118 files changed, 1100 insertions, 870 deletions
diff --git a/net/802/tr.c b/net/802/tr.c
index afd8385c0c9c..e9dc803f2fe0 100644
--- a/net/802/tr.c
+++ b/net/802/tr.c
@@ -643,6 +643,5 @@ static int __init rif_init(void)
 module_init(rif_init);
-EXPORT_SYMBOL(tr_source_route);
 EXPORT_SYMBOL(tr_type_trans);
 EXPORT_SYMBOL(alloc_trdev);
diff --git a/net/atm/clip.c b/net/atm/clip.c
index 3ab4e7947bab..72d852982664 100644
--- a/net/atm/clip.c
+++ b/net/atm/clip.c
@@ -2,7 +2,6 @@
 /* Written 1995-2000 by Werner Almesberger, EPFL LRC/ICA */
 #include <linux/config.h>
 #include <linux/string.h>
 #include <linux/errno.h>
@@ -54,24 +53,24 @@ static struct net_device *clip_devs;
 static struct atm_vcc *atmarpd;
 static struct neigh_table clip_tbl;
 static struct timer_list idle_timer;
-static int start_timer = 1;
-static int to_atmarpd(enum atmarp_ctrl_type type,int itf,unsigned long ip)
+static int to_atmarpd(enum atmarp_ctrl_type type, int itf, unsigned long ip)
 {
        struct sock *sk;
        struct atmarp_ctrl *ctrl;
        struct sk_buff *skb;
-        DPRINTK("to_atmarpd(%d)\n",type);
+        DPRINTK("to_atmarpd(%d)\n", type);
-        if (!atmarpd) return -EUNATCH;
+        if (!atmarpd)
+                return -EUNATCH;
        skb = alloc_skb(sizeof(struct atmarp_ctrl),GFP_ATOMIC);
-        if (!skb) return -ENOMEM;
+        if (!skb)
+                return -ENOMEM;
        ctrl = (struct atmarp_ctrl *) skb_put(skb,sizeof(struct atmarp_ctrl));
        ctrl->type = type;
        ctrl->itf_num = itf;
        ctrl->ip = ip;
-        atm_force_charge(atmarpd,skb->truesize);
+        atm_force_charge(atmarpd, skb->truesize);
        sk = sk_atm(atmarpd);
        skb_queue_tail(&sk->sk_receive_queue, skb);
@@ -79,26 +78,24 @@ static int to_atmarpd(enum atmarp_ctrl_type type,int itf,unsigned long ip)
        return 0;
 }
+static void link_vcc(struct clip_vcc *clip_vcc, struct atmarp_entry *entry)
-static void link_vcc(struct clip_vcc *clip_vcc,struct atmarp_entry *entry)
 {
-        DPRINTK("link_vcc %p to entry %p (neigh %p)\n",clip_vcc,entry,
+        DPRINTK("link_vcc %p to entry %p (neigh %p)\n", clip_vcc, entry,
-            entry->neigh);
+                entry->neigh);
        clip_vcc->entry = entry;
-        clip_vcc->xoff = 0; /* @@@ may overrun buffer by one packet */
+        clip_vcc->xoff = 0;     /* @@@ may overrun buffer by one packet */
        clip_vcc->next = entry->vccs;
        entry->vccs = clip_vcc;
        entry->neigh->used = jiffies;
 }
 static void unlink_clip_vcc(struct clip_vcc *clip_vcc)
 {
        struct atmarp_entry *entry = clip_vcc->entry;
        struct clip_vcc **walk;
        if (!entry) {
-                printk(KERN_CRIT "!clip_vcc->entry (clip_vcc %p)\n",clip_vcc);
+                printk(KERN_CRIT "!clip_vcc->entry (clip_vcc %p)\n", clip_vcc);
                return;
        }
        spin_lock_bh(&entry->neigh->dev->xmit_lock);    /* block clip_start_xmit() */
@@ -107,24 +104,24 @@ static void unlink_clip_vcc(struct clip_vcc *clip_vcc)
                if (*walk == clip_vcc) {
                        int error;
-                        *walk = clip_vcc->next; /* atomic */
+                        *walk = clip_vcc->next; /* atomic */
                        clip_vcc->entry = NULL;
                        if (clip_vcc->xoff)
                                netif_wake_queue(entry->neigh->dev);
                        if (entry->vccs)
                                goto out;
-                        entry->expires = jiffies-1;
+                        entry->expires = jiffies - 1;
-                                /* force resolution or expiration */
+                        /* force resolution or expiration */
                        error = neigh_update(entry->neigh, NULL, NUD_NONE,
                                             NEIGH_UPDATE_F_ADMIN);
                        if (error)
                                printk(KERN_CRIT "unlink_clip_vcc: "
-                                    "neigh_update failed with %d\n",error);
+                                       "neigh_update failed with %d\n", error);
                        goto out;
                }
        printk(KERN_CRIT "ATMARP: unlink_clip_vcc failed (entry %p, vcc "
-          "0x%p)\n",entry,clip_vcc);
+               "0x%p)\n", entry, clip_vcc);
-out:
+      out:
        spin_unlock_bh(&entry->neigh->dev->xmit_lock);
 }
@@ -153,13 +150,13 @@ static int neigh_check_cb(struct neighbour *n)
                DPRINTK("destruction postponed with ref %d\n",
                        atomic_read(&n->refcnt));
-                while ((skb = skb_dequeue(&n->arp_queue)) != NULL) 
+                while ((skb = skb_dequeue(&n->arp_queue)) != NULL)
                        dev_kfree_skb(skb);
                return 0;
        }
-        DPRINTK("expired neigh %p\n",n);
+        DPRINTK("expired neigh %p\n", n);
        return 1;
 }
@@ -167,7 +164,7 @@ static void idle_timer_check(unsigned long dummy)
 {
        write_lock(&clip_tbl.lock);
        __neigh_for_each_release(&clip_tbl, neigh_check_cb);
-        mod_timer(&idle_timer, jiffies+CLIP_CHECK_INTERVAL*HZ);
+        mod_timer(&idle_timer, jiffies + CLIP_CHECK_INTERVAL * HZ);
        write_unlock(&clip_tbl.lock);
 }
@@ -177,13 +174,13 @@ static int clip_arp_rcv(struct sk_buff *skb)
        DPRINTK("clip_arp_rcv\n");
        vcc = ATM_SKB(skb)->vcc;
-        if (!vcc || !atm_charge(vcc,skb->truesize)) {
+        if (!vcc || !atm_charge(vcc, skb->truesize)) {
                dev_kfree_skb_any(skb);
                return 0;
        }
-        DPRINTK("pushing to %p\n",vcc);
+        DPRINTK("pushing to %p\n", vcc);
-        DPRINTK("using %p\n",CLIP_VCC(vcc)->old_push);
+        DPRINTK("using %p\n", CLIP_VCC(vcc)->old_push);
-        CLIP_VCC(vcc)->old_push(vcc,skb);
+        CLIP_VCC(vcc)->old_push(vcc, skb);
        return 0;
 }
@@ -193,34 +190,38 @@ static const unsigned char llc_oui[] = {
        0x03,   /* Ctrl: Unnumbered Information Command PDU */
        0x00,   /* OUI: EtherType */
        0x00,
-        0x00 };
+        0x00
+};
-static void clip_push(struct atm_vcc *vcc,struct sk_buff *skb)
+static void clip_push(struct atm_vcc *vcc, struct sk_buff *skb)
 {
        struct clip_vcc *clip_vcc = CLIP_VCC(vcc);
        DPRINTK("clip push\n");
        if (!skb) {
-                DPRINTK("removing VCC %p\n",clip_vcc);
+                DPRINTK("removing VCC %p\n", clip_vcc);
-                if (clip_vcc->entry) unlink_clip_vcc(clip_vcc);
+                if (clip_vcc->entry)
-                clip_vcc->old_push(vcc,NULL); /* pass on the bad news */
+                        unlink_clip_vcc(clip_vcc);
+                clip_vcc->old_push(vcc, NULL);  /* pass on the bad news */
                kfree(clip_vcc);
                return;
        }
-        atm_return(vcc,skb->truesize);
+        atm_return(vcc, skb->truesize);
        skb->dev = clip_vcc->entry ? clip_vcc->entry->neigh->dev : clip_devs;
-                /* clip_vcc->entry == NULL if we don't have an IP address yet */
+        /* clip_vcc->entry == NULL if we don't have an IP address yet */
        if (!skb->dev) {
                dev_kfree_skb_any(skb);
                return;
        }
        ATM_SKB(skb)->vcc = vcc;
        skb->mac.raw = skb->data;
-        if (!clip_vcc->encap || skb->len < RFC1483LLC_LEN || memcmp(skb->data,
+        if (!clip_vcc->encap
-            llc_oui,sizeof(llc_oui))) skb->protocol = htons(ETH_P_IP);
+            || skb->len < RFC1483LLC_LEN
+            || memcmp(skb->data, llc_oui, sizeof (llc_oui)))
+                skb->protocol = htons(ETH_P_IP);
        else {
                skb->protocol = ((u16 *) skb->data)[3];
-                skb_pull(skb,RFC1483LLC_LEN);
+                skb_pull(skb, RFC1483LLC_LEN);
                if (skb->protocol == htons(ETH_P_ARP)) {
                        PRIV(skb->dev)->stats.rx_packets++;
                        PRIV(skb->dev)->stats.rx_bytes += skb->len;
@@ -235,58 +236,54 @@ static void clip_push(struct atm_vcc *vcc,struct sk_buff *skb)
        netif_rx(skb);
 }
 /*
 * Note: these spinlocks _must_not_ block on non-SMP. The only goal is that
 * clip_pop is atomic with respect to the critical section in clip_start_xmit.
 */
+static void clip_pop(struct atm_vcc *vcc, struct sk_buff *skb)
-static void clip_pop(struct atm_vcc *vcc,struct sk_buff *skb)
 {
        struct clip_vcc *clip_vcc = CLIP_VCC(vcc);
        struct net_device *dev = skb->dev;
        int old;
        unsigned long flags;
-        DPRINTK("clip_pop(vcc %p)\n",vcc);
+        DPRINTK("clip_pop(vcc %p)\n", vcc);
-        clip_vcc->old_pop(vcc,skb);
+        clip_vcc->old_pop(vcc, skb);
        /* skb->dev == NULL in outbound ARP packets */
-        if (!dev) return;
+        if (!dev)
-        spin_lock_irqsave(&PRIV(dev)->xoff_lock,flags);
+                return;
-        if (atm_may_send(vcc,0)) {
+        spin_lock_irqsave(&PRIV(dev)->xoff_lock, flags);
-                old = xchg(&clip_vcc->xoff,0);
+        if (atm_may_send(vcc, 0)) {
-                if (old) netif_wake_queue(dev);
+                old = xchg(&clip_vcc->xoff, 0);
+                if (old)
+                        netif_wake_queue(dev);
        }
-        spin_unlock_irqrestore(&PRIV(dev)->xoff_lock,flags);
+        spin_unlock_irqrestore(&PRIV(dev)->xoff_lock, flags);
 }
 static void clip_neigh_destroy(struct neighbour *neigh)
 {
-        DPRINTK("clip_neigh_destroy (neigh %p)\n",neigh);
+        DPRINTK("clip_neigh_destroy (neigh %p)\n", neigh);
        if (NEIGH2ENTRY(neigh)->vccs)
                printk(KERN_CRIT "clip_neigh_destroy: vccs != NULL !!!\n");
        NEIGH2ENTRY(neigh)->vccs = (void *) 0xdeadbeef;
 }
+static void clip_neigh_solicit(struct neighbour *neigh, struct sk_buff *skb)
-static void clip_neigh_solicit(struct neighbour *neigh,struct sk_buff *skb)
 {
-        DPRINTK("clip_neigh_solicit (neigh %p, skb %p)\n",neigh,skb);
+        DPRINTK("clip_neigh_solicit (neigh %p, skb %p)\n", neigh, skb);
-        to_atmarpd(act_need,PRIV(neigh->dev)->number,NEIGH2ENTRY(neigh)->ip);
+        to_atmarpd(act_need, PRIV(neigh->dev)->number, NEIGH2ENTRY(neigh)->ip);
 }
+static void clip_neigh_error(struct neighbour *neigh, struct sk_buff *skb)
-static void clip_neigh_error(struct neighbour *neigh,struct sk_buff *skb)
 {
 #ifndef CONFIG_ATM_CLIP_NO_ICMP
-        icmp_send(skb,ICMP_DEST_UNREACH,ICMP_HOST_UNREACH,0);
+        icmp_send(skb, ICMP_DEST_UNREACH, ICMP_HOST_UNREACH, 0);
 #endif
        kfree_skb(skb);
 }
 static struct neigh_ops clip_neigh_ops = {
        .family =               AF_INET,
        .solicit =              clip_neigh_solicit,
@@ -297,7 +294,6 @@ static struct neigh_ops clip_neigh_ops = {
        .queue_xmit =           dev_queue_xmit,
 };
 static int clip_constructor(struct neighbour *neigh)
 {
        struct atmarp_entry *entry = NEIGH2ENTRY(neigh);
@@ -305,9 +301,10 @@ static int clip_constructor(struct neighbour *neigh)
        struct in_device *in_dev;
        struct neigh_parms *parms;
-        DPRINTK("clip_constructor (neigh %p, entry %p)\n",neigh,entry);
+        DPRINTK("clip_constructor (neigh %p, entry %p)\n", neigh, entry);
        neigh->type = inet_addr_type(entry->ip);
-        if (neigh->type != RTN_UNICAST) return -EINVAL;
+        if (neigh->type != RTN_UNICAST)
+                return -EINVAL;
        rcu_read_lock();
        in_dev = __in_dev_get_rcu(dev);
@@ -326,13 +323,13 @@ static int clip_constructor(struct neighbour *neigh)
            neigh->ops->connected_output : neigh->ops->output;
        entry->neigh = neigh;
        entry->vccs = NULL;
-        entry->expires = jiffies-1;
+        entry->expires = jiffies - 1;
        return 0;
 }
 static u32 clip_hash(const void *pkey, const struct net_device *dev)
 {
-        return jhash_2words(*(u32 *)pkey, dev->ifindex, clip_tbl.hash_rnd);
+        return jhash_2words(*(u32 *) pkey, dev->ifindex, clip_tbl.hash_rnd);
 }
 static struct neigh_table clip_tbl = {
@@ -366,7 +363,6 @@ static struct neigh_table clip_tbl = {
        .gc_thresh3     = 1024,
 };
 /* @@@ copy bh locking from arp.c -- need to bh-enable atm code before */
 /*
@@ -376,15 +372,13 @@ static struct neigh_table clip_tbl = {
 * clip_setentry.
