20 files changed, 136 insertions, 83 deletions

diff --git a/net/ipv4/tcp_bic.c b/net/ipv4/tcp_bic.c
index 281c9f913257..dd9ef65ad3ff 100644
--- a/net/ipv4/tcp_bic.c
+++ b/net/ipv4/tcp_bic.c
@@ -29,7 +29,7 @@ static int fast_convergence = 1;
 static int max_increment = 16;
 static int low_window = 14;
 static int beta = 819;          /* = 819/1024 (BICTCP_BETA_SCALE) */
-static int initial_ssthresh = 100;
+static int initial_ssthresh;
 static int smooth_part = 20;
 
 module_param(fast_convergence, int, 0644);
diff --git a/net/ipv4/tcp_cubic.c b/net/ipv4/tcp_cubic.c
index 14224487b16b..ebfaac2f9f46 100644
--- a/net/ipv4/tcp_cubic.c
+++ b/net/ipv4/tcp_cubic.c
@@ -29,7 +29,7 @@
 static int fast_convergence __read_mostly = 1;
 static int max_increment __read_mostly = 16;
 static int beta __read_mostly = 819;    /* = 819/1024 (BICTCP_BETA_SCALE) */
-static int initial_ssthresh __read_mostly = 100;
+static int initial_ssthresh __read_mostly;
 static int bic_scale __read_mostly = 41;
 static int tcp_friendliness __read_mostly = 1;
 
diff --git a/net/ipv4/tcp_illinois.c b/net/ipv4/tcp_illinois.c
index 4adc47c55351..b2b2256d3b84 100644
--- a/net/ipv4/tcp_illinois.c
+++ b/net/ipv4/tcp_illinois.c
@@ -90,6 +90,9 @@ static void tcp_illinois_acked(struct sock *sk, u32 pkts_acked, ktime_t last)
 
         ca->acked = pkts_acked;
 
+        if (ktime_equal(last, net_invalid_timestamp()))
+                return;
+
         rtt = ktime_to_us(net_timedelta(last));
 
         /* ignore bogus values, this prevents wraparound in alpha math */
diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
index 74683d81c3f1..69f9f1ef3ef6 100644
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -953,7 +953,7 @@ tcp_sacktag_write_queue(struct sock *sk, struct sk_buff *ack_skb, u32 prior_snd_
         int prior_fackets;
         u32 lost_retrans = 0;
         int flag = 0;
-        int dup_sack = 0;
+        int found_dup_sack = 0;
         int cached_fack_count;
         int i;
         int first_sack_index;
@@ -964,20 +964,20 @@ tcp_sacktag_write_queue(struct sock *sk, struct sk_buff *ack_skb, u32 prior_snd_
 
         /* Check for D-SACK. */
         if (before(ntohl(sp[0].start_seq), TCP_SKB_CB(ack_skb)->ack_seq)) {
-                dup_sack = 1;
+                found_dup_sack = 1;
                 tp->rx_opt.sack_ok |= 4;
                 NET_INC_STATS_BH(LINUX_MIB_TCPDSACKRECV);
         } else if (num_sacks > 1 &&
                         !after(ntohl(sp[0].end_seq), ntohl(sp[1].end_seq)) &&
                         !before(ntohl(sp[0].start_seq), ntohl(sp[1].start_seq))) {
-                dup_sack = 1;
+                found_dup_sack = 1;
                 tp->rx_opt.sack_ok |= 4;
                 NET_INC_STATS_BH(LINUX_MIB_TCPDSACKOFORECV);
         }
 
         /* D-SACK for already forgotten data...
          * Do dumb counting. */
-        if (dup_sack &&
+        if (found_dup_sack &&
                         !after(ntohl(sp[0].end_seq), prior_snd_una) &&
                         after(ntohl(sp[0].end_seq), tp->undo_marker))
                 tp->undo_retrans--;
@@ -1058,6 +1058,7 @@ tcp_sacktag_write_queue(struct sock *sk, struct sk_buff *ack_skb, u32 prior_snd_
                 __u32 start_seq = ntohl(sp->start_seq);
                 __u32 end_seq = ntohl(sp->end_seq);
                 int fack_count;
+                int dup_sack = (found_dup_sack && (i == first_sack_index));
 
                 skb = cached_skb;
                 fack_count = cached_fack_count;
@@ -2037,7 +2038,7 @@ static void tcp_try_to_open(struct sock *sk, int flag)
 {
         struct tcp_sock *tp = tcp_sk(sk);
 
