53 files changed, 666 insertions, 401 deletions
diff --git a/net/bluetooth/hci_sock.c b/net/bluetooth/hci_sock.c
index bfc9a35bad33..1dae3dfc66a9 100644
--- a/net/bluetooth/hci_sock.c
+++ b/net/bluetooth/hci_sock.c
@@ -665,7 +665,8 @@ static int hci_sock_dev_event(struct notifier_block *this, unsigned long event,
                /* Detach sockets from device */
                read_lock(&hci_sk_list.lock);
                sk_for_each(sk, node, &hci_sk_list.head) {
-                        lock_sock(sk);
+                        local_bh_disable();
+                        bh_lock_sock_nested(sk);
                        if (hci_pi(sk)->hdev == hdev) {
                                hci_pi(sk)->hdev = NULL;
                                sk->sk_err = EPIPE;
@@ -674,7 +675,8 @@ static int hci_sock_dev_event(struct notifier_block *this, unsigned long event,
                                hci_dev_put(hdev);
                        }
-                        release_sock(sk);
+                        bh_unlock_sock(sk);
+                        local_bh_enable();
                }
                read_unlock(&hci_sk_list.lock);
        }
diff --git a/net/bluetooth/l2cap.c b/net/bluetooth/l2cap.c
index a59b1fb63b76..670ff95ca64b 100644
--- a/net/bluetooth/l2cap.c
+++ b/net/bluetooth/l2cap.c
@@ -507,6 +507,7 @@ static void l2cap_sock_init(struct sock *sk, struct sock *parent)
        }
        /* Default config options */
+        pi->conf_len = 0;
        pi->conf_mtu = L2CAP_DEFAULT_MTU;
        pi->flush_to = L2CAP_DEFAULT_FLUSH_TO;
 }
@@ -1271,42 +1272,6 @@ static inline int l2cap_get_conf_opt(void **ptr, int *type, int *olen, unsigned
        return len;
 }
-static inline void l2cap_parse_conf_req(struct sock *sk, void *data, int len)
-{
-        int type, hint, olen;
-        unsigned long val;
-        void *ptr = data;
-        BT_DBG("sk %p len %d", sk, len);
-        while (len >= L2CAP_CONF_OPT_SIZE) {
-                len -= l2cap_get_conf_opt(&ptr, &type, &olen, &val);
-                hint  = type & 0x80;
-                type &= 0x7f;
-                switch (type) {
-                case L2CAP_CONF_MTU:
-                        l2cap_pi(sk)->conf_mtu = val;
-                        break;
-                case L2CAP_CONF_FLUSH_TO:
-                        l2cap_pi(sk)->flush_to = val;
-                        break;
-                case L2CAP_CONF_QOS:
-                        break;
-                default:
-                        if (hint)
-                                break;
-                        /* FIXME: Reject unknown option */
-                        break;
-                }
-        }
-}
 static void l2cap_add_conf_opt(void **ptr, u8 type, u8 len, unsigned long val)
 {
        struct l2cap_conf_opt *opt = *ptr;
@@ -1358,39 +1323,75 @@ static int l2cap_build_conf_req(struct sock *sk, void *data)
        return ptr - data;
 }
-static inline int l2cap_conf_output(struct sock *sk, void **ptr)
+static int l2cap_parse_conf_req(struct sock *sk, void *data)
 {
        struct l2cap_pinfo *pi = l2cap_pi(sk);
-        int result = 0;
+        struct l2cap_conf_rsp *rsp = data;
+        void *ptr = rsp->data;
+        void *req = pi->conf_req;
+        int len = pi->conf_len;
+        int type, hint, olen;
+        unsigned long val;
+        u16 result = L2CAP_CONF_SUCCESS;
-        /* Configure output options and let the other side know
+        BT_DBG("sk %p", sk);
-         * which ones we don't like. */
-        if (pi->conf_mtu < pi->omtu)
+        while (len >= L2CAP_CONF_OPT_SIZE) {
-                result = L2CAP_CONF_UNACCEPT;
+                len -= l2cap_get_conf_opt(&req, &type, &olen, &val);
-        else
-                pi->omtu = pi->conf_mtu;
-        l2cap_add_conf_opt(ptr, L2CAP_CONF_MTU, 2, pi->omtu);
+                hint  = type & 0x80;
+                type &= 0x7f;
+                switch (type) {
+                case L2CAP_CONF_MTU:
+                        pi->conf_mtu = val;
+                        break;
+                case L2CAP_CONF_FLUSH_TO:
+                        pi->flush_to = val;
+                        break;
+                case L2CAP_CONF_QOS:
+                        break;
+                default:
+                        if (hint)
+                                break;
+                        result = L2CAP_CONF_UNKNOWN;
+                        *((u8 *) ptr++) = type;
+                        break;
+                }
+        }
+        if (result == L2CAP_CONF_SUCCESS) {
+                /* Configure output options and let the other side know
+                 * which ones we don't like. */
+                if (pi->conf_mtu < pi->omtu)
+                        result = L2CAP_CONF_UNACCEPT;
+                else
+                        pi->omtu = pi->conf_mtu;
+                l2cap_add_conf_opt(&ptr, L2CAP_CONF_MTU, 2, pi->omtu);
+        }
-        BT_DBG("sk %p result %d", sk, result);
+        rsp->scid   = cpu_to_le16(pi->dcid);
-        return result;
+        rsp->result = cpu_to_le16(result);
+        rsp->flags  = cpu_to_le16(0x0000);
+        return ptr - data;
 }
-static int l2cap_build_conf_rsp(struct sock *sk, void *data, int *result)
+static int l2cap_build_conf_rsp(struct sock *sk, void *data, u16 result, u16 flags)
 {
        struct l2cap_conf_rsp *rsp = data;
        void *ptr = rsp->data;
-        u16 flags = 0;
-        BT_DBG("sk %p complete %d", sk, result ? 1 : 0);
-        if (result)
+        BT_DBG("sk %p", sk);
-                *result = l2cap_conf_output(sk, &ptr);
-        else
-                flags = 0x0001;
        rsp->scid   = cpu_to_le16(l2cap_pi(sk)->dcid);
-        rsp->result = cpu_to_le16(result ? *result : 0);
+        rsp->result = cpu_to_le16(result);
        rsp->flags  = cpu_to_le16(flags);
        return ptr - data;
@@ -1535,7 +1536,7 @@ static inline int l2cap_config_req(struct l2cap_conn *conn, struct l2cap_cmd_hdr
        u16 dcid, flags;
        u8 rsp[64];
        struct sock *sk;
-        int result;
+        int len;
        dcid  = __le16_to_cpu(req->dcid);
        flags = __le16_to_cpu(req->flags);
@@ -1548,25 +1549,40 @@ static inline int l2cap_config_req(struct l2cap_conn *conn, struct l2cap_cmd_hdr
        if (sk->sk_state == BT_DISCONN)
                goto unlock;
-        l2cap_parse_conf_req(sk, req->data, cmd->len - sizeof(*req));
+        /* Reject if config buffer is too small. */
+        len = cmd->len - sizeof(*req);
+        if (l2cap_pi(sk)->conf_len + len > sizeof(l2cap_pi(sk)->conf_req)) {
+                l2cap_send_cmd(conn, cmd->ident, L2CAP_CONF_RSP,
+                                l2cap_build_conf_rsp(sk, rsp,
+                                        L2CAP_CONF_REJECT, flags), rsp);
+                goto unlock;
+        }
+        /* Store config. */
+        memcpy(l2cap_pi(sk)->conf_req + l2cap_pi(sk)->conf_len, req->data, len);
+        l2cap_pi(sk)->conf_len += len;
        if (flags & 0x0001) {
                /* Incomplete config. Send empty response. */
                l2cap_send_cmd(conn, cmd->ident, L2CAP_CONF_RSP,
-                                l2cap_build_conf_rsp(sk, rsp, NULL), rsp);
+                                l2cap_build_conf_rsp(sk, rsp,
+                                        L2CAP_CONF_SUCCESS, 0x0001), rsp);
                goto unlock;
        }
        /* Complete config. */
-        l2cap_send_cmd(conn, cmd->ident, L2CAP_CONF_RSP,
+        len = l2cap_parse_conf_req(sk, rsp);
-                        l2cap_build_conf_rsp(sk, rsp, &result), rsp);
+        if (len < 0)
-        if (result)
                goto unlock;
-        /* Output config done */
+        l2cap_send_cmd(conn, cmd->ident, L2CAP_CONF_RSP, len, rsp);
+        /* Output config done. */
        l2cap_pi(sk)->conf_state |= L2CAP_CONF_OUTPUT_DONE;
+        /* Reset config buffer. */
+        l2cap_pi(sk)->conf_len = 0;
        if (l2cap_pi(sk)->conf_state & L2CAP_CONF_INPUT_DONE) {
                sk->sk_state = BT_CONNECTED;
                l2cap_chan_ready(sk);
diff --git a/net/core/dev.c b/net/core/dev.c
index 8301e2ac747f..5a7f20f78574 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -116,6 +116,7 @@
 #include <linux/dmaengine.h>
 #include <linux/err.h>
 #include <linux/ctype.h>
+#include <linux/if_arp.h>
 /*
 *      The list of packet types we will receive (as opposed to discard)
@@ -217,6 +218,73 @@ extern void netdev_unregister_sysfs(struct net_device *);
 #define netdev_unregister_sysfs(dev)    do { } while(0)
 #endif
+#ifdef CONFIG_DEBUG_LOCK_ALLOC
+/*
+ * register_netdevice() inits dev->_xmit_lock and sets lockdep class
+ * according to dev->type
+ */
+static const unsigned short netdev_lock_type[] =
+        {ARPHRD_NETROM, ARPHRD_ETHER, ARPHRD_EETHER, ARPHRD_AX25,
+         ARPHRD_PRONET, ARPHRD_CHAOS, ARPHRD_IEEE802, ARPHRD_ARCNET,
+         ARPHRD_APPLETLK, ARPHRD_DLCI, ARPHRD_ATM, ARPHRD_METRICOM,
+         ARPHRD_IEEE1394, ARPHRD_EUI64, ARPHRD_INFINIBAND, ARPHRD_SLIP,
+         ARPHRD_CSLIP, ARPHRD_SLIP6, ARPHRD_CSLIP6, ARPHRD_RSRVD,
+         ARPHRD_ADAPT, ARPHRD_ROSE, ARPHRD_X25, ARPHRD_HWX25,
+         ARPHRD_PPP, ARPHRD_CISCO, ARPHRD_LAPB, ARPHRD_DDCMP,
+         ARPHRD_RAWHDLC, ARPHRD_TUNNEL, ARPHRD_TUNNEL6, ARPHRD_FRAD,
+         ARPHRD_SKIP, ARPHRD_LOOPBACK, ARPHRD_LOCALTLK, ARPHRD_FDDI,
+         ARPHRD_BIF, ARPHRD_SIT, ARPHRD_IPDDP, ARPHRD_IPGRE,
+         ARPHRD_PIMREG, ARPHRD_HIPPI, ARPHRD_ASH, ARPHRD_ECONET,
+         ARPHRD_IRDA, ARPHRD_FCPP, ARPHRD_FCAL, ARPHRD_FCPL,
+         ARPHRD_FCFABRIC, ARPHRD_IEEE802_TR, ARPHRD_IEEE80211,
+         ARPHRD_IEEE80211_PRISM, ARPHRD_IEEE80211_RADIOTAP, ARPHRD_VOID,
+         ARPHRD_NONE};
+static const char *netdev_lock_name[] =
+        {"_xmit_NETROM", "_xmit_ETHER", "_xmit_EETHER", "_xmit_AX25",
+         "_xmit_PRONET", "_xmit_CHAOS", "_xmit_IEEE802", "_xmit_ARCNET",
+         "_xmit_APPLETLK", "_xmit_DLCI", "_xmit_ATM", "_xmit_METRICOM",
+         "_xmit_IEEE1394", "_xmit_EUI64", "_xmit_INFINIBAND", "_xmit_SLIP",
+         "_xmit_CSLIP", "_xmit_SLIP6", "_xmit_CSLIP6", "_xmit_RSRVD",
+         "_xmit_ADAPT", "_xmit_ROSE", "_xmit_X25", "_xmit_HWX25",
+         "_xmit_PPP", "_xmit_CISCO", "_xmit_LAPB", "_xmit_DDCMP",
+         "_xmit_RAWHDLC", "_xmit_TUNNEL", "_xmit_TUNNEL6", "_xmit_FRAD",
+         "_xmit_SKIP", "_xmit_LOOPBACK", "_xmit_LOCALTLK", "_xmit_FDDI",
+         "_xmit_BIF", "_xmit_SIT", "_xmit_IPDDP", "_xmit_IPGRE",
+         "_xmit_PIMREG", "_xmit_HIPPI", "_xmit_ASH", "_xmit_ECONET",
+         "_xmit_IRDA", "_xmit_FCPP", "_xmit_FCAL", "_xmit_FCPL",
+         "_xmit_FCFABRIC", "_xmit_IEEE802_TR", "_xmit_IEEE80211",
+         "_xmit_IEEE80211_PRISM", "_xmit_IEEE80211_RADIOTAP", "_xmit_VOID",
+         "_xmit_NONE"};
+static struct lock_class_key netdev_xmit_lock_key[ARRAY_SIZE(netdev_lock_type)];
+static inline unsigned short netdev_lock_pos(unsigned short dev_type)
+{
+        int i;
+        for (i = 0; i < ARRAY_SIZE(netdev_lock_type); i++)
+                if (netdev_lock_type[i] == dev_type)
+                        return i;
+        /* the last key is used by default */
+        return ARRAY_SIZE(netdev_lock_type) - 1;
+}
+static inline void netdev_set_lockdep_class(spinlock_t *lock,
+                                            unsigned short dev_type)
+{
+        int i;
+        i = netdev_lock_pos(dev_type);
+        lockdep_set_class_and_name(lock, &netdev_xmit_lock_key[i],
+                                   netdev_lock_name[i]);
+}
+#else
+static inline void netdev_set_lockdep_class(spinlock_t *lock,
+                                            unsigned short dev_type)
+{
+}
+#endif
 /*******************************************************************************
@@ -3001,6 +3069,7 @@ int register_netdevice(struct net_device *dev)
        spin_lock_init(&dev->queue_lock);
        spin_lock_init(&dev->_xmit_lock);
+        netdev_set_lockdep_class(&dev->_xmit_lock, dev->type);
        dev->xmit_lock_owner = -1;
        spin_lock_init(&dev->ingress_lock);
@@ -3245,7 +3314,6 @@ void netdev_run_todo(void)
                        continue;
                }
-                netdev_unregister_sysfs(dev);
                dev->reg_state = NETREG_UNREGISTERED;
                netdev_wait_allrefs(dev);
@@ -3256,11 +3324,11 @@ void netdev_run_todo(void)
                BUG_TRAP(!dev->ip6_ptr);
                BUG_TRAP(!dev->dn_ptr);
-                /* It must be the very last action,
-                 * after this 'dev' may point to freed up memory.
