                /* Secret recipe starts with IP addresses */
+                *mess++ ^= daddr;
+                *mess++ ^= saddr;
 
-        tcp_parse_options(skb, &tmp_opt, 0);
+                /* plus variable length Initiator Cookie */
+                c = (u8 *)mess;
+                while (l-- > 0)
+                        *c++ ^= *hash_location++;
+
+#ifdef CONFIG_SYN_COOKIES
+                want_cookie = 0;        /* not our kind of cookie */
+#endif
+                tmp_ext.cookie_out_never = 0; /* false */
+                tmp_ext.cookie_plus = tmp_opt.cookie_plus;
+        } else if (!tp->rx_opt.cookie_in_always) {
+                /* redundant indications, but ensure initialization. */
+                tmp_ext.cookie_out_never = 1; /* true */
+                tmp_ext.cookie_plus = 0;
+        } else {
+                goto drop_and_release;
+        }
+        tmp_ext.cookie_in_always = tp->rx_opt.cookie_in_always;
 
         if (want_cookie && !tmp_opt.saw_tstamp)
                 tcp_clear_options(&tmp_opt);
 
         tmp_opt.tstamp_ok = tmp_opt.saw_tstamp;
-
         tcp_openreq_init(req, &tmp_opt, skb);
 
-        ireq = inet_rsk(req);
-        ireq->loc_addr = daddr;
-        ireq->rmt_addr = saddr;
-        ireq->no_srccheck = inet_sk(sk)->transparent;
-        ireq->opt = tcp_v4_save_options(sk, skb);
-
         if (security_inet_conn_request(sk, skb, req))
-                goto drop_and_free;
+                goto drop_and_release;
 
         if (!want_cookie)
                 TCP_ECN_create_request(req, tcp_hdr(skb));
@@ -1301,10 +1345,9 @@ int tcp_v4_conn_request(struct sock *sk, struct sk_buff *skb)
                  */
                 if (tmp_opt.saw_tstamp &&
                     tcp_death_row.sysctl_tw_recycle &&
-                    (dst = inet_csk_route_req(sk, req)) != NULL &&
                     (peer = rt_get_peer((struct rtable *)dst)) != NULL &&
                     peer->v4daddr == saddr) {
-                        if (get_seconds() < peer->tcp_ts_stamp + TCP_PAWS_MSL &&
+                        if ((u32)get_seconds() - peer->tcp_ts_stamp < TCP_PAWS_MSL &&
                             (s32)(peer->tcp_ts - req->ts_recent) >
                                                         TCP_PAWS_WINDOW) {
                                 NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_PAWSPASSIVEREJECTED);
@@ -1333,7 +1376,9 @@ int tcp_v4_conn_request(struct sock *sk, struct sk_buff *skb)
         }
         tcp_rsk(req)->snt_isn = isn;
 
-        if (__tcp_v4_send_synack(sk, req, dst) || want_cookie)
+        if (__tcp_v4_send_synack(sk, dst, req,
+                                 (struct request_values *)&tmp_ext) ||
+            want_cookie)
                 goto drop_and_free;
 
         inet_csk_reqsk_queue_hash_add(sk, req, TCP_TIMEOUT_INIT);
@@ -1380,9 +1425,9 @@ struct sock *tcp_v4_syn_recv_sock(struct sock *sk, struct sk_buff *skb,
         newtp                 = tcp_sk(newsk);
         newinet               = inet_sk(newsk);
         ireq                  = inet_rsk(req);
-        newinet->daddr        = ireq->rmt_addr;
-        newinet->rcv_saddr    = ireq->loc_addr;
-        newinet->saddr        = ireq->loc_addr;
+        newinet->inet_daddr   = ireq->rmt_addr;
+        newinet->inet_rcv_saddr = ireq->loc_addr;
+        newinet->inet_saddr           = ireq->loc_addr;
         newinet->opt          = ireq->opt;
         ireq->opt             = NULL;
         newinet->mc_index     = inet_iif(skb);
@@ -1390,7 +1435,7 @@ struct sock *tcp_v4_syn_recv_sock(struct sock *sk, struct sk_buff *skb,
         inet_csk(newsk)->icsk_ext_hdr_len = 0;
         if (newinet->opt)
                 inet_csk(newsk)->icsk_ext_hdr_len = newinet->opt->optlen;
-        newinet->id = newtp->write_seq ^ jiffies;
+        newinet->inet_id = newtp->write_seq ^ jiffies;
 
         tcp_mtup_init(newsk);
         tcp_sync_mss(newsk, dst_mtu(dst));
@@ -1403,7 +1448,8 @@ struct sock *tcp_v4_syn_recv_sock(struct sock *sk, struct sk_buff *skb,
 
 #ifdef CONFIG_TCP_MD5SIG
         /* Copy over the MD5 key from the original socket */
-        if ((key = tcp_v4_md5_do_lookup(sk, newinet->daddr)) != NULL) {
+        key = tcp_v4_md5_do_lookup(sk, newinet->inet_daddr);
+        if (key != NULL) {
                 /*
                  * We're using one, so create a matching key
                  * on the newsk structure. If we fail to get
@@ -1412,7 +1458,7 @@ struct sock *tcp_v4_syn_recv_sock(struct sock *sk, struct sk_buff *skb,
                  */
                 char *newkey = kmemdup(key->key, key->keylen, GFP_ATOMIC);
                 if (newkey != NULL)
-                        tcp_v4_md5_do_add(newsk, newinet->daddr,
+                        tcp_v4_md5_do_add(newsk, newinet->inet_daddr,
                                           newkey, key->keylen);
                 newsk->sk_route_caps &= ~NETIF_F_GSO_MASK;
         }
@@ -1711,8 +1757,8 @@ int tcp_v4_remember_stamp(struct sock *sk)
         struct inet_peer *peer = NULL;
         int release_it = 0;
 
-        if (!rt || rt->rt_dst != inet->daddr) {
-                peer = inet_getpeer(inet->daddr, 1);
+        if (!rt || rt->rt_dst != inet->inet_daddr) {
+                peer = inet_getpeer(inet->inet_daddr, 1);
                 release_it = 1;
         } else {
                 if (!rt->peer)
@@ -1722,9 +1768,9 @@ int tcp_v4_remember_stamp(struct sock *sk)
 
         if (peer) {
                 if ((s32)(peer->tcp_ts - tp->rx_opt.ts_recent) <= 0 ||
-                    (peer->tcp_ts_stamp + TCP_PAWS_MSL < get_seconds() &&
-                     peer->tcp_ts_stamp <= tp->rx_opt.ts_recent_stamp)) {
-                        peer->tcp_ts_stamp = tp->rx_opt.ts_recent_stamp;
+                    ((u32)get_seconds() - peer->tcp_ts_stamp > TCP_PAWS_MSL &&
+                     peer->tcp_ts_stamp <= (u32)tp->rx_opt.ts_recent_stamp)) {
+                        peer->tcp_ts_stamp = (u32)tp->rx_opt.ts_recent_stamp;
                         peer->tcp_ts = tp->rx_opt.ts_recent;
                 }
                 if (release_it)
@@ -1743,9 +1789,9 @@ int tcp_v4_tw_remember_stamp(struct inet_timewait_sock *tw)
                 const struct tcp_timewait_sock *tcptw = tcp_twsk((struct sock *)tw);
 
                 if ((s32)(peer->tcp_ts - tcptw->tw_ts_recent) <= 0 ||
-                    (peer->tcp_ts_stamp + TCP_PAWS_MSL < get_seconds() &&
-                     peer->tcp_ts_stamp <= tcptw->tw_ts_recent_stamp)) {
-                        peer->tcp_ts_stamp = tcptw->tw_ts_recent_stamp;
+                    ((u32)get_seconds() - peer->tcp_ts_stamp > TCP_PAWS_MSL &&
+                     peer->tcp_ts_stamp <= (u32)tcptw->tw_ts_recent_stamp)) {
+                        peer->tcp_ts_stamp = (u32)tcptw->tw_ts_recent_stamp;
                         peer->tcp_ts       = tcptw->tw_ts_recent;
                 }
                 inet_putpeer(peer);
@@ -1810,7 +1856,7 @@ static int tcp_v4_init_sock(struct sock *sk)
          */
         tp->snd_ssthresh = TCP_INFINITE_SSTHRESH;
         tp->snd_cwnd_clamp = ~0;
-        tp->mss_cache = 536;
+        tp->mss_cache = TCP_MSS_DEFAULT;
 
         tp->reordering = sysctl_tcp_reordering;
         icsk->icsk_ca_ops = &tcp_init_congestion_ops;
@@ -1826,6 +1872,19 @@ static int tcp_v4_init_sock(struct sock *sk)
         tp->af_specific = &tcp_sock_ipv4_specific;
 #endif
 
+        /* TCP Cookie Transactions */
+        if (sysctl_tcp_cookie_size > 0) {
+                /* Default, cookies without s_data_payload. */
+                tp->cookie_values =
+                        kzalloc(sizeof(*tp->cookie_values),
+                                sk->sk_allocation);
+                if (tp->cookie_values != NULL)
+                        kref_init(&tp->cookie_values->kref);
+        }
+        /* Presumed zeroed, in order of appearance:
+         *      cookie_in_always, cookie_out_never,
+         *      s_data_constant, s_data_in, s_data_out
+         */
         sk->sk_sndbuf = sysctl_tcp_wmem[1];
         sk->sk_rcvbuf = sysctl_tcp_rmem[1];
 
@@ -1879,6 +1938,13 @@ void tcp_v4_destroy_sock(struct sock *sk)
                 sk->sk_sndmsg_page = NULL;
         }
 
+        /* TCP Cookie Transactions */
+        if (tp->cookie_values != NULL) {
+                kref_put(&tp->cookie_values->kref,
+                         tcp_cookie_values_release);
+                tp->cookie_values = NULL;
+        }
+
         percpu_counter_dec(&tcp_sockets_allocated);
 }
 
@@ -2000,7 +2066,7 @@ static void *established_get_first(struct seq_file *seq)
         struct net *net = seq_file_net(seq);
         void *rc = NULL;
 
-        for (st->bucket = 0; st->bucket < tcp_hashinfo.ehash_size; ++st->bucket) {
+        for (st->bucket = 0; st->bucket <= tcp_hashinfo.ehash_mask; ++st->bucket) {
                 struct sock *sk;
                 struct hlist_nulls_node *node;
                 struct inet_timewait_sock *tw;
@@ -2061,10 +2127,10 @@ get_tw:
                 st->state = TCP_SEQ_STATE_ESTABLISHED;
 