-        tp->left_out = tp->sacked_out;
+        tcp_sync_left_out(tp);
 
         if (tp->retrans_out == 0)
                 tp->retrans_stamp = 0;
@@ -2409,7 +2410,7 @@ static int tcp_clean_rtx_queue(struct sock *sk, __s32 *seq_rtt_p)
         int acked = 0;
         int prior_packets = tp->packets_out;
         __s32 seq_rtt = -1;
-        ktime_t last_ackt = ktime_set(0,0);
+        ktime_t last_ackt = net_invalid_timestamp();
 
         while ((skb = tcp_write_queue_head(sk)) &&
                skb != tcp_send_head(sk)) {
@@ -2487,6 +2488,10 @@ static int tcp_clean_rtx_queue(struct sock *sk, __s32 *seq_rtt_p)
                 tcp_ack_update_rtt(sk, acked, seq_rtt);
                 tcp_ack_packets_out(sk);
 
+                /* Is the ACK triggering packet unambiguous? */
+                if (acked & FLAG_RETRANS_DATA_ACKED)
+                        last_ackt = net_invalid_timestamp();
+
                 if (ca_ops->pkts_acked)
                         ca_ops->pkts_acked(sk, pkts_acked, last_ackt);
         }
@@ -2932,6 +2937,7 @@ void tcp_parse_options(struct sk_buff *skb, struct tcp_options_received *opt_rx,
                                            opt_rx->sack_ok) {
                                                 TCP_SKB_CB(skb)->sacked = (ptr - 2) - (unsigned char *)th;
                                         }
+                                        break;
 #ifdef CONFIG_TCP_MD5SIG
                                 case TCPOPT_MD5SIG:
                                         /*
diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
index 97e294e82679..354721d67f69 100644
--- a/net/ipv4/tcp_ipv4.c
+++ b/net/ipv4/tcp_ipv4.c
@@ -878,6 +878,7 @@ int tcp_v4_md5_do_add(struct sock *sk, __be32 addr,
                                 kfree(newkey);
                                 return -ENOMEM;
                         }
+                        sk->sk_route_caps &= ~NETIF_F_GSO_MASK;
                 }
                 if (tcp_alloc_md5sig_pool() == NULL) {
                         kfree(newkey);
@@ -1007,7 +1008,7 @@ static int tcp_v4_parse_md5_keys(struct sock *sk, char __user *optval,
                         return -EINVAL;
 
                 tp->md5sig_info = p;
-
+                sk->sk_route_caps &= ~NETIF_F_GSO_MASK;
         }
 
         newkey = kmemdup(cmd.tcpm_key, cmd.tcpm_keylen, GFP_KERNEL);
diff --git a/net/ipv4/tcp_lp.c b/net/ipv4/tcp_lp.c
index 43294ad9f63e..e49836ce012e 100644
--- a/net/ipv4/tcp_lp.c
+++ b/net/ipv4/tcp_lp.c
@@ -266,7 +266,8 @@ static void tcp_lp_pkts_acked(struct sock *sk, u32 num_acked, ktime_t last)
         struct tcp_sock *tp = tcp_sk(sk);
         struct lp *lp = inet_csk_ca(sk);
 
-        tcp_lp_rtt_sample(sk,  ktime_to_us(net_timedelta(last)));
+        if (!ktime_equal(last, net_invalid_timestamp()))
+                tcp_lp_rtt_sample(sk,  ktime_to_us(net_timedelta(last)));
 