-                 */
                if (dev->destructor)
                        dev->destructor(dev);
+                /* Free network device */
+                kobject_put(&dev->dev.kobj);
        }
 out:
@@ -3411,6 +3479,9 @@ void unregister_netdevice(struct net_device *dev)
        /* Notifier chain MUST detach us from master device. */
        BUG_TRAP(!dev->master);
+        /* Remove entries from sysfs */
+        netdev_unregister_sysfs(dev);
        /* Finish processing unregister after unlock */
        net_set_todo(dev);
diff --git a/net/core/net-sysfs.c b/net/core/net-sysfs.c
index b21307b15b82..5c19b0646d7a 100644
--- a/net/core/net-sysfs.c
+++ b/net/core/net-sysfs.c
@@ -456,9 +456,15 @@ static struct class net_class = {
 #endif
 };
+/* Delete sysfs entries but hold kobject reference until after all
+ * netdev references are gone.
+ */
 void netdev_unregister_sysfs(struct net_device * net)
 {
-        device_del(&(net->dev));
+        struct device *dev = &(net->dev);
+        kobject_get(&dev->kobj);
+        device_del(dev);
 }
 /* Create sysfs entries for network device. */
diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
index 8c971a2efe2a..27da9cdec6a8 100644
--- a/net/core/rtnetlink.c
+++ b/net/core/rtnetlink.c
@@ -437,7 +437,7 @@ static void copy_rtnl_link_stats(struct rtnl_link_stats *a,
        a->tx_compressed = b->tx_compressed;
 };
-static inline size_t if_nlmsg_size(int iwbuflen)
+static inline size_t if_nlmsg_size(void)
 {
        return NLMSG_ALIGN(sizeof(struct ifinfomsg))
               + nla_total_size(IFNAMSIZ) /* IFLA_IFNAME */
@@ -452,13 +452,12 @@ static inline size_t if_nlmsg_size(int iwbuflen)
               + nla_total_size(4) /* IFLA_LINK */
               + nla_total_size(4) /* IFLA_MASTER */
               + nla_total_size(1) /* IFLA_OPERSTATE */
-               + nla_total_size(1) /* IFLA_LINKMODE */
+               + nla_total_size(1); /* IFLA_LINKMODE */
-               + nla_total_size(iwbuflen);
 }
 static int rtnl_fill_ifinfo(struct sk_buff *skb, struct net_device *dev,
-                            void *iwbuf, int iwbuflen, int type, u32 pid,
+                            int type, u32 pid, u32 seq, u32 change,
-                            u32 seq, u32 change, unsigned int flags)
+                            unsigned int flags)
 {
        struct ifinfomsg *ifm;
        struct nlmsghdr *nlh;
@@ -523,9 +522,6 @@ static int rtnl_fill_ifinfo(struct sk_buff *skb, struct net_device *dev,
                }
        }
-        if (iwbuf)
-                NLA_PUT(skb, IFLA_WIRELESS, iwbuflen, iwbuf);
        return nlmsg_end(skb, nlh);
 nla_put_failure:
@@ -543,7 +539,7 @@ static int rtnl_dump_ifinfo(struct sk_buff *skb, struct netlink_callback *cb)
        for_each_netdev(dev) {
                if (idx < s_idx)
                        goto cont;
-                if (rtnl_fill_ifinfo(skb, dev, NULL, 0, RTM_NEWLINK,
+                if (rtnl_fill_ifinfo(skb, dev, RTM_NEWLINK,
                                     NETLINK_CB(cb->skb).pid,
                                     cb->nlh->nlmsg_seq, 0, NLM_F_MULTI) <= 0)
                        break;
@@ -689,8 +685,15 @@ static int rtnl_setlink(struct sk_buff *skb, struct nlmsghdr *nlh, void *arg)
        }
-        if (ifm->ifi_flags)
+        if (ifm->ifi_flags || ifm->ifi_change) {
-                dev_change_flags(dev, ifm->ifi_flags);
+                unsigned int flags = ifm->ifi_flags;
+                /* bugwards compatibility: ifi_change == 0 is treated as ~0 */
+                if (ifm->ifi_change)
+                        flags = (flags & ifm->ifi_change) |
+                                (dev->flags & ~ifm->ifi_change);
+                dev_change_flags(dev, flags);
+        }
        if (tb[IFLA_TXQLEN])
                dev->tx_queue_len = nla_get_u32(tb[IFLA_TXQLEN]);
@@ -730,8 +733,6 @@ static int rtnl_getlink(struct sk_buff *skb, struct nlmsghdr* nlh, void *arg)
        struct nlattr *tb[IFLA_MAX+1];
        struct net_device *dev = NULL;
        struct sk_buff *nskb;
-        char *iw_buf = NULL, *iw = NULL;
-        int iw_buf_len = 0;
        int err;
        err = nlmsg_parse(nlh, sizeof(*ifm), tb, IFLA_MAX, ifla_policy);
@@ -746,14 +747,14 @@ static int rtnl_getlink(struct sk_buff *skb, struct nlmsghdr* nlh, void *arg)
        } else
                return -EINVAL;
-        nskb = nlmsg_new(if_nlmsg_size(iw_buf_len), GFP_KERNEL);
+        nskb = nlmsg_new(if_nlmsg_size(), GFP_KERNEL);
        if (nskb == NULL) {
                err = -ENOBUFS;
                goto errout;
        }
-        err = rtnl_fill_ifinfo(nskb, dev, iw, iw_buf_len, RTM_NEWLINK,
+        err = rtnl_fill_ifinfo(nskb, dev, RTM_NEWLINK, NETLINK_CB(skb).pid,
-                               NETLINK_CB(skb).pid, nlh->nlmsg_seq, 0, 0);
+                               nlh->nlmsg_seq, 0, 0);
        if (err < 0) {
                /* -EMSGSIZE implies BUG in if_nlmsg_size */
                WARN_ON(err == -EMSGSIZE);
@@ -762,7 +763,6 @@ static int rtnl_getlink(struct sk_buff *skb, struct nlmsghdr* nlh, void *arg)
        }
        err = rtnl_unicast(nskb, NETLINK_CB(skb).pid);
 errout:
-        kfree(iw_buf);
        dev_put(dev);
        return err;
@@ -797,11 +797,11 @@ void rtmsg_ifinfo(int type, struct net_device *dev, unsigned change)
        struct sk_buff *skb;
        int err = -ENOBUFS;
-        skb = nlmsg_new(if_nlmsg_size(0), GFP_KERNEL);
+        skb = nlmsg_new(if_nlmsg_size(), GFP_KERNEL);
        if (skb == NULL)
                goto errout;
-        err = rtnl_fill_ifinfo(skb, dev, NULL, 0, type, 0, 0, change, 0);
+        err = rtnl_fill_ifinfo(skb, dev, type, 0, 0, change, 0);
        if (err < 0) {
                /* -EMSGSIZE implies BUG in if_nlmsg_size() */
                WARN_ON(err == -EMSGSIZE);
diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index 142257307fa2..7c6a34e21eee 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -644,11 +644,10 @@ int pskb_expand_head(struct sk_buff *skb, int nhead, int ntail,
        /* Copy only real data... and, alas, header. This should be
         * optimized for the cases when header is void. */
-        memcpy(data + nhead, skb->head,
 #ifdef NET_SKBUFF_DATA_USES_OFFSET
-                skb->tail);
+        memcpy(data + nhead, skb->head, skb->tail);
 #else
-                skb->tail - skb->head);
+        memcpy(data + nhead, skb->head, skb->tail - skb->head);
 #endif
        memcpy(data + size, skb_end_pointer(skb),
               sizeof(struct skb_shared_info));
diff --git a/net/core/sock.c b/net/core/sock.c
index 22183c2ef284..7e51d3a5e4f6 100644
--- a/net/core/sock.c
+++ b/net/core/sock.c
@@ -206,7 +206,19 @@ static int sock_set_timeout(long *timeo_p, char __user *optval, int optlen)
                return -EINVAL;
        if (copy_from_user(&tv, optval, sizeof(tv)))
                return -EFAULT;
+        if (tv.tv_usec < 0 || tv.tv_usec >= USEC_PER_SEC)
+                return -EDOM;
+        if (tv.tv_sec < 0) {
+                static int warned = 0;
+                *timeo_p = 0;
+                if (warned < 10 && net_ratelimit())
+                        warned++;
+                        printk(KERN_INFO "sock_set_timeout: `%s' (pid %d) "
+                               "tries to set negative timeout\n",
+                                current->comm, current->pid);
+                return 0;
+        }
        *timeo_p = MAX_SCHEDULE_TIMEOUT;
        if (tv.tv_sec == 0 && tv.tv_usec == 0)
                return 0;
diff --git a/net/core/sysctl_net_core.c b/net/core/sysctl_net_core.c
index b29712033dd4..f34aca041a25 100644
--- a/net/core/sysctl_net_core.c
+++ b/net/core/sysctl_net_core.c
@@ -24,6 +24,7 @@ extern int sysctl_core_destroy_delay;
 #ifdef CONFIG_XFRM
 extern u32 sysctl_xfrm_aevent_etime;
 extern u32 sysctl_xfrm_aevent_rseqth;
+extern int sysctl_xfrm_larval_drop;
 #endif
 ctl_table core_table[] = {
@@ -118,6 +119,14 @@ ctl_table core_table[] = {
                .mode           = 0644,
                .proc_handler   = &proc_dointvec
        },
+        {
+                .ctl_name       = CTL_UNNUMBERED,
+                .procname       = "xfrm_larval_drop",
+                .data           = &sysctl_xfrm_larval_drop,
+                .maxlen         = sizeof(int),
+                .mode           = 0644,
+                .proc_handler   = &proc_dointvec
+        },
 #endif /* CONFIG_XFRM */
 #endif /* CONFIG_NET */
        {
diff --git a/net/dccp/Kconfig b/net/dccp/Kconfig
index b8a68dd41000..0549e4719b13 100644
--- a/net/dccp/Kconfig
+++ b/net/dccp/Kconfig
@@ -1,8 +1,6 @@
-menu "DCCP Configuration (EXPERIMENTAL)"
+menuconfig IP_DCCP
-        depends on INET && EXPERIMENTAL
-config IP_DCCP
        tristate "The DCCP Protocol (EXPERIMENTAL)"
+        depends on INET && EXPERIMENTAL
        ---help---
          Datagram Congestion Control Protocol (RFC 4340)
@@ -19,19 +17,20 @@ config IP_DCCP
          If in doubt, say N.