 */
+static int clip_encap(struct atm_vcc *vcc, int mode)
-static int clip_encap(struct atm_vcc *vcc,int mode)
 {
        CLIP_VCC(vcc)->encap = mode;
        return 0;
 }
+static int clip_start_xmit(struct sk_buff *skb, struct net_device *dev)
-static int clip_start_xmit(struct sk_buff *skb,struct net_device *dev)
 {
        struct clip_priv *clip_priv = PRIV(dev);
        struct atmarp_entry *entry;
@@ -392,7 +386,7 @@ static int clip_start_xmit(struct sk_buff *skb,struct net_device *dev)
        int old;
        unsigned long flags;
-        DPRINTK("clip_start_xmit (skb %p)\n",skb);
+        DPRINTK("clip_start_xmit (skb %p)\n", skb);
        if (!skb->dst) {
                printk(KERN_ERR "clip_start_xmit: skb->dst == NULL\n");
                dev_kfree_skb(skb);
@@ -401,9 +395,9 @@ static int clip_start_xmit(struct sk_buff *skb,struct net_device *dev)
        }
        if (!skb->dst->neighbour) {
 #if 0
-                skb->dst->neighbour = clip_find_neighbour(skb->dst,1);
+                skb->dst->neighbour = clip_find_neighbour(skb->dst, 1);
                if (!skb->dst->neighbour) {
-                        dev_kfree_skb(skb); /* lost that one */
+                        dev_kfree_skb(skb);     /* lost that one */
                        clip_priv->stats.tx_dropped++;
                        return 0;
                }
@@ -417,73 +411,73 @@ static int clip_start_xmit(struct sk_buff *skb,struct net_device *dev)
        if (!entry->vccs) {
                if (time_after(jiffies, entry->expires)) {
                        /* should be resolved */
-                        entry->expires = jiffies+ATMARP_RETRY_DELAY*HZ;
+                        entry->expires = jiffies + ATMARP_RETRY_DELAY * HZ;
-                        to_atmarpd(act_need,PRIV(dev)->number,entry->ip);
+                        to_atmarpd(act_need, PRIV(dev)->number, entry->ip);
                }
                if (entry->neigh->arp_queue.qlen < ATMARP_MAX_UNRES_PACKETS)
-                        skb_queue_tail(&entry->neigh->arp_queue,skb);
+                        skb_queue_tail(&entry->neigh->arp_queue, skb);
                else {
                        dev_kfree_skb(skb);
                        clip_priv->stats.tx_dropped++;
                }
                return 0;
        }
-        DPRINTK("neigh %p, vccs %p\n",entry,entry->vccs);
+        DPRINTK("neigh %p, vccs %p\n", entry, entry->vccs);
        ATM_SKB(skb)->vcc = vcc = entry->vccs->vcc;
-        DPRINTK("using neighbour %p, vcc %p\n",skb->dst->neighbour,vcc);
+        DPRINTK("using neighbour %p, vcc %p\n", skb->dst->neighbour, vcc);
        if (entry->vccs->encap) {
                void *here;
-                here = skb_push(skb,RFC1483LLC_LEN);
+                here = skb_push(skb, RFC1483LLC_LEN);
-                memcpy(here,llc_oui,sizeof(llc_oui));
+                memcpy(here, llc_oui, sizeof(llc_oui));
                ((u16 *) here)[3] = skb->protocol;
        }
        atomic_add(skb->truesize, &sk_atm(vcc)->sk_wmem_alloc);
        ATM_SKB(skb)->atm_options = vcc->atm_options;
        entry->vccs->last_use = jiffies;
-        DPRINTK("atm_skb(%p)->vcc(%p)->dev(%p)\n",skb,vcc,vcc->dev);
+        DPRINTK("atm_skb(%p)->vcc(%p)->dev(%p)\n", skb, vcc, vcc->dev);
-        old = xchg(&entry->vccs->xoff,1); /* assume XOFF ... */
+        old = xchg(&entry->vccs->xoff, 1);      /* assume XOFF ... */
        if (old) {
                printk(KERN_WARNING "clip_start_xmit: XOFF->XOFF transition\n");
                return 0;
        }
        clip_priv->stats.tx_packets++;
        clip_priv->stats.tx_bytes += skb->len;
-        (void) vcc->send(vcc,skb);
+        vcc->send(vcc, skb);
-        if (atm_may_send(vcc,0)) {
+        if (atm_may_send(vcc, 0)) {
                entry->vccs->xoff = 0;
                return 0;
        }
-        spin_lock_irqsave(&clip_priv->xoff_lock,flags);
+        spin_lock_irqsave(&clip_priv->xoff_lock, flags);
-        netif_stop_queue(dev); /* XOFF -> throttle immediately */
+        netif_stop_queue(dev);  /* XOFF -> throttle immediately */
        barrier();
        if (!entry->vccs->xoff)
                netif_start_queue(dev);
-                /* Oh, we just raced with clip_pop. netif_start_queue should be
+        /* Oh, we just raced with clip_pop. netif_start_queue should be
-                   good enough, because nothing should really be asleep because
+           good enough, because nothing should really be asleep because
-                   of the brief netif_stop_queue. If this isn't true or if it
+           of the brief netif_stop_queue. If this isn't true or if it
-                   changes, use netif_wake_queue instead. */
+           changes, use netif_wake_queue instead. */
-        spin_unlock_irqrestore(&clip_priv->xoff_lock,flags);
+        spin_unlock_irqrestore(&clip_priv->xoff_lock, flags);
        return 0;
 }
 static struct net_device_stats *clip_get_stats(struct net_device *dev)
 {
        return &PRIV(dev)->stats;
 }
+static int clip_mkip(struct atm_vcc *vcc, int timeout)
-static int clip_mkip(struct atm_vcc *vcc,int timeout)
 {
        struct clip_vcc *clip_vcc;
        struct sk_buff_head copy;
        struct sk_buff *skb;
-        if (!vcc->push) return -EBADFD;
+        if (!vcc->push)
-        clip_vcc = kmalloc(sizeof(struct clip_vcc),GFP_KERNEL);
+                return -EBADFD;
-        if (!clip_vcc) return -ENOMEM;
+        clip_vcc = kmalloc(sizeof(struct clip_vcc), GFP_KERNEL);
-        DPRINTK("mkip clip_vcc %p vcc %p\n",clip_vcc,vcc);
+        if (!clip_vcc)
+                return -ENOMEM;
+        DPRINTK("mkip clip_vcc %p vcc %p\n", clip_vcc, vcc);
        clip_vcc->vcc = vcc;
        vcc->user_back = clip_vcc;
        set_bit(ATM_VF_IS_CLIP, &vcc->flags);
@@ -491,7 +485,7 @@ static int clip_mkip(struct atm_vcc *vcc,int timeout)
        clip_vcc->xoff = 0;
        clip_vcc->encap = 1;
        clip_vcc->last_use = jiffies;
-        clip_vcc->idle_timeout = timeout*HZ;
+        clip_vcc->idle_timeout = timeout * HZ;
        clip_vcc->old_push = vcc->push;
        clip_vcc->old_pop = vcc->pop;
        vcc->push = clip_push;
@@ -501,27 +495,25 @@ static int clip_mkip(struct atm_vcc *vcc,int timeout)
        /* re-process everything received between connection setup and MKIP */
        while ((skb = skb_dequeue(&copy)) != NULL)
                if (!clip_devs) {
-                        atm_return(vcc,skb->truesize);
+                        atm_return(vcc, skb->truesize);
                        kfree_skb(skb);
-                }
+                } else {
-                else {
                        unsigned int len = skb->len;
-                        clip_push(vcc,skb);
+                        clip_push(vcc, skb);
                        PRIV(skb->dev)->stats.rx_packets--;
                        PRIV(skb->dev)->stats.rx_bytes -= len;
                }
        return 0;
 }
+static int clip_setentry(struct atm_vcc *vcc, u32 ip)
-static int clip_setentry(struct atm_vcc *vcc,u32 ip)
 {
        struct neighbour *neigh;
        struct atmarp_entry *entry;
        int error;
        struct clip_vcc *clip_vcc;
-        struct flowi fl = { .nl_u = { .ip4_u = { .daddr = ip, .tos = 1 } } };
+        struct flowi fl = { .nl_u = { .ip4_u = { .daddr = ip, .tos = 1}} };
        struct rtable *rt;
        if (vcc->push != clip_push) {
@@ -538,28 +530,29 @@ static int clip_setentry(struct atm_vcc *vcc,u32 ip)
                unlink_clip_vcc(clip_vcc);
                return 0;
        }
-        error = ip_route_output_key(&rt,&fl);
+        error = ip_route_output_key(&rt, &fl);
-        if (error) return error;
+        if (error)
-        neigh = __neigh_lookup(&clip_tbl,&ip,rt->u.dst.dev,1);
+                return error;
+        neigh = __neigh_lookup(&clip_tbl, &ip, rt->u.dst.dev, 1);
        ip_rt_put(rt);
        if (!neigh)
                return -ENOMEM;
        entry = NEIGH2ENTRY(neigh);
        if (entry != clip_vcc->entry) {
-                if (!clip_vcc->entry) DPRINTK("setentry: add\n");
+                if (!clip_vcc->entry)
+                        DPRINTK("setentry: add\n");
                else {
                        DPRINTK("setentry: update\n");
                        unlink_clip_vcc(clip_vcc);
                }
-                link_vcc(clip_vcc,entry);
+                link_vcc(clip_vcc, entry);
        }
-        error = neigh_update(neigh, llc_oui, NUD_PERMANENT, 
+        error = neigh_update(neigh, llc_oui, NUD_PERMANENT,
-                             NEIGH_UPDATE_F_OVERRIDE|NEIGH_UPDATE_F_ADMIN);
+                             NEIGH_UPDATE_F_OVERRIDE | NEIGH_UPDATE_F_ADMIN);
        neigh_release(neigh);
        return error;
 }
 static void clip_setup(struct net_device *dev)
 {
        dev->hard_start_xmit = clip_start_xmit;
@@ -568,15 +561,14 @@ static void clip_setup(struct net_device *dev)
        dev->type = ARPHRD_ATM;
        dev->hard_header_len = RFC1483LLC_LEN;
        dev->mtu = RFC1626_MTU;
-        dev->tx_queue_len = 100; /* "normal" queue (packets) */
+        dev->tx_queue_len = 100;        /* "normal" queue (packets) */
-            /* When using a "real" qdisc, the qdisc determines the queue */
+        /* When using a "real" qdisc, the qdisc determines the queue */
-            /* length. tx_queue_len is only used for the default case, */
+        /* length. tx_queue_len is only used for the default case, */
-            /* without any more elaborate queuing. 100 is a reasonable */
+        /* without any more elaborate queuing. 100 is a reasonable */
-            /* compromise between decent burst-tolerance and protection */
+        /* compromise between decent burst-tolerance and protection */
-            /* against memory hogs. */
+        /* against memory hogs. */
 }
 static int clip_create(int number)
 {
        struct net_device *dev;
@@ -585,19 +577,19 @@ static int clip_create(int number)
        if (number != -1) {
                for (dev = clip_devs; dev; dev = PRIV(dev)->next)
-                        if (PRIV(dev)->number == number) return -EEXIST;
+                        if (PRIV(dev)->number == number)
-        }
+                                return -EEXIST;
-        else {
+        } else {
                number = 0;
                for (dev = clip_devs; dev; dev = PRIV(dev)->next)
                        if (PRIV(dev)->number >= number)
-                                number = PRIV(dev)->number+1;
+                                number = PRIV(dev)->number + 1;
        }
        dev = alloc_netdev(sizeof(struct clip_priv), "", clip_setup);
        if (!dev)
                return -ENOMEM;
        clip_priv = PRIV(dev);
-        sprintf(dev->name,"atm%d",number);
+        sprintf(dev->name, "atm%d", number);
        spin_lock_init(&clip_priv->xoff_lock);
        clip_priv->number = number;
        error = register_netdev(dev);
@@ -607,53 +599,48 @@ static int clip_create(int number)
        }
        clip_priv->next = clip_devs;
        clip_devs = dev;
-        DPRINTK("registered (net:%s)\n",dev->name);
+        DPRINTK("registered (net:%s)\n", dev->name);
        return number;
 }
+static int clip_device_event(struct notifier_block *this, unsigned long event,
-static int clip_device_event(struct notifier_block *this,unsigned long event,
+                             void *arg)
-    void *dev)
 {
+        struct net_device *dev = arg;
+        if (event == NETDEV_UNREGISTER) {
+                neigh_ifdown(&clip_tbl, dev);
+                return NOTIFY_DONE;
+        }
        /* ignore non-CLIP devices */
-        if (((struct net_device *) dev)->type != ARPHRD_ATM ||
+        if (dev->type != ARPHRD_ATM || dev->hard_start_xmit != clip_start_xmit)
-            ((struct net_device *) dev)->hard_start_xmit != clip_start_xmit)
                return NOTIFY_DONE;
        switch (event) {
-                case NETDEV_UP:
+        case NETDEV_UP:
-                        DPRINTK("clip_device_event NETDEV_UP\n");
+                DPRINTK("clip_device_event NETDEV_UP\n");
-                        (void) to_atmarpd(act_up,PRIV(dev)->number,0);