                 /* Look for next non empty bucket */
-                while (++st->bucket < tcp_hashinfo.ehash_size &&
+                while (++st->bucket <= tcp_hashinfo.ehash_mask &&
                                 empty_bucket(st))
                         ;
-                if (st->bucket >= tcp_hashinfo.ehash_size)
+                if (st->bucket > tcp_hashinfo.ehash_mask)
                         return NULL;
 
                 spin_lock_bh(inet_ehash_lockp(&tcp_hashinfo, st->bucket));
@@ -2225,7 +2291,7 @@ static void get_openreq4(struct sock *sk, struct request_sock *req,
                 " %02X %08X:%08X %02X:%08lX %08X %5d %8d %u %d %p%n",
                 i,
                 ireq->loc_addr,
-                ntohs(inet_sk(sk)->sport),
+                ntohs(inet_sk(sk)->inet_sport),
                 ireq->rmt_addr,
                 ntohs(ireq->rmt_port),
                 TCP_SYN_RECV,
@@ -2248,10 +2314,11 @@ static void get_tcp4_sock(struct sock *sk, struct seq_file *f, int i, int *len)
         struct tcp_sock *tp = tcp_sk(sk);
         const struct inet_connection_sock *icsk = inet_csk(sk);
         struct inet_sock *inet = inet_sk(sk);
-        __be32 dest = inet->daddr;
-        __be32 src = inet->rcv_saddr;
-        __u16 destp = ntohs(inet->dport);
-        __u16 srcp = ntohs(inet->sport);
+        __be32 dest = inet->inet_daddr;
+        __be32 src = inet->inet_rcv_saddr;
+        __u16 destp = ntohs(inet->inet_dport);
+        __u16 srcp = ntohs(inet->inet_sport);
+        int rx_queue;
 
         if (icsk->icsk_pending == ICSK_TIME_RETRANS) {
                 timer_active    = 1;
@@ -2267,12 +2334,19 @@ static void get_tcp4_sock(struct sock *sk, struct seq_file *f, int i, int *len)
                 timer_expires = jiffies;
         }
 
+        if (sk->sk_state == TCP_LISTEN)
+                rx_queue = sk->sk_ack_backlog;
+        else
+                /*
+                 * because we dont lock socket, we might find a transient negative value
+                 */
+                rx_queue = max_t(int, tp->rcv_nxt - tp->copied_seq, 0);
+
         seq_printf(f, "%4d: %08X:%04X %08X:%04X %02X %08X:%08X %02X:%08lX "
                         "%08X %5d %8d %lu %d %p %lu %lu %u %u %d%n",
                 i, src, srcp, dest, destp, sk->sk_state,
                 tp->write_seq - tp->snd_una,
-                sk->sk_state == TCP_LISTEN ? sk->sk_ack_backlog :
-                                             (tp->rcv_nxt - tp->copied_seq),
+                rx_queue,
                 timer_active,
                 jiffies_to_clock_t(timer_expires - jiffies),
                 icsk->icsk_retransmits,
@@ -2463,12 +2537,17 @@ static int __net_init tcp_sk_init(struct net *net)
 static void __net_exit tcp_sk_exit(struct net *net)
 {
         inet_ctl_sock_destroy(net->ipv4.tcp_sock);
-        inet_twsk_purge(net, &tcp_hashinfo, &tcp_death_row, AF_INET);
+}
+
+static void __net_exit tcp_sk_exit_batch(struct list_head *net_exit_list)
+{
+        inet_twsk_purge(&tcp_hashinfo, &tcp_death_row, AF_INET);
 }
 
 static struct pernet_operations __net_initdata tcp_sk_ops = {
-       .init = tcp_sk_init,
-       .exit = tcp_sk_exit,
+       .init       = tcp_sk_init,
+       .exit       = tcp_sk_exit,
+       .exit_batch = tcp_sk_exit_batch,
 };
 
 void __init tcp_v4_init(void)
diff --git a/net/ipv4/tcp_lp.c b/net/ipv4/tcp_lp.c
index ce3c41ff50b2..de870377fbba 100644
--- a/net/ipv4/tcp_lp.c
+++ b/net/ipv4/tcp_lp.c
@@ -143,8 +143,8 @@ static u32 tcp_lp_remote_hz_estimator(struct sock *sk)
                 goto out;
 
         /* we can't calc remote HZ with no different!! */
-        if (tp->rx_opt.rcv_tsval == lp->remote_ref_time
-            || tp->rx_opt.rcv_tsecr == lp->local_ref_time)
+        if (tp->rx_opt.rcv_tsval == lp->remote_ref_time ||
+            tp->rx_opt.rcv_tsecr == lp->local_ref_time)
                 goto out;
 
         m = HZ * (tp->rx_opt.rcv_tsval -
diff --git a/net/ipv4/tcp_minisocks.c b/net/ipv4/tcp_minisocks.c
index 4c03598ed924..87accec8d097 100644
--- a/net/ipv4/tcp_minisocks.c
+++ b/net/ipv4/tcp_minisocks.c
@@ -26,13 +26,7 @@
 #include <net/inet_common.h>
 #include <net/xfrm.h>
 
-#ifdef CONFIG_SYSCTL
-#define SYNC_INIT 0 /* let the user enable it */
-#else
-#define SYNC_INIT 1
-#endif
-
-int sysctl_tcp_syncookies __read_mostly = SYNC_INIT;
+int sysctl_tcp_syncookies __read_mostly = 1;
 EXPORT_SYMBOL(sysctl_tcp_syncookies);
 
 int sysctl_tcp_abort_on_overflow __read_mostly;
@@ -96,13 +90,14 @@ enum tcp_tw_status
 tcp_timewait_state_process(struct inet_timewait_sock *tw, struct sk_buff *skb,
                            const struct tcphdr *th)
 {
-        struct tcp_timewait_sock *tcptw = tcp_twsk((struct sock *)tw);
         struct tcp_options_received tmp_opt;
+        u8 *hash_location;
+        struct tcp_timewait_sock *tcptw = tcp_twsk((struct sock *)tw);
         int paws_reject = 0;
 
-        tmp_opt.saw_tstamp = 0;
         if (th->doff > (sizeof(*th) >> 2) && tcptw->tw_ts_recent_stamp) {
-                tcp_parse_options(skb, &tmp_opt, 0);
+                tmp_opt.tstamp_ok = 1;
+                tcp_parse_options(skb, &tmp_opt, &hash_location, 1, NULL);
 
                 if (tmp_opt.saw_tstamp) {
                         tmp_opt.ts_recent       = tcptw->tw_ts_recent;
@@ -389,14 +384,43 @@ struct sock *tcp_create_openreq_child(struct sock *sk, struct request_sock *req,
                 const struct inet_request_sock *ireq = inet_rsk(req);
                 struct tcp_request_sock *treq = tcp_rsk(req);
                 struct inet_connection_sock *newicsk = inet_csk(newsk);
-                struct tcp_sock *newtp;
+                struct tcp_sock *newtp = tcp_sk(newsk);
+                struct tcp_sock *oldtp = tcp_sk(sk);
+                struct tcp_cookie_values *oldcvp = oldtp->cookie_values;
+
+                /* TCP Cookie Transactions require space for the cookie pair,
+                 * as it differs for each connection.  There is no need to
+                 * copy any s_data_payload stored at the original socket.
+                 * Failure will prevent resuming the connection.
+                 *
+                 * Presumed copied, in order of appearance:
+                 *      cookie_in_always, cookie_out_never
+                 */
+                if (oldcvp != NULL) {
+                        struct tcp_cookie_values *newcvp =
+                                kzalloc(sizeof(*newtp->cookie_values),
+                                        GFP_ATOMIC);
+
+                        if (newcvp != NULL) {
+                                kref_init(&newcvp->kref);
+                                newcvp->cookie_desired =
+                                                oldcvp->cookie_desired;
+                                newtp->cookie_values = newcvp;
+                        } else {
+                                /* Not Yet Implemented */
+                                newtp->cookie_values = NULL;
+                        }
+                }
 
                 /* Now setup tcp_sock */
-                newtp = tcp_sk(newsk);
                 newtp->pred_flags = 0;
-                newtp->rcv_wup = newtp->copied_seq = newtp->rcv_nxt = treq->rcv_isn + 1;
-                newtp->snd_sml = newtp->snd_una = newtp->snd_nxt = treq->snt_isn + 1;
-                newtp->snd_up = treq->snt_isn + 1;
+
+                newtp->rcv_wup = newtp->copied_seq =
+                newtp->rcv_nxt = treq->rcv_isn + 1;
+
+                newtp->snd_sml = newtp->snd_una =
+                newtp->snd_nxt = newtp->snd_up =
+                        treq->snt_isn + 1 + tcp_s_data_size(oldtp);
 
                 tcp_prequeue_init(newtp);
 
@@ -429,8 +453,8 @@ struct sock *tcp_create_openreq_child(struct sock *sk, struct request_sock *req,
                 tcp_set_ca_state(newsk, TCP_CA_Open);
                 tcp_init_xmit_timers(newsk);
                 skb_queue_head_init(&newtp->out_of_order_queue);
-                newtp->write_seq = treq->snt_isn + 1;
-                newtp->pushed_seq = newtp->write_seq;
+                newtp->write_seq = newtp->pushed_seq =
+                        treq->snt_isn + 1 + tcp_s_data_size(oldtp);
 
                 newtp->rx_opt.saw_tstamp = 0;
 
@@ -476,7 +500,7 @@ struct sock *tcp_create_openreq_child(struct sock *sk, struct request_sock *req,
                 if (newtp->af_specific->md5_lookup(sk, newsk))
                         newtp->tcp_header_len += TCPOLEN_MD5SIG_ALIGNED;
 #endif
-                if (skb->len >= TCP_MIN_RCVMSS+newtp->tcp_header_len)
+                if (skb->len >= TCP_MSS_DEFAULT + newtp->tcp_header_len)
                         newicsk->icsk_ack.last_seg_size = skb->len - newtp->tcp_header_len;
                 newtp->rx_opt.mss_clamp = req->mss;
                 TCP_ECN_openreq_child(newtp, req);
@@ -495,15 +519,16 @@ struct sock *tcp_check_req(struct sock *sk, struct sk_buff *skb,
                            struct request_sock *req,
                            struct request_sock **prev)
 {
+        struct tcp_options_received tmp_opt;
+        u8 *hash_location;
+        struct sock *child;
         const struct tcphdr *th = tcp_hdr(skb);
         __be32 flg = tcp_flag_word(th) & (TCP_FLAG_RST|TCP_FLAG_SYN|TCP_FLAG_ACK);
         int paws_reject = 0;
-        struct tcp_options_received tmp_opt;
-        struct sock *child;
 
-        tmp_opt.saw_tstamp = 0;
-        if (th->doff > (sizeof(struct tcphdr)>>2)) {
-                tcp_parse_options(skb, &tmp_opt, 0);
+        if ((th->doff > (sizeof(*th) >> 2)) && (req->ts_recent)) {
+                tmp_opt.tstamp_ok = 1;
+                tcp_parse_options(skb, &tmp_opt, &hash_location, 1, NULL);
 
                 if (tmp_opt.saw_tstamp) {
                         tmp_opt.ts_recent = req->ts_recent;
@@ -537,7 +562,7 @@ struct sock *tcp_check_req(struct sock *sk, struct sk_buff *skb,
                  * Enforce "SYN-ACK" according to figure 8, figure 6
                  * of RFC793, fixed by RFC1122.
                  */
-                req->rsk_ops->rtx_syn_ack(sk, req);
+                req->rsk_ops->rtx_syn_ack(sk, req, NULL);
                 return NULL;
         }
 