+if IP_DCCP
 config INET_DCCP_DIAG
-        depends on IP_DCCP && INET_DIAG
+        depends on INET_DIAG
        def_tristate y if (IP_DCCP = y && INET_DIAG = y)
        def_tristate m
 config IP_DCCP_ACKVEC
-        depends on IP_DCCP
        bool
 source "net/dccp/ccids/Kconfig"
 menu "DCCP Kernel Hacking"
-        depends on IP_DCCP && DEBUG_KERNEL=y
+        depends on DEBUG_KERNEL=y
 config IP_DCCP_DEBUG
        bool "DCCP debug messages"
@@ -61,4 +60,4 @@ config NET_DCCPPROBE
 endmenu
-endmenu
+endif # IP_DDCP
diff --git a/net/dccp/ccids/ccid3.c b/net/dccp/ccids/ccid3.c
index d7d9ce737244..ec7fa4d67f08 100644
--- a/net/dccp/ccids/ccid3.c
+++ b/net/dccp/ccids/ccid3.c
@@ -419,7 +419,6 @@ static void ccid3_hc_tx_packet_sent(struct sock *sk, int more,
 static void ccid3_hc_tx_packet_recv(struct sock *sk, struct sk_buff *skb)
 {
-        const struct dccp_sock *dp = dccp_sk(sk);
        struct ccid3_hc_tx_sock *hctx = ccid3_hc_tx_sk(sk);
        struct ccid3_options_received *opt_recv;
        struct dccp_tx_hist_entry *packet;
@@ -491,7 +490,7 @@ static void ccid3_hc_tx_packet_recv(struct sock *sk, struct sk_buff *skb)
                        ccid3_pr_debug("%s(%p), s=%u, MSS=%u, "
                                       "R_sample=%uus, X=%u\n", dccp_role(sk),
                                       sk, hctx->ccid3hctx_s,
-                                       dp->dccps_mss_cache, r_sample,
+                                       dccp_sk(sk)->dccps_mss_cache, r_sample,
                                       (unsigned)(hctx->ccid3hctx_x >> 6));
                        ccid3_hc_tx_set_state(sk, TFRC_SSTATE_FBACK);
diff --git a/net/dccp/ipv6.c b/net/dccp/ipv6.c
index 64eac2515aa2..31737cdf156a 100644
--- a/net/dccp/ipv6.c
+++ b/net/dccp/ipv6.c
@@ -1043,9 +1043,13 @@ static int dccp_v6_connect(struct sock *sk, struct sockaddr *uaddr,
        if (final_p)
                ipv6_addr_copy(&fl.fl6_dst, final_p);
-        err = xfrm_lookup(&dst, &fl, sk, 1);
+        err = __xfrm_lookup(&dst, &fl, sk, 1);
-        if (err < 0)
+        if (err < 0) {
-                goto failure;
+                if (err == -EREMOTE)
+                        err = ip6_dst_blackhole(sk, &dst, &fl);
+                if (err < 0)
+                        goto failure;
+        }
        if (saddr == NULL) {
                saddr = &fl.fl6_src;
diff --git a/net/ieee80211/ieee80211_module.c b/net/ieee80211/ieee80211_module.c
index 7ec6610841ba..17ad278696ed 100644
--- a/net/ieee80211/ieee80211_module.c
+++ b/net/ieee80211/ieee80211_module.c
@@ -140,7 +140,7 @@ struct net_device *alloc_ieee80211(int sizeof_priv)
        dev = alloc_etherdev(sizeof(struct ieee80211_device) + sizeof_priv);
        if (!dev) {
-                IEEE80211_ERROR("Unable to network device.\n");
+                IEEE80211_ERROR("Unable to allocate network device.\n");
                goto failed;
        }
        ieee = netdev_priv(dev);
diff --git a/net/ieee80211/softmac/ieee80211softmac_module.c b/net/ieee80211/softmac/ieee80211softmac_module.c
index e9cdc6615ddc..c308756c2f9d 100644
--- a/net/ieee80211/softmac/ieee80211softmac_module.c
+++ b/net/ieee80211/softmac/ieee80211softmac_module.c
@@ -33,7 +33,10 @@ struct net_device *alloc_ieee80211softmac(int sizeof_priv)
        struct ieee80211softmac_device *softmac;
        struct net_device *dev;
-        dev = alloc_ieee80211(sizeof(struct ieee80211softmac_device) + sizeof_priv);
+        dev = alloc_ieee80211(sizeof(*softmac) + sizeof_priv);
+        if (!dev)
+                return NULL;
        softmac = ieee80211_priv(dev);
        softmac->dev = dev;
        softmac->ieee = netdev_priv(dev);
diff --git a/net/ipv4/Kconfig b/net/ipv4/Kconfig
index c68196cc56ab..010fbb2d45e9 100644
--- a/net/ipv4/Kconfig
+++ b/net/ipv4/Kconfig
@@ -43,11 +43,11 @@ config IP_ADVANCED_ROUTER
          asymmetric routing (packets from you to a host take a different path
          than packets from that host to you) or if you operate a non-routing
          host which has several IP addresses on different interfaces. To turn
-          rp_filter off use:
+          rp_filter on use:
-          echo 0 > /proc/sys/net/ipv4/conf/<device>/rp_filter
+          echo 1 > /proc/sys/net/ipv4/conf/<device>/rp_filter
          or
-          echo 0 > /proc/sys/net/ipv4/conf/all/rp_filter
+          echo 1 > /proc/sys/net/ipv4/conf/all/rp_filter
          If unsure, say N here.
@@ -577,6 +577,7 @@ config TCP_CONG_VENO
 config TCP_CONG_YEAH
        tristate "YeAH TCP"
        depends on EXPERIMENTAL
+        select TCP_CONG_VEGAS
        default n
        ---help---
        YeAH-TCP is a sender-side high-speed enabled TCP congestion control
diff --git a/net/ipv4/fib_hash.c b/net/ipv4/fib_hash.c
index 9cfecf1215c9..07e843a47dde 100644
--- a/net/ipv4/fib_hash.c
+++ b/net/ipv4/fib_hash.c
@@ -456,6 +456,8 @@ static int fn_hash_insert(struct fib_table *tb, struct fib_config *cfg)
                        fib_release_info(fi_drop);
                        if (state & FA_S_ACCESSED)
                                rt_cache_flush(-1);
+                        rtmsg_fib(RTM_NEWROUTE, key, fa, cfg->fc_dst_len, tb->tb_id,
+                                  &cfg->fc_nlinfo, NLM_F_REPLACE);
                        return 0;
                }
@@ -523,7 +525,7 @@ static int fn_hash_insert(struct fib_table *tb, struct fib_config *cfg)
        rt_cache_flush(-1);
        rtmsg_fib(RTM_NEWROUTE, key, new_fa, cfg->fc_dst_len, tb->tb_id,
-                  &cfg->fc_nlinfo);
+                  &cfg->fc_nlinfo, 0);
        return 0;
 out_free_new_fa:
@@ -589,7 +591,7 @@ static int fn_hash_delete(struct fib_table *tb, struct fib_config *cfg)
                fa = fa_to_delete;
                rtmsg_fib(RTM_DELROUTE, key, fa, cfg->fc_dst_len,
-                          tb->tb_id, &cfg->fc_nlinfo);
+                          tb->tb_id, &cfg->fc_nlinfo, 0);
                kill_fn = 0;
                write_lock_bh(&fib_hash_lock);
diff --git a/net/ipv4/fib_lookup.h b/net/ipv4/fib_lookup.h
index 0e8b70bad4e1..eef9eec17e0c 100644
--- a/net/ipv4/fib_lookup.h
+++ b/net/ipv4/fib_lookup.h
@@ -30,7 +30,8 @@ extern int fib_dump_info(struct sk_buff *skb, u32 pid, u32 seq, int event,
                         int dst_len, u8 tos, struct fib_info *fi,
                         unsigned int);
 extern void rtmsg_fib(int event, __be32 key, struct fib_alias *fa,
-                      int dst_len, u32 tb_id, struct nl_info *info);
+                      int dst_len, u32 tb_id, struct nl_info *info,
+                      unsigned int nlm_flags);
 extern struct fib_alias *fib_find_alias(struct list_head *fah,
                                        u8 tos, u32 prio);
 extern int fib_detect_death(struct fib_info *fi, int order,
diff --git a/net/ipv4/fib_semantics.c b/net/ipv4/fib_semantics.c
index 406ea7050aed..bb94550d95c3 100644
--- a/net/ipv4/fib_semantics.c
+++ b/net/ipv4/fib_semantics.c
@@ -301,7 +301,8 @@ static inline size_t fib_nlmsg_size(struct fib_info *fi)
 }
 void rtmsg_fib(int event, __be32 key, struct fib_alias *fa,
-               int dst_len, u32 tb_id, struct nl_info *info)
+               int dst_len, u32 tb_id, struct nl_info *info,
+               unsigned int nlm_flags)
 {
        struct sk_buff *skb;
        u32 seq = info->nlh ? info->nlh->nlmsg_seq : 0;
@@ -313,7 +314,7 @@ void rtmsg_fib(int event, __be32 key, struct fib_alias *fa,
        err = fib_dump_info(skb, info->pid, seq, event, tb_id,
                            fa->fa_type, fa->fa_scope, key, dst_len,
-                            fa->fa_tos, fa->fa_info, 0);
+                            fa->fa_tos, fa->fa_info, nlm_flags);
        if (err < 0) {
                /* -EMSGSIZE implies BUG in fib_nlmsg_size() */
                WARN_ON(err == -EMSGSIZE);
diff --git a/net/ipv4/fib_trie.c b/net/ipv4/fib_trie.c
index 9be7da7c3a8f..30e332ade61b 100644
--- a/net/ipv4/fib_trie.c
+++ b/net/ipv4/fib_trie.c
@@ -1226,6 +1226,8 @@ static int fn_trie_insert(struct fib_table *tb, struct fib_config *cfg)
                        fib_release_info(fi_drop);
                        if (state & FA_S_ACCESSED)
                                rt_cache_flush(-1);
+                        rtmsg_fib(RTM_NEWROUTE, htonl(key), new_fa, plen,
+                                tb->tb_id, &cfg->fc_nlinfo, NLM_F_REPLACE);
                        goto succeeded;
                }
@@ -1278,7 +1280,7 @@ static int fn_trie_insert(struct fib_table *tb, struct fib_config *cfg)
        rt_cache_flush(-1);
        rtmsg_fib(RTM_NEWROUTE, htonl(key), new_fa, plen, tb->tb_id,
-                  &cfg->fc_nlinfo);
+                  &cfg->fc_nlinfo, 0);
 succeeded:
        return 0;
@@ -1624,7 +1626,7 @@ static int fn_trie_delete(struct fib_table *tb, struct fib_config *cfg)
        fa = fa_to_delete;
        rtmsg_fib(RTM_DELROUTE, htonl(key), fa, plen, tb->tb_id,
-                  &cfg->fc_nlinfo);
+                  &cfg->fc_nlinfo, 0);
        l = fib_find_node(t, key);
        li = find_leaf_info(l, plen);
diff --git a/net/ipv4/icmp.c b/net/ipv4/icmp.c
index d38cbba92a4d..e238b17f554c 100644
--- a/net/ipv4/icmp.c
+++ b/net/ipv4/icmp.c
@@ -514,7 +514,10 @@ void icmp_send(struct sk_buff *skb_in, int type, int code, __be32 info)
        saddr = iph->daddr;
        if (!(rt->rt_flags & RTCF_LOCAL)) {
-                if (sysctl_icmp_errors_use_inbound_ifaddr)
+                /* This is broken, skb_in->dev points to the outgoing device
+                 * after the packet passes through ip_output().
+                 */
+                if (skb_in->dev && sysctl_icmp_errors_use_inbound_ifaddr)
                        saddr = inet_select_addr(skb_in->dev, 0, RT_SCOPE_LINK);
                else
                        saddr = 0;
diff --git a/net/ipv4/ipvs/Kconfig b/net/ipv4/ipvs/Kconfig
index 891b9355cf96..09d0c3f35669 100644
--- a/net/ipv4/ipvs/Kconfig
+++ b/net/ipv4/ipvs/Kconfig
@@ -1,10 +1,7 @@
 #
 # IP Virtual Server configuration
 #
-menu    "IP: Virtual Server Configuration"
+menuconfig IP_VS
-        depends on NETFILTER
-config  IP_VS
        tristate "IP virtual server support (EXPERIMENTAL)"
        depends on NETFILTER
        ---help---
@@ -25,9 +22,10 @@ config	IP_VS
          If you want to compile it in kernel, say Y. To compile it as a
          module, choose M here. If unsure, say N.
+if IP_VS
 config  IP_VS_DEBUG
        bool "IP virtual server debugging"
-        depends on IP_VS
        ---help---
          Say Y here if you want to get additional messages useful in
          debugging the IP virtual server code. You can change the debug
@@ -35,7 +33,6 @@ config	IP_VS_DEBUG
 config  IP_VS_TAB_BITS
        int "IPVS connection table size (the Nth power of 2)"
-        depends on IP_VS 
        default "12" 
        ---help---
          The IPVS connection hash table uses the chaining scheme to handle
@@ -61,42 +58,35 @@ config	IP_VS_TAB_BITS
          needed for your box.
 comment "IPVS transport protocol load balancing support"
-        depends on IP_VS
 config  IP_VS_PROTO_TCP
        bool "TCP load balancing support"
-        depends on IP_VS
        ---help---
          This option enables support for load balancing TCP transport
          protocol. Say Y if unsure.
 config  IP_VS_PROTO_UDP
        bool "UDP load balancing support"
-        depends on IP_VS
        ---help---
          This option enables support for load balancing UDP transport
          protocol. Say Y if unsure.
 config  IP_VS_PROTO_ESP
        bool "ESP load balancing support"
-        depends on IP_VS
        ---help---
          This option enables support for load balancing ESP (Encapsulation
          Security Payload) transport protocol. Say Y if unsure.
 config  IP_VS_PROTO_AH
        bool "AH load balancing support"
-        depends on IP_VS
        ---help---
          This option enables support for load balancing AH (Authentication
          Header) transport protocol. Say Y if unsure.
 comment "IPVS scheduler"
-        depends on IP_VS
 config  IP_VS_RR
        tristate "round-robin scheduling"
-        depends on IP_VS
        ---help---
          The robin-robin scheduling algorithm simply directs network
          connections to different real servers in a round-robin manner.