+                to_atmarpd(act_up, PRIV(dev)->number, 0);
-                        break;
+                break;
-                case NETDEV_GOING_DOWN:
+        case NETDEV_GOING_DOWN:
-                        DPRINTK("clip_device_event NETDEV_DOWN\n");
+                DPRINTK("clip_device_event NETDEV_DOWN\n");
-                        (void) to_atmarpd(act_down,PRIV(dev)->number,0);
+                to_atmarpd(act_down, PRIV(dev)->number, 0);
-                        break;
+                break;
-                case NETDEV_CHANGE:
+        case NETDEV_CHANGE:
-                case NETDEV_CHANGEMTU:
+        case NETDEV_CHANGEMTU:
-                        DPRINTK("clip_device_event NETDEV_CHANGE*\n");
+                DPRINTK("clip_device_event NETDEV_CHANGE*\n");
-                        (void) to_atmarpd(act_change,PRIV(dev)->number,0);
+                to_atmarpd(act_change, PRIV(dev)->number, 0);
-                        break;
+                break;
-                case NETDEV_REBOOT:
-                case NETDEV_REGISTER:
-                case NETDEV_DOWN:
-                        DPRINTK("clip_device_event %ld\n",event);
-                        /* ignore */
-                        break;
-                default:
-                        printk(KERN_WARNING "clip_device_event: unknown event "
-                            "%ld\n",event);
-                        break;
        }
        return NOTIFY_DONE;
 }
+static int clip_inet_event(struct notifier_block *this, unsigned long event,
-static int clip_inet_event(struct notifier_block *this,unsigned long event,
+                           void *ifa)
-    void *ifa)
 {
        struct in_device *in_dev;
-        in_dev = ((struct in_ifaddr *) ifa)->ifa_dev;
+        in_dev = ((struct in_ifaddr *)ifa)->ifa_dev;
        if (!in_dev || !in_dev->dev) {
                printk(KERN_WARNING "clip_inet_event: no device\n");
                return NOTIFY_DONE;
@@ -662,23 +649,20 @@ static int clip_inet_event(struct notifier_block *this,unsigned long event,
         * Transitions are of the down-change-up type, so it's sufficient to
         * handle the change on up.
         */
-        if (event != NETDEV_UP) return NOTIFY_DONE;
+        if (event != NETDEV_UP)
-        return clip_device_event(this,NETDEV_CHANGE,in_dev->dev);
+                return NOTIFY_DONE;
+        return clip_device_event(this, NETDEV_CHANGE, in_dev->dev);
 }
 static struct notifier_block clip_dev_notifier = {
-        clip_device_event,
+        .notifier_call = clip_device_event,
-        NULL,
-        0
 };
 static struct notifier_block clip_inet_notifier = {
-        clip_inet_event,
+        .notifier_call = clip_inet_event,
-        NULL,
-        0
 };
@@ -686,14 +670,12 @@ static struct notifier_block clip_inet_notifier = {
 static void atmarpd_close(struct atm_vcc *vcc)
 {
        DPRINTK("atmarpd_close\n");
-        atmarpd = NULL; /* assumed to be atomic */
-        barrier();
+        rtnl_lock();
-        unregister_inetaddr_notifier(&clip_inet_notifier);
+        atmarpd = NULL;
-        unregister_netdevice_notifier(&clip_dev_notifier);
-        if (skb_peek(&sk_atm(vcc)->sk_receive_queue))
-                printk(KERN_ERR "atmarpd_close: closing with requests "
-                    "pending\n");
        skb_queue_purge(&sk_atm(vcc)->sk_receive_queue);
+        rtnl_unlock();
        DPRINTK("(done)\n");
        module_put(THIS_MODULE);
 }
@@ -714,14 +696,14 @@ static struct atm_dev atmarpd_dev = {
 static int atm_init_atmarp(struct atm_vcc *vcc)
 {
-        if (atmarpd) return -EADDRINUSE;
+        rtnl_lock();
-        if (start_timer) {
+        if (atmarpd) {
-                start_timer = 0;
+                rtnl_unlock();
-                init_timer(&idle_timer);
+                return -EADDRINUSE;
-                idle_timer.expires = jiffies+CLIP_CHECK_INTERVAL*HZ;
-                idle_timer.function = idle_timer_check;
-                add_timer(&idle_timer);
        }
+        mod_timer(&idle_timer, jiffies+CLIP_CHECK_INTERVAL*HZ);
        atmarpd = vcc;
        set_bit(ATM_VF_META,&vcc->flags);
        set_bit(ATM_VF_READY,&vcc->flags);
@@ -731,10 +713,7 @@ static int atm_init_atmarp(struct atm_vcc *vcc)
        vcc->push = NULL;
        vcc->pop = NULL; /* crash */
        vcc->push_oam = NULL; /* crash */
-        if (register_netdevice_notifier(&clip_dev_notifier))
+        rtnl_unlock();
-                printk(KERN_ERR "register_netdevice_notifier failed\n");
-        if (register_inetaddr_notifier(&clip_inet_notifier))
-                printk(KERN_ERR "register_inetaddr_notifier failed\n");
        return 0;
 }
@@ -744,53 +723,53 @@ static int clip_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg)
        int err = 0;
        switch (cmd) {
-                case SIOCMKCLIP:
+        case SIOCMKCLIP:
-                case ATMARPD_CTRL:
+        case ATMARPD_CTRL:
-                case ATMARP_MKIP:
+        case ATMARP_MKIP:
-                case ATMARP_SETENTRY:
+        case ATMARP_SETENTRY:
-                case ATMARP_ENCAP:
+        case ATMARP_ENCAP:
-                        if (!capable(CAP_NET_ADMIN))
+                if (!capable(CAP_NET_ADMIN))
-                                return -EPERM;
+                        return -EPERM;
-                        break;
+                break;
-                default:
+        default:
-                        return -ENOIOCTLCMD;
+                return -ENOIOCTLCMD;
        }
        switch (cmd) {
-                case SIOCMKCLIP:
+        case SIOCMKCLIP:
-                        err = clip_create(arg);
+                err = clip_create(arg);
-                        break;
+                break;
-                case ATMARPD_CTRL:
+        case ATMARPD_CTRL:
-                        err = atm_init_atmarp(vcc);
+                err = atm_init_atmarp(vcc);
-                        if (!err) {
+                if (!err) {
-                                sock->state = SS_CONNECTED;
+                        sock->state = SS_CONNECTED;
-                                __module_get(THIS_MODULE);
+                        __module_get(THIS_MODULE);
-                        }
+                }
-                        break;
+                break;
-                case ATMARP_MKIP:
+        case ATMARP_MKIP:
-                        err = clip_mkip(vcc ,arg);
+                err = clip_mkip(vcc, arg);
-                        break;
+                break;
-                case ATMARP_SETENTRY:
+        case ATMARP_SETENTRY:
-                        err = clip_setentry(vcc, arg);
+                err = clip_setentry(vcc, arg);
-                        break;
+                break;
-                case ATMARP_ENCAP:
+        case ATMARP_ENCAP:
-                        err = clip_encap(vcc, arg);
+                err = clip_encap(vcc, arg);
-                        break;
+                break;
        }
        return err;
 }
 static struct atm_ioctl clip_ioctl_ops = {
-        .owner  = THIS_MODULE,
+        .owner = THIS_MODULE,
-        .ioctl  = clip_ioctl,
+        .ioctl = clip_ioctl,
 };
 #ifdef CONFIG_PROC_FS
 static void svc_addr(struct seq_file *seq, struct sockaddr_atmsvc *addr)
 {
-        static int code[] = { 1,2,10,6,1,0 };
+        static int code[] = { 1, 2, 10, 6, 1, 0 };
-        static int e164[] = { 1,8,4,6,1,0 };
+        static int e164[] = { 1, 8, 4, 6, 1, 0 };
        if (*addr->sas_addr.pub) {
                seq_printf(seq, "%s", addr->sas_addr.pub);
@@ -809,7 +788,7 @@ static void svc_addr(struct seq_file *seq, struct sockaddr_atmsvc *addr)
                for (i = 0; fields[i]; i++) {
                        for (j = fields[i]; j; j--)
                                seq_printf(seq, "%02X", *prv++);
-                        if (fields[i+1])
+                        if (fields[i + 1])
                                seq_putc(seq, '.');
                }
        }
@@ -828,8 +807,7 @@ static void atmarp_info(struct seq_file *seq, struct net_device *dev,
        svc = ((clip_vcc == SEQ_NO_VCC_TOKEN) ||
               (sk_atm(clip_vcc->vcc)->sk_family == AF_ATMSVC));
-        llc = ((clip_vcc == SEQ_NO_VCC_TOKEN) ||
+        llc = ((clip_vcc == SEQ_NO_VCC_TOKEN) || clip_vcc->encap);
-               clip_vcc->encap);
        if (clip_vcc == SEQ_NO_VCC_TOKEN)
                exp = entry->neigh->used;
@@ -839,10 +817,7 @@ static void atmarp_info(struct seq_file *seq, struct net_device *dev,
        exp = (jiffies - exp) / HZ;
        seq_printf(seq, "%-6s%-4s%-4s%5ld ",
-                   dev->name,
+                   dev->name, svc ? "SVC" : "PVC", llc ? "LLC" : "NULL", exp);
-                   svc ? "SVC" : "PVC",
-                   llc ? "LLC" : "NULL",
-                   exp);
        off = scnprintf(buf, sizeof(buf) - 1, "%d.%d.%d.%d",
                        NIPQUAD(entry->ip));
@@ -860,8 +835,7 @@ static void atmarp_info(struct seq_file *seq, struct net_device *dev,
        } else if (!svc) {
                seq_printf(seq, "%d.%d.%d\n",
                           clip_vcc->vcc->dev->number,
-                           clip_vcc->vcc->vpi,
+                           clip_vcc->vcc->vpi, clip_vcc->vcc->vci);
-                           clip_vcc->vcc->vci);
        } else {
                svc_addr(seq, &clip_vcc->vcc->remote);
                seq_putc(seq, '\n');
@@ -894,7 +868,7 @@ static struct clip_vcc *clip_seq_next_vcc(struct atmarp_entry *e,
 }
 static void *clip_seq_vcc_walk(struct clip_seq_state *state,
-                               struct atmarp_entry *e, loff_t *pos)
+                               struct atmarp_entry *e, loff_t * pos)
 {
        struct clip_vcc *vcc = state->vcc;
@@ -911,24 +885,24 @@ static void *clip_seq_vcc_walk(struct clip_seq_state *state,
        return vcc;
 }
-  
 static void *clip_seq_sub_iter(struct neigh_seq_state *_state,
-                               struct neighbour *n, loff_t *pos)
+                               struct neighbour *n, loff_t * pos)
 {
-        struct clip_seq_state *state = (struct clip_seq_state *) _state;
+        struct clip_seq_state *state = (struct clip_seq_state *)_state;
        return clip_seq_vcc_walk(state, NEIGH2ENTRY(n), pos);
 }
-static void *clip_seq_start(struct seq_file *seq, loff_t *pos)
+static void *clip_seq_start(struct seq_file *seq, loff_t * pos)
 {
        return neigh_seq_start(seq, pos, &clip_tbl, NEIGH_SEQ_NEIGH_ONLY);
 }
 static int clip_seq_show(struct seq_file *seq, void *v)
 {
-        static char atm_arp_banner[] = 
+        static char atm_arp_banner[] =
-                "IPitf TypeEncp Idle IP address      ATM address\n";
+            "IPitf TypeEncp Idle IP address      ATM address\n";
        if (v == SEQ_START_TOKEN) {
                seq_puts(seq, atm_arp_banner);
@@ -939,7 +913,7 @@ static int clip_seq_show(struct seq_file *seq, void *v)
                atmarp_info(seq, n->dev, NEIGH2ENTRY(n), vcc);
        }
-        return 0;
+        return 0;
 }
 static struct seq_operations arp_seq_ops = {
@@ -988,20 +962,19 @@ static struct file_operations arp_seq_fops = {
 static int __init atm_clip_init(void)
 {
-        neigh_table_init(&clip_tbl);
+        struct proc_dir_entry *p;
+        neigh_table_init_no_netlink(&clip_tbl);
        clip_tbl_hook = &clip_tbl;
        register_atm_ioctl(&clip_ioctl_ops);
+        register_netdevice_notifier(&clip_dev_notifier);
+        register_inetaddr_notifier(&clip_inet_notifier);
-#ifdef CONFIG_PROC_FS
+        setup_timer(&idle_timer, idle_timer_check, 0);
-{
-        struct proc_dir_entry *p;
        p = create_proc_entry("arp", S_IRUGO, atm_proc_root);
        if (p)
                p->proc_fops = &arp_seq_fops;
-}
-#endif
        return 0;
 }
@@ -1012,13 +985,15 @@ static void __exit atm_clip_exit(void)
        remove_proc_entry("arp", atm_proc_root);
+        unregister_inetaddr_notifier(&clip_inet_notifier);
+        unregister_netdevice_notifier(&clip_dev_notifier);
        deregister_atm_ioctl(&clip_ioctl_ops);
        /* First, stop the idle timer, so it stops banging
         * on the table.