         /* calc inference */
         if (tcp_time_stamp > tp->rx_opt.rcv_tsecr)
diff --git a/net/ipv4/tcp_vegas.c b/net/ipv4/tcp_vegas.c
index 73e19cf7df21..e218a51ceced 100644
--- a/net/ipv4/tcp_vegas.c
+++ b/net/ipv4/tcp_vegas.c
@@ -117,6 +117,9 @@ void tcp_vegas_pkts_acked(struct sock *sk, u32 cnt, ktime_t last)
         struct vegas *vegas = inet_csk_ca(sk);
         u32 vrtt;
 
+        if (ktime_equal(last, net_invalid_timestamp()))
+                return;
+
         /* Never allow zero rtt or baseRTT */
         vrtt = ktime_to_us(net_timedelta(last)) + 1;
 
diff --git a/net/ipv4/tcp_veno.c b/net/ipv4/tcp_veno.c
index 9edb340f2f95..ec854cc5fad5 100644
--- a/net/ipv4/tcp_veno.c
+++ b/net/ipv4/tcp_veno.c
@@ -74,6 +74,9 @@ static void tcp_veno_pkts_acked(struct sock *sk, u32 cnt, ktime_t last)
         struct veno *veno = inet_csk_ca(sk);
         u32 vrtt;
 
+        if (ktime_equal(last, net_invalid_timestamp()))
+                return;
+
         /* Never allow zero rtt or baseRTT */
         vrtt = ktime_to_us(net_timedelta(last)) + 1;
 
diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index 5a5f8bd4597a..f96ed76d8fa4 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -2154,6 +2154,15 @@ static void addrconf_dev_config(struct net_device *dev)
 
         ASSERT_RTNL();
 
+        if ((dev->type != ARPHRD_ETHER) &&
+            (dev->type != ARPHRD_FDDI) &&
+            (dev->type != ARPHRD_IEEE802_TR) &&
+            (dev->type != ARPHRD_ARCNET) &&
+            (dev->type != ARPHRD_INFINIBAND)) {
+                /* Alas, we support only Ethernet autoconfiguration. */
+                return;
+        }
+
         idev = addrconf_add_dev(dev);
         if (idev == NULL)
                 return;
@@ -2241,36 +2250,16 @@ static void addrconf_ip6_tnl_config(struct net_device *dev)
         ip6_tnl_add_linklocal(idev);
 }
 
-static int ipv6_hwtype(struct net_device *dev)
-{
-        if ((dev->type == ARPHRD_ETHER) ||
-            (dev->type == ARPHRD_LOOPBACK) ||
-            (dev->type == ARPHRD_SIT) ||
-            (dev->type == ARPHRD_TUNNEL6) ||
-            (dev->type == ARPHRD_FDDI) ||
-            (dev->type == ARPHRD_IEEE802_TR) ||
-            (dev->type == ARPHRD_ARCNET) ||
-            (dev->type == ARPHRD_INFINIBAND))
-                return 1;
-
-        return 0;
-}
-
 static int addrconf_notify(struct notifier_block *this, unsigned long event,
                            void * data)
 {
         struct net_device *dev = (struct net_device *) data;
-        struct inet6_dev *idev;
+        struct inet6_dev *idev = __in6_dev_get(dev);
         int run_pending = 0;
 
-        if (!ipv6_hwtype(dev))
-                return NOTIFY_OK;
-
-        idev = __in6_dev_get(dev);
-
         switch(event) {
         case NETDEV_REGISTER:
-                if (!idev) {
+                if (!idev && dev->mtu >= IPV6_MIN_MTU) {
                         idev = ipv6_add_dev(dev);
                         if (!idev)
                                 printk(KERN_WARNING "IPv6: add_dev failed for %s\n",
diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
index 4f06a51ad4fd..193d9d60bb7a 100644
--- a/net/ipv6/tcp_ipv6.c
+++ b/net/ipv6/tcp_ipv6.c
@@ -590,6 +590,7 @@ static int tcp_v6_md5_do_add(struct sock *sk, struct in6_addr *peer,
                                 kfree(newkey);
                                 return -ENOMEM;
                         }
+                        sk->sk_route_caps &= ~NETIF_F_GSO_MASK;
                 }
                 tcp_alloc_md5sig_pool();
                 if (tp->md5sig_info->alloced6 == tp->md5sig_info->entries6) {
@@ -724,6 +725,7 @@ static int tcp_v6_parse_md5_keys (struct sock *sk, char __user *optval,
                         return -ENOMEM;
 