@@ -106,7 +96,6 @@ config	IP_VS_RR
 
 config  IP_VS_WRR
        tristate "weighted round-robin scheduling" 
-        depends on IP_VS
        ---help---
          The weighted robin-robin scheduling algorithm directs network
          connections to different real servers based on server weights
@@ -120,7 +109,6 @@ config	IP_VS_WRR
 config  IP_VS_LC
        tristate "least-connection scheduling"
-        depends on IP_VS
        ---help---
          The least-connection scheduling algorithm directs network
          connections to the server with the least number of active 
@@ -131,7 +119,6 @@ config	IP_VS_LC
 config  IP_VS_WLC
        tristate "weighted least-connection scheduling"
-        depends on IP_VS
        ---help---
          The weighted least-connection scheduling algorithm directs network
          connections to the server with the least active connections
@@ -142,7 +129,6 @@ config	IP_VS_WLC
 config  IP_VS_LBLC
        tristate "locality-based least-connection scheduling"
-        depends on IP_VS
        ---help---
          The locality-based least-connection scheduling algorithm is for
          destination IP load balancing. It is usually used in cache cluster.
@@ -157,7 +143,6 @@ config	IP_VS_LBLC
 config  IP_VS_LBLCR
        tristate "locality-based least-connection with replication scheduling"
-        depends on IP_VS
        ---help---
          The locality-based least-connection with replication scheduling
          algorithm is also for destination IP load balancing. It is 
@@ -176,7 +161,6 @@ config  IP_VS_LBLCR
 config  IP_VS_DH
        tristate "destination hashing scheduling"
-        depends on IP_VS
        ---help---
          The destination hashing scheduling algorithm assigns network
          connections to the servers through looking up a statically assigned
@@ -187,7 +171,6 @@ config	IP_VS_DH
 config  IP_VS_SH
        tristate "source hashing scheduling"
-        depends on IP_VS
        ---help---
          The source hashing scheduling algorithm assigns network
          connections to the servers through looking up a statically assigned
@@ -198,7 +181,6 @@ config	IP_VS_SH
 config  IP_VS_SED
        tristate "shortest expected delay scheduling"
-        depends on IP_VS
        ---help---
          The shortest expected delay scheduling algorithm assigns network
          connections to the server with the shortest expected delay. The 
@@ -212,7 +194,6 @@ config	IP_VS_SED
 config  IP_VS_NQ
        tristate "never queue scheduling"
-        depends on IP_VS
        ---help---
          The never queue scheduling algorithm adopts a two-speed model.
          When there is an idle server available, the job will be sent to
@@ -225,11 +206,10 @@ config	IP_VS_NQ
          module, choose M here. If unsure, say N.
 comment 'IPVS application helper'
-        depends on IP_VS
 config  IP_VS_FTP
        tristate "FTP protocol helper"
-        depends on IP_VS && IP_VS_PROTO_TCP
+        depends on IP_VS_PROTO_TCP
        ---help---
          FTP is a protocol that transfers IP address and/or port number in
          the payload. In the virtual server via Network Address Translation,
@@ -241,4 +221,4 @@ config	IP_VS_FTP
          If you want to compile it in kernel, say Y. To compile it as a
          module, choose M here. If unsure, say N.
-endmenu
+endif # IP_VS
diff --git a/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c b/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c
index 0654eaae70c9..fd62a41d69cc 100644
--- a/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c
+++ b/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c
@@ -154,12 +154,10 @@ static unsigned int ipv4_conntrack_defrag(unsigned int hooknum,
                                          const struct net_device *out,
                                          int (*okfn)(struct sk_buff *))
 {
-#if !defined(CONFIG_IP_NF_NAT) && !defined(CONFIG_IP_NF_NAT_MODULE)
        /* Previously seen (loopback)?  Ignore.  Do this before
           fragment check. */
        if ((*pskb)->nfct)
                return NF_ACCEPT;
-#endif
        /* Gather fragments. */
        if (ip_hdr(*pskb)->frag_off & htons(IP_MF | IP_OFFSET)) {
diff --git a/net/ipv4/netfilter/nf_nat_ftp.c b/net/ipv4/netfilter/nf_nat_ftp.c
index 751b59801755..e6bc8e5a72f1 100644
--- a/net/ipv4/netfilter/nf_nat_ftp.c
+++ b/net/ipv4/netfilter/nf_nat_ftp.c
@@ -40,8 +40,7 @@ mangle_rfc959_packet(struct sk_buff **pskb,
                     unsigned int matchoff,
                     unsigned int matchlen,
                     struct nf_conn *ct,
-                     enum ip_conntrack_info ctinfo,
+                     enum ip_conntrack_info ctinfo)
-                     u32 *seq)
 {
        char buffer[sizeof("nnn,nnn,nnn,nnn,nnn,nnn")];
@@ -50,7 +49,6 @@ mangle_rfc959_packet(struct sk_buff **pskb,
        DEBUGP("calling nf_nat_mangle_tcp_packet\n");
-        *seq += strlen(buffer) - matchlen;
        return nf_nat_mangle_tcp_packet(pskb, ct, ctinfo, matchoff,
                                        matchlen, buffer, strlen(buffer));
 }
@@ -63,8 +61,7 @@ mangle_eprt_packet(struct sk_buff **pskb,
                   unsigned int matchoff,
                   unsigned int matchlen,
                   struct nf_conn *ct,
-                   enum ip_conntrack_info ctinfo,
+                   enum ip_conntrack_info ctinfo)
-                   u32 *seq)
 {
        char buffer[sizeof("|1|255.255.255.255|65535|")];
@@ -72,7 +69,6 @@ mangle_eprt_packet(struct sk_buff **pskb,
        DEBUGP("calling nf_nat_mangle_tcp_packet\n");
-        *seq += strlen(buffer) - matchlen;
        return nf_nat_mangle_tcp_packet(pskb, ct, ctinfo, matchoff,
                                        matchlen, buffer, strlen(buffer));
 }
@@ -85,8 +81,7 @@ mangle_epsv_packet(struct sk_buff **pskb,
                   unsigned int matchoff,
                   unsigned int matchlen,
                   struct nf_conn *ct,
-                   enum ip_conntrack_info ctinfo,
+                   enum ip_conntrack_info ctinfo)
-                   u32 *seq)
 {
        char buffer[sizeof("|||65535|")];
@@ -94,14 +89,13 @@ mangle_epsv_packet(struct sk_buff **pskb,
        DEBUGP("calling nf_nat_mangle_tcp_packet\n");
-        *seq += strlen(buffer) - matchlen;
        return nf_nat_mangle_tcp_packet(pskb, ct, ctinfo, matchoff,
                                        matchlen, buffer, strlen(buffer));
 }
 static int (*mangle[])(struct sk_buff **, __be32, u_int16_t,
                       unsigned int, unsigned int, struct nf_conn *,
-                       enum ip_conntrack_info, u32 *seq)
+                       enum ip_conntrack_info)
 = {
        [NF_CT_FTP_PORT] = mangle_rfc959_packet,
        [NF_CT_FTP_PASV] = mangle_rfc959_packet,
@@ -116,8 +110,7 @@ static unsigned int nf_nat_ftp(struct sk_buff **pskb,
                               enum nf_ct_ftp_type type,
                               unsigned int matchoff,
                               unsigned int matchlen,
-                               struct nf_conntrack_expect *exp,
+                               struct nf_conntrack_expect *exp)
-                               u32 *seq)
 {
        __be32 newip;
        u_int16_t port;
@@ -145,8 +138,7 @@ static unsigned int nf_nat_ftp(struct sk_buff **pskb,
        if (port == 0)
                return NF_DROP;
-        if (!mangle[type](pskb, newip, port, matchoff, matchlen, ct, ctinfo,
+        if (!mangle[type](pskb, newip, port, matchoff, matchlen, ct, ctinfo)) {
-                          seq)) {
                nf_conntrack_unexpect_related(exp);
                return NF_DROP;
        }
diff --git a/net/ipv4/netfilter/nf_nat_h323.c b/net/ipv4/netfilter/nf_nat_h323.c
index fcebc968d37f..c5d2a2d690b8 100644
--- a/net/ipv4/netfilter/nf_nat_h323.c
+++ b/net/ipv4/netfilter/nf_nat_h323.c
@@ -455,9 +455,9 @@ static int nat_q931(struct sk_buff **pskb, struct nf_conn *ct,
                if (idx > 0 &&
                    get_h225_addr(ct, *data, &taddr[0], &addr, &port) &&
                    (ntohl(addr.ip) & 0xff000000) == 0x7f000000) {
-                        set_h225_addr_hook(pskb, data, 0, &taddr[0],
+                        set_h225_addr(pskb, data, 0, &taddr[0],
-                                           &ct->tuplehash[!dir].tuple.dst.u3,
+                                      &ct->tuplehash[!dir].tuple.dst.u3,
-                                           info->sig_port[!dir]);
+                                      info->sig_port[!dir]);
                }
        } else {
                nf_conntrack_unexpect_related(exp);
diff --git a/net/ipv4/route.c b/net/ipv4/route.c
index cb76e3c725a0..8603cfb271f2 100644
--- a/net/ipv4/route.c
+++ b/net/ipv4/route.c
@@ -2396,7 +2396,7 @@ static int ip_route_output_slow(struct rtable **rp, const struct flowi *oldflp)
                /* It is equivalent to inet_addr_type(saddr) == RTN_LOCAL */
                dev_out = ip_dev_find(oldflp->fl4_src);
-                if ((dev_out == NULL) && !(sysctl_ip_nonlocal_bind))
+                if (dev_out == NULL)
                        goto out;
                /* I removed check for oif == dev_out->oif here.
@@ -2407,7 +2407,7 @@ static int ip_route_output_slow(struct rtable **rp, const struct flowi *oldflp)
                      of another iface. --ANK
                 */
-                if (dev_out && oldflp->oif == 0
+                if (oldflp->oif == 0
                    && (MULTICAST(oldflp->fl4_dst) || oldflp->fl4_dst == htonl(0xFFFFFFFF))) {
                        /* Special hack: user can direct multicasts
                           and limited broadcast via necessary interface
@@ -2598,6 +2598,69 @@ int __ip_route_output_key(struct rtable **rp, const struct flowi *flp)
 EXPORT_SYMBOL_GPL(__ip_route_output_key);
+static void ipv4_rt_blackhole_update_pmtu(struct dst_entry *dst, u32 mtu)
+{
+}
+static struct dst_ops ipv4_dst_blackhole_ops = {
+        .family                 =       AF_INET,
+        .protocol               =       __constant_htons(ETH_P_IP),
+        .destroy                =       ipv4_dst_destroy,
+        .check                  =       ipv4_dst_check,
+        .update_pmtu            =       ipv4_rt_blackhole_update_pmtu,
+        .entry_size             =       sizeof(struct rtable),
+};
+static int ipv4_blackhole_output(struct sk_buff *skb)
+{
+        kfree_skb(skb);
+        return 0;
+}
+static int ipv4_dst_blackhole(struct rtable **rp, struct flowi *flp, struct sock *sk)
+{
+        struct rtable *ort = *rp;
+        struct rtable *rt = (struct rtable *)
+                dst_alloc(&ipv4_dst_blackhole_ops);
+        if (rt) {
+                struct dst_entry *new = &rt->u.dst;
+                atomic_set(&new->__refcnt, 1);
+                new->__use = 1;
+                new->input = ipv4_blackhole_output;
+                new->output = ipv4_blackhole_output;
+                memcpy(new->metrics, ort->u.dst.metrics, RTAX_MAX*sizeof(u32));
+                new->dev = ort->u.dst.dev;
+                if (new->dev)
+                        dev_hold(new->dev);
+                rt->fl = ort->fl;
+                rt->idev = ort->idev;
+                if (rt->idev)
+                        in_dev_hold(rt->idev);
+                rt->rt_flags = ort->rt_flags;
+                rt->rt_type = ort->rt_type;
+                rt->rt_dst = ort->rt_dst;
+                rt->rt_src = ort->rt_src;
+                rt->rt_iif = ort->rt_iif;
+                rt->rt_gateway = ort->rt_gateway;
+                rt->rt_spec_dst = ort->rt_spec_dst;
+                rt->peer = ort->peer;
+                if (rt->peer)
+                        atomic_inc(&rt->peer->refcnt);
+                dst_free(new);
+        }
+        dst_release(&(*rp)->u.dst);
+        *rp = rt;
+        return (rt ? 0 : -ENOMEM);
+}
 int ip_route_output_flow(struct rtable **rp, struct flowi *flp, struct sock *sk, int flags)
 {
        int err;
@@ -2610,7 +2673,11 @@ int ip_route_output_flow(struct rtable **rp, struct flowi *flp, struct sock *sk,
                        flp->fl4_src = (*rp)->rt_src;
                if (!flp->fl4_dst)
                        flp->fl4_dst = (*rp)->rt_dst;
-                return xfrm_lookup((struct dst_entry **)rp, flp, sk, flags);
+                err = __xfrm_lookup((struct dst_entry **)rp, flp, sk, flags);
+                if (err == -EREMOTE)
+                        err = ipv4_dst_blackhole(rp, flp, sk);
+                return err;
        }
        return 0;
@@ -3139,6 +3206,8 @@ int __init ip_rt_init(void)
                kmem_cache_create("ip_dst_cache", sizeof(struct rtable), 0,
                                  SLAB_HWCACHE_ALIGN|SLAB_PANIC, NULL, NULL);
+        ipv4_dst_blackhole_ops.kmem_cachep = ipv4_dst_ops.kmem_cachep;
        rt_hash_table = (struct rt_hash_bucket *)
                alloc_large_system_hash("IP route cache",
                                        sizeof(struct rt_hash_bucket),
diff --git a/net/ipv4/tcp_cong.c b/net/ipv4/tcp_cong.c
index 86b26539e54b..1260e52ad772 100644
--- a/net/ipv4/tcp_cong.c
+++ b/net/ipv4/tcp_cong.c
@@ -276,30 +276,34 @@ int tcp_set_congestion_control(struct sock *sk, const char *name)
 /*
- * Slow start (exponential increase) with
+ * Slow start is used when congestion window is less than slow start
- * RFC3742 Limited Slow Start (fast linear increase) support.