@@ -596,7 +621,8 @@ struct sock *tcp_check_req(struct sock *sk, struct sk_buff *skb,
          * Invalid ACK: reset will be sent by listening socket
          */
         if ((flg & TCP_FLAG_ACK) &&
-            (TCP_SKB_CB(skb)->ack_seq != tcp_rsk(req)->snt_isn + 1))
+            (TCP_SKB_CB(skb)->ack_seq !=
+             tcp_rsk(req)->snt_isn + 1 + tcp_s_data_size(tcp_sk(sk))))
                 return sk;
 
         /* Also, it would be not so bad idea to check rcv_tsecr, which
diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
index fcd278a7080e..93316a96d820 100644
--- a/net/ipv4/tcp_output.c
+++ b/net/ipv4/tcp_output.c
@@ -59,6 +59,10 @@ int sysctl_tcp_base_mss __read_mostly = 512;
 /* By default, RFC2861 behavior.  */
 int sysctl_tcp_slow_start_after_idle __read_mostly = 1;
 
+int sysctl_tcp_cookie_size __read_mostly = 0; /* TCP_COOKIE_MAX */
+EXPORT_SYMBOL_GPL(sysctl_tcp_cookie_size);
+
+
 /* Account for new data that has been sent to the network. */
 static void tcp_event_new_data_sent(struct sock *sk, struct sk_buff *skb)
 {
@@ -362,15 +366,45 @@ static inline int tcp_urg_mode(const struct tcp_sock *tp)
 #define OPTION_TS               (1 << 1)
 #define OPTION_MD5              (1 << 2)
 #define OPTION_WSCALE           (1 << 3)
+#define OPTION_COOKIE_EXTENSION (1 << 4)
 
 struct tcp_out_options {
         u8 options;             /* bit field of OPTION_* */
         u8 ws;                  /* window scale, 0 to disable */
         u8 num_sack_blocks;     /* number of SACK blocks to include */
+        u8 hash_size;           /* bytes in hash_location */
         u16 mss;                /* 0 to disable */
         __u32 tsval, tsecr;     /* need to include OPTION_TS */
+        __u8 *hash_location;    /* temporary pointer, overloaded */
 };
 
+/* The sysctl int routines are generic, so check consistency here.
+ */
+static u8 tcp_cookie_size_check(u8 desired)
+{
+        if (desired > 0) {
+                /* previously specified */
+                return desired;
+        }
+        if (sysctl_tcp_cookie_size <= 0) {
+                /* no default specified */
+                return 0;
+        }
+        if (sysctl_tcp_cookie_size <= TCP_COOKIE_MIN) {
+                /* value too small, specify minimum */
+                return TCP_COOKIE_MIN;
+        }
+        if (sysctl_tcp_cookie_size >= TCP_COOKIE_MAX) {
+                /* value too large, specify maximum */
+                return TCP_COOKIE_MAX;
+        }
+        if (0x1 & sysctl_tcp_cookie_size) {
+                /* 8-bit multiple, illegal, fix it */
+                return (u8)(sysctl_tcp_cookie_size + 0x1);
+        }
+        return (u8)sysctl_tcp_cookie_size;
+}
+
 /* Write previously computed TCP options to the packet.
  *
  * Beware: Something in the Internet is very sensitive to the ordering of
@@ -385,17 +419,34 @@ struct tcp_out_options {
  * (but it may well be that other scenarios fail similarly).
  */
 static void tcp_options_write(__be32 *ptr, struct tcp_sock *tp,
-                              const struct tcp_out_options *opts,
-                              __u8 **md5_hash) {
-        if (unlikely(OPTION_MD5 & opts->options)) {
-                *ptr++ = htonl((TCPOPT_NOP << 24) |
-                               (TCPOPT_NOP << 16) |
-                               (TCPOPT_MD5SIG << 8) |
-                               TCPOLEN_MD5SIG);
-                *md5_hash = (__u8 *)ptr;
+                              struct tcp_out_options *opts)
+{
+        u8 options = opts->options;     /* mungable copy */
+
+        /* Having both authentication and cookies for security is redundant,
+         * and there's certainly not enough room.  Instead, the cookie-less
+         * extension variant is proposed.
+         *
+         * Consider the pessimal case with authentication.  The options
+         * could look like:
+         *   COOKIE|MD5(20) + MSS(4) + SACK|TS(12) + WSCALE(4) == 40
+         */
+        if (unlikely(OPTION_MD5 & options)) {
+                if (unlikely(OPTION_COOKIE_EXTENSION & options)) {
+                        *ptr++ = htonl((TCPOPT_COOKIE << 24) |
+                                       (TCPOLEN_COOKIE_BASE << 16) |
+                                       (TCPOPT_MD5SIG << 8) |
+                                       TCPOLEN_MD5SIG);
+                } else {
+                        *ptr++ = htonl((TCPOPT_NOP << 24) |
+                                       (TCPOPT_NOP << 16) |
+                                       (TCPOPT_MD5SIG << 8) |
+                                       TCPOLEN_MD5SIG);
+                }
+                options &= ~OPTION_COOKIE_EXTENSION;
+                /* overload cookie hash location */
+                opts->hash_location = (__u8 *)ptr;
                 ptr += 4;
-        } else {
-                *md5_hash = NULL;
         }
 
         if (unlikely(opts->mss)) {
@@ -404,12 +455,13 @@ static void tcp_options_write(__be32 *ptr, struct tcp_sock *tp,
                                opts->mss);
         }
 
-        if (likely(OPTION_TS & opts->options)) {
-                if (unlikely(OPTION_SACK_ADVERTISE & opts->options)) {
+        if (likely(OPTION_TS & options)) {
+                if (unlikely(OPTION_SACK_ADVERTISE & options)) {
                         *ptr++ = htonl((TCPOPT_SACK_PERM << 24) |
                                        (TCPOLEN_SACK_PERM << 16) |
                                        (TCPOPT_TIMESTAMP << 8) |
                                        TCPOLEN_TIMESTAMP);
+                        options &= ~OPTION_SACK_ADVERTISE;
                 } else {
                         *ptr++ = htonl((TCPOPT_NOP << 24) |
                                        (TCPOPT_NOP << 16) |
@@ -420,15 +472,52 @@ static void tcp_options_write(__be32 *ptr, struct tcp_sock *tp,
                 *ptr++ = htonl(opts->tsecr);
         }
 
-        if (unlikely(OPTION_SACK_ADVERTISE & opts->options &&
-                     !(OPTION_TS & opts->options))) {
+        /* Specification requires after timestamp, so do it now.
+         *
+         * Consider the pessimal case without authentication.  The options
+         * could look like:
+         *   MSS(4) + SACK|TS(12) + COOKIE(20) + WSCALE(4) == 40
+         */
+        if (unlikely(OPTION_COOKIE_EXTENSION & options)) {
+                __u8 *cookie_copy = opts->hash_location;
+                u8 cookie_size = opts->hash_size;
+
+                /* 8-bit multiple handled in tcp_cookie_size_check() above,
+                 * and elsewhere.
+                 */
+                if (0x2 & cookie_size) {
+                        __u8 *p = (__u8 *)ptr;
+
+                        /* 16-bit multiple */
+                        *p++ = TCPOPT_COOKIE;
+                        *p++ = TCPOLEN_COOKIE_BASE + cookie_size;
+                        *p++ = *cookie_copy++;
+                        *p++ = *cookie_copy++;
+                        ptr++;
+                        cookie_size -= 2;
+                } else {
+                        /* 32-bit multiple */
+                        *ptr++ = htonl(((TCPOPT_NOP << 24) |
+                                        (TCPOPT_NOP << 16) |
+                                        (TCPOPT_COOKIE << 8) |
+                                        TCPOLEN_COOKIE_BASE) +
+                                       cookie_size);
+                }
+
+                if (cookie_size > 0) {
+                        memcpy(ptr, cookie_copy, cookie_size);
+                        ptr += (cookie_size / 4);
+                }
+        }
+
+        if (unlikely(OPTION_SACK_ADVERTISE & options)) {
                 *ptr++ = htonl((TCPOPT_NOP << 24) |
                                (TCPOPT_NOP << 16) |
                                (TCPOPT_SACK_PERM << 8) |
                                TCPOLEN_SACK_PERM);
         }
 
-        if (unlikely(OPTION_WSCALE & opts->options)) {
+        if (unlikely(OPTION_WSCALE & options)) {
                 *ptr++ = htonl((TCPOPT_NOP << 24) |
                                (TCPOPT_WINDOW << 16) |
                                (TCPOLEN_WINDOW << 8) |
@@ -463,13 +552,18 @@ static unsigned tcp_syn_options(struct sock *sk, struct sk_buff *skb,
                                 struct tcp_out_options *opts,
                                 struct tcp_md5sig_key **md5) {
         struct tcp_sock *tp = tcp_sk(sk);
-        unsigned size = 0;
+        struct tcp_cookie_values *cvp = tp->cookie_values;
+        struct dst_entry *dst = __sk_dst_get(sk);
+        unsigned remaining = MAX_TCP_OPTION_SPACE;
+        u8 cookie_size = (!tp->rx_opt.cookie_out_never && cvp != NULL) ?
+                         tcp_cookie_size_check(cvp->cookie_desired) :
+                         0;
 
 #ifdef CONFIG_TCP_MD5SIG
         *md5 = tp->af_specific->md5_lookup(sk, sk);
         if (*md5) {
                 opts->options |= OPTION_MD5;
-                size += TCPOLEN_MD5SIG_ALIGNED;
+                remaining -= TCPOLEN_MD5SIG_ALIGNED;
         }
 #else
         *md5 = NULL;
@@ -485,26 +579,76 @@ static unsigned tcp_syn_options(struct sock *sk, struct sk_buff *skb,
          * SACKs don't matter, we never delay an ACK when we have any of those
          * going out.  */
         opts->mss = tcp_advertise_mss(sk);
-        size += TCPOLEN_MSS_ALIGNED;
+        remaining -= TCPOLEN_MSS_ALIGNED;
 