                 tp->md5sig_info = p;
+                sk->sk_route_caps &= ~NETIF_F_GSO_MASK;
         }
 
         newkey = kmemdup(cmd.tcpm_key, cmd.tcpm_keylen, GFP_KERNEL);
diff --git a/net/irda/irlap_event.c b/net/irda/irlap_event.c
index 0b02073ffdf3..a8b8873aa263 100644
--- a/net/irda/irlap_event.c
+++ b/net/irda/irlap_event.c
@@ -317,23 +317,6 @@ void irlap_do_event(struct irlap_cb *self, IRLAP_EVENT event,
 }
 
 /*
- * Function irlap_next_state (self, state)
- *
- *    Switches state and provides debug information
- *
- */
-static inline void irlap_next_state(struct irlap_cb *self, IRLAP_STATE state)
-{
-        /*
-        if (!self || self->magic != LAP_MAGIC)
-                return;
-
-        IRDA_DEBUG(4, "next LAP state = %s\n", irlap_state[state]);
-        */
-        self->state = state;
-}
-
-/*
  * Function irlap_state_ndm (event, skb, frame)
  *
  *    NDM (Normal Disconnected Mode) state
@@ -1086,7 +1069,6 @@ static int irlap_state_xmit_p(struct irlap_cb *self, IRLAP_EVENT event,
                         } else {
                                 /* Final packet of window */
                                 irlap_send_data_primary_poll(self, skb);
-                                irlap_next_state(self, LAP_NRM_P);
 
                                 /*
                                  * Make sure state machine does not try to send
@@ -1436,14 +1418,14 @@ static int irlap_state_nrm_p(struct irlap_cb *self, IRLAP_EVENT event,
                  */
                 self->remote_busy = FALSE;
 
+                /* Stop final timer */
+                del_timer(&self->final_timer);
+
                 /*
                  *  Nr as expected?
                  */
                 ret = irlap_validate_nr_received(self, info->nr);
                 if (ret == NR_EXPECTED) {
-                        /* Stop final timer */
-                        del_timer(&self->final_timer);
-
                         /* Update Nr received */
                         irlap_update_nr_received(self, info->nr);
 
@@ -1475,14 +1457,12 @@ static int irlap_state_nrm_p(struct irlap_cb *self, IRLAP_EVENT event,
 
                         /* Resend rejected frames */
                         irlap_resend_rejected_frames(self, CMD_FRAME);
-
-                        /* Final timer ??? Jean II */
+                        irlap_start_final_timer(self, self->final_timeout * 2);
 
                         irlap_next_state(self, LAP_NRM_P);
                 } else if (ret == NR_INVALID) {
                         IRDA_DEBUG(1, "%s(), Received RR with "
                                    "invalid nr !\n", __FUNCTION__);
-                        del_timer(&self->final_timer);
 
                         irlap_next_state(self, LAP_RESET_WAIT);
 
diff --git a/net/irda/irlap_frame.c b/net/irda/irlap_frame.c
index 3c5a68e36414..3013c49ab975 100644
--- a/net/irda/irlap_frame.c
+++ b/net/irda/irlap_frame.c
@@ -798,16 +798,19 @@ void irlap_send_data_primary_poll(struct irlap_cb *self, struct sk_buff *skb)
                 self->vs = (self->vs + 1) % 8;
                 self->ack_required = FALSE;
 