+ * threshold. This version implements the basic RFC2581 version
+ * and optionally supports:
+ *      RFC3742 Limited Slow Start        - growth limited to max_ssthresh
+ *      RFC3465 Appropriate Byte Counting - growth limited by bytes acknowledged
 */
 void tcp_slow_start(struct tcp_sock *tp)
 {
-        int cnt = 0;
+        int cnt; /* increase in packets */
-        if (sysctl_tcp_abc) {
+        /* RFC3465: ABC Slow start
-                /* RFC3465: Slow Start
+         * Increase only after a full MSS of bytes is acked
-                 * TCP sender SHOULD increase cwnd by the number of
+         *
-                 * previously unacknowledged bytes ACKed by each incoming
+         * TCP sender SHOULD increase cwnd by the number of
-                 * acknowledgment, provided the increase is not more than L
+         * previously unacknowledged bytes ACKed by each incoming
-                 */
+         * acknowledgment, provided the increase is not more than L
-                if (tp->bytes_acked < tp->mss_cache)
+         */
-                        return;
+        if (sysctl_tcp_abc && tp->bytes_acked < tp->mss_cache)
-        }
+                return;
-        if (sysctl_tcp_max_ssthresh > 0 &&
+        if (sysctl_tcp_max_ssthresh > 0 && tp->snd_cwnd > sysctl_tcp_max_ssthresh)
-            tp->snd_cwnd > sysctl_tcp_max_ssthresh)
+                cnt = sysctl_tcp_max_ssthresh >> 1;     /* limited slow start */
-                cnt += sysctl_tcp_max_ssthresh>>1;
        else
-                cnt += tp->snd_cwnd;
+                cnt = tp->snd_cwnd;                     /* exponential increase */
-        /* RFC3465: We MAY increase by 2 if discovered delayed ack */
+        /* RFC3465: ABC
+         * We MAY increase by 2 if discovered delayed ack
+         */
        if (sysctl_tcp_abc > 1 && tp->bytes_acked >= 2*tp->mss_cache)
                cnt <<= 1;
        tp->bytes_acked = 0;
diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
index 7641b2761a14..38cb25b48bf3 100644
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -1501,6 +1501,8 @@ void tcp_enter_loss(struct sock *sk, int how)
        tcp_set_ca_state(sk, TCP_CA_Loss);
        tp->high_seq = tp->snd_nxt;
        TCP_ECN_queue_cwr(tp);
+        /* Abort FRTO algorithm if one is in progress */
+        tp->frto_counter = 0;
        clear_all_retrans_hints(tp);
 }
@@ -2608,6 +2610,7 @@ static void tcp_conservative_spur_to_response(struct tcp_sock *tp)
 {
        tp->snd_cwnd = min(tp->snd_cwnd, tp->snd_ssthresh);
        tp->snd_cwnd_cnt = 0;
+        TCP_ECN_queue_cwr(tp);
        tcp_moderate_cwnd(tp);
 }
diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index c7ea248fae2e..329de679ac38 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -2154,15 +2154,6 @@ static void addrconf_dev_config(struct net_device *dev)
        ASSERT_RTNL();
-        if ((dev->type != ARPHRD_ETHER) &&
-            (dev->type != ARPHRD_FDDI) &&
-            (dev->type != ARPHRD_IEEE802_TR) &&
-            (dev->type != ARPHRD_ARCNET) &&
-            (dev->type != ARPHRD_INFINIBAND)) {
-                /* Alas, we support only Ethernet autoconfiguration. */
-                return;
-        }
        idev = addrconf_add_dev(dev);
        if (idev == NULL)
                return;
@@ -2250,13 +2241,33 @@ static void addrconf_ip6_tnl_config(struct net_device *dev)
        ip6_tnl_add_linklocal(idev);
 }
+static int ipv6_hwtype(struct net_device *dev)
+{
+        if ((dev->type == ARPHRD_ETHER) ||
+            (dev->type == ARPHRD_LOOPBACK) ||
+            (dev->type == ARPHRD_SIT) ||
+            (dev->type == ARPHRD_TUNNEL6) ||
+            (dev->type == ARPHRD_FDDI) ||
+            (dev->type == ARPHRD_IEEE802_TR) ||
+            (dev->type == ARPHRD_ARCNET) ||
+            (dev->type == ARPHRD_INFINIBAND))
+                return 1;
+        return 0;
+}
 static int addrconf_notify(struct notifier_block *this, unsigned long event,
                           void * data)
 {
        struct net_device *dev = (struct net_device *) data;
-        struct inet6_dev *idev = __in6_dev_get(dev);
+        struct inet6_dev *idev;
        int run_pending = 0;
+        if (!ipv6_hwtype(dev))
+                return NOTIFY_OK;
+        idev = __in6_dev_get(dev);
        switch(event) {
        case NETDEV_REGISTER:
                if (!idev) {
diff --git a/net/ipv6/datagram.c b/net/ipv6/datagram.c
index 403eee66b9c5..b1fe7ac5dc90 100644
--- a/net/ipv6/datagram.c
+++ b/net/ipv6/datagram.c
@@ -177,8 +177,12 @@ ipv4_connected:
        if (final_p)
                ipv6_addr_copy(&fl.fl6_dst, final_p);
-        if ((err = xfrm_lookup(&dst, &fl, sk, 1)) < 0)
+        if ((err = __xfrm_lookup(&dst, &fl, sk, 1)) < 0) {
-                goto out;
+                if (err == -EREMOTE)
+                        err = ip6_dst_blackhole(sk, &dst, &fl);
+                if (err < 0)
+                        goto out;
+        }
        /* source address lookup done in ip6_dst_lookup */
diff --git a/net/ipv6/raw.c b/net/ipv6/raw.c
index 009a1047fc3f..a58459a76684 100644
--- a/net/ipv6/raw.c
+++ b/net/ipv6/raw.c
@@ -818,8 +818,12 @@ static int rawv6_sendmsg(struct kiocb *iocb, struct sock *sk,
        if (final_p)
                ipv6_addr_copy(&fl.fl6_dst, final_p);
-        if ((err = xfrm_lookup(&dst, &fl, sk, 1)) < 0)
+        if ((err = __xfrm_lookup(&dst, &fl, sk, 1)) < 0) {
-                goto out;
+                if (err == -EREMOTE)
+                        err = ip6_dst_blackhole(sk, &dst, &fl);
+                if (err < 0)
+                        goto out;
+        }
        if (hlimit < 0) {
                if (ipv6_addr_is_multicast(&fl.fl6_dst))
diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index b46ad53044ba..1324b06796c0 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -119,6 +119,19 @@ static struct dst_ops ip6_dst_ops = {
        .entry_size             =       sizeof(struct rt6_info),
 };
+static void ip6_rt_blackhole_update_pmtu(struct dst_entry *dst, u32 mtu)
+{
+}
+static struct dst_ops ip6_dst_blackhole_ops = {
+        .family                 =       AF_INET6,
+        .protocol               =       __constant_htons(ETH_P_IPV6),
+        .destroy                =       ip6_dst_destroy,
+        .check                  =       ip6_dst_check,
+        .update_pmtu            =       ip6_rt_blackhole_update_pmtu,
+        .entry_size             =       sizeof(struct rt6_info),
+};
 struct rt6_info ip6_null_entry = {
        .u = {
                .dst = {
@@ -833,6 +846,54 @@ struct dst_entry * ip6_route_output(struct sock *sk, struct flowi *fl)
 EXPORT_SYMBOL(ip6_route_output);
+static int ip6_blackhole_output(struct sk_buff *skb)
+{
+        kfree_skb(skb);
+        return 0;
+}
+int ip6_dst_blackhole(struct sock *sk, struct dst_entry **dstp, struct flowi *fl)
+{
+        struct rt6_info *ort = (struct rt6_info *) *dstp;
+        struct rt6_info *rt = (struct rt6_info *)
+                dst_alloc(&ip6_dst_blackhole_ops);
+        struct dst_entry *new = NULL;
+        if (rt) {
+                new = &rt->u.dst;
+                atomic_set(&new->__refcnt, 1);
+                new->__use = 1;
+                new->input = ip6_blackhole_output;
+                new->output = ip6_blackhole_output;
+                memcpy(new->metrics, ort->u.dst.metrics, RTAX_MAX*sizeof(u32));
+                new->dev = ort->u.dst.dev;
+                if (new->dev)
+                        dev_hold(new->dev);
+                rt->rt6i_idev = ort->rt6i_idev;
+                if (rt->rt6i_idev)
+                        in6_dev_hold(rt->rt6i_idev);
+                rt->rt6i_expires = 0;
+                ipv6_addr_copy(&rt->rt6i_gateway, &ort->rt6i_gateway);
+                rt->rt6i_flags = ort->rt6i_flags & ~RTF_EXPIRES;
+                rt->rt6i_metric = 0;
+                memcpy(&rt->rt6i_dst, &ort->rt6i_dst, sizeof(struct rt6key));
+#ifdef CONFIG_IPV6_SUBTREES
+                memcpy(&rt->rt6i_src, &ort->rt6i_src, sizeof(struct rt6key));
+#endif
+                dst_free(new);
+        }
+        dst_release(*dstp);
+        *dstp = new;
+        return (new ? 0 : -ENOMEM);
+}
+EXPORT_SYMBOL_GPL(ip6_dst_blackhole);
 /*
 *      Destination cache support functions
 */
@@ -2495,6 +2556,8 @@ void __init ip6_route_init(void)
        ip6_dst_ops.kmem_cachep =
                kmem_cache_create("ip6_dst_cache", sizeof(struct rt6_info), 0,
                                  SLAB_HWCACHE_ALIGN|SLAB_PANIC, NULL, NULL);
+        ip6_dst_blackhole_ops.kmem_cachep = ip6_dst_ops.kmem_cachep;
        fib6_init();
 #ifdef  CONFIG_PROC_FS
        p = proc_net_create("ipv6_route", 0, rt6_proc_info);
diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
index e2f25ea43b68..4f06a51ad4fd 100644
--- a/net/ipv6/tcp_ipv6.c
+++ b/net/ipv6/tcp_ipv6.c
@@ -265,8 +265,12 @@ static int tcp_v6_connect(struct sock *sk, struct sockaddr *uaddr,
        if (final_p)
                ipv6_addr_copy(&fl.fl6_dst, final_p);
-        if ((err = xfrm_lookup(&dst, &fl, sk, 1)) < 0)
+        if ((err = __xfrm_lookup(&dst, &fl, sk, 1)) < 0) {
-                goto failure;
+                if (err == -EREMOTE)
+                        err = ip6_dst_blackhole(sk, &dst, &fl);
+                if (err < 0)
+                        goto failure;
+        }
        if (saddr == NULL) {
                saddr = &fl.fl6_src;
diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c
index a7ae59c954d5..d1fbddd172e7 100644
--- a/net/ipv6/udp.c
+++ b/net/ipv6/udp.c
@@ -767,8 +767,12 @@ do_udp_sendmsg:
        if (final_p)
                ipv6_addr_copy(&fl.fl6_dst, final_p);
-        if ((err = xfrm_lookup(&dst, &fl, sk, 1)) < 0)
+        if ((err = __xfrm_lookup(&dst, &fl, sk, 1)) < 0) {
-                goto out;
+                if (err == -EREMOTE)
+                        err = ip6_dst_blackhole(sk, &dst, &fl);
+                if (err < 0)
+                        goto out;
+        }
        if (hlimit < 0) {
                if (ipv6_addr_is_multicast(&fl.fl6_dst))
diff --git a/net/ipx/af_ipx.c b/net/ipx/af_ipx.c
index 15419dd682fd..8400525177ab 100644
--- a/net/ipx/af_ipx.c
+++ b/net/ipx/af_ipx.c
@@ -87,7 +87,7 @@ extern int ipxrtr_add_route(__be32 network, struct ipx_interface *intrfc,
                            unsigned char *node);
 extern void ipxrtr_del_routes(struct ipx_interface *intrfc);
 extern int ipxrtr_route_packet(struct sock *sk, struct sockaddr_ipx *usipx,
-                               struct iovec *iov, int len, int noblock);
+                               struct iovec *iov, size_t len, int noblock);
 extern int ipxrtr_route_skb(struct sk_buff *skb);
 extern struct ipx_route *ipxrtr_lookup(__be32 net);
 extern int ipxrtr_ioctl(unsigned int cmd, void __user *arg);
diff --git a/net/key/af_key.c b/net/key/af_key.c
index a99444142dc7..d302ddae580c 100644
--- a/net/key/af_key.c
+++ b/net/key/af_key.c
@@ -1448,8 +1448,6 @@ static int pfkey_add(struct sock *sk, struct sk_buff *skb, struct sadb_msg *hdr,
        int err;
        struct km_event c;
-        xfrm_probe_algs();
        x = pfkey_msg2xfrm_state(hdr, ext_hdrs);
        if (IS_ERR(x))
                return PTR_ERR(x);
diff --git a/net/netfilter/nf_conntrack_core.c b/net/netfilter/nf_conntrack_core.c
index e8b5c2d7db62..483e927a9ca4 100644
--- a/net/netfilter/nf_conntrack_core.c
+++ b/net/netfilter/nf_conntrack_core.c
@@ -298,7 +298,6 @@ static void
 destroy_conntrack(struct nf_conntrack *nfct)
 {
        struct nf_conn *ct = (struct nf_conn *)nfct;
-        struct nf_conn_help *help = nfct_help(ct);
        struct nf_conntrack_l4proto *l4proto;
        typeof(nf_conntrack_destroyed) destroyed;
@@ -309,9 +308,6 @@ destroy_conntrack(struct nf_conntrack *nfct)
        nf_conntrack_event(IPCT_DESTROY, ct);
        set_bit(IPS_DYING_BIT, &ct->status);
-        if (help && help->helper && help->helper->destroy)
-                help->helper->destroy(ct);
        /* To make sure we don't get any weird locking issues here:
         * destroy_conntrack() MUST NOT be called with a write lock
         * to nf_conntrack_lock!!! -HW */
@@ -353,6 +349,10 @@ destroy_conntrack(struct nf_conntrack *nfct)
 static void death_by_timeout(unsigned long ul_conntrack)
 {
        struct nf_conn *ct = (void *)ul_conntrack;
+        struct nf_conn_help *help = nfct_help(ct);
+        if (help && help->helper && help->helper->destroy)
+                help->helper->destroy(ct);
        write_lock_bh(&nf_conntrack_lock);
        /* Inside lock so preempt is disabled on module removal path.