         */
-        if (start_timer == 0)
+        del_timer_sync(&idle_timer);
-                del_timer(&idle_timer);
        /* Next, purge the table, so that the device
         * unregister loop below does not hang due to
@@ -1042,5 +1017,6 @@ static void __exit atm_clip_exit(void)
 module_init(atm_clip_init);
 module_exit(atm_clip_exit);
+MODULE_AUTHOR("Werner Almesberger");
+MODULE_DESCRIPTION("Classical/IP over ATM interface");
 MODULE_LICENSE("GPL");
diff --git a/net/ax25/af_ax25.c b/net/ax25/af_ax25.c
index dbf9b47681f7..a2e0dd047e9f 100644
--- a/net/ax25/af_ax25.c
+++ b/net/ax25/af_ax25.c
@@ -228,6 +228,8 @@ ax25_cb *ax25_find_cb(ax25_address *src_addr, ax25_address *dest_addr,
        return NULL;
 }
+EXPORT_SYMBOL(ax25_find_cb);
 void ax25_send_to_raw(ax25_address *addr, struct sk_buff *skb, int proto)
 {
        ax25_cb *s;
@@ -424,6 +426,26 @@ static int ax25_ctl_ioctl(const unsigned int cmd, void __user *arg)
        return 0;
 }
+static void ax25_fillin_cb_from_dev(ax25_cb *ax25, ax25_dev *ax25_dev)
+{
+        ax25->rtt     = msecs_to_jiffies(ax25_dev->values[AX25_VALUES_T1]) / 2;
+        ax25->t1      = msecs_to_jiffies(ax25_dev->values[AX25_VALUES_T1]);
+        ax25->t2      = msecs_to_jiffies(ax25_dev->values[AX25_VALUES_T2]);
+        ax25->t3      = msecs_to_jiffies(ax25_dev->values[AX25_VALUES_T3]);
+        ax25->n2      = ax25_dev->values[AX25_VALUES_N2];
+        ax25->paclen  = ax25_dev->values[AX25_VALUES_PACLEN];
+        ax25->idle    = msecs_to_jiffies(ax25_dev->values[AX25_VALUES_IDLE]);
+        ax25->backoff = ax25_dev->values[AX25_VALUES_BACKOFF];
+        if (ax25_dev->values[AX25_VALUES_AXDEFMODE]) {
+                ax25->modulus = AX25_EMODULUS;
+                ax25->window  = ax25_dev->values[AX25_VALUES_EWINDOW];
+        } else {
+                ax25->modulus = AX25_MODULUS;
+                ax25->window  = ax25_dev->values[AX25_VALUES_WINDOW];
+        }
+}
 /*
 *      Fill in a created AX.25 created control block with the default
 *      values for a particular device.
@@ -433,39 +455,28 @@ void ax25_fillin_cb(ax25_cb *ax25, ax25_dev *ax25_dev)
        ax25->ax25_dev = ax25_dev;
        if (ax25->ax25_dev != NULL) {
-                ax25->rtt     = ax25_dev->values[AX25_VALUES_T1] / 2;
+                ax25_fillin_cb_from_dev(ax25, ax25_dev);
-                ax25->t1      = ax25_dev->values[AX25_VALUES_T1];
+                return;
-                ax25->t2      = ax25_dev->values[AX25_VALUES_T2];
+        }
-                ax25->t3      = ax25_dev->values[AX25_VALUES_T3];
-                ax25->n2      = ax25_dev->values[AX25_VALUES_N2];
+        /*
-                ax25->paclen  = ax25_dev->values[AX25_VALUES_PACLEN];
+         * No device, use kernel / AX.25 spec default values
-                ax25->idle    = ax25_dev->values[AX25_VALUES_IDLE];
+         */
-                ax25->backoff = ax25_dev->values[AX25_VALUES_BACKOFF];
+        ax25->rtt     = msecs_to_jiffies(AX25_DEF_T1) / 2;
+        ax25->t1      = msecs_to_jiffies(AX25_DEF_T1);
-                if (ax25_dev->values[AX25_VALUES_AXDEFMODE]) {
+        ax25->t2      = msecs_to_jiffies(AX25_DEF_T2);
-                        ax25->modulus = AX25_EMODULUS;
+        ax25->t3      = msecs_to_jiffies(AX25_DEF_T3);
-                        ax25->window  = ax25_dev->values[AX25_VALUES_EWINDOW];
+        ax25->n2      = AX25_DEF_N2;
-                } else {
+        ax25->paclen  = AX25_DEF_PACLEN;
-                        ax25->modulus = AX25_MODULUS;
+        ax25->idle    = msecs_to_jiffies(AX25_DEF_IDLE);
-                        ax25->window  = ax25_dev->values[AX25_VALUES_WINDOW];
+        ax25->backoff = AX25_DEF_BACKOFF;
-                }
+        if (AX25_DEF_AXDEFMODE) {
+                ax25->modulus = AX25_EMODULUS;
+                ax25->window  = AX25_DEF_EWINDOW;
        } else {
-                ax25->rtt     = AX25_DEF_T1 / 2;
+                ax25->modulus = AX25_MODULUS;
-                ax25->t1      = AX25_DEF_T1;
+                ax25->window  = AX25_DEF_WINDOW;
-                ax25->t2      = AX25_DEF_T2;
-                ax25->t3      = AX25_DEF_T3;
-                ax25->n2      = AX25_DEF_N2;
-                ax25->paclen  = AX25_DEF_PACLEN;
-                ax25->idle    = AX25_DEF_IDLE;
-                ax25->backoff = AX25_DEF_BACKOFF;
-                if (AX25_DEF_AXDEFMODE) {
-                        ax25->modulus = AX25_EMODULUS;
-                        ax25->window  = AX25_DEF_EWINDOW;
-                } else {
-                        ax25->modulus = AX25_MODULUS;
-                        ax25->window  = AX25_DEF_WINDOW;
-                }
        }
 }
@@ -1979,24 +1990,6 @@ static struct notifier_block ax25_dev_notifier = {
        .notifier_call =ax25_device_event,
 };
-EXPORT_SYMBOL(ax25_hard_header);
-EXPORT_SYMBOL(ax25_rebuild_header);
-EXPORT_SYMBOL(ax25_findbyuid);
-EXPORT_SYMBOL(ax25_find_cb);
-EXPORT_SYMBOL(ax25_linkfail_register);
-EXPORT_SYMBOL(ax25_linkfail_release);
-EXPORT_SYMBOL(ax25_listen_register);
-EXPORT_SYMBOL(ax25_listen_release);
-EXPORT_SYMBOL(ax25_protocol_register);
-EXPORT_SYMBOL(ax25_protocol_release);
-EXPORT_SYMBOL(ax25_send_frame);
-EXPORT_SYMBOL(ax25_uid_policy);
-EXPORT_SYMBOL(ax25cmp);
-EXPORT_SYMBOL(ax2asc);
-EXPORT_SYMBOL(asc2ax);
-EXPORT_SYMBOL(null_ax25_address);
-EXPORT_SYMBOL(ax25_display_timer);
 static int __init ax25_init(void)
 {
        int rc = proto_register(&ax25_proto, 0);
diff --git a/net/ax25/ax25_addr.c b/net/ax25/ax25_addr.c
index 0164a155b8c4..5f0896ad0042 100644
--- a/net/ax25/ax25_addr.c
+++ b/net/ax25/ax25_addr.c
@@ -11,6 +11,7 @@
 #include <linux/socket.h>
 #include <linux/in.h>
 #include <linux/kernel.h>
+#include <linux/module.h>
 #include <linux/sched.h>
 #include <linux/timer.h>
 #include <linux/string.h>
@@ -33,6 +34,8 @@
 */
 ax25_address null_ax25_address = {{0x40, 0x40, 0x40, 0x40, 0x40, 0x40, 0x00}};
+EXPORT_SYMBOL(null_ax25_address);
 /*
 *      ax25 -> ascii conversion
 */
@@ -64,6 +67,8 @@ char *ax2asc(char *buf, ax25_address *a)
 }
+EXPORT_SYMBOL(ax2asc);
 /*
 *      ascii -> ax25 conversion
 */
@@ -97,6 +102,8 @@ void asc2ax(ax25_address *addr, char *callsign)
        addr->ax25_call[6] &= 0x1E;
 }
+EXPORT_SYMBOL(asc2ax);
 /*
 *      Compare two ax.25 addresses
 */
@@ -116,6 +123,8 @@ int ax25cmp(ax25_address *a, ax25_address *b)
        return 2;                       /* Partial match */
 }
+EXPORT_SYMBOL(ax25cmp);
 /*
 *      Compare two AX.25 digipeater paths.