-        if (likely(sysctl_tcp_timestamps && *md5 == NULL)) {
+        if (likely(sysctl_tcp_timestamps &&
+                   !dst_feature(dst, RTAX_FEATURE_NO_TSTAMP) &&
+                   *md5 == NULL)) {
                 opts->options |= OPTION_TS;
                 opts->tsval = TCP_SKB_CB(skb)->when;
                 opts->tsecr = tp->rx_opt.ts_recent;
-                size += TCPOLEN_TSTAMP_ALIGNED;
+                remaining -= TCPOLEN_TSTAMP_ALIGNED;
         }
-        if (likely(sysctl_tcp_window_scaling)) {
+        if (likely(sysctl_tcp_window_scaling &&
+                   !dst_feature(dst, RTAX_FEATURE_NO_WSCALE))) {
                 opts->ws = tp->rx_opt.rcv_wscale;
                 opts->options |= OPTION_WSCALE;
-                size += TCPOLEN_WSCALE_ALIGNED;
+                remaining -= TCPOLEN_WSCALE_ALIGNED;
         }
-        if (likely(sysctl_tcp_sack)) {
+        if (likely(sysctl_tcp_sack &&
+                   !dst_feature(dst, RTAX_FEATURE_NO_SACK))) {
                 opts->options |= OPTION_SACK_ADVERTISE;
                 if (unlikely(!(OPTION_TS & opts->options)))
-                        size += TCPOLEN_SACKPERM_ALIGNED;
+                        remaining -= TCPOLEN_SACKPERM_ALIGNED;
         }
 
-        return size;
+        /* Note that timestamps are required by the specification.
+         *
+         * Odd numbers of bytes are prohibited by the specification, ensuring
+         * that the cookie is 16-bit aligned, and the resulting cookie pair is
+         * 32-bit aligned.
+         */
+        if (*md5 == NULL &&
+            (OPTION_TS & opts->options) &&
+            cookie_size > 0) {
+                int need = TCPOLEN_COOKIE_BASE + cookie_size;
+
+                if (0x2 & need) {
+                        /* 32-bit multiple */
+                        need += 2; /* NOPs */
+
+                        if (need > remaining) {
+                                /* try shrinking cookie to fit */
+                                cookie_size -= 2;
+                                need -= 4;
+                        }
+                }
+                while (need > remaining && TCP_COOKIE_MIN <= cookie_size) {
+                        cookie_size -= 4;
+                        need -= 4;
+                }
+                if (TCP_COOKIE_MIN <= cookie_size) {
+                        opts->options |= OPTION_COOKIE_EXTENSION;
+                        opts->hash_location = (__u8 *)&cvp->cookie_pair[0];
+                        opts->hash_size = cookie_size;
+
+                        /* Remember for future incarnations. */
+                        cvp->cookie_desired = cookie_size;
+
+                        if (cvp->cookie_desired != cvp->cookie_pair_size) {
+                                /* Currently use random bytes as a nonce,
+                                 * assuming these are completely unpredictable
+                                 * by hostile users of the same system.
+                                 */
+                                get_random_bytes(&cvp->cookie_pair[0],
+                                                 cookie_size);
+                                cvp->cookie_pair_size = cookie_size;
+                        }
+
+                        remaining -= need;
+                }
+        }
+        return MAX_TCP_OPTION_SPACE - remaining;
 }
 
 /* Set up TCP options for SYN-ACKs. */
@@ -512,48 +656,77 @@ static unsigned tcp_synack_options(struct sock *sk,
                                    struct request_sock *req,
                                    unsigned mss, struct sk_buff *skb,
                                    struct tcp_out_options *opts,
-                                   struct tcp_md5sig_key **md5) {
-        unsigned size = 0;
+                                   struct tcp_md5sig_key **md5,
+                                   struct tcp_extend_values *xvp)
+{
         struct inet_request_sock *ireq = inet_rsk(req);
-        char doing_ts;
+        unsigned remaining = MAX_TCP_OPTION_SPACE;
+        u8 cookie_plus = (xvp != NULL && !xvp->cookie_out_never) ?
+                         xvp->cookie_plus :
+                         0;
+        bool doing_ts = ireq->tstamp_ok;
 
 #ifdef CONFIG_TCP_MD5SIG
         *md5 = tcp_rsk(req)->af_specific->md5_lookup(sk, req);
         if (*md5) {
                 opts->options |= OPTION_MD5;
-                size += TCPOLEN_MD5SIG_ALIGNED;
+                remaining -= TCPOLEN_MD5SIG_ALIGNED;
+
+                /* We can't fit any SACK blocks in a packet with MD5 + TS
+                 * options. There was discussion about disabling SACK
+                 * rather than TS in order to fit in better with old,
+                 * buggy kernels, but that was deemed to be unnecessary.
+                 */
+                doing_ts &= !ireq->sack_ok;
         }
 #else
         *md5 = NULL;
 #endif
 
-        /* we can't fit any SACK blocks in a packet with MD5 + TS
-           options. There was discussion about disabling SACK rather than TS in
-           order to fit in better with old, buggy kernels, but that was deemed
-           to be unnecessary. */
-        doing_ts = ireq->tstamp_ok && !(*md5 && ireq->sack_ok);
-
+        /* We always send an MSS option. */
         opts->mss = mss;
-        size += TCPOLEN_MSS_ALIGNED;
+        remaining -= TCPOLEN_MSS_ALIGNED;
 
         if (likely(ireq->wscale_ok)) {
                 opts->ws = ireq->rcv_wscale;
                 opts->options |= OPTION_WSCALE;
-                size += TCPOLEN_WSCALE_ALIGNED;
+                remaining -= TCPOLEN_WSCALE_ALIGNED;
         }
         if (likely(doing_ts)) {
                 opts->options |= OPTION_TS;
                 opts->tsval = TCP_SKB_CB(skb)->when;
                 opts->tsecr = req->ts_recent;
-                size += TCPOLEN_TSTAMP_ALIGNED;
+                remaining -= TCPOLEN_TSTAMP_ALIGNED;
         }
         if (likely(ireq->sack_ok)) {
                 opts->options |= OPTION_SACK_ADVERTISE;
                 if (unlikely(!doing_ts))
-                        size += TCPOLEN_SACKPERM_ALIGNED;
+                        remaining -= TCPOLEN_SACKPERM_ALIGNED;
         }
 
-        return size;
+        /* Similar rationale to tcp_syn_options() applies here, too.
+         * If the <SYN> options fit, the same options should fit now!
+         */
+        if (*md5 == NULL &&
+            doing_ts &&
+            cookie_plus > TCPOLEN_COOKIE_BASE) {
+                int need = cookie_plus; /* has TCPOLEN_COOKIE_BASE */
+
+                if (0x2 & need) {
+                        /* 32-bit multiple */
+                        need += 2; /* NOPs */
+                }
+                if (need <= remaining) {
+                        opts->options |= OPTION_COOKIE_EXTENSION;
+                        opts->hash_size = cookie_plus - TCPOLEN_COOKIE_BASE;
+                        remaining -= need;
+                } else {
+                        /* There's no error return, so flag it. */
+                        xvp->cookie_out_never = 1; /* true */
+                        opts->hash_size = 0;
+                }
+        }
+        return MAX_TCP_OPTION_SPACE - remaining;
 }
 
 /* Compute TCP options for ESTABLISHED sockets. This is not the
@@ -619,7 +792,6 @@ static int tcp_transmit_skb(struct sock *sk, struct sk_buff *skb, int clone_it,
         struct tcp_out_options opts;
         unsigned tcp_options_size, tcp_header_size;
         struct tcp_md5sig_key *md5;
-        __u8 *md5_hash_location;
         struct tcphdr *th;
         int err;
 
@@ -661,8 +833,8 @@ static int tcp_transmit_skb(struct sock *sk, struct sk_buff *skb, int clone_it,
 
         /* Build TCP header and checksum it. */
         th = tcp_hdr(skb);
-        th->source              = inet->sport;
-        th->dest                = inet->dport;
+        th->source              = inet->inet_sport;
+        th->dest                = inet->inet_dport;
         th->seq                 = htonl(tcb->seq);
         th->ack_seq             = htonl(tp->rcv_nxt);
         *(((__be16 *)th) + 6)   = htons(((tcp_header_size >> 2) << 12) |
@@ -690,7 +862,7 @@ static int tcp_transmit_skb(struct sock *sk, struct sk_buff *skb, int clone_it,
                 }
         }
 
-        tcp_options_write((__be32 *)(th + 1), tp, &opts, &md5_hash_location);
+        tcp_options_write((__be32 *)(th + 1), tp, &opts);
         if (likely((tcb->flags & TCPCB_FLAG_SYN) == 0))
                 TCP_ECN_send(sk, skb, tcp_header_size);
 
@@ -698,7 +870,7 @@ static int tcp_transmit_skb(struct sock *sk, struct sk_buff *skb, int clone_it,
         /* Calculate the MD5 hash, as we have all we need now */
         if (md5) {
                 sk->sk_route_caps &= ~NETIF_F_GSO_MASK;
-                tp->af_specific->calc_md5_hash(md5_hash_location,
+                tp->af_specific->calc_md5_hash(opts.hash_location,
                                                md5, sk, NULL, skb);
         }
 #endif
@@ -1918,8 +2090,8 @@ int tcp_retransmit_skb(struct sock *sk, struct sk_buff *skb)
          * case, when window is shrunk to zero. In this case
          * our retransmit serves as a zero window probe.
          */
-        if (!before(TCP_SKB_CB(skb)->seq, tcp_wnd_end(tp))
-            && TCP_SKB_CB(skb)->seq != tp->snd_una)
+        if (!before(TCP_SKB_CB(skb)->seq, tcp_wnd_end(tp)) &&
+            TCP_SKB_CB(skb)->seq != tp->snd_una)
                 return -EAGAIN;
 
         if (skb->len > cur_mss) {
@@ -2219,16 +2391,17 @@ int tcp_send_synack(struct sock *sk)
 
 /* Prepare a SYN-ACK. */
 struct sk_buff *tcp_make_synack(struct sock *sk, struct dst_entry *dst,
-                                struct request_sock *req)
+                                struct request_sock *req,
+                                struct request_values *rvp)
 {
+        struct tcp_out_options opts;
+        struct tcp_extend_values *xvp = tcp_xv(rvp);
         struct inet_request_sock *ireq = inet_rsk(req);
         struct tcp_sock *tp = tcp_sk(sk);
         struct tcphdr *th;
-        int tcp_header_size;
-        struct tcp_out_options opts;
         struct sk_buff *skb;
         struct tcp_md5sig_key *md5;
-        __u8 *md5_hash_location;
+        int tcp_header_size;
         int mss;
 
         skb = sock_wmalloc(sk, MAX_TCP_HEADER + 15, 1, GFP_ATOMIC);
@@ -2266,8 +2439,8 @@ struct sk_buff *tcp_make_synack(struct sock *sk, struct dst_entry *dst,
 #endif
         TCP_SKB_CB(skb)->when = tcp_time_stamp;
         tcp_header_size = tcp_synack_options(sk, req, mss,
-                                             skb, &opts, &md5) +
-                          sizeof(struct tcphdr);
+                                             skb, &opts, &md5, xvp)
+                        + sizeof(*th);
 