diff --git a/net/netfilter/nf_conntrack_ftp.c b/net/netfilter/nf_conntrack_ftp.c
index a186799f6542..82db2aa53bfc 100644
--- a/net/netfilter/nf_conntrack_ftp.c
+++ b/net/netfilter/nf_conntrack_ftp.c
@@ -48,8 +48,7 @@ unsigned int (*nf_nat_ftp_hook)(struct sk_buff **pskb,
                                enum nf_ct_ftp_type type,
                                unsigned int matchoff,
                                unsigned int matchlen,
-                                struct nf_conntrack_expect *exp,
+                                struct nf_conntrack_expect *exp);
-                                u32 *seq);
 EXPORT_SYMBOL_GPL(nf_nat_ftp_hook);
 #if 0
@@ -335,15 +334,17 @@ static void update_nl_seq(u32 nl_seq, struct nf_ct_ftp_master *info, int dir,
                if (info->seq_aft_nl[dir][i] == nl_seq)
                        return;
-                if (oldest == info->seq_aft_nl_num[dir]
+                if (oldest == info->seq_aft_nl_num[dir] ||
-                    || before(info->seq_aft_nl[dir][i], oldest))
+                    before(info->seq_aft_nl[dir][i],
+                           info->seq_aft_nl[dir][oldest]))
                        oldest = i;
        }
        if (info->seq_aft_nl_num[dir] < NUM_SEQ_TO_REMEMBER) {
                info->seq_aft_nl[dir][info->seq_aft_nl_num[dir]++] = nl_seq;
                nf_conntrack_event_cache(IPCT_HELPINFO_VOLATILE, skb);
-        } else if (oldest != NUM_SEQ_TO_REMEMBER) {
+        } else if (oldest != NUM_SEQ_TO_REMEMBER &&
+                   after(nl_seq, info->seq_aft_nl[dir][oldest])) {
                info->seq_aft_nl[dir][oldest] = nl_seq;
                nf_conntrack_event_cache(IPCT_HELPINFO_VOLATILE, skb);
        }
@@ -519,7 +520,7 @@ static int help(struct sk_buff **pskb,
        nf_nat_ftp = rcu_dereference(nf_nat_ftp_hook);
        if (nf_nat_ftp && ct->status & IPS_NAT_MASK)
                ret = nf_nat_ftp(pskb, ctinfo, search[dir][i].ftptype,
-                                 matchoff, matchlen, exp, &seq);
+                                 matchoff, matchlen, exp);
        else {
                /* Can't expect this?  Best to drop packet now. */
                if (nf_conntrack_expect_related(exp) != 0)
diff --git a/net/netfilter/nf_conntrack_h323_main.c b/net/netfilter/nf_conntrack_h323_main.c
index b284db73ca7c..a1b95acad297 100644
--- a/net/netfilter/nf_conntrack_h323_main.c
+++ b/net/netfilter/nf_conntrack_h323_main.c
@@ -520,6 +520,16 @@ static int process_olca(struct sk_buff **pskb, struct nf_conn *ct,
                }
        }
+        if ((olca->options & eOpenLogicalChannelAck_separateStack) &&
+                olca->separateStack.networkAddress.choice ==
+                eNetworkAccessParameters_networkAddress_localAreaAddress) {
+                ret = expect_t120(pskb, ct, ctinfo, data, dataoff,
+                                  &olca->separateStack.networkAddress.
+                                  localAreaAddress);
+                if (ret < 0)
+                        return -1;
+        }
        return 0;
 }
@@ -640,7 +650,7 @@ int get_h225_addr(struct nf_conn *ct, unsigned char *data,
        case eTransportAddress_ip6Address:
                if (family != AF_INET6)
                        return 0;
-                p = data + taddr->ip6Address.ip6;
+                p = data + taddr->ip6Address.ip;
                len = 16;
                break;
        default:
@@ -977,30 +987,6 @@ static int process_alerting(struct sk_buff **pskb, struct nf_conn *ct,
 }
 /****************************************************************************/
-static int process_information(struct sk_buff **pskb,
-                               struct nf_conn *ct,
-                               enum ip_conntrack_info ctinfo,
-                               unsigned char **data, int dataoff,
-                               Information_UUIE *info)
-{
-        int ret;
-        int i;
-        DEBUGP("nf_ct_q931: Information\n");
-        if (info->options & eInformation_UUIE_fastStart) {
-                for (i = 0; i < info->fastStart.count; i++) {
-                        ret = process_olc(pskb, ct, ctinfo, data, dataoff,
-                                          &info->fastStart.item[i]);
-                        if (ret < 0)
-                                return -1;
-                }
-        }
-        return 0;
-}
-/****************************************************************************/
 static int process_facility(struct sk_buff **pskb, struct nf_conn *ct,
                            enum ip_conntrack_info ctinfo,
                            unsigned char **data, int dataoff,
@@ -1096,11 +1082,6 @@ static int process_q931(struct sk_buff **pskb, struct nf_conn *ct,
                ret = process_alerting(pskb, ct, ctinfo, data, dataoff,
                                       &pdu->h323_message_body.alerting);
                break;
-        case eH323_UU_PDU_h323_message_body_information:
-                ret = process_information(pskb, ct, ctinfo, data, dataoff,
-                                          &pdu->h323_message_body.
-                                          information);
-                break;
        case eH323_UU_PDU_h323_message_body_facility:
                ret = process_facility(pskb, ct, ctinfo, data, dataoff,
                                       &pdu->h323_message_body.facility);
diff --git a/net/netfilter/nf_conntrack_h323_types.c b/net/netfilter/nf_conntrack_h323_types.c
index 4c6f8b3b1208..3a21fdf1a265 100644
--- a/net/netfilter/nf_conntrack_h323_types.c
+++ b/net/netfilter/nf_conntrack_h323_types.c
@@ -1,4 +1,4 @@
-/* Generated by Jing Min Zhao's ASN.1 parser, Apr 20 2006
+/* Generated by Jing Min Zhao's ASN.1 parser, May 16 2007
 *
 * Copyright (c) 2006 Jing Min Zhao <zhaojingmin@users.sourceforge.net>
 *
@@ -37,7 +37,7 @@ static field_t _TransportAddress_ipxAddress[] = {	/* SEQUENCE */
 static field_t _TransportAddress_ip6Address[] = {       /* SEQUENCE */
        {FNAME("ip") OCTSTR, FIXD, 16, 0, DECODE,
-         offsetof(TransportAddress_ip6Address, ip6), NULL},
+         offsetof(TransportAddress_ip6Address, ip), NULL},
        {FNAME("port") INT, WORD, 0, 0, SKIP, 0, NULL},
 };
@@ -67,7 +67,8 @@ static field_t _TransportAddress[] = {	/* CHOICE */
        {FNAME("ipxAddress") SEQ, 0, 3, 3, SKIP, 0,
         _TransportAddress_ipxAddress},
        {FNAME("ip6Address") SEQ, 0, 2, 2, DECODE | EXT,
-        offsetof(TransportAddress, ip6Address), _TransportAddress_ip6Address},
+         offsetof(TransportAddress, ip6Address),
+         _TransportAddress_ip6Address},
        {FNAME("netBios") OCTSTR, FIXD, 16, 0, SKIP, 0, NULL},
        {FNAME("nsap") OCTSTR, 5, 1, 0, SKIP, 0, NULL},
        {FNAME("nonStandardAddress") SEQ, 0, 2, 2, SKIP, 0,
@@ -638,7 +639,8 @@ static field_t _UnicastAddress_iPXAddress[] = {	/* SEQUENCE */
 };
 static field_t _UnicastAddress_iP6Address[] = { /* SEQUENCE */
-        {FNAME("network") OCTSTR, FIXD, 16, 0, SKIP, 0, NULL},
+        {FNAME("network") OCTSTR, FIXD, 16, 0, DECODE,
+         offsetof(UnicastAddress_iP6Address, network), NULL},
        {FNAME("tsapIdentifier") INT, WORD, 0, 0, SKIP, 0, NULL},
 };
@@ -665,8 +667,8 @@ static field_t _UnicastAddress[] = {	/* CHOICE */
         offsetof(UnicastAddress, iPAddress), _UnicastAddress_iPAddress},
        {FNAME("iPXAddress") SEQ, 0, 3, 3, SKIP | EXT, 0,
         _UnicastAddress_iPXAddress},
-        {FNAME("iP6Address") SEQ, 0, 2, 2, SKIP | EXT, 0,
+        {FNAME("iP6Address") SEQ, 0, 2, 2, DECODE | EXT,
-         _UnicastAddress_iP6Address},
+         offsetof(UnicastAddress, iP6Address), _UnicastAddress_iP6Address},
        {FNAME("netBios") OCTSTR, FIXD, 16, 0, SKIP, 0, NULL},
        {FNAME("iPSourceRouteAddress") SEQ, 0, 4, 4, SKIP | EXT, 0,
         _UnicastAddress_iPSourceRouteAddress},
@@ -984,19 +986,12 @@ static field_t _Alerting_UUIE[] = {	/* SEQUENCE */
        {FNAME("featureSet") SEQ, 3, 4, 4, SKIP | EXT | OPT, 0, NULL},
 };
-static field_t _Information_UUIE_fastStart[] = {        /* SEQUENCE OF */
-        {FNAME("item") SEQ, 1, 3, 5, DECODE | OPEN | EXT,
-         sizeof(OpenLogicalChannel), _OpenLogicalChannel}
-        ,
-};
 static field_t _Information_UUIE[] = {  /* SEQUENCE */
        {FNAME("protocolIdentifier") OID, BYTE, 0, 0, SKIP, 0, NULL},
        {FNAME("callIdentifier") SEQ, 0, 1, 1, SKIP | EXT, 0, NULL},
        {FNAME("tokens") SEQOF, SEMI, 0, 0, SKIP | OPT, 0, NULL},
        {FNAME("cryptoTokens") SEQOF, SEMI, 0, 0, SKIP | OPT, 0, NULL},
-        {FNAME("fastStart") SEQOF, SEMI, 0, 30, DECODE | OPT,
+        {FNAME("fastStart") SEQOF, SEMI, 0, 30, SKIP | OPT, 0, NULL},
-         offsetof(Information_UUIE, fastStart), _Information_UUIE_fastStart},
        {FNAME("fastConnectRefused") NUL, FIXD, 0, 0, SKIP | OPT, 0, NULL},
        {FNAME("circuitInfo") SEQ, 3, 3, 3, SKIP | EXT | OPT, 0, NULL},
 };
@@ -1343,9 +1338,7 @@ static field_t _H323_UU_PDU_h323_message_body[] = {	/* CHOICE */
         offsetof(H323_UU_PDU_h323_message_body, connect), _Connect_UUIE},
        {FNAME("alerting") SEQ, 1, 3, 17, DECODE | EXT,
         offsetof(H323_UU_PDU_h323_message_body, alerting), _Alerting_UUIE},
-        {FNAME("information") SEQ, 0, 1, 7, DECODE | EXT,
+        {FNAME("information") SEQ, 0, 1, 7, SKIP | EXT, 0, _Information_UUIE},
-         offsetof(H323_UU_PDU_h323_message_body, information),
-         _Information_UUIE},
        {FNAME("releaseComplete") SEQ, 1, 2, 11, SKIP | EXT, 0,
         _ReleaseComplete_UUIE},
        {FNAME("facility") SEQ, 3, 5, 21, DECODE | EXT,
@@ -1430,7 +1423,9 @@ static field_t _OpenLogicalChannelAck[] = {	/* SEQUENCE */
         DECODE | EXT | OPT, offsetof(OpenLogicalChannelAck,
                                      reverseLogicalChannelParameters),
         _OpenLogicalChannelAck_reverseLogicalChannelParameters},