 */
diff --git a/net/ax25/ax25_ds_timer.c b/net/ax25/ax25_ds_timer.c
index 061083efc1dc..5961459935eb 100644
--- a/net/ax25/ax25_ds_timer.c
+++ b/net/ax25/ax25_ds_timer.c
@@ -61,7 +61,8 @@ void ax25_ds_set_timer(ax25_dev *ax25_dev)
                return;
        del_timer(&ax25_dev->dama.slave_timer);
-        ax25_dev->dama.slave_timeout = ax25_dev->values[AX25_VALUES_DS_TIMEOUT] / 10;
+        ax25_dev->dama.slave_timeout =
+                msecs_to_jiffies(ax25_dev->values[AX25_VALUES_DS_TIMEOUT]) / 10;
        ax25_ds_add_timer(ax25_dev);
 }
diff --git a/net/ax25/ax25_iface.c b/net/ax25/ax25_iface.c
index d68aff100729..3bb152710b77 100644
--- a/net/ax25/ax25_iface.c
+++ b/net/ax25/ax25_iface.c
@@ -12,6 +12,7 @@
 #include <linux/socket.h>
 #include <linux/in.h>
 #include <linux/kernel.h>
+#include <linux/module.h>
 #include <linux/sched.h>
 #include <linux/spinlock.h>
 #include <linux/timer.h>
@@ -74,6 +75,8 @@ int ax25_protocol_register(unsigned int pid,
        return 1;
 }
+EXPORT_SYMBOL(ax25_protocol_register);
 void ax25_protocol_release(unsigned int pid)
 {
        struct protocol_struct *s, *protocol;
@@ -106,6 +109,8 @@ void ax25_protocol_release(unsigned int pid)
        write_unlock(&protocol_list_lock);
 }
+EXPORT_SYMBOL(ax25_protocol_release);
 int ax25_linkfail_register(void (*func)(ax25_cb *, int))
 {
        struct linkfail_struct *linkfail;
@@ -123,6 +128,8 @@ int ax25_linkfail_register(void (*func)(ax25_cb *, int))
        return 1;
 }
+EXPORT_SYMBOL(ax25_linkfail_register);
 void ax25_linkfail_release(void (*func)(ax25_cb *, int))
 {
        struct linkfail_struct *s, *linkfail;
@@ -155,6 +162,8 @@ void ax25_linkfail_release(void (*func)(ax25_cb *, int))
        spin_unlock_bh(&linkfail_lock);
 }
+EXPORT_SYMBOL(ax25_linkfail_release);
 int ax25_listen_register(ax25_address *callsign, struct net_device *dev)
 {
        struct listen_struct *listen;
@@ -176,6 +185,8 @@ int ax25_listen_register(ax25_address *callsign, struct net_device *dev)
        return 1;
 }
+EXPORT_SYMBOL(ax25_listen_register);
 void ax25_listen_release(ax25_address *callsign, struct net_device *dev)
 {
        struct listen_struct *s, *listen;
@@ -208,6 +219,8 @@ void ax25_listen_release(ax25_address *callsign, struct net_device *dev)
        spin_unlock_bh(&listen_lock);
 }
+EXPORT_SYMBOL(ax25_listen_release);
 int (*ax25_protocol_function(unsigned int pid))(struct sk_buff *, ax25_cb *)
 {
        int (*res)(struct sk_buff *, ax25_cb *) = NULL;
diff --git a/net/ax25/ax25_ip.c b/net/ax25/ax25_ip.c
index d643dac3eccc..a0b534f80f17 100644
--- a/net/ax25/ax25_ip.c
+++ b/net/ax25/ax25_ip.c
@@ -12,6 +12,7 @@
 #include <linux/socket.h>
 #include <linux/in.h>
 #include <linux/kernel.h>
+#include <linux/module.h>
 #include <linux/sched.h>
 #include <linux/timer.h>
 #include <linux/string.h>
@@ -221,3 +222,5 @@ int ax25_rebuild_header(struct sk_buff *skb)
 #endif
+EXPORT_SYMBOL(ax25_hard_header);
+EXPORT_SYMBOL(ax25_rebuild_header);
diff --git a/net/ax25/ax25_out.c b/net/ax25/ax25_out.c
index 5fc048dcd39a..5d99852b239c 100644
--- a/net/ax25/ax25_out.c
+++ b/net/ax25/ax25_out.c
@@ -14,6 +14,7 @@
 #include <linux/socket.h>
 #include <linux/in.h>
 #include <linux/kernel.h>
+#include <linux/module.h>
 #include <linux/sched.h>
 #include <linux/timer.h>
 #include <linux/string.h>
@@ -104,6 +105,8 @@ ax25_cb *ax25_send_frame(struct sk_buff *skb, int paclen, ax25_address *src, ax2
        return ax25;                    /* We had to create it */
 }
+EXPORT_SYMBOL(ax25_send_frame);
 /*
 *      All outgoing AX.25 I frames pass via this routine. Therefore this is
 *      where the fragmentation of frames takes place. If fragment is set to
diff --git a/net/ax25/ax25_route.c b/net/ax25/ax25_route.c
index f04f8630fd28..5ac98250797b 100644
--- a/net/ax25/ax25_route.c
+++ b/net/ax25/ax25_route.c
@@ -360,7 +360,7 @@ struct file_operations ax25_route_fops = {
 /*
 *      Find AX.25 route
 *
- *      Only routes with a refernce rout of zero can be destroyed.
+ *      Only routes with a reference count of zero can be destroyed.
 */
 static ax25_route *ax25_get_route(ax25_address *addr, struct net_device *dev)
 {
diff --git a/net/ax25/ax25_timer.c b/net/ax25/ax25_timer.c
index 7a6b50a14554..ec254057f212 100644
--- a/net/ax25/ax25_timer.c
+++ b/net/ax25/ax25_timer.c
@@ -18,6 +18,7 @@
 #include <linux/socket.h>
 #include <linux/in.h>
 #include <linux/kernel.h>
+#include <linux/module.h>
 #include <linux/jiffies.h>
 #include <linux/timer.h>
 #include <linux/string.h>
@@ -137,6 +138,8 @@ unsigned long ax25_display_timer(struct timer_list *timer)
        return timer->expires - jiffies;
 }
+EXPORT_SYMBOL(ax25_display_timer);
 static void ax25_heartbeat_expiry(unsigned long param)
 {
        int proto = AX25_PROTO_STD_SIMPLEX;
diff --git a/net/ax25/ax25_uid.c b/net/ax25/ax25_uid.c
index b8b5854bce9a..5e9a81e8b214 100644
--- a/net/ax25/ax25_uid.c
+++ b/net/ax25/ax25_uid.c
@@ -49,6 +49,8 @@ static DEFINE_RWLOCK(ax25_uid_lock);
 int ax25_uid_policy = 0;
+EXPORT_SYMBOL(ax25_uid_policy);
 ax25_uid_assoc *ax25_findbyuid(uid_t uid)
 {
        ax25_uid_assoc *ax25_uid, *res = NULL;
@@ -67,6 +69,8 @@ ax25_uid_assoc *ax25_findbyuid(uid_t uid)
        return res;
 }
+EXPORT_SYMBOL(ax25_findbyuid);
 int ax25_uid_ioctl(int cmd, struct sockaddr_ax25 *sax)
 {
        ax25_uid_assoc *ax25_uid;
diff --git a/net/ax25/sysctl_net_ax25.c b/net/ax25/sysctl_net_ax25.c
index 894a22558d9d..bdb64c36df12 100644
--- a/net/ax25/sysctl_net_ax25.c
+++ b/net/ax25/sysctl_net_ax25.c
@@ -18,14 +18,14 @@ static int min_backoff[1],		max_backoff[] = {2};
 static int min_conmode[1],              max_conmode[] = {2};
 static int min_window[] = {1},          max_window[] = {7};
 static int min_ewindow[] = {1},         max_ewindow[] = {63};
-static int min_t1[] = {1},              max_t1[] = {30 * HZ};
+static int min_t1[] = {1},              max_t1[] = {30000};
-static int min_t2[] = {1},              max_t2[] = {20 * HZ};
+static int min_t2[] = {1},              max_t2[] = {20000};
-static int min_t3[1],                   max_t3[] = {3600 * HZ};
+static int min_t3[1],                   max_t3[] = {3600000};
-static int min_idle[1],                 max_idle[] = {65535 * HZ};
+static int min_idle[1],                 max_idle[] = {65535000};
 static int min_n2[] = {1},              max_n2[] = {31};
 static int min_paclen[] = {1},          max_paclen[] = {512};
 static int min_proto[1],                max_proto[] = { AX25_PROTO_MAX };
-static int min_ds_timeout[1],           max_ds_timeout[] = {65535 * HZ};
+static int min_ds_timeout[1],           max_ds_timeout[] = {65535000};
 static struct ctl_table_header *ax25_table_header;
diff --git a/net/bridge/br.c b/net/bridge/br.c
index 22d806cf40ca..12da21afb9ca 100644
--- a/net/bridge/br.c
+++ b/net/bridge/br.c
@@ -55,7 +55,7 @@ static int __init br_init(void)
 static void __exit br_deinit(void)
 {
-        llc_sap_close(br_stp_sap);
+        rcu_assign_pointer(br_stp_sap->rcv_func, NULL);
 #ifdef CONFIG_BRIDGE_NETFILTER
        br_netfilter_fini();
@@ -67,6 +67,7 @@ static void __exit br_deinit(void)
        synchronize_net();
+        llc_sap_put(br_stp_sap);
        br_fdb_get_hook = NULL;
        br_fdb_put_hook = NULL;
diff --git a/net/bridge/br_forward.c b/net/bridge/br_forward.c
index 2d24fb400e0c..56f3aa47e758 100644
--- a/net/bridge/br_forward.c
+++ b/net/bridge/br_forward.c
@@ -16,6 +16,7 @@
 #include <linux/kernel.h>
 #include <linux/netdevice.h>
 #include <linux/skbuff.h>
+#include <linux/if_vlan.h>
 #include <linux/netfilter_bridge.h>
 #include "br_private.h"
@@ -29,10 +30,15 @@ static inline int should_deliver(const struct net_bridge_port *p,
        return 1;
 }
+static inline unsigned packet_length(const struct sk_buff *skb)
+{
+        return skb->len - (skb->protocol == htons(ETH_P_8021Q) ? VLAN_HLEN : 0);
+}
 int br_dev_queue_push_xmit(struct sk_buff *skb)
 {
        /* drop mtu oversized packets except tso */
-        if (skb->len > skb->dev->mtu && !skb_shinfo(skb)->tso_size)
+        if (packet_length(skb) > skb->dev->mtu && !skb_shinfo(skb)->tso_size)
                kfree_skb(skb);
        else {
 #ifdef CONFIG_BRIDGE_NETFILTER
diff --git a/net/bridge/br_if.c b/net/bridge/br_if.c
index 59eef42d4a42..f5d47bf4f967 100644
--- a/net/bridge/br_if.c
+++ b/net/bridge/br_if.c
@@ -300,34 +300,22 @@ int br_add_bridge(const char *name)
        rtnl_lock();
        if (strchr(dev->name, '%')) {
                ret = dev_alloc_name(dev, dev->name);
-                if (ret < 0)
+                if (ret < 0) {
-                        goto err1;
+                        free_netdev(dev);
+                        goto out;
+                }
        }
        ret = register_netdevice(dev);
        if (ret)
-                goto err2;
+                goto out;
-        /* network device kobject is not setup until
-         * after rtnl_unlock does it's hotplug magic.
-         * so hold reference to avoid race.