+                irlap_next_state(self, LAP_NRM_P);
                 irlap_send_i_frame(self, tx_skb, CMD_FRAME);
         } else {
                 IRDA_DEBUG(4, "%s(), sending unreliable frame\n", __FUNCTION__);
 
                 if (self->ack_required) {
                         irlap_send_ui_frame(self, skb_get(skb), self->caddr, CMD_FRAME);
+                        irlap_next_state(self, LAP_NRM_P);
                         irlap_send_rr_frame(self, CMD_FRAME);
                         self->ack_required = FALSE;
                 } else {
                         skb->data[1] |= PF_BIT;
+                        irlap_next_state(self, LAP_NRM_P);
                         irlap_send_ui_frame(self, skb_get(skb), self->caddr, CMD_FRAME);
                 }
         }
diff --git a/net/mac80211/debugfs.c b/net/mac80211/debugfs.c
index bb6c0feb2d48..476c8486f789 100644
--- a/net/mac80211/debugfs.c
+++ b/net/mac80211/debugfs.c
@@ -112,7 +112,7 @@ DEBUGFS_READONLY_FILE(wep_iv, 20, "%#06x",
                       local->wep_iv & 0xffffff);
 DEBUGFS_READONLY_FILE(tx_power_reduction, 20, "%d.%d dBm",
                       local->hw.conf.tx_power_reduction / 10,
-                      local->hw.conf.tx_power_reduction & 10);
+                      local->hw.conf.tx_power_reduction % 10);
 DEBUGFS_READONLY_FILE(rate_ctrl_alg, 100, "%s",
                       local->rate_ctrl ? local->rate_ctrl->ops->name : "<unset>");
 
diff --git a/net/mac80211/ieee80211_sta.c b/net/mac80211/ieee80211_sta.c
index 9f30ae4c2ab3..91b545c144c1 100644
--- a/net/mac80211/ieee80211_sta.c
+++ b/net/mac80211/ieee80211_sta.c
@@ -2592,11 +2592,17 @@ void ieee80211_scan_completed(struct ieee80211_hw *hw)
 
         read_lock(&local->sub_if_lock);
         list_for_each_entry(sdata, &local->sub_if_list, list) {
+
+                /* No need to wake the master device. */
+                if (sdata->dev == local->mdev)
+                        continue;
+
                 if (sdata->type == IEEE80211_IF_TYPE_STA) {
                         if (sdata->u.sta.associated)
                                 ieee80211_send_nullfunc(local, sdata, 0);
                         ieee80211_sta_timer((unsigned long)sdata);
                 }
+
                 netif_wake_queue(sdata->dev);
         }
         read_unlock(&local->sub_if_lock);
@@ -2738,6 +2744,12 @@ static int ieee80211_sta_start_scan(struct net_device *dev,
 
         read_lock(&local->sub_if_lock);
         list_for_each_entry(sdata, &local->sub_if_list, list) {
+
+                /* Don't stop the master interface, otherwise we can't transmit
+                 * probes! */
+                if (sdata->dev == local->mdev)
+                        continue;
+
                 netif_stop_queue(sdata->dev);
                 if (sdata->type == IEEE80211_IF_TYPE_STA &&
                     sdata->u.sta.associated)
diff --git a/net/rxrpc/ar-connection.c b/net/rxrpc/ar-connection.c
index 43cb3e051ece..482750efc235 100644
--- a/net/rxrpc/ar-connection.c
+++ b/net/rxrpc/ar-connection.c
@@ -211,7 +211,7 @@ static struct rxrpc_connection *rxrpc_alloc_connection(gfp_t gfp)
                 conn->header_size = sizeof(struct rxrpc_header);
         }
 
-        _leave(" = %p{%d}", conn, conn->debug_id);
+        _leave(" = %p{%d}", conn, conn ? conn->debug_id : 0);
         return conn;
 }
 