-        {FNAME("separateStack") SEQ, 2, 4, 5, SKIP | EXT | OPT, 0, NULL},
+        {FNAME("separateStack") SEQ, 2, 4, 5, DECODE | EXT | OPT,
+         offsetof(OpenLogicalChannelAck, separateStack),
+         _NetworkAccessParameters},
        {FNAME("forwardMultiplexAckParameters") CHOICE, 0, 1, 1,
         DECODE | EXT | OPT, offsetof(OpenLogicalChannelAck,
                                      forwardMultiplexAckParameters),
diff --git a/net/rfkill/rfkill.c b/net/rfkill/rfkill.c
index a973603e3880..f3986d498b40 100644
--- a/net/rfkill/rfkill.c
+++ b/net/rfkill/rfkill.c
@@ -296,7 +296,7 @@ struct rfkill *rfkill_allocate(struct device *parent, enum rfkill_type type)
        struct device *dev;
        rfkill = kzalloc(sizeof(struct rfkill), GFP_KERNEL);
-        if (rfkill)
+        if (!rfkill)
                return NULL;
        mutex_init(&rfkill->mutex);
diff --git a/net/rxrpc/Kconfig b/net/rxrpc/Kconfig
index 91b3d52f6f1a..e662f1d07664 100644
--- a/net/rxrpc/Kconfig
+++ b/net/rxrpc/Kconfig
@@ -4,7 +4,7 @@
 config AF_RXRPC
        tristate "RxRPC session sockets"
-        depends on EXPERIMENTAL
+        depends on INET && EXPERIMENTAL
        select KEYS
        help
          Say Y or M here to include support for RxRPC session sockets (just
diff --git a/net/rxrpc/ar-call.c b/net/rxrpc/ar-call.c
index 4d92d88ff1fc..3c04b00dab74 100644
--- a/net/rxrpc/ar-call.c
+++ b/net/rxrpc/ar-call.c
@@ -15,6 +15,25 @@
 #include <net/af_rxrpc.h>
 #include "ar-internal.h"
+const char *rxrpc_call_states[] = {
+        [RXRPC_CALL_CLIENT_SEND_REQUEST]        = "ClSndReq",
+        [RXRPC_CALL_CLIENT_AWAIT_REPLY]         = "ClAwtRpl",
+        [RXRPC_CALL_CLIENT_RECV_REPLY]          = "ClRcvRpl",
+        [RXRPC_CALL_CLIENT_FINAL_ACK]           = "ClFnlACK",
+        [RXRPC_CALL_SERVER_SECURING]            = "SvSecure",
+        [RXRPC_CALL_SERVER_ACCEPTING]           = "SvAccept",
+        [RXRPC_CALL_SERVER_RECV_REQUEST]        = "SvRcvReq",
+        [RXRPC_CALL_SERVER_ACK_REQUEST]         = "SvAckReq",
+        [RXRPC_CALL_SERVER_SEND_REPLY]          = "SvSndRpl",
+        [RXRPC_CALL_SERVER_AWAIT_ACK]           = "SvAwtACK",
+        [RXRPC_CALL_COMPLETE]                   = "Complete",
+        [RXRPC_CALL_SERVER_BUSY]                = "SvBusy  ",
+        [RXRPC_CALL_REMOTELY_ABORTED]           = "RmtAbort",
+        [RXRPC_CALL_LOCALLY_ABORTED]            = "LocAbort",
+        [RXRPC_CALL_NETWORK_ERROR]              = "NetError",
+        [RXRPC_CALL_DEAD]                       = "Dead    ",
+};
 struct kmem_cache *rxrpc_call_jar;
 LIST_HEAD(rxrpc_calls);
 DEFINE_RWLOCK(rxrpc_call_lock);
diff --git a/net/rxrpc/ar-proc.c b/net/rxrpc/ar-proc.c
index 58f4b4e5cece..1c0be0e77b16 100644
--- a/net/rxrpc/ar-proc.c
+++ b/net/rxrpc/ar-proc.c
@@ -25,25 +25,6 @@ static const char *rxrpc_conn_states[] = {
        [RXRPC_CONN_NETWORK_ERROR]      = "NetError",
 };
-const char *rxrpc_call_states[] = {
-        [RXRPC_CALL_CLIENT_SEND_REQUEST]        = "ClSndReq",
-        [RXRPC_CALL_CLIENT_AWAIT_REPLY]         = "ClAwtRpl",
-        [RXRPC_CALL_CLIENT_RECV_REPLY]          = "ClRcvRpl",
-        [RXRPC_CALL_CLIENT_FINAL_ACK]           = "ClFnlACK",
-        [RXRPC_CALL_SERVER_SECURING]            = "SvSecure",
-        [RXRPC_CALL_SERVER_ACCEPTING]           = "SvAccept",
-        [RXRPC_CALL_SERVER_RECV_REQUEST]        = "SvRcvReq",
-        [RXRPC_CALL_SERVER_ACK_REQUEST]         = "SvAckReq",
-        [RXRPC_CALL_SERVER_SEND_REPLY]          = "SvSndRpl",
-        [RXRPC_CALL_SERVER_AWAIT_ACK]           = "SvAwtACK",
-        [RXRPC_CALL_COMPLETE]                   = "Complete",
-        [RXRPC_CALL_SERVER_BUSY]                = "SvBusy  ",
-        [RXRPC_CALL_REMOTELY_ABORTED]           = "RmtAbort",
-        [RXRPC_CALL_LOCALLY_ABORTED]            = "LocAbort",
-        [RXRPC_CALL_NETWORK_ERROR]              = "NetError",
-        [RXRPC_CALL_DEAD]                       = "Dead    ",
-};
 /*
 * generate a list of extant and dead calls in /proc/net/rxrpc_calls
 */
diff --git a/net/sched/sch_generic.c b/net/sched/sch_generic.c
index f28bb2dc58d0..cbefe225581e 100644
--- a/net/sched/sch_generic.c
+++ b/net/sched/sch_generic.c
@@ -169,8 +169,8 @@ requeue:
                else
                        q->ops->requeue(skb, q);
                netif_schedule(dev);
-                return 0;
        }
+        return 0;
 out:
        BUG_ON((int) q->q.qlen < 0);
diff --git a/net/sched/sch_htb.c b/net/sched/sch_htb.c
index 99bcec8dd04c..035788c5b7f8 100644
--- a/net/sched/sch_htb.c
+++ b/net/sched/sch_htb.c
@@ -976,8 +976,9 @@ static struct sk_buff *htb_dequeue(struct Qdisc *sch)
                if (q->now >= q->near_ev_cache[level]) {
                        event = htb_do_events(q, level);
-                        q->near_ev_cache[level] = event ? event :
+                        if (!event)
-                                                          PSCHED_TICKS_PER_SEC;
+                                event = q->now + PSCHED_TICKS_PER_SEC;
+                        q->near_ev_cache[level] = event;
                } else
                        event = q->near_ev_cache[level];
diff --git a/net/sctp/Kconfig b/net/sctp/Kconfig
index 9cba49e2ad43..8210f549c492 100644
--- a/net/sctp/Kconfig
+++ b/net/sctp/Kconfig
@@ -2,11 +2,9 @@
 # SCTP configuration
 #
-menu "SCTP Configuration (EXPERIMENTAL)"
+menuconfig IP_SCTP
-        depends on INET && EXPERIMENTAL
-config IP_SCTP
        tristate "The SCTP Protocol (EXPERIMENTAL)"
+        depends on INET && EXPERIMENTAL
        depends on IPV6 || IPV6=n
        select CRYPTO if SCTP_HMAC_SHA1 || SCTP_HMAC_MD5
        select CRYPTO_HMAC if SCTP_HMAC_SHA1 || SCTP_HMAC_MD5
@@ -36,9 +34,10 @@ config IP_SCTP
          If in doubt, say N.
+if IP_SCTP
 config SCTP_DBG_MSG
        bool "SCTP: Debug messages"
-        depends on IP_SCTP
        help
          If you say Y, this will enable verbose debugging messages. 
@@ -47,7 +46,6 @@ config SCTP_DBG_MSG
 config SCTP_DBG_OBJCNT
        bool "SCTP: Debug object counts"
-        depends on IP_SCTP
        help
          If you say Y, this will enable debugging support for counting the 
          type of objects that are currently allocated.  This is useful for 
@@ -59,7 +57,6 @@ config SCTP_DBG_OBJCNT
 choice
        prompt "SCTP: Cookie HMAC Algorithm"
-        depends on IP_SCTP
        default SCTP_HMAC_MD5
        help
          HMAC algorithm to be used during association initialization.  It
@@ -86,4 +83,5 @@ config SCTP_HMAC_MD5
          advised to use either HMAC-MD5 or HMAC-SHA1.
 endchoice
-endmenu
+endif # IP_SCTP
diff --git a/net/socket.c b/net/socket.c
index 98a8f67abbfc..f4530196a70a 100644
--- a/net/socket.c
+++ b/net/socket.c
@@ -261,8 +261,7 @@ static void init_once(void *foo, struct kmem_cache *cachep, unsigned long flags)
 {
        struct socket_alloc *ei = (struct socket_alloc *)foo;
-        if (flags & SLAB_CTOR_CONSTRUCTOR)
+        inode_init_once(&ei->vfs_inode);
-                inode_init_once(&ei->vfs_inode);
 }
 static int init_inodecache(void)
diff --git a/net/sunrpc/rpc_pipe.c b/net/sunrpc/rpc_pipe.c
index a2f1893bde53..5887457dc936 100644
--- a/net/sunrpc/rpc_pipe.c
+++ b/net/sunrpc/rpc_pipe.c
@@ -828,19 +828,17 @@ init_once(void * foo, struct kmem_cache * cachep, unsigned long flags)
 {
        struct rpc_inode *rpci = (struct rpc_inode *) foo;
-        if (flags & SLAB_CTOR_CONSTRUCTOR) {
+        inode_init_once(&rpci->vfs_inode);
-                inode_init_once(&rpci->vfs_inode);
+        rpci->private = NULL;
-                rpci->private = NULL;
+        rpci->nreaders = 0;
-                rpci->nreaders = 0;
+        rpci->nwriters = 0;
-                rpci->nwriters = 0;
+        INIT_LIST_HEAD(&rpci->in_upcall);
-                INIT_LIST_HEAD(&rpci->in_upcall);
+        INIT_LIST_HEAD(&rpci->pipe);
-                INIT_LIST_HEAD(&rpci->pipe);
+        rpci->pipelen = 0;
-                rpci->pipelen = 0;
+        init_waitqueue_head(&rpci->waitq);
-                init_waitqueue_head(&rpci->waitq);
+        INIT_DELAYED_WORK(&rpci->queue_timeout,
-                INIT_DELAYED_WORK(&rpci->queue_timeout,
+                            rpc_timeout_upcall_queue);
-                                    rpc_timeout_upcall_queue);
+        rpci->ops = NULL;
-                rpci->ops = NULL;
-        }
 }
 int register_rpc_pipefs(void)
diff --git a/net/sunrpc/sched.c b/net/sunrpc/sched.c
index b011eb625e49..944d75396fb3 100644
--- a/net/sunrpc/sched.c
+++ b/net/sunrpc/sched.c
@@ -989,8 +989,6 @@ void rpc_killall_tasks(struct rpc_clnt *clnt)
        spin_unlock(&rpc_sched_lock);
 }
-static DECLARE_MUTEX_LOCKED(rpciod_running);
 static void rpciod_killall(void)
 {
        unsigned long flags;
diff --git a/net/sunrpc/sunrpc_syms.c b/net/sunrpc/sunrpc_syms.c
index 0d35bc796d00..73075dec83c0 100644
--- a/net/sunrpc/sunrpc_syms.c
+++ b/net/sunrpc/sunrpc_syms.c
@@ -134,11 +134,7 @@ EXPORT_SYMBOL(nfsd_debug);
 EXPORT_SYMBOL(nlm_debug);
 #endif
-extern int register_rpc_pipefs(void);
-extern void unregister_rpc_pipefs(void);
 extern struct cache_detail ip_map_cache, unix_gid_cache;
-extern int init_socket_xprt(void);
-extern void cleanup_socket_xprt(void);
 static int __init
 init_sunrpc(void)
diff --git a/net/tipc/Kconfig b/net/tipc/Kconfig
index f9e367d946eb..3b30d1130b61 100644
--- a/net/tipc/Kconfig
+++ b/net/tipc/Kconfig
@@ -2,11 +2,9 @@
 # TIPC configuration
 #
-menu "TIPC Configuration (EXPERIMENTAL)"
+menuconfig TIPC
-        depends on INET && EXPERIMENTAL
-config TIPC
        tristate "The TIPC Protocol (EXPERIMENTAL)"
+        depends on INET && EXPERIMENTAL
        ---help---
          The Transparent Inter Process Communication (TIPC) protocol is
          specially designed for intra cluster communication. This protocol
@@ -22,9 +20,10 @@ config TIPC
          If in doubt, say N.