-         */
-        dev_hold(dev);
-        rtnl_unlock();
        ret = br_sysfs_addbr(dev);
-        dev_put(dev);
+        if (ret)
+                unregister_netdevice(dev);
-        if (ret) 
-                unregister_netdev(dev);
 out:
-        return ret;
- err2:
-        free_netdev(dev);
- err1:
        rtnl_unlock();
-        goto out;
+        return ret;
 }
 int br_del_bridge(const char *name)
diff --git a/net/bridge/br_input.c b/net/bridge/br_input.c
index b0b7f55c1edd..bfa4d8c333f7 100644
--- a/net/bridge/br_input.c
+++ b/net/bridge/br_input.c
@@ -66,6 +66,7 @@ int br_handle_frame_finish(struct sk_buff *skb)
        }
        if (is_multicast_ether_addr(dest)) {
+                br->statistics.multicast++;
                br_flood_forward(br, skb, !passedup);
                if (!passedup)
                        br_pass_frame_up(br, skb);
diff --git a/net/bridge/netfilter/ebt_log.c b/net/bridge/netfilter/ebt_log.c
index d159c92cca84..466ed3440b74 100644
--- a/net/bridge/netfilter/ebt_log.c
+++ b/net/bridge/netfilter/ebt_log.c
@@ -168,7 +168,7 @@ static void ebt_log(const struct sk_buff *skb, unsigned int hooknr,
        if (info->bitmask & EBT_LOG_NFLOG)
                nf_log_packet(PF_BRIDGE, hooknr, skb, in, out, &li,
-                              info->prefix);
+                              "%s", info->prefix);
        else
                ebt_log_packet(PF_BRIDGE, hooknr, skb, in, out, &li,
                               info->prefix);
diff --git a/net/bridge/netfilter/ebtables.c b/net/bridge/netfilter/ebtables.c
index 84b9af76f0a2..3a13ed643459 100644
--- a/net/bridge/netfilter/ebtables.c
+++ b/net/bridge/netfilter/ebtables.c
@@ -831,7 +831,7 @@ static int translate_table(struct ebt_replace *repl,
                        return -ENOMEM;
                for_each_possible_cpu(i) {
                        newinfo->chainstack[i] =
-                           vmalloc(udc_cnt * sizeof(struct ebt_chainstack));
+                          vmalloc(udc_cnt * sizeof(*(newinfo->chainstack[0])));
                        if (!newinfo->chainstack[i]) {
                                while (i)
                                        vfree(newinfo->chainstack[--i]);
@@ -841,8 +841,7 @@ static int translate_table(struct ebt_replace *repl,
                        }
                }
-                cl_s = (struct ebt_cl_stack *)
+                cl_s = vmalloc(udc_cnt * sizeof(*cl_s));
-                   vmalloc(udc_cnt * sizeof(struct ebt_cl_stack));
                if (!cl_s)
                        return -ENOMEM;
                i = 0; /* the i'th udc */
@@ -944,8 +943,7 @@ static int do_replace(void __user *user, unsigned int len)
        countersize = COUNTER_OFFSET(tmp.nentries) * 
                                        (highest_possible_processor_id()+1);
-        newinfo = (struct ebt_table_info *)
+        newinfo = vmalloc(sizeof(*newinfo) + countersize);
-           vmalloc(sizeof(struct ebt_table_info) + countersize);
        if (!newinfo)
                return -ENOMEM;
@@ -967,8 +965,7 @@ static int do_replace(void __user *user, unsigned int len)
        /* the user wants counters back
           the check on the size is done later, when we have the lock */
        if (tmp.num_counters) {
-                counterstmp = (struct ebt_counter *)
+                counterstmp = vmalloc(tmp.num_counters * sizeof(*counterstmp));
-                   vmalloc(tmp.num_counters * sizeof(struct ebt_counter));
                if (!counterstmp) {
                        ret = -ENOMEM;
                        goto free_entries;
@@ -1148,8 +1145,7 @@ int ebt_register_table(struct ebt_table *table)
        countersize = COUNTER_OFFSET(table->table->nentries) *
                                        (highest_possible_processor_id()+1);
-        newinfo = (struct ebt_table_info *)
+        newinfo = vmalloc(sizeof(*newinfo) + countersize);
-           vmalloc(sizeof(struct ebt_table_info) + countersize);
        ret = -ENOMEM;
        if (!newinfo)
                return -ENOMEM;
@@ -1247,8 +1243,7 @@ static int update_counters(void __user *user, unsigned int len)
        if (hlp.num_counters == 0)
                return -EINVAL;
-        if ( !(tmp = (struct ebt_counter *)
+        if (!(tmp = vmalloc(hlp.num_counters * sizeof(*tmp)))) {
-           vmalloc(hlp.num_counters * sizeof(struct ebt_counter))) ){
                MEMPRINT("Update_counters && nomemory\n");
                return -ENOMEM;
        }
@@ -1377,8 +1372,7 @@ static int copy_everything_to_user(struct ebt_table *t, void __user *user,
                        BUGPRINT("Num_counters wrong\n");
                        return -EINVAL;
                }
-                counterstmp = (struct ebt_counter *)
+                counterstmp = vmalloc(nentries * sizeof(*counterstmp));
-                   vmalloc(nentries * sizeof(struct ebt_counter));
                if (!counterstmp) {
                        MEMPRINT("Couldn't copy counters, out of memory\n");
                        return -ENOMEM;
diff --git a/net/core/dev.c b/net/core/dev.c
index 83231a27ae02..4fba549caf29 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -127,7 +127,7 @@
 *             sure which should go first, but I bet it won't make much
 *             difference if we are running VLANs.  The good news is that
 *             this protocol won't be in the list unless compiled in, so
- *             the average user (w/out VLANs) will not be adversly affected.
+ *             the average user (w/out VLANs) will not be adversely affected.
 *             --BLG
 *
 *              0800    IP
@@ -149,7 +149,7 @@ static struct list_head ptype_base[16];	/* 16 way hashed list */
 static struct list_head ptype_all;              /* Taps */
 /*
- * The @dev_base list is protected by @dev_base_lock and the rtln
+ * The @dev_base list is protected by @dev_base_lock and the rtnl
 * semaphore.
 *
 * Pure readers hold dev_base_lock for reading.
@@ -193,7 +193,7 @@ static inline struct hlist_head *dev_index_hash(int ifindex)
 *      Our notifier list
 */
-static BLOCKING_NOTIFIER_HEAD(netdev_chain);
+static RAW_NOTIFIER_HEAD(netdev_chain);
 /*
 *      Device drivers call our routines to queue packets here. We empty the
@@ -641,10 +641,12 @@ int dev_valid_name(const char *name)
 *      @name: name format string
 *
 *      Passed a format string - eg "lt%d" it will try and find a suitable
- *      id. Not efficient for many devices, not called a lot. The caller
+ *      id. It scans list of devices to build up a free map, then chooses
- *      must hold the dev_base or rtnl lock while allocating the name and
+ *      the first empty slot. The caller must hold the dev_base or rtnl lock
- *      adding the device in order to avoid duplicates. Returns the number
+ *      while allocating the name and adding the device in order to avoid
- *      of the unit assigned or a negative errno code.
+ *      duplicates.
+ *      Limited to bits_per_byte * page size devices (ie 32K on most platforms).
+ *      Returns the number of the unit assigned or a negative errno code.
 */
 int dev_alloc_name(struct net_device *dev, const char *name)
@@ -736,7 +738,7 @@ int dev_change_name(struct net_device *dev, char *newname)
        if (!err) {
                hlist_del(&dev->name_hlist);
                hlist_add_head(&dev->name_hlist, dev_name_hash(dev->name));
-                blocking_notifier_call_chain(&netdev_chain,
+                raw_notifier_call_chain(&netdev_chain,
                                NETDEV_CHANGENAME, dev);
        }
@@ -744,14 +746,14 @@ int dev_change_name(struct net_device *dev, char *newname)
 }
 /**
- *      netdev_features_change - device changes fatures
+ *      netdev_features_change - device changes features
 *      @dev: device to cause notification
 *
 *      Called to indicate a device has changed features.
 */
 void netdev_features_change(struct net_device *dev)
 {
-        blocking_notifier_call_chain(&netdev_chain, NETDEV_FEAT_CHANGE, dev);
+        raw_notifier_call_chain(&netdev_chain, NETDEV_FEAT_CHANGE, dev);
 }
 EXPORT_SYMBOL(netdev_features_change);
@@ -766,7 +768,7 @@ EXPORT_SYMBOL(netdev_features_change);
 void netdev_state_change(struct net_device *dev)
 {
        if (dev->flags & IFF_UP) {
-                blocking_notifier_call_chain(&netdev_chain,
+                raw_notifier_call_chain(&netdev_chain,
                                NETDEV_CHANGE, dev);
                rtmsg_ifinfo(RTM_NEWLINK, dev, 0);
        }
@@ -864,7 +866,7 @@ int dev_open(struct net_device *dev)
                /*
                 *      ... and announce new interface.
                 */
-                blocking_notifier_call_chain(&netdev_chain, NETDEV_UP, dev);
+                raw_notifier_call_chain(&netdev_chain, NETDEV_UP, dev);
        }
        return ret;
 }
@@ -887,7 +889,7 @@ int dev_close(struct net_device *dev)
         *      Tell people we are going down, so that they can
         *      prepare to death, when device is still operating.
         */
-        blocking_notifier_call_chain(&netdev_chain, NETDEV_GOING_DOWN, dev);
+        raw_notifier_call_chain(&netdev_chain, NETDEV_GOING_DOWN, dev);
        dev_deactivate(dev);
@@ -924,7 +926,7 @@ int dev_close(struct net_device *dev)
        /*
         * Tell people we are down
         */
-        blocking_notifier_call_chain(&netdev_chain, NETDEV_DOWN, dev);
+        raw_notifier_call_chain(&netdev_chain, NETDEV_DOWN, dev);
        return 0;
 }
@@ -955,7 +957,7 @@ int register_netdevice_notifier(struct notifier_block *nb)
        int err;
        rtnl_lock();
-        err = blocking_notifier_chain_register(&netdev_chain, nb);
+        err = raw_notifier_chain_register(&netdev_chain, nb);
        if (!err) {
                for (dev = dev_base; dev; dev = dev->next) {
                        nb->notifier_call(nb, NETDEV_REGISTER, dev);
@@ -983,7 +985,7 @@ int unregister_netdevice_notifier(struct notifier_block *nb)
        int err;
        rtnl_lock();
-        err = blocking_notifier_chain_unregister(&netdev_chain, nb);
+        err = raw_notifier_chain_unregister(&netdev_chain, nb);
        rtnl_unlock();
        return err;
 }
@@ -994,12 +996,12 @@ int unregister_netdevice_notifier(struct notifier_block *nb)
 *      @v:   pointer passed unmodified to notifier function
 *
 *      Call all network notifier blocks.  Parameters and return value
- *      are as for blocking_notifier_call_chain().
+ *      are as for raw_notifier_call_chain().
 */
 int call_netdevice_notifiers(unsigned long val, void *v)
 {
-        return blocking_notifier_call_chain(&netdev_chain, val, v);
+        return raw_notifier_call_chain(&netdev_chain, val, v);
 }
 /* When > 0 there are consumers of rx skb time stamps */
@@ -2196,7 +2198,7 @@ int netdev_set_master(struct net_device *slave, struct net_device *master)
 *      @dev: device
 *      @inc: modifier
 *
- *      Add or remove promsicuity from a device. While the count in the device
+ *      Add or remove promiscuity from a device. While the count in the device
 *      remains above zero the interface remains promiscuous. Once it hits zero
 *      the device reverts back to normal filtering operation. A negative inc
 *      value is used to drop promiscuity on the device.
@@ -2308,7 +2310,7 @@ int dev_change_flags(struct net_device *dev, unsigned flags)
        if (dev->flags & IFF_UP &&
            ((old_flags ^ dev->flags) &~ (IFF_UP | IFF_PROMISC | IFF_ALLMULTI |
                                          IFF_VOLATILE)))
-                blocking_notifier_call_chain(&netdev_chain,
+                raw_notifier_call_chain(&netdev_chain,
                                NETDEV_CHANGE, dev);
        if ((flags ^ dev->gflags) & IFF_PROMISC) {
@@ -2353,7 +2355,7 @@ int dev_set_mtu(struct net_device *dev, int new_mtu)
        else
                dev->mtu = new_mtu;
        if (!err && dev->flags & IFF_UP)
-                blocking_notifier_call_chain(&netdev_chain,
+                raw_notifier_call_chain(&netdev_chain,
                                NETDEV_CHANGEMTU, dev);
        return err;
 }
@@ -2370,7 +2372,7 @@ int dev_set_mac_address(struct net_device *dev, struct sockaddr *sa)
                return -ENODEV;
        err = dev->set_mac_address(dev, sa);
        if (!err)
-                blocking_notifier_call_chain(&netdev_chain,
+                raw_notifier_call_chain(&netdev_chain,
                                NETDEV_CHANGEADDR, dev);
        return err;
 }
@@ -2427,7 +2429,7 @@ static int dev_ifsioc(struct ifreq *ifr, unsigned int cmd)
                                return -EINVAL;
                        memcpy(dev->broadcast, ifr->ifr_hwaddr.sa_data,
                               min(sizeof ifr->ifr_hwaddr.sa_data, (size_t) dev->addr_len));
-                        blocking_notifier_call_chain(&netdev_chain,
+                        raw_notifier_call_chain(&netdev_chain,
                                            NETDEV_CHANGEADDR, dev);
                        return 0;
@@ -2698,7 +2700,8 @@ int dev_ioctl(unsigned int cmd, void __user *arg)
                                /* If command is `set a parameter', or
                                 * `get the encoding parameters', check if
                                 * the user has the right to do it */
-                                if (IW_IS_SET(cmd) || cmd == SIOCGIWENCODE) {
+                                if (IW_IS_SET(cmd) || cmd == SIOCGIWENCODE
+                                    || cmd == SIOCGIWENCODEEXT) {
                                        if (!capable(CAP_NET_ADMIN))
                                                return -EPERM;
                                }
@@ -2776,6 +2779,8 @@ int register_netdevice(struct net_device *dev)
        BUG_ON(dev_boot_phase);
        ASSERT_RTNL();
+        might_sleep();
        /* When net_device's are persistent, this will be fatal. */
        BUG_ON(dev->reg_state != NETREG_UNINITIALIZED);
@@ -2862,6 +2867,11 @@ int register_netdevice(struct net_device *dev)
        if (!dev->rebuild_header)
                dev->rebuild_header = default_rebuild_header;
+        ret = netdev_register_sysfs(dev);
+        if (ret)
+                goto out_err;
+        dev->reg_state = NETREG_REGISTERED;
        /*
         *      Default initial state at registry is that the
         *      device is present.