         skb_push(skb, tcp_header_size);
         skb_reset_transport_header(skb);
@@ -2284,19 +2457,58 @@ struct sk_buff *tcp_make_synack(struct sock *sk, struct dst_entry *dst,
          */
         tcp_init_nondata_skb(skb, tcp_rsk(req)->snt_isn,
                              TCPCB_FLAG_SYN | TCPCB_FLAG_ACK);
+
+        if (OPTION_COOKIE_EXTENSION & opts.options) {
+                const struct tcp_cookie_values *cvp = tp->cookie_values;
+
+                if (cvp != NULL &&
+                    cvp->s_data_constant &&
+                    cvp->s_data_desired > 0) {
+                        u8 *buf = skb_put(skb, cvp->s_data_desired);
+
+                        /* copy data directly from the listening socket. */
+                        memcpy(buf, cvp->s_data_payload, cvp->s_data_desired);
+                        TCP_SKB_CB(skb)->end_seq += cvp->s_data_desired;
+                }
+
+                if (opts.hash_size > 0) {
+                        __u32 workspace[SHA_WORKSPACE_WORDS];
+                        u32 *mess = &xvp->cookie_bakery[COOKIE_DIGEST_WORDS];
+                        u32 *tail = &mess[COOKIE_MESSAGE_WORDS-1];
+
+                        /* Secret recipe depends on the Timestamp, (future)
+                         * Sequence and Acknowledgment Numbers, Initiator
+                         * Cookie, and others handled by IP variant caller.
+                         */
+                        *tail-- ^= opts.tsval;
+                        *tail-- ^= tcp_rsk(req)->rcv_isn + 1;
+                        *tail-- ^= TCP_SKB_CB(skb)->seq + 1;
+
+                        /* recommended */
+                        *tail-- ^= ((th->dest << 16) | th->source);
+                        *tail-- ^= (u32)(unsigned long)cvp; /* per sockopt */
+
+                        sha_transform((__u32 *)&xvp->cookie_bakery[0],
+                                      (char *)mess,
+                                      &workspace[0]);
+                        opts.hash_location =
+                                (__u8 *)&xvp->cookie_bakery[0];
+                }
+        }
+
         th->seq = htonl(TCP_SKB_CB(skb)->seq);
         th->ack_seq = htonl(tcp_rsk(req)->rcv_isn + 1);
 
         /* RFC1323: The window in SYN & SYN/ACK segments is never scaled. */
         th->window = htons(min(req->rcv_wnd, 65535U));
-        tcp_options_write((__be32 *)(th + 1), tp, &opts, &md5_hash_location);
+        tcp_options_write((__be32 *)(th + 1), tp, &opts);
         th->doff = (tcp_header_size >> 2);
         TCP_INC_STATS(sock_net(sk), TCP_MIB_OUTSEGS);
 
 #ifdef CONFIG_TCP_MD5SIG
         /* Okay, we have all we need - do the md5 hash if needed */
         if (md5) {
-                tcp_rsk(req)->af_specific->calc_md5_hash(md5_hash_location,
+                tcp_rsk(req)->af_specific->calc_md5_hash(opts.hash_location,
                                                md5, NULL, req, skb);
         }
 #endif
@@ -2315,7 +2527,9 @@ static void tcp_connect_init(struct sock *sk)
          * See tcp_input.c:tcp_rcv_state_process case TCP_SYN_SENT.
          */
         tp->tcp_header_len = sizeof(struct tcphdr) +
-                (sysctl_tcp_timestamps ? TCPOLEN_TSTAMP_ALIGNED : 0);
+                (sysctl_tcp_timestamps &&
+                (!dst_feature(dst, RTAX_FEATURE_NO_TSTAMP) ?
+                  TCPOLEN_TSTAMP_ALIGNED : 0));
 
 #ifdef CONFIG_TCP_MD5SIG
         if (tp->af_specific->md5_lookup(sk, sk) != NULL)
@@ -2341,7 +2555,8 @@ static void tcp_connect_init(struct sock *sk)
                                   tp->advmss - (tp->rx_opt.ts_recent_stamp ? tp->tcp_header_len - sizeof(struct tcphdr) : 0),
                                   &tp->rcv_wnd,
                                   &tp->window_clamp,
-                                  sysctl_tcp_window_scaling,
+                                  (sysctl_tcp_window_scaling &&
+                                   !dst_feature(dst, RTAX_FEATURE_NO_WSCALE)),
                                   &rcv_wscale);
 
         tp->rx_opt.rcv_wscale = rcv_wscale;
diff --git a/net/ipv4/tcp_probe.c b/net/ipv4/tcp_probe.c
index 59f5b5e7c566..bb110c5ce1d2 100644
--- a/net/ipv4/tcp_probe.c
+++ b/net/ipv4/tcp_probe.c
@@ -94,8 +94,9 @@ static int jtcp_rcv_established(struct sock *sk, struct sk_buff *skb,
         const struct inet_sock *inet = inet_sk(sk);
 
         /* Only update if port matches */
-        if ((port == 0 || ntohs(inet->dport) == port || ntohs(inet->sport) == port)
-            && (full || tp->snd_cwnd != tcp_probe.lastcwnd)) {
+        if ((port == 0 || ntohs(inet->inet_dport) == port ||
+             ntohs(inet->inet_sport) == port) &&
+            (full || tp->snd_cwnd != tcp_probe.lastcwnd)) {
 
                 spin_lock(&tcp_probe.lock);
                 /* If log fills, just silently drop */
@@ -103,10 +104,10 @@ static int jtcp_rcv_established(struct sock *sk, struct sk_buff *skb,
                         struct tcp_log *p = tcp_probe.log + tcp_probe.head;
 
                         p->tstamp = ktime_get();
-                        p->saddr = inet->saddr;
-                        p->sport = inet->sport;
-                        p->daddr = inet->daddr;
-                        p->dport = inet->dport;
+                        p->saddr = inet->inet_saddr;
+                        p->sport = inet->inet_sport;
+                        p->daddr = inet->inet_daddr;
+                        p->dport = inet->inet_dport;
                         p->length = skb->len;
                         p->snd_nxt = tp->snd_nxt;
                         p->snd_una = tp->snd_una;
diff --git a/net/ipv4/tcp_timer.c b/net/ipv4/tcp_timer.c
index cdb2ca7684d4..8353a538cd4c 100644
--- a/net/ipv4/tcp_timer.c
+++ b/net/ipv4/tcp_timer.c
@@ -141,14 +141,14 @@ static int tcp_write_timeout(struct sock *sk)
 
         if ((1 << sk->sk_state) & (TCPF_SYN_SENT | TCPF_SYN_RECV)) {
                 if (icsk->icsk_retransmits)
-                        dst_negative_advice(&sk->sk_dst_cache);
+                        dst_negative_advice(&sk->sk_dst_cache, sk);
                 retry_until = icsk->icsk_syn_retries ? : sysctl_tcp_syn_retries;
         } else {
                 if (retransmits_timed_out(sk, sysctl_tcp_retries1)) {
                         /* Black hole detection */
                         tcp_mtu_probing(icsk, sk);
 
-                        dst_negative_advice(&sk->sk_dst_cache);
+                        dst_negative_advice(&sk->sk_dst_cache, sk);
                 }
 
                 retry_until = sysctl_tcp_retries2;
@@ -303,15 +303,15 @@ void tcp_retransmit_timer(struct sock *sk)
                 struct inet_sock *inet = inet_sk(sk);
                 if (sk->sk_family == AF_INET) {
                         LIMIT_NETDEBUG(KERN_DEBUG "TCP: Peer %pI4:%u/%u unexpectedly shrunk window %u:%u (repaired)\n",
-                               &inet->daddr, ntohs(inet->dport),
-                               inet->num, tp->snd_una, tp->snd_nxt);
+                               &inet->inet_daddr, ntohs(inet->inet_dport),
+                               inet->inet_num, tp->snd_una, tp->snd_nxt);
                 }
 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
                 else if (sk->sk_family == AF_INET6) {
                         struct ipv6_pinfo *np = inet6_sk(sk);
                         LIMIT_NETDEBUG(KERN_DEBUG "TCP: Peer %pI6:%u/%u unexpectedly shrunk window %u:%u (repaired)\n",
-                               &np->daddr, ntohs(inet->dport),
-                               inet->num, tp->snd_una, tp->snd_nxt);
+                               &np->daddr, ntohs(inet->inet_dport),
+                               inet->inet_num, tp->snd_una, tp->snd_nxt);
                 }
 #endif
 #endif
diff --git a/net/ipv4/tcp_veno.c b/net/ipv4/tcp_veno.c
index e9bbff746488..b612acf76183 100644
--- a/net/ipv4/tcp_veno.c
+++ b/net/ipv4/tcp_veno.c
@@ -165,9 +165,8 @@ static void tcp_veno_cong_avoid(struct sock *sk, u32 ack, u32 in_flight)
                                  * every other rtt.
                                  */
                                 if (tp->snd_cwnd_cnt >= tp->snd_cwnd) {
-                                        if (veno->inc
-                                            && tp->snd_cwnd <
-                                            tp->snd_cwnd_clamp) {
+                                        if (veno->inc &&
+                                            tp->snd_cwnd < tp->snd_cwnd_clamp) {
                                                 tp->snd_cwnd++;
                                                 veno->inc = 0;
                                         } else
diff --git a/net/ipv4/tcp_yeah.c b/net/ipv4/tcp_yeah.c
index 66b6821b984e..a0f240358892 100644
--- a/net/ipv4/tcp_yeah.c
+++ b/net/ipv4/tcp_yeah.c
@@ -157,8 +157,8 @@ static void tcp_yeah_cong_avoid(struct sock *sk, u32 ack, u32 in_flight)
 
                         if (queue > TCP_YEAH_ALPHA ||
                             rtt - yeah->vegas.baseRTT > (yeah->vegas.baseRTT / TCP_YEAH_PHY)) {
-                                if (queue > TCP_YEAH_ALPHA
-                                    && tp->snd_cwnd > yeah->reno_count) {
+                                if (queue > TCP_YEAH_ALPHA &&
+                                    tp->snd_cwnd > yeah->reno_count) {
                                         u32 reduction = min(queue / TCP_YEAH_GAMMA ,
                                                             tp->snd_cwnd >> TCP_YEAH_EPSILON);
 
diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
index 0fa9f70e4b19..1f9534846ca9 100644
--- a/net/ipv4/udp.c
+++ b/net/ipv4/udp.c
@@ -106,7 +106,7 @@
 #include <net/xfrm.h>
 #include "udp_impl.h"
 
-struct udp_table udp_table;
+struct udp_table udp_table __read_mostly;
 EXPORT_SYMBOL(udp_table);
 
 int sysctl_udp_mem[3] __read_mostly;
@@ -121,28 +121,30 @@ EXPORT_SYMBOL(sysctl_udp_wmem_min);
 atomic_t udp_memory_allocated;
 EXPORT_SYMBOL(udp_memory_allocated);
 