diff --git a/net/sctp/associola.c b/net/sctp/associola.c
index df94e3cdfba3..498edb0cd4e5 100644
--- a/net/sctp/associola.c
+++ b/net/sctp/associola.c
@@ -1231,6 +1231,10 @@ void sctp_assoc_sync_pmtu(struct sctp_association *asoc)
         /* Get the lowest pmtu of all the transports. */
         list_for_each(pos, &asoc->peer.transport_addr_list) {
                 t = list_entry(pos, struct sctp_transport, transports);
+                if (t->pmtu_pending && t->dst) {
+                        sctp_transport_update_pmtu(t, dst_mtu(t->dst));
+                        t->pmtu_pending = 0;
+                }
                 if (!pmtu || (t->pathmtu < pmtu))
                         pmtu = t->pathmtu;
         }
diff --git a/net/sctp/input.c b/net/sctp/input.c
index 885109fb3dda..d57ff7f3c576 100644
--- a/net/sctp/input.c
+++ b/net/sctp/input.c
@@ -367,24 +367,18 @@ static void sctp_add_backlog(struct sock *sk, struct sk_buff *skb)
 void sctp_icmp_frag_needed(struct sock *sk, struct sctp_association *asoc,
                            struct sctp_transport *t, __u32 pmtu)
 {
-        if (sock_owned_by_user(sk) || !t || (t->pathmtu == pmtu))
+        if (!t || (t->pathmtu == pmtu))
                 return;
 
+        if (sock_owned_by_user(sk)) {
+                asoc->pmtu_pending = 1;
+                t->pmtu_pending = 1;
+                return;
+        }
+
         if (t->param_flags & SPP_PMTUD_ENABLE) {
-                if (unlikely(pmtu < SCTP_DEFAULT_MINSEGMENT)) {
-                        printk(KERN_WARNING "%s: Reported pmtu %d too low, "
-                               "using default minimum of %d\n",
-                               __FUNCTION__, pmtu,
-                               SCTP_DEFAULT_MINSEGMENT);
-                        /* Use default minimum segment size and disable
-                         * pmtu discovery on this transport.
-                         */
-                        t->pathmtu = SCTP_DEFAULT_MINSEGMENT;
-                        t->param_flags = (t->param_flags & ~SPP_PMTUD) |
-                                SPP_PMTUD_DISABLE;
-                } else {
-                        t->pathmtu = pmtu;
-                }
+                /* Update transports view of the MTU */
+                sctp_transport_update_pmtu(t, pmtu);
 
                 /* Update association pmtu. */
                 sctp_assoc_sync_pmtu(asoc);
diff --git a/net/sctp/socket.c b/net/sctp/socket.c
index 4dcdabf56473..6edaaa009d62 100644
--- a/net/sctp/socket.c
+++ b/net/sctp/socket.c
@@ -333,12 +333,19 @@ SCTP_STATIC int sctp_do_bind(struct sock *sk, union sctp_addr *addr, int len)
         if (!sp->pf->bind_verify(sp, addr))
                 return -EADDRNOTAVAIL;
 
-        /* We must either be unbound, or bind to the same port.  */
-        if (bp->port && (snum != bp->port)) {
-                SCTP_DEBUG_PRINTK("sctp_do_bind:"
+        /* We must either be unbound, or bind to the same port.
+         * It's OK to allow 0 ports if we are already bound.
+         * We'll just inhert an already bound port in this case
+         */
+        if (bp->port) {
+                if (!snum)
+                        snum = bp->port;
+                else if (snum != bp->port) {
+                        SCTP_DEBUG_PRINTK("sctp_do_bind:"
                                   " New port %d does not match existing port "
                                   "%d.\n", snum, bp->port);
-                return -EINVAL;
+                        return -EINVAL;
+                }
         }
 
         if (snum && snum < PROT_SOCK && !capable(CAP_NET_BIND_SERVICE))
@@ -1655,6 +1662,9 @@ SCTP_STATIC int sctp_sendmsg(struct kiocb *iocb, struct sock *sk,
                 goto out_free;
         }
 
+        if (asoc->pmtu_pending)
+                sctp_assoc_pending_pmtu(asoc);
+
         /* If fragmentation is disabled and the message length exceeds the
          * association fragmentation point, return EMSGSIZE.  The I-D
          * does not specify what this error is, but this looks like
@@ -3550,6 +3560,7 @@ SCTP_STATIC int sctp_do_peeloff(struct sctp_association *asoc,
         struct sock *sk = asoc->base.sk;
         struct socket *sock;
         struct inet_sock *inetsk;
+        struct sctp_af *af;
         int err = 0;
 