+if TIPC
 config TIPC_ADVANCED
        bool "TIPC: Advanced configuration"
-        depends on TIPC
        default n
        help
          Saying Y here will open some advanced configuration
@@ -33,7 +32,7 @@ config TIPC_ADVANCED
 config TIPC_ZONES
        int "Maximum number of zones in network"
-        depends on TIPC && TIPC_ADVANCED
+        depends on TIPC_ADVANCED
        default "3"
        help
         Max number of zones inside TIPC network. Max supported value 
@@ -44,7 +43,7 @@ config TIPC_ZONES
 config TIPC_CLUSTERS
        int "Maximum number of clusters in a zone"
-        depends on TIPC && TIPC_ADVANCED
+        depends on TIPC_ADVANCED
        default "1"
        help
          ***Only 1 (one cluster in a zone) is supported by current code.
@@ -59,7 +58,7 @@ config TIPC_CLUSTERS
 config TIPC_NODES
        int "Maximum number of nodes in cluster"
-        depends on TIPC && TIPC_ADVANCED
+        depends on TIPC_ADVANCED
        default "255"
        help
          Maximum number of nodes inside a TIPC cluster. Maximum 
@@ -70,7 +69,7 @@ config TIPC_NODES
 config TIPC_SLAVE_NODES
        int "Maximum number of slave nodes in cluster"
-        depends on TIPC && TIPC_ADVANCED
+        depends on TIPC_ADVANCED
        default "0"
        help
          ***This capability is not supported by current code.***
@@ -83,7 +82,7 @@ config TIPC_SLAVE_NODES
 config TIPC_PORTS
        int "Maximum number of ports in a node"
-        depends on TIPC && TIPC_ADVANCED
+        depends on TIPC_ADVANCED
        default "8191"
        help
          Maximum number of ports within a node. Maximum 
@@ -94,7 +93,7 @@ config TIPC_PORTS
 config TIPC_LOG
        int "Size of log buffer"
-        depends on TIPC && TIPC_ADVANCED
+        depends on TIPC_ADVANCED
        default 0
        help
          Size (in bytes) of TIPC's internal log buffer, which records the
@@ -106,7 +105,6 @@ config TIPC_LOG
 config TIPC_DEBUG
        bool "Enable debugging support"
-        depends on TIPC
        default n
        help
          This will enable debugging of TIPC.
@@ -114,4 +112,4 @@ config TIPC_DEBUG
          Only say Y here if you are having trouble with TIPC.  It will
          enable the display of detailed information about what is going on.
-endmenu
+endif # TIPC
diff --git a/net/tipc/eth_media.c b/net/tipc/eth_media.c
index 0ee6ded18f3a..77d2d9ce8962 100644
--- a/net/tipc/eth_media.c
+++ b/net/tipc/eth_media.c
@@ -120,18 +120,20 @@ static int recv_msg(struct sk_buff *buf, struct net_device *dev,
 static int enable_bearer(struct tipc_bearer *tb_ptr)
 {
-        struct net_device *dev, *pdev;
+        struct net_device *dev = NULL;
+        struct net_device *pdev = NULL;
        struct eth_bearer *eb_ptr = &eth_bearers[0];
        struct eth_bearer *stop = &eth_bearers[MAX_ETH_BEARERS];
        char *driver_name = strchr((const char *)tb_ptr->name, ':') + 1;
        /* Find device with specified name */
-        dev = NULL;
-        for_each_netdev(pdev)
+        for_each_netdev(pdev){
-                if (!strncmp(dev->name, driver_name, IFNAMSIZ)) {
+                if (!strncmp(pdev->name, driver_name, IFNAMSIZ)) {
                        dev = pdev;
                        break;
                }
+        }
        if (!dev)
                return -ENODEV;
diff --git a/net/xfrm/xfrm_algo.c b/net/xfrm/xfrm_algo.c
index 6249a9405bb8..5ced62c19c63 100644
--- a/net/xfrm/xfrm_algo.c
+++ b/net/xfrm/xfrm_algo.c
@@ -347,67 +347,44 @@ static inline int calg_entries(void)
        return ARRAY_SIZE(calg_list);
 }
-/* Todo: generic iterators */
+struct xfrm_algo_list {
-struct xfrm_algo_desc *xfrm_aalg_get_byid(int alg_id)
+        struct xfrm_algo_desc *algs;
-{
+        int entries;
-        int i;
+        u32 type;
+        u32 mask;
-        for (i = 0; i < aalg_entries(); i++) {
+};
-                if (aalg_list[i].desc.sadb_alg_id == alg_id) {
-                        if (aalg_list[i].available)
-                                return &aalg_list[i];
-                        else
-                                break;
-                }
-        }
-        return NULL;
-}
-EXPORT_SYMBOL_GPL(xfrm_aalg_get_byid);
-struct xfrm_algo_desc *xfrm_ealg_get_byid(int alg_id)
-{
-        int i;
-        for (i = 0; i < ealg_entries(); i++) {
+static const struct xfrm_algo_list xfrm_aalg_list = {
-                if (ealg_list[i].desc.sadb_alg_id == alg_id) {
+        .algs = aalg_list,
-                        if (ealg_list[i].available)
+        .entries = ARRAY_SIZE(aalg_list),
-                                return &ealg_list[i];
+        .type = CRYPTO_ALG_TYPE_HASH,
-                        else
+        .mask = CRYPTO_ALG_TYPE_HASH_MASK | CRYPTO_ALG_ASYNC,
-                                break;
+};
-                }
-        }
-        return NULL;
-}
-EXPORT_SYMBOL_GPL(xfrm_ealg_get_byid);
-struct xfrm_algo_desc *xfrm_calg_get_byid(int alg_id)
+static const struct xfrm_algo_list xfrm_ealg_list = {
-{
+        .algs = ealg_list,
-        int i;
+        .entries = ARRAY_SIZE(ealg_list),
+        .type = CRYPTO_ALG_TYPE_BLKCIPHER,
+        .mask = CRYPTO_ALG_TYPE_MASK | CRYPTO_ALG_ASYNC,
+};
-        for (i = 0; i < calg_entries(); i++) {
+static const struct xfrm_algo_list xfrm_calg_list = {
-                if (calg_list[i].desc.sadb_alg_id == alg_id) {
+        .algs = calg_list,
-                        if (calg_list[i].available)
+        .entries = ARRAY_SIZE(calg_list),
-                                return &calg_list[i];
+        .type = CRYPTO_ALG_TYPE_COMPRESS,
-                        else
+        .mask = CRYPTO_ALG_TYPE_MASK | CRYPTO_ALG_ASYNC,
-                                break;
+};
-                }
-        }
-        return NULL;
-}
-EXPORT_SYMBOL_GPL(xfrm_calg_get_byid);
-static struct xfrm_algo_desc *xfrm_get_byname(struct xfrm_algo_desc *list,
+static struct xfrm_algo_desc *xfrm_find_algo(
-                                              int entries, u32 type, u32 mask,
+        const struct xfrm_algo_list *algo_list,
-                                              char *name, int probe)
+        int match(const struct xfrm_algo_desc *entry, const void *data),
+        const void *data, int probe)
 {
+        struct xfrm_algo_desc *list = algo_list->algs;
        int i, status;
-        if (!name)
+        for (i = 0; i < algo_list->entries; i++) {
-                return NULL;
+                if (!match(list + i, data))
-        for (i = 0; i < entries; i++) {
-                if (strcmp(name, list[i].name) &&
-                    (!list[i].compat || strcmp(name, list[i].compat)))
                        continue;
                if (list[i].available)
@@ -416,8 +393,8 @@ static struct xfrm_algo_desc *xfrm_get_byname(struct xfrm_algo_desc *list,
                if (!probe)
                        break;
-                status = crypto_has_alg(list[i].name, type,
+                status = crypto_has_alg(list[i].name, algo_list->type,
-                                        mask | CRYPTO_ALG_ASYNC);
+                                        algo_list->mask);
                if (!status)
                        break;
@@ -427,27 +404,60 @@ static struct xfrm_algo_desc *xfrm_get_byname(struct xfrm_algo_desc *list,
        return NULL;
 }
+static int xfrm_alg_id_match(const struct xfrm_algo_desc *entry,
+                             const void *data)
+{
+        return entry->desc.sadb_alg_id == (unsigned long)data;
+}
+struct xfrm_algo_desc *xfrm_aalg_get_byid(int alg_id)
+{
+        return xfrm_find_algo(&xfrm_aalg_list, xfrm_alg_id_match,
+                              (void *)(unsigned long)alg_id, 1);
+}
+EXPORT_SYMBOL_GPL(xfrm_aalg_get_byid);
+struct xfrm_algo_desc *xfrm_ealg_get_byid(int alg_id)
+{
+        return xfrm_find_algo(&xfrm_ealg_list, xfrm_alg_id_match,
+                              (void *)(unsigned long)alg_id, 1);
+}
+EXPORT_SYMBOL_GPL(xfrm_ealg_get_byid);
+struct xfrm_algo_desc *xfrm_calg_get_byid(int alg_id)
+{
+        return xfrm_find_algo(&xfrm_calg_list, xfrm_alg_id_match,
+                              (void *)(unsigned long)alg_id, 1);
+}
+EXPORT_SYMBOL_GPL(xfrm_calg_get_byid);
+static int xfrm_alg_name_match(const struct xfrm_algo_desc *entry,
+                               const void *data)
+{
+        const char *name = data;
+        return name && (!strcmp(name, entry->name) ||
+                        (entry->compat && !strcmp(name, entry->compat)));
+}
 struct xfrm_algo_desc *xfrm_aalg_get_byname(char *name, int probe)
 {
-        return xfrm_get_byname(aalg_list, aalg_entries(),
+        return xfrm_find_algo(&xfrm_aalg_list, xfrm_alg_name_match, name,
-                               CRYPTO_ALG_TYPE_HASH, CRYPTO_ALG_TYPE_HASH_MASK,
+                              probe);
-                               name, probe);
 }
 EXPORT_SYMBOL_GPL(xfrm_aalg_get_byname);
 struct xfrm_algo_desc *xfrm_ealg_get_byname(char *name, int probe)
 {
-        return xfrm_get_byname(ealg_list, ealg_entries(),
+        return xfrm_find_algo(&xfrm_ealg_list, xfrm_alg_name_match, name,
-                               CRYPTO_ALG_TYPE_BLKCIPHER, CRYPTO_ALG_TYPE_MASK,
+                              probe);
-                               name, probe);
 }
 EXPORT_SYMBOL_GPL(xfrm_ealg_get_byname);
 struct xfrm_algo_desc *xfrm_calg_get_byname(char *name, int probe)
 {
-        return xfrm_get_byname(calg_list, calg_entries(),
+        return xfrm_find_algo(&xfrm_calg_list, xfrm_alg_name_match, name,
-                               CRYPTO_ALG_TYPE_COMPRESS, CRYPTO_ALG_TYPE_MASK,
+                              probe);
-                               name, probe);
 }
 EXPORT_SYMBOL_GPL(xfrm_calg_get_byname);
diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c
index d0882e53b6fc..b8bab89616a0 100644
--- a/net/xfrm/xfrm_policy.c
+++ b/net/xfrm/xfrm_policy.c
@@ -29,6 +29,8 @@
 #include "xfrm_hash.h"
+int sysctl_xfrm_larval_drop;
 DEFINE_MUTEX(xfrm_cfg_mutex);
 EXPORT_SYMBOL(xfrm_cfg_mutex);
@@ -1390,8 +1392,8 @@ static int stale_bundle(struct dst_entry *dst);
 * At the moment we eat a raw IP route. Mostly to speed up lookups
 * on interfaces with disabled IPsec.
 */
-int xfrm_lookup(struct dst_entry **dst_p, struct flowi *fl,
+int __xfrm_lookup(struct dst_entry **dst_p, struct flowi *fl,
-                struct sock *sk, int flags)
+                  struct sock *sk, int flags)
 {
        struct xfrm_policy *policy;
        struct xfrm_policy *pols[XFRM_POLICY_TYPE_MAX];
@@ -1509,6 +1511,13 @@ restart:
                if (unlikely(nx<0)) {
                        err = nx;
+                        if (err == -EAGAIN && sysctl_xfrm_larval_drop) {
+                                /* EREMOTE tells the caller to generate
+                                 * a one-shot blackhole route.
+                                 */
+                                xfrm_pol_put(policy);
+                                return -EREMOTE;
+                        }
                        if (err == -EAGAIN && flags) {
                                DECLARE_WAITQUEUE(wait, current);
@@ -1598,6 +1607,21 @@ error:
        *dst_p = NULL;
        return err;
 }
+EXPORT_SYMBOL(__xfrm_lookup);
+int xfrm_lookup(struct dst_entry **dst_p, struct flowi *fl,
+                struct sock *sk, int flags)
+{
+        int err = __xfrm_lookup(dst_p, fl, sk, flags);
+        if (err == -EREMOTE) {
+                dst_release(*dst_p);
+                *dst_p = NULL;
+                err = -EAGAIN;
+        }
+        return err;
+}
 EXPORT_SYMBOL(xfrm_lookup);
 static inline int