-#define PORTS_PER_CHAIN (65536 / UDP_HTABLE_SIZE)
+#define MAX_UDP_PORTS 65536
+#define PORTS_PER_CHAIN (MAX_UDP_PORTS / UDP_HTABLE_SIZE_MIN)
 
 static int udp_lib_lport_inuse(struct net *net, __u16 num,
                                const struct udp_hslot *hslot,
                                unsigned long *bitmap,
                                struct sock *sk,
                                int (*saddr_comp)(const struct sock *sk1,
-                                                 const struct sock *sk2))
+                                                 const struct sock *sk2),
+                               unsigned int log)
 {
         struct sock *sk2;
         struct hlist_nulls_node *node;
 
         sk_nulls_for_each(sk2, node, &hslot->head)
-                if (net_eq(sock_net(sk2), net)                  &&
-                    sk2 != sk                                   &&
-                    (bitmap || sk2->sk_hash == num)             &&
-                    (!sk2->sk_reuse || !sk->sk_reuse)           &&
-                    (!sk2->sk_bound_dev_if || !sk->sk_bound_dev_if
-                        || sk2->sk_bound_dev_if == sk->sk_bound_dev_if) &&
+                if (net_eq(sock_net(sk2), net) &&
+                    sk2 != sk &&
+                    (bitmap || udp_sk(sk2)->udp_port_hash == num) &&
+                    (!sk2->sk_reuse || !sk->sk_reuse) &&
+                    (!sk2->sk_bound_dev_if || !sk->sk_bound_dev_if ||
+                     sk2->sk_bound_dev_if == sk->sk_bound_dev_if) &&
                     (*saddr_comp)(sk, sk2)) {
                         if (bitmap)
-                                __set_bit(sk2->sk_hash / UDP_HTABLE_SIZE,
+                                __set_bit(udp_sk(sk2)->udp_port_hash >> log,
                                           bitmap);
                         else
                                 return 1;
@@ -150,18 +152,51 @@ static int udp_lib_lport_inuse(struct net *net, __u16 num,
         return 0;
 }
 
+/*
+ * Note: we still hold spinlock of primary hash chain, so no other writer
+ * can insert/delete a socket with local_port == num
+ */
+static int udp_lib_lport_inuse2(struct net *net, __u16 num,
+                               struct udp_hslot *hslot2,
+                               struct sock *sk,
+                               int (*saddr_comp)(const struct sock *sk1,
+                                                 const struct sock *sk2))
+{
+        struct sock *sk2;
+        struct hlist_nulls_node *node;
+        int res = 0;
+
+        spin_lock(&hslot2->lock);
+        udp_portaddr_for_each_entry(sk2, node, &hslot2->head)
+                if (net_eq(sock_net(sk2), net) &&
+                    sk2 != sk &&
+                    (udp_sk(sk2)->udp_port_hash == num) &&
+                    (!sk2->sk_reuse || !sk->sk_reuse) &&
+                    (!sk2->sk_bound_dev_if || !sk->sk_bound_dev_if ||
+                     sk2->sk_bound_dev_if == sk->sk_bound_dev_if) &&
+                    (*saddr_comp)(sk, sk2)) {
+                        res = 1;
+                        break;
+                }
+        spin_unlock(&hslot2->lock);
+        return res;
+}
+
 /**
  *  udp_lib_get_port  -  UDP/-Lite port lookup for IPv4 and IPv6
  *
  *  @sk:          socket struct in question
  *  @snum:        port number to look up
  *  @saddr_comp:  AF-dependent comparison of bound local IP addresses
+ *  @hash2_nulladdr: AF-dependant hash value in secondary hash chains,
+ *                   with NULL address
  */
 int udp_lib_get_port(struct sock *sk, unsigned short snum,
                        int (*saddr_comp)(const struct sock *sk1,
-                                         const struct sock *sk2))
+                                         const struct sock *sk2),
+                     unsigned int hash2_nulladdr)
 {
-        struct udp_hslot *hslot;
+        struct udp_hslot *hslot, *hslot2;
         struct udp_table *udptable = sk->sk_prot->h.udp_table;
         int    error = 1;
         struct net *net = sock_net(sk);
@@ -180,13 +215,15 @@ int udp_lib_get_port(struct sock *sk, unsigned short snum,
                 /*
                  * force rand to be an odd multiple of UDP_HTABLE_SIZE
                  */
-                rand = (rand | 1) * UDP_HTABLE_SIZE;
-                for (last = first + UDP_HTABLE_SIZE; first != last; first++) {
-                        hslot = &udptable->hash[udp_hashfn(net, first)];
+                rand = (rand | 1) * (udptable->mask + 1);
+                for (last = first + udptable->mask + 1;
+                     first != last;
+                     first++) {
+                        hslot = udp_hashslot(udptable, net, first);
                         bitmap_zero(bitmap, PORTS_PER_CHAIN);
                         spin_lock_bh(&hslot->lock);
                         udp_lib_lport_inuse(net, snum, hslot, bitmap, sk,
-                                            saddr_comp);
+                                            saddr_comp, udptable->log);
 
                         snum = first;
                         /*
@@ -196,7 +233,7 @@ int udp_lib_get_port(struct sock *sk, unsigned short snum,
                          */
                         do {
                                 if (low <= snum && snum <= high &&
-                                    !test_bit(snum / UDP_HTABLE_SIZE, bitmap))
+                                    !test_bit(snum >> udptable->log, bitmap))
                                         goto found;
                                 snum += rand;
                         } while (snum != first);
@@ -204,17 +241,51 @@ int udp_lib_get_port(struct sock *sk, unsigned short snum,
                 }
                 goto fail;
         } else {
-                hslot = &udptable->hash[udp_hashfn(net, snum)];
+                hslot = udp_hashslot(udptable, net, snum);
                 spin_lock_bh(&hslot->lock);
-                if (udp_lib_lport_inuse(net, snum, hslot, NULL, sk, saddr_comp))
+                if (hslot->count > 10) {
+                        int exist;
+                        unsigned int slot2 = udp_sk(sk)->udp_portaddr_hash ^ snum;
+
+                        slot2          &= udptable->mask;
+                        hash2_nulladdr &= udptable->mask;
+
+                        hslot2 = udp_hashslot2(udptable, slot2);
+                        if (hslot->count < hslot2->count)
+                                goto scan_primary_hash;
+
+                        exist = udp_lib_lport_inuse2(net, snum, hslot2,
+                                                     sk, saddr_comp);
+                        if (!exist && (hash2_nulladdr != slot2)) {
+                                hslot2 = udp_hashslot2(udptable, hash2_nulladdr);
+                                exist = udp_lib_lport_inuse2(net, snum, hslot2,
+                                                             sk, saddr_comp);
+                        }
+                        if (exist)
+                                goto fail_unlock;
+                        else
+                                goto found;
+                }
+scan_primary_hash:
+                if (udp_lib_lport_inuse(net, snum, hslot, NULL, sk,
+                                        saddr_comp, 0))
                         goto fail_unlock;
         }
 found:
-        inet_sk(sk)->num = snum;
-        sk->sk_hash = snum;
+        inet_sk(sk)->inet_num = snum;
+        udp_sk(sk)->udp_port_hash = snum;
+        udp_sk(sk)->udp_portaddr_hash ^= snum;
         if (sk_unhashed(sk)) {
                 sk_nulls_add_node_rcu(sk, &hslot->head);
+                hslot->count++;
                 sock_prot_inuse_add(sock_net(sk), sk->sk_prot, 1);
+
+                hslot2 = udp_hashslot2(udptable, udp_sk(sk)->udp_portaddr_hash);
+                spin_lock(&hslot2->lock);
+                hlist_nulls_add_head_rcu(&udp_sk(sk)->udp_portaddr_node,
+                                         &hslot2->head);
+                hslot2->count++;
+                spin_unlock(&hslot2->lock);
         }
         error = 0;
 fail_unlock:
@@ -229,13 +300,26 @@ static int ipv4_rcv_saddr_equal(const struct sock *sk1, const struct sock *sk2)
         struct inet_sock *inet1 = inet_sk(sk1), *inet2 = inet_sk(sk2);
 
         return  (!ipv6_only_sock(sk2)  &&
-                 (!inet1->rcv_saddr || !inet2->rcv_saddr ||
-                   inet1->rcv_saddr == inet2->rcv_saddr));
+                 (!inet1->inet_rcv_saddr || !inet2->inet_rcv_saddr ||
+                   inet1->inet_rcv_saddr == inet2->inet_rcv_saddr));
+}
+
+static unsigned int udp4_portaddr_hash(struct net *net, __be32 saddr,
+                                       unsigned int port)
+{
+        return jhash_1word(saddr, net_hash_mix(net)) ^ port;
 }
 
 int udp_v4_get_port(struct sock *sk, unsigned short snum)
 {
-        return udp_lib_get_port(sk, snum, ipv4_rcv_saddr_equal);
+        unsigned int hash2_nulladdr =
+                udp4_portaddr_hash(sock_net(sk), INADDR_ANY, snum);
+        unsigned int hash2_partial =
+                udp4_portaddr_hash(sock_net(sk), inet_sk(sk)->inet_rcv_saddr, 0);
+
+        /* precompute partial secondary hash */
+        udp_sk(sk)->udp_portaddr_hash = hash2_partial;
+        return udp_lib_get_port(sk, snum, ipv4_rcv_saddr_equal, hash2_nulladdr);
 }
 
 static inline int compute_score(struct sock *sk, struct net *net, __be32 saddr,
@@ -244,23 +328,61 @@ static inline int compute_score(struct sock *sk, struct net *net, __be32 saddr,
 {
         int score = -1;
 
-        if (net_eq(sock_net(sk), net) && sk->sk_hash == hnum &&
+        if (net_eq(sock_net(sk), net) && udp_sk(sk)->udp_port_hash == hnum &&
                         !ipv6_only_sock(sk)) {
                 struct inet_sock *inet = inet_sk(sk);
 
                 score = (sk->sk_family == PF_INET ? 1 : 0);
-                if (inet->rcv_saddr) {
-                        if (inet->rcv_saddr != daddr)
+                if (inet->inet_rcv_saddr) {
+                        if (inet->inet_rcv_saddr != daddr)
+                                return -1;
+                        score += 2;
+                }
+                if (inet->inet_daddr) {
+                        if (inet->inet_daddr != saddr)
+                                return -1;
+                        score += 2;
+                }
+                if (inet->inet_dport) {
+                        if (inet->inet_dport != sport)
+                                return -1;
+                        score += 2;
+                }
+                if (sk->sk_bound_dev_if) {
+                        if (sk->sk_bound_dev_if != dif)
                                 return -1;
                         score += 2;
                 }
-                if (inet->daddr) {
-                        if (inet->daddr != saddr)
+        }
+        return score;
+}
+
+/*
+ * In this second variant, we check (daddr, dport) matches (inet_rcv_sadd, inet_num)
+ */
+#define SCORE2_MAX (1 + 2 + 2 + 2)
+static inline int compute_score2(struct sock *sk, struct net *net,
+                                 __be32 saddr, __be16 sport,
+                                 __be32 daddr, unsigned int hnum, int dif)
+{
+        int score = -1;
+
+        if (net_eq(sock_net(sk), net) && !ipv6_only_sock(sk)) {
+                struct inet_sock *inet = inet_sk(sk);
+
+                if (inet->inet_rcv_saddr != daddr)
+                        return -1;
+                if (inet->inet_num != hnum)
+                        return -1;
+
+                score = (sk->sk_family == PF_INET ? 1 : 0);
+                if (inet->inet_daddr) {
+                        if (inet->inet_daddr != saddr)
                                 return -1;
                         score += 2;
                 }
-                if (inet->dport) {
-                        if (inet->dport != sport)
+                if (inet->inet_dport) {
+                        if (inet->inet_dport != sport)
                                 return -1;
                         score += 2;
                 }
@@ -273,6 +395,51 @@ static inline int compute_score(struct sock *sk, struct net *net, __be32 saddr,
         return score;
 }
 