@@ -2877,14 +2887,11 @@ int register_netdevice(struct net_device *dev)
        hlist_add_head(&dev->name_hlist, head);
        hlist_add_head(&dev->index_hlist, dev_index_hash(dev->ifindex));
        dev_hold(dev);
-        dev->reg_state = NETREG_REGISTERING;
        write_unlock_bh(&dev_base_lock);
        /* Notify protocols, that a new device appeared. */
-        blocking_notifier_call_chain(&netdev_chain, NETDEV_REGISTER, dev);
+        raw_notifier_call_chain(&netdev_chain, NETDEV_REGISTER, dev);
-        /* Finish registration after unlock */
-        net_set_todo(dev);
        ret = 0;
 out:
@@ -2960,7 +2967,7 @@ static void netdev_wait_allrefs(struct net_device *dev)
                        rtnl_lock();
                        /* Rebroadcast unregister notification */
-                        blocking_notifier_call_chain(&netdev_chain,
+                        raw_notifier_call_chain(&netdev_chain,
                                            NETDEV_UNREGISTER, dev);
                        if (test_bit(__LINK_STATE_LINKWATCH_PENDING,
@@ -3007,7 +3014,7 @@ static void netdev_wait_allrefs(struct net_device *dev)
 *
 * We are invoked by rtnl_unlock() after it drops the semaphore.
 * This allows us to deal with problems:
- * 1) We can create/delete sysfs objects which invoke hotplug
+ * 1) We can delete sysfs objects which invoke hotplug
 *    without deadlocking with linkwatch via keventd.
 * 2) Since we run with the RTNL semaphore not held, we can sleep
 *    safely in order to wait for the netdev refcnt to drop to zero.
@@ -3016,8 +3023,6 @@ static DEFINE_MUTEX(net_todo_run_mutex);
 void netdev_run_todo(void)
 {
        struct list_head list = LIST_HEAD_INIT(list);
-        int err;
        /* Need to guard against multiple cpu's getting out of order. */
        mutex_lock(&net_todo_run_mutex);
@@ -3040,40 +3045,29 @@ void netdev_run_todo(void)
                        = list_entry(list.next, struct net_device, todo_list);
                list_del(&dev->todo_list);
-                switch(dev->reg_state) {
+                if (unlikely(dev->reg_state != NETREG_UNREGISTERING)) {
-                case NETREG_REGISTERING:
+                        printk(KERN_ERR "network todo '%s' but state %d\n",
-                        dev->reg_state = NETREG_REGISTERED;
+                               dev->name, dev->reg_state);
-                        err = netdev_register_sysfs(dev);
+                        dump_stack();
-                        if (err)
+                        continue;
-                                printk(KERN_ERR "%s: failed sysfs registration (%d)\n",
+                }
-                                       dev->name, err);
-                        break;
-                case NETREG_UNREGISTERING:
-                        netdev_unregister_sysfs(dev);
-                        dev->reg_state = NETREG_UNREGISTERED;
-                        netdev_wait_allrefs(dev);
-                        /* paranoia */
+                netdev_unregister_sysfs(dev);
-                        BUG_ON(atomic_read(&dev->refcnt));
+                dev->reg_state = NETREG_UNREGISTERED;
-                        BUG_TRAP(!dev->ip_ptr);
-                        BUG_TRAP(!dev->ip6_ptr);
-                        BUG_TRAP(!dev->dn_ptr);
+                netdev_wait_allrefs(dev);
-                        /* It must be the very last action, 
+                /* paranoia */
-                         * after this 'dev' may point to freed up memory.
+                BUG_ON(atomic_read(&dev->refcnt));
-                         */
+                BUG_TRAP(!dev->ip_ptr);
-                        if (dev->destructor)
+                BUG_TRAP(!dev->ip6_ptr);
-                                dev->destructor(dev);
+                BUG_TRAP(!dev->dn_ptr);
-                        break;
-                default:
+                /* It must be the very last action,
-                        printk(KERN_ERR "network todo '%s' but state %d\n",
+                 * after this 'dev' may point to freed up memory.
-                               dev->name, dev->reg_state);
+                 */
-                        break;
+                if (dev->destructor)
-                }
+                        dev->destructor(dev);
        }
 out:
@@ -3130,7 +3124,7 @@ EXPORT_SYMBOL(alloc_netdev);
 void free_netdev(struct net_device *dev)
 {
 #ifdef CONFIG_SYSFS
-        /*  Compatiablity with error handling in drivers */
+        /*  Compatibility with error handling in drivers */
        if (dev->reg_state == NETREG_UNINITIALIZED) {
                kfree((char *)dev - dev->padded);
                return;
@@ -3215,7 +3209,7 @@ int unregister_netdevice(struct net_device *dev)
        /* Notify protocols, that we are about to destroy
           this device. They should clean all the things.
        */
-        blocking_notifier_call_chain(&netdev_chain, NETDEV_UNREGISTER, dev);
+        raw_notifier_call_chain(&netdev_chain, NETDEV_UNREGISTER, dev);
        
        /*
         *      Flush the multicast chain
diff --git a/net/core/filter.c b/net/core/filter.c
index 93fbd01d2259..5b4486a60cf6 100644
--- a/net/core/filter.c
+++ b/net/core/filter.c
@@ -34,6 +34,7 @@
 #include <linux/timer.h>
 #include <asm/system.h>
 #include <asm/uaccess.h>
+#include <asm/unaligned.h>
 #include <linux/filter.h>
 /* No hurry in this branch */
@@ -177,7 +178,7 @@ unsigned int sk_run_filter(struct sk_buff *skb, struct sock_filter *filter, int
 load_w:
                        ptr = load_pointer(skb, k, 4, &tmp);
                        if (ptr != NULL) {
-                                A = ntohl(*(u32 *)ptr);
+                                A = ntohl(get_unaligned((u32 *)ptr));
                                continue;
                        }
                        break;
@@ -186,7 +187,7 @@ load_w:
 load_h:
                        ptr = load_pointer(skb, k, 2, &tmp);
                        if (ptr != NULL) {
-                                A = ntohs(*(u16 *)ptr);
+                                A = ntohs(get_unaligned((u16 *)ptr));
                                continue;
                        }
                        break;
diff --git a/net/core/link_watch.c b/net/core/link_watch.c
index 341de44c7ed1..646937cc2d84 100644
--- a/net/core/link_watch.c
+++ b/net/core/link_watch.c
@@ -170,13 +170,13 @@ void linkwatch_fire_event(struct net_device *dev)
                spin_unlock_irqrestore(&lweventlist_lock, flags);
                if (!test_and_set_bit(LW_RUNNING, &linkwatch_flags)) {
-                        unsigned long thisevent = jiffies;
+                        unsigned long delay = linkwatch_nextevent - jiffies;
-                        if (thisevent >= linkwatch_nextevent) {
+                        /* If we wrap around we'll delay it by at most HZ. */
+                        if (!delay || delay > HZ)
                                schedule_work(&linkwatch_work);
-                        } else {
+                        else
-                                schedule_delayed_work(&linkwatch_work, linkwatch_nextevent - thisevent);
+                                schedule_delayed_work(&linkwatch_work, delay);
-                        }
                }
        }
 }
diff --git a/net/core/neighbour.c b/net/core/neighbour.c
index 4cf878efdb49..50a8c73caf97 100644
--- a/net/core/neighbour.c
+++ b/net/core/neighbour.c
@@ -1326,8 +1326,7 @@ void neigh_parms_destroy(struct neigh_parms *parms)
        kfree(parms);
 }
+void neigh_table_init_no_netlink(struct neigh_table *tbl)
-void neigh_table_init(struct neigh_table *tbl)
 {
        unsigned long now = jiffies;
        unsigned long phsize;
@@ -1383,10 +1382,27 @@ void neigh_table_init(struct neigh_table *tbl)
        tbl->last_flush = now;
        tbl->last_rand  = now + tbl->parms.reachable_time * 20;
+}
+void neigh_table_init(struct neigh_table *tbl)
+{
+        struct neigh_table *tmp;
+        neigh_table_init_no_netlink(tbl);
        write_lock(&neigh_tbl_lock);
+        for (tmp = neigh_tables; tmp; tmp = tmp->next) {
+                if (tmp->family == tbl->family)
+                        break;
+        }
        tbl->next       = neigh_tables;
        neigh_tables    = tbl;
        write_unlock(&neigh_tbl_lock);
+        if (unlikely(tmp)) {
+                printk(KERN_ERR "NEIGH: Registering multiple tables for "
+                       "family %d\n", tbl->family);
+                dump_stack();
+        }
 }
 int neigh_table_clear(struct neigh_table *tbl)
@@ -2657,6 +2673,7 @@ EXPORT_SYMBOL(neigh_rand_reach_time);
 EXPORT_SYMBOL(neigh_resolve_output);
 EXPORT_SYMBOL(neigh_table_clear);
 EXPORT_SYMBOL(neigh_table_init);
+EXPORT_SYMBOL(neigh_table_init_no_netlink);
 EXPORT_SYMBOL(neigh_update);
 EXPORT_SYMBOL(neigh_update_hhs);
 EXPORT_SYMBOL(pneigh_enqueue);
diff --git a/net/core/net-sysfs.c b/net/core/net-sysfs.c
index c12990c9c603..47a6fceb6771 100644
--- a/net/core/net-sysfs.c
+++ b/net/core/net-sysfs.c
@@ -29,7 +29,7 @@ static const char fmt_ulong[] = "%lu\n";
 static inline int dev_isalive(const struct net_device *dev) 
 {
-        return dev->reg_state == NETREG_REGISTERED;
+        return dev->reg_state <= NETREG_REGISTERED;
 }
 /* use same locking rules as GIF* ioctl's */
@@ -445,58 +445,33 @@ static struct class net_class = {
 void netdev_unregister_sysfs(struct net_device * net)
 {
-        struct class_device * class_dev = &(net->class_dev);
+        class_device_del(&(net->class_dev));
-        if (net->get_stats)
-                sysfs_remove_group(&class_dev->kobj, &netstat_group);
-#ifdef WIRELESS_EXT
-        if (net->get_wireless_stats || (net->wireless_handlers &&
-                        net->wireless_handlers->get_wireless_stats))
-                sysfs_remove_group(&class_dev->kobj, &wireless_group);
-#endif
-        class_device_del(class_dev);
 }
 /* Create sysfs entries for network device. */
 int netdev_register_sysfs(struct net_device *net)
 {
        struct class_device *class_dev = &(net->class_dev);
-        int ret;
+        struct attribute_group **groups = net->sysfs_groups;
+        class_device_initialize(class_dev);
        class_dev->class = &net_class;
        class_dev->class_data = net;
+        class_dev->groups = groups;
+        BUILD_BUG_ON(BUS_ID_SIZE < IFNAMSIZ);
        strlcpy(class_dev->class_id, net->name, BUS_ID_SIZE);
-        if ((ret = class_device_register(class_dev)))
-                goto out;
-        if (net->get_stats &&
+        if (net->get_stats)
-            (ret = sysfs_create_group(&class_dev->kobj, &netstat_group)))
+                *groups++ = &netstat_group;
-                goto out_unreg; 
 #ifdef WIRELESS_EXT
-        if (net->get_wireless_stats || (net->wireless_handlers &&
+        if (net->get_wireless_stats
-                        net->wireless_handlers->get_wireless_stats)) {
+            || (net->wireless_handlers && net->wireless_handlers->get_wireless_stats))
-                ret = sysfs_create_group(&class_dev->kobj, &wireless_group);
+                *groups++ = &wireless_group;
-                if (ret)
-                        goto out_cleanup;
-        }
-        return 0;
-out_cleanup:
-        if (net->get_stats)
-                sysfs_remove_group(&class_dev->kobj, &netstat_group);
-#else
-        return 0;
 #endif
-out_unreg:
+        return class_device_add(class_dev);
-        printk(KERN_WARNING "%s: sysfs attribute registration failed %d\n",
-               net->name, ret);
-        class_device_unregister(class_dev);
-out:
-        return ret;
 }
 int netdev_sysfs_init(void)
diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index 09464fa8d72f..fb3770f9c094 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -112,6 +112,14 @@ void skb_under_panic(struct sk_buff *skb, int sz, void *here)
        BUG();
 }
+void skb_truesize_bug(struct sk_buff *skb)
+{
+        printk(KERN_ERR "SKB BUG: Invalid truesize (%u) "
+               "len=%u, sizeof(sk_buff)=%Zd\n",
+               skb->truesize, skb->len, sizeof(struct sk_buff));
+}
+EXPORT_SYMBOL(skb_truesize_bug);
 /*      Allocate a new skbuff. We do this ourselves so we can fill in a few
 *      'private' fields and also do memory statistics to find all the
 *      [BEEP] leaks.