         /* An association cannot be branched off from an already peeled-off
@@ -3571,8 +3582,9 @@ SCTP_STATIC int sctp_do_peeloff(struct sctp_association *asoc,
         /* Make peeled-off sockets more like 1-1 accepted sockets.
          * Set the daddr and initialize id to something more random
          */
+        af = sctp_get_af_specific(asoc->peer.primary_addr.sa.sa_family);
+        af->to_sk_daddr(&asoc->peer.primary_addr, sk);
         inetsk = inet_sk(sock->sk);
-        inetsk->daddr = asoc->peer.primary_addr.v4.sin_addr.s_addr;
         inetsk->id = asoc->next_tsn ^ jiffies;
 
         *sockp = sock;
@@ -4343,11 +4355,12 @@ copy_getaddrs:
                 err = -EFAULT;
                 goto error;
         }
-        if (put_user(cnt, &((struct sctp_getaddrs __user *)optval)->addr_num))
-                return -EFAULT;
+        if (put_user(cnt, &((struct sctp_getaddrs __user *)optval)->addr_num)) {
+                err = -EFAULT;
+                goto error;
+        }
         if (put_user(bytes_copied, optlen))
-                return -EFAULT;
-
+                err = -EFAULT;
 error:
         kfree(addrs);
         return err;
diff --git a/net/sctp/transport.c b/net/sctp/transport.c
index 961df275d5b9..5f467c914f80 100644
--- a/net/sctp/transport.c
+++ b/net/sctp/transport.c
@@ -241,6 +241,45 @@ void sctp_transport_pmtu(struct sctp_transport *transport)
                 transport->pathmtu = SCTP_DEFAULT_MAXSEGMENT;
 }
 
+/* this is a complete rip-off from __sk_dst_check
+ * the cookie is always 0 since this is how it's used in the
+ * pmtu code
+ */
+static struct dst_entry *sctp_transport_dst_check(struct sctp_transport *t)
+{
+        struct dst_entry *dst = t->dst;
+
+        if (dst && dst->obsolete && dst->ops->check(dst, 0) == NULL) {
+                dst_release(t->dst);
+                t->dst = NULL;
+                return NULL;
+        }
+
+        return dst;
+}
+
+void sctp_transport_update_pmtu(struct sctp_transport *t, u32 pmtu)
+{
+        struct dst_entry *dst;
+
+        if (unlikely(pmtu < SCTP_DEFAULT_MINSEGMENT)) {
+                printk(KERN_WARNING "%s: Reported pmtu %d too low, "
+                       "using default minimum of %d\n",
+                       __FUNCTION__, pmtu,
+                       SCTP_DEFAULT_MINSEGMENT);
+                /* Use default minimum segment size and disable
+                 * pmtu discovery on this transport.
+                 */
+                t->pathmtu = SCTP_DEFAULT_MINSEGMENT;
+        } else {
+                t->pathmtu = pmtu;
+        }
+
+        dst = sctp_transport_dst_check(t);
+        if (dst)
+                dst->ops->update_pmtu(dst, pmtu);
+}
+
 /* Caches the dst entry and source address for a transport's destination
  * address.
  */
diff --git a/net/wireless/sysfs.c b/net/wireless/sysfs.c
index 3ebae1442963..88aaacd9f822 100644
--- a/net/wireless/sysfs.c
+++ b/net/wireless/sysfs.c
@@ -33,7 +33,7 @@ static ssize_t _show_permaddr(struct device *dev,
                               struct device_attribute *attr,
                               char *buf)
 {
-        char *addr = dev_to_rdev(dev)->wiphy.perm_addr;
+        unsigned char *addr = dev_to_rdev(dev)->wiphy.perm_addr;
 
         return sprintf(buf, "%.2x:%.2x:%.2x:%.2x:%.2x:%.2x\n",
                        addr[0], addr[1], addr[2], addr[3], addr[4], addr[5]);