+
+/* called with read_rcu_lock() */
+static struct sock *udp4_lib_lookup2(struct net *net,
+                __be32 saddr, __be16 sport,
+                __be32 daddr, unsigned int hnum, int dif,
+                struct udp_hslot *hslot2, unsigned int slot2)
+{
+        struct sock *sk, *result;
+        struct hlist_nulls_node *node;
+        int score, badness;
+
+begin:
+        result = NULL;
+        badness = -1;
+        udp_portaddr_for_each_entry_rcu(sk, node, &hslot2->head) {
+                score = compute_score2(sk, net, saddr, sport,
+                                      daddr, hnum, dif);
+                if (score > badness) {
+                        result = sk;
+                        badness = score;
+                        if (score == SCORE2_MAX)
+                                goto exact_match;
+                }
+        }
+        /*
+         * if the nulls value we got at the end of this lookup is
+         * not the expected one, we must restart lookup.
+         * We probably met an item that was moved to another chain.
+         */
+        if (get_nulls_value(node) != slot2)
+                goto begin;
+
+        if (result) {
+exact_match:
+                if (unlikely(!atomic_inc_not_zero(&result->sk_refcnt)))
+                        result = NULL;
+                else if (unlikely(compute_score2(result, net, saddr, sport,
+                                  daddr, hnum, dif) < badness)) {
+                        sock_put(result);
+                        goto begin;
+                }
+        }
+        return result;
+}
+
 /* UDP is nearly always wildcards out the wazoo, it makes no sense to try
  * harder than this. -DaveM
  */
@@ -283,11 +450,35 @@ static struct sock *__udp4_lib_lookup(struct net *net, __be32 saddr,
         struct sock *sk, *result;
         struct hlist_nulls_node *node;
         unsigned short hnum = ntohs(dport);
-        unsigned int hash = udp_hashfn(net, hnum);
-        struct udp_hslot *hslot = &udptable->hash[hash];
+        unsigned int hash2, slot2, slot = udp_hashfn(net, hnum, udptable->mask);
+        struct udp_hslot *hslot2, *hslot = &udptable->hash[slot];
         int score, badness;
 
         rcu_read_lock();
+        if (hslot->count > 10) {
+                hash2 = udp4_portaddr_hash(net, daddr, hnum);
+                slot2 = hash2 & udptable->mask;
+                hslot2 = &udptable->hash2[slot2];
+                if (hslot->count < hslot2->count)
+                        goto begin;
+
+                result = udp4_lib_lookup2(net, saddr, sport,
+                                          daddr, hnum, dif,
+                                          hslot2, slot2);
+                if (!result) {
+                        hash2 = udp4_portaddr_hash(net, INADDR_ANY, hnum);
+                        slot2 = hash2 & udptable->mask;
+                        hslot2 = &udptable->hash2[slot2];
+                        if (hslot->count < hslot2->count)
+                                goto begin;
+
+                        result = udp4_lib_lookup2(net, INADDR_ANY, sport,
+                                                  daddr, hnum, dif,
+                                                  hslot2, slot2);
+                }
+                rcu_read_unlock();
+                return result;
+        }
 begin:
         result = NULL;
         badness = -1;
@@ -304,7 +495,7 @@ begin:
          * not the expected one, we must restart lookup.
          * We probably met an item that was moved to another chain.
          */
-        if (get_nulls_value(node) != hash)
+        if (get_nulls_value(node) != slot)
                 goto begin;
 
         if (result) {
@@ -354,12 +545,13 @@ static inline struct sock *udp_v4_mcast_next(struct net *net, struct sock *sk,
         sk_nulls_for_each_from(s, node) {
                 struct inet_sock *inet = inet_sk(s);
 
-                if (!net_eq(sock_net(s), net)                           ||
-                    s->sk_hash != hnum                                  ||
-                    (inet->daddr && inet->daddr != rmt_addr)            ||
-                    (inet->dport != rmt_port && inet->dport)            ||
-                    (inet->rcv_saddr && inet->rcv_saddr != loc_addr)    ||
-                    ipv6_only_sock(s)                                   ||
+                if (!net_eq(sock_net(s), net) ||
+                    udp_sk(s)->udp_port_hash != hnum ||
+                    (inet->inet_daddr && inet->inet_daddr != rmt_addr) ||
+                    (inet->inet_dport != rmt_port && inet->inet_dport) ||
+                    (inet->inet_rcv_saddr &&
+                     inet->inet_rcv_saddr != loc_addr) ||
+                    ipv6_only_sock(s) ||
                     (s->sk_bound_dev_if && s->sk_bound_dev_if != dif))
                         continue;
                 if (!ip_mc_sf_allow(s, loc_addr, rmt_addr, dif))
@@ -642,14 +834,14 @@ int udp_sendmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
         } else {
                 if (sk->sk_state != TCP_ESTABLISHED)
                         return -EDESTADDRREQ;
-                daddr = inet->daddr;
-                dport = inet->dport;
+                daddr = inet->inet_daddr;
+                dport = inet->inet_dport;
                 /* Open fast path for connected socket.
                    Route will not be used, if at least one option is set.
                  */
                 connected = 1;
         }
-        ipc.addr = inet->saddr;
+        ipc.addr = inet->inet_saddr;
 
         ipc.oif = sk->sk_bound_dev_if;
         err = sock_tx_timestamp(msg, sk, &ipc.shtx);
@@ -704,7 +896,7 @@ int udp_sendmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
                                     .proto = sk->sk_protocol,
                                     .flags = inet_sk_flowi_flags(sk),
                                     .uli_u = { .ports =
-                                               { .sport = inet->sport,
+                                               { .sport = inet->inet_sport,
                                                  .dport = dport } } };
                 struct net *net = sock_net(sk);
 
@@ -748,7 +940,7 @@ back_from_confirm:
         inet->cork.fl.fl4_dst = daddr;
         inet->cork.fl.fl_ip_dport = dport;
         inet->cork.fl.fl4_src = saddr;
-        inet->cork.fl.fl_ip_sport = inet->sport;
+        inet->cork.fl.fl_ip_sport = inet->inet_sport;
         up->pending = AF_INET;
 
 do_append_data:
@@ -862,6 +1054,7 @@ static unsigned int first_packet_length(struct sock *sk)
                 udp_lib_checksum_complete(skb)) {
                 UDP_INC_STATS_BH(sock_net(sk), UDP_MIB_INERRORS,
                                  IS_UDPLITE(sk));
+                atomic_inc(&sk->sk_drops);
                 __skb_unlink(skb, rcvq);
                 __skb_queue_tail(&list_kill, skb);
         }
@@ -982,7 +1175,7 @@ try_again:
                 UDP_INC_STATS_USER(sock_net(sk),
                                 UDP_MIB_INDATAGRAMS, is_udplite);
 
-        sock_recv_timestamp(msg, sk, skb);
+        sock_recv_ts_and_drops(msg, sk, skb);
 
         /* Copy the address. */
         if (sin) {
@@ -1023,15 +1216,15 @@ int udp_disconnect(struct sock *sk, int flags)
          */
 
         sk->sk_state = TCP_CLOSE;
-        inet->daddr = 0;
-        inet->dport = 0;
+        inet->inet_daddr = 0;
+        inet->inet_dport = 0;
         sk->sk_bound_dev_if = 0;
         if (!(sk->sk_userlocks & SOCK_BINDADDR_LOCK))
                 inet_reset_saddr(sk);
 
         if (!(sk->sk_userlocks & SOCK_BINDPORT_LOCK)) {
                 sk->sk_prot->unhash(sk);
-                inet->sport = 0;
+                inet->inet_sport = 0;
         }
         sk_dst_reset(sk);
         return 0;
@@ -1042,13 +1235,22 @@ void udp_lib_unhash(struct sock *sk)
 {
         if (sk_hashed(sk)) {
                 struct udp_table *udptable = sk->sk_prot->h.udp_table;
-                unsigned int hash = udp_hashfn(sock_net(sk), sk->sk_hash);
-                struct udp_hslot *hslot = &udptable->hash[hash];
+                struct udp_hslot *hslot, *hslot2;
+
+                hslot  = udp_hashslot(udptable, sock_net(sk),
+                                      udp_sk(sk)->udp_port_hash);
+                hslot2 = udp_hashslot2(udptable, udp_sk(sk)->udp_portaddr_hash);
 
                 spin_lock_bh(&hslot->lock);
                 if (sk_nulls_del_node_init_rcu(sk)) {
-                        inet_sk(sk)->num = 0;
+                        hslot->count--;
+                        inet_sk(sk)->inet_num = 0;
                         sock_prot_inuse_add(sock_net(sk), sk->sk_prot, -1);
+
+                        spin_lock(&hslot2->lock);
+                        hlist_nulls_del_init_rcu(&udp_sk(sk)->udp_portaddr_node);
+                        hslot2->count--;
+                        spin_unlock(&hslot2->lock);
                 }
                 spin_unlock_bh(&hslot->lock);
         }
@@ -1057,25 +1259,22 @@ EXPORT_SYMBOL(udp_lib_unhash);
 
 static int __udp_queue_rcv_skb(struct sock *sk, struct sk_buff *skb)
 {
-        int is_udplite = IS_UDPLITE(sk);
-        int rc;
+        int rc = sock_queue_rcv_skb(sk, skb);
+
+        if (rc < 0) {
+                int is_udplite = IS_UDPLITE(sk);
 
-        if ((rc = sock_queue_rcv_skb(sk, skb)) < 0) {
                 /* Note that an ENOMEM error is charged twice */
-                if (rc == -ENOMEM) {
+                if (rc == -ENOMEM)
                         UDP_INC_STATS_BH(sock_net(sk), UDP_MIB_RCVBUFERRORS,
                                          is_udplite);
-                        atomic_inc(&sk->sk_drops);
-                }
-                goto drop;
+                UDP_INC_STATS_BH(sock_net(sk), UDP_MIB_INERRORS, is_udplite);
+                kfree_skb(skb);
+                return -1;
         }
 
         return 0;
 
-drop:
-        UDP_INC_STATS_BH(sock_net(sk), UDP_MIB_INERRORS, is_udplite);
-        kfree_skb(skb);
-        return -1;
 }
 
 /* returns:
@@ -1182,53 +1381,88 @@ int udp_queue_rcv_skb(struct sock *sk, struct sk_buff *skb)
 
 drop:
         UDP_INC_STATS_BH(sock_net(sk), UDP_MIB_INERRORS, is_udplite);
+        atomic_inc(&sk->sk_drops);
         kfree_skb(skb);
         return -1;
 }
 
+
+static void flush_stack(struct sock **stack, unsigned int count,
+                        struct sk_buff *skb, unsigned int final)
+{
+        unsigned int i;
+        struct sk_buff *skb1 = NULL;
+        struct sock *sk;
+
+        for (i = 0; i < count; i++) {
+                sk = stack[i];
+                if (likely(skb1 == NULL))
+                        skb1 = (i == final) ? skb : skb_clone(skb, GFP_ATOMIC);
+
+                if (!skb1) {
+                        atomic_inc(&sk->sk_drops);
+                        UDP_INC_STATS_BH(sock_net(sk), UDP_MIB_RCVBUFERRORS,
+                                         IS_UDPLITE(sk));
+                        UDP_INC_STATS_BH(sock_net(sk), UDP_MIB_INERRORS,
+                                         IS_UDPLITE(sk));
+                }
+
+                if (skb1 && udp_queue_rcv_skb(sk, skb1) <= 0)
+                        skb1 = NULL;
+        }
+        if (unlikely(skb1))
+                kfree_skb(skb1);
+}
+
 /*
  *      Multicasts and broadcasts go to each listener.
  *
- *      Note: called only from the BH handler context,
- *      so we don't need to lock the hashes.
+ *      Note: called only from the BH handler context.
  */
 static int __udp4_lib_mcast_deliver(struct net *net, struct sk_buff *skb,
                                     struct udphdr  *uh,
                                     __be32 saddr, __be32 daddr,
                                     struct udp_table *udptable)
 {
-        struct sock *sk;
-        struct udp_hslot *hslot = &udptable->hash[udp_hashfn(net, ntohs(uh->dest))];
+        struct sock *sk, *stack[256 / sizeof(struct sock *)];
+        struct udp_hslot *hslot = udp_hashslot(udptable, net, ntohs(uh->dest));
         int dif;
+        unsigned int i, count = 0;
 
         spin_lock(&hslot->lock);
         sk = sk_nulls_head(&hslot->head);
         dif = skb->dev->ifindex;
         sk = udp_v4_mcast_next(net, sk, uh->dest, daddr, uh->source, saddr, dif);
-        if (sk) {
-                struct sock *sknext = NULL;
-
-                do {
-                        struct sk_buff *skb1 = skb;
-
-                        sknext = udp_v4_mcast_next(net, sk_nulls_next(sk), uh->dest,
-                                                   daddr, uh->source, saddr,
-                                                   dif);
-                        if (sknext)
-                                skb1 = skb_clone(skb, GFP_ATOMIC);
-
-                        if (skb1) {
-                                int ret = udp_queue_rcv_skb(sk, skb1);
-                                if (ret > 0)
-                                        /* we should probably re-process instead
-                                         * of dropping packets here. */
-                                        kfree_skb(skb1);
-                        }
-                        sk = sknext;
-                } while (sknext);
-        } else
-                consume_skb(skb);
+        while (sk) {
+                stack[count++] = sk;
+                sk = udp_v4_mcast_next(net, sk_nulls_next(sk), uh->dest,
+                                       daddr, uh->source, saddr, dif);
+                if (unlikely(count == ARRAY_SIZE(stack))) {
+                        if (!sk)
+                                break;
+                        flush_stack(stack, count, skb, ~0);
+                        count = 0;
+                }
+        }
+        /*
+         * before releasing chain lock, we must take a reference on sockets
+         */
+        for (i = 0; i < count; i++)
+                sock_hold(stack[i]);
+
         spin_unlock(&hslot->lock);
+
+        /*
+         * do the slow work with no lock held
+         */
+        if (count) {
+                flush_stack(stack, count, skb, count - 1);
+
+                for (i = 0; i < count; i++)
+                        sock_put(stack[i]);
+        } else {
+                kfree_skb(skb);
+        }
         return 0;
 }
 
@@ -1620,9 +1854,14 @@ static struct sock *udp_get_first(struct seq_file *seq, int start)
         struct udp_iter_state *state = seq->private;
         struct net *net = seq_file_net(seq);
 
-        for (state->bucket = start; state->bucket < UDP_HTABLE_SIZE; ++state->bucket) {
+        for (state->bucket = start; state->bucket <= state->udp_table->mask;
+             ++state->bucket) {
                 struct hlist_nulls_node *node;
                 struct udp_hslot *hslot = &state->udp_table->hash[state->bucket];
+
+                if (hlist_nulls_empty(&hslot->head))
+                        continue;
+
                 spin_lock_bh(&hslot->lock);
                 sk_nulls_for_each(sk, node, &hslot->head) {
                         if (!net_eq(sock_net(sk), net))
@@ -1647,7 +1886,7 @@ static struct sock *udp_get_next(struct seq_file *seq, struct sock *sk)
         } while (sk && (!net_eq(sock_net(sk), net) || sk->sk_family != state->family));
 
         if (!sk) {
-                if (state->bucket < UDP_HTABLE_SIZE)
+                if (state->bucket <= state->udp_table->mask)
                         spin_unlock_bh(&state->udp_table->hash[state->bucket].lock);
                 return udp_get_first(seq, state->bucket + 1);
         }
@@ -1667,7 +1906,7 @@ static struct sock *udp_get_idx(struct seq_file *seq, loff_t pos)
 static void *udp_seq_start(struct seq_file *seq, loff_t *pos)
 {
         struct udp_iter_state *state = seq->private;
-        state->bucket = UDP_HTABLE_SIZE;
+        state->bucket = MAX_UDP_PORTS;
 
         return *pos ? udp_get_idx(seq, *pos-1) : SEQ_START_TOKEN;
 }
@@ -1689,7 +1928,7 @@ static void udp_seq_stop(struct seq_file *seq, void *v)
 {
         struct udp_iter_state *state = seq->private;
 
-        if (state->bucket < UDP_HTABLE_SIZE)
+        if (state->bucket <= state->udp_table->mask)
                 spin_unlock_bh(&state->udp_table->hash[state->bucket].lock);
 }
 
@@ -1744,12 +1983,12 @@ static void udp4_format_sock(struct sock *sp, struct seq_file *f,
                 int bucket, int *len)
 {
         struct inet_sock *inet = inet_sk(sp);
-        __be32 dest = inet->daddr;
-        __be32 src  = inet->rcv_saddr;
-        __u16 destp       = ntohs(inet->dport);
-        __u16 srcp        = ntohs(inet->sport);
+        __be32 dest = inet->inet_daddr;
+        __be32 src  = inet->inet_rcv_saddr;
+        __u16 destp       = ntohs(inet->inet_dport);
+        __u16 srcp        = ntohs(inet->inet_sport);
 
-        seq_printf(f, "%4d: %08X:%04X %08X:%04X"
+        seq_printf(f, "%5d: %08X:%04X %08X:%04X"
                 " %02X %08X:%08X %02X:%08lX %08X %5d %8d %lu %d %p %d%n",
                 bucket, src, srcp, dest, destp, sp->sk_state,
                 sk_wmem_alloc_get(sp),
@@ -1815,21 +2054,60 @@ void udp4_proc_exit(void)
 }
 #endif /* CONFIG_PROC_FS */
 
-void __init udp_table_init(struct udp_table *table)
+static __initdata unsigned long uhash_entries;
+static int __init set_uhash_entries(char *str)
 {
-        int i;
+        if (!str)
+                return 0;
+        uhash_entries = simple_strtoul(str, &str, 0);
+        if (uhash_entries && uhash_entries < UDP_HTABLE_SIZE_MIN)
+                uhash_entries = UDP_HTABLE_SIZE_MIN;
+        return 1;
+}
+__setup("uhash_entries=", set_uhash_entries);
 
-        for (i = 0; i < UDP_HTABLE_SIZE; i++) {
+void __init udp_table_init(struct udp_table *table, const char *name)
+{
+        unsigned int i;
+
+        if (!CONFIG_BASE_SMALL)
+                table->hash = alloc_large_system_hash(name,
+                        2 * sizeof(struct udp_hslot),
+                        uhash_entries,
+                        21, /* one slot per 2 MB */
+                        0,
+                        &table->log,
+                        &table->mask,
+                        64 * 1024);
+        /*
+         * Make sure hash table has the minimum size
+         */
+        if (CONFIG_BASE_SMALL || table->mask < UDP_HTABLE_SIZE_MIN - 1) {
+                table->hash = kmalloc(UDP_HTABLE_SIZE_MIN *
+                                      2 * sizeof(struct udp_hslot), GFP_KERNEL);
+                if (!table->hash)
+                        panic(name);
+                table->log = ilog2(UDP_HTABLE_SIZE_MIN);
+                table->mask = UDP_HTABLE_SIZE_MIN - 1;
+        }
+        table->hash2 = table->hash + (table->mask + 1);
+        for (i = 0; i <= table->mask; i++) {
                 INIT_HLIST_NULLS_HEAD(&table->hash[i].head, i);
+                table->hash[i].count = 0;
                 spin_lock_init(&table->hash[i].lock);
         }
+        for (i = 0; i <= table->mask; i++) {
+                INIT_HLIST_NULLS_HEAD(&table->hash2[i].head, i);
+                table->hash2[i].count = 0;
+                spin_lock_init(&table->hash2[i].lock);
+        }
 }
 
 void __init udp_init(void)
 {
         unsigned long nr_pages, limit;
 
-        udp_table_init(&udp_table);
+        udp_table_init(&udp_table, "UDP");
         /* Set the pressure threshold up by the same strategy of TCP. It is a
          * fraction of global memory that is up to 1/2 at 256 MB, decreasing
          * toward zero with the amount of memory, with a floor of 128 pages.
diff --git a/net/ipv4/udplite.c b/net/ipv4/udplite.c
index 95248d7f75ec..66f79513f4a5 100644
--- a/net/ipv4/udplite.c
+++ b/net/ipv4/udplite.c
@@ -12,7 +12,7 @@
  */
 #include "udp_impl.h"
 
-struct udp_table        udplite_table;
+struct udp_table        udplite_table __read_mostly;
 EXPORT_SYMBOL(udplite_table);
 
 static int udplite_rcv(struct sk_buff *skb)
@@ -64,7 +64,6 @@ static struct inet_protosw udplite4_protosw = {
         .protocol       =  IPPROTO_UDPLITE,
         .prot           =  &udplite_prot,
         .ops            =  &inet_dgram_ops,
-        .capability     = -1,
         .no_check       =  0,           /* must checksum (RFC 3828) */
         .flags          =  INET_PROTOSW_PERMANENT,
 };
@@ -110,7 +109,7 @@ static inline int udplite4_proc_init(void)
 
 void __init udplite4_register(void)
 {
-        udp_table_init(&udplite_table);
+        udp_table_init(&udplite_table, "UDP-Lite");
         if (proto_register(&udplite_prot, 1))
                 goto out_register_err;