diff --git a/net/core/stream.c b/net/core/stream.c
index 35e25259fd95..e9489696f694 100644
--- a/net/core/stream.c
+++ b/net/core/stream.c
@@ -176,6 +176,7 @@ void sk_stream_rfree(struct sk_buff *skb)
 {
        struct sock *sk = skb->sk;
+        skb_truesize_check(skb);
        atomic_sub(skb->truesize, &sk->sk_rmem_alloc);
        sk->sk_forward_alloc += skb->truesize;
 }
diff --git a/net/core/wireless.c b/net/core/wireless.c
index 81d6995fcfdb..d2bc72d318f7 100644
--- a/net/core/wireless.c
+++ b/net/core/wireless.c
@@ -1726,6 +1726,14 @@ int wireless_rtnetlink_get(struct net_device *	dev,
        if(!IW_IS_GET(request->cmd))
                return -EOPNOTSUPP;
+        /* If command is `get the encoding parameters', check if
+         * the user has the right to do it */
+        if (request->cmd == SIOCGIWENCODE ||
+            request->cmd == SIOCGIWENCODEEXT) {
+                if (!capable(CAP_NET_ADMIN))
+                        return -EPERM;
+        }
        /* Special cases */
        if(request->cmd == SIOCGIWSTATS)
                /* Get Wireless Stats */
diff --git a/net/dccp/proto.c b/net/dccp/proto.c
index 1ff7328b0e17..2e0ee8355c41 100644
--- a/net/dccp/proto.c
+++ b/net/dccp/proto.c
@@ -848,6 +848,7 @@ static int dccp_close_state(struct sock *sk)
 void dccp_close(struct sock *sk, long timeout)
 {
        struct sk_buff *skb;
+        int state;
        lock_sock(sk);
@@ -882,6 +883,11 @@ void dccp_close(struct sock *sk, long timeout)
        sk_stream_wait_close(sk, timeout);
 adjudge_to_death:
+        state = sk->sk_state;
+        sock_hold(sk);
+        sock_orphan(sk);
+        atomic_inc(sk->sk_prot->orphan_count);
        /*
         * It is the last release_sock in its life. It will remove backlog.
         */
@@ -894,8 +900,9 @@ adjudge_to_death:
        bh_lock_sock(sk);
        BUG_TRAP(!sock_owned_by_user(sk));
-        sock_hold(sk);
+        /* Have we already been destroyed by a softirq or backlog? */
-        sock_orphan(sk);
+        if (state != DCCP_CLOSED && sk->sk_state == DCCP_CLOSED)
+                goto out;
        /*
         * The last release_sock may have processed the CLOSE or RESET
@@ -915,12 +922,12 @@ adjudge_to_death:
 #endif
        }
-        atomic_inc(sk->sk_prot->orphan_count);
        if (sk->sk_state == DCCP_CLOSED)
                inet_csk_destroy_sock(sk);
        /* Otherwise, socket is reprieved until protocol close. */
+out:
        bh_unlock_sock(sk);
        local_bh_enable();
        sock_put(sk);
diff --git a/net/decnet/dn_neigh.c b/net/decnet/dn_neigh.c
index 7c8692c26bfe..66e230c3b328 100644
--- a/net/decnet/dn_neigh.c
+++ b/net/decnet/dn_neigh.c
@@ -493,7 +493,6 @@ struct elist_cb_state {
 static void neigh_elist_cb(struct neighbour *neigh, void *_info)
 {
        struct elist_cb_state *s = _info;
-        struct dn_dev *dn_db;
        struct dn_neigh *dn;
        if (neigh->dev != s->dev)
@@ -503,10 +502,6 @@ static void neigh_elist_cb(struct neighbour *neigh, void *_info)
        if (!(dn->flags & (DN_NDFLAG_R1|DN_NDFLAG_R2)))
                return;
-        dn_db = (struct dn_dev *) s->dev->dn_ptr;
-        if (dn_db->parms.forwarding == 1 && (dn->flags & DN_NDFLAG_R2))
-                return;
        if (s->t == s->n)
                s->rs = dn_find_slot(s->ptr, s->n, dn->priority);
        else
diff --git a/net/ethernet/Makefile b/net/ethernet/Makefile
index 69b74a9a0fc3..7cef1d8ace27 100644
--- a/net/ethernet/Makefile
+++ b/net/ethernet/Makefile
@@ -3,6 +3,5 @@
 #
 obj-y                                   += eth.o
-obj-$(CONFIG_SYSCTL)                    += sysctl_net_ether.o
 obj-$(subst m,y,$(CONFIG_IPX))          += pe2.o
 obj-$(subst m,y,$(CONFIG_ATALK))        += pe2.o
diff --git a/net/ethernet/sysctl_net_ether.c b/net/ethernet/sysctl_net_ether.c
deleted file mode 100644
index 66b39fc342d2..000000000000
--- a/net/ethernet/sysctl_net_ether.c
+++ /dev/null
@@ -1,14 +0,0 @@
-/* -*- linux-c -*-
- * sysctl_net_ether.c: sysctl interface to net Ethernet subsystem.
- *
- * Begun April 1, 1996, Mike Shaver.
- * Added /proc/sys/net/ether directory entry (empty =) ). [MS]
- */
-#include <linux/mm.h>
-#include <linux/sysctl.h>
-#include <linux/if_ether.h>
-ctl_table ether_table[] = {
-        {0}
-};
diff --git a/net/ieee80211/softmac/Kconfig b/net/ieee80211/softmac/Kconfig
index 6cd9f3427be6..f2a27cc6ecb1 100644
--- a/net/ieee80211/softmac/Kconfig
+++ b/net/ieee80211/softmac/Kconfig
@@ -1,6 +1,7 @@
 config IEEE80211_SOFTMAC
        tristate "Software MAC add-on to the IEEE 802.11 networking stack"
        depends on IEEE80211 && EXPERIMENTAL
+        select WIRELESS_EXT
        ---help---
        This option enables the hardware independent software MAC addon
        for the IEEE 802.11 networking stack.
diff --git a/net/ieee80211/softmac/ieee80211softmac_assoc.c b/net/ieee80211/softmac/ieee80211softmac_assoc.c
index be61de78dfa4..57ea9f6f465c 100644
--- a/net/ieee80211/softmac/ieee80211softmac_assoc.c
+++ b/net/ieee80211/softmac/ieee80211softmac_assoc.c
@@ -51,11 +51,12 @@ ieee80211softmac_assoc(struct ieee80211softmac_device *mac, struct ieee80211soft
        spin_lock_irqsave(&mac->lock, flags);
        mac->associnfo.associating = 1;
        mac->associated = 0; /* just to make sure */
-        spin_unlock_irqrestore(&mac->lock, flags);
        /* Set a timer for timeout */
        /* FIXME: make timeout configurable */
-        schedule_delayed_work(&mac->associnfo.timeout, 5 * HZ);
+        if (likely(mac->running))
+                schedule_delayed_work(&mac->associnfo.timeout, 5 * HZ);
+        spin_unlock_irqrestore(&mac->lock, flags);
 }
 void
@@ -101,6 +102,7 @@ ieee80211softmac_disassoc(struct ieee80211softmac_device *mac, u16 reason)
        /* Do NOT clear bssvalid as that will break ieee80211softmac_assoc_work! */
        mac->associated = 0;
        mac->associnfo.associating = 0;
+        ieee80211softmac_call_events_locked(mac, IEEE80211SOFTMAC_EVENT_DISASSOCIATED, NULL);
        spin_unlock_irqrestore(&mac->lock, flags);
 }
@@ -143,6 +145,12 @@ network_matches_request(struct ieee80211softmac_device *mac, struct ieee80211_ne
        if (!we_support_all_basic_rates(mac, net->rates_ex, net->rates_ex_len))
                return 0;
+        /* assume that users know what they're doing ...
+         * (note we don't let them select a net we're incompatible with) */
+        if (mac->associnfo.bssfixed) {
+                return !memcmp(mac->associnfo.bssid, net->bssid, ETH_ALEN);
+        }
        /* if 'ANY' network requested, take any that doesn't have privacy enabled */
        if (mac->associnfo.req_essid.len == 0 
            && !(net->capability & WLAN_CAPABILITY_PRIVACY))
@@ -175,7 +183,7 @@ ieee80211softmac_assoc_work(void *d)
                ieee80211softmac_disassoc(mac, WLAN_REASON_DISASSOC_STA_HAS_LEFT);
        /* try to find the requested network in our list, if we found one already */
-        if (mac->associnfo.bssvalid)
+        if (mac->associnfo.bssvalid || mac->associnfo.bssfixed)
                found = ieee80211softmac_get_network_by_bssid(mac, mac->associnfo.bssid);       
        
        /* Search the ieee80211 networks for this network if we didn't find it by bssid,
@@ -240,19 +248,25 @@ ieee80211softmac_assoc_work(void *d)
                        if (ieee80211softmac_start_scan(mac))
                                dprintk(KERN_INFO PFX "Associate: failed to initiate scan. Is device up?\n");
                        return;
-                }
+                } else {
-                else {
                        spin_lock_irqsave(&mac->lock, flags);
                        mac->associnfo.associating = 0;
                        mac->associated = 0;
                        spin_unlock_irqrestore(&mac->lock, flags);
                        dprintk(KERN_INFO PFX "Unable to find matching network after scan!\n");
+                        /* reset the retry counter for the next user request since we
+                         * break out and don't reschedule ourselves after this point. */
+                        mac->associnfo.scan_retry = IEEE80211SOFTMAC_ASSOC_SCAN_RETRY_LIMIT;
                        ieee80211softmac_call_events(mac, IEEE80211SOFTMAC_EVENT_ASSOCIATE_NET_NOT_FOUND, NULL);
                        return;
                }
        }
-        
+        /* reset the retry counter for the next user request since we
+         * now found a net and will try to associate to it, but not
+         * schedule this function again. */
+        mac->associnfo.scan_retry = IEEE80211SOFTMAC_ASSOC_SCAN_RETRY_LIMIT;
        mac->associnfo.bssvalid = 1;
        memcpy(mac->associnfo.bssid, found->bssid, ETH_ALEN);
        /* copy the ESSID for displaying it */
@@ -306,6 +320,9 @@ ieee80211softmac_handle_assoc_response(struct net_device * dev,
        u16 status = le16_to_cpup(&resp->status);
        struct ieee80211softmac_network *network = NULL;
        unsigned long flags;
+        if (unlikely(!mac->running))
+                return -ENODEV;
        
        spin_lock_irqsave(&mac->lock, flags);
@@ -364,15 +381,22 @@ ieee80211softmac_handle_disassoc(struct net_device * dev,
 {
        struct ieee80211softmac_device *mac = ieee80211_priv(dev);
        unsigned long flags;
+        if (unlikely(!mac->running))
+                return -ENODEV;
        if (memcmp(disassoc->header.addr2, mac->associnfo.bssid, ETH_ALEN))
                return 0;
        if (memcmp(disassoc->header.addr1, mac->dev->dev_addr, ETH_ALEN))
                return 0;
        dprintk(KERN_INFO PFX "got disassoc frame\n");
        netif_carrier_off(dev);
        spin_lock_irqsave(&mac->lock, flags);
        mac->associnfo.bssvalid = 0;
        mac->associated = 0;
+        ieee80211softmac_call_events_locked(mac, IEEE80211SOFTMAC_EVENT_DISASSOCIATED, NULL);
        schedule_work(&mac->associnfo.work);
        spin_unlock_irqrestore(&mac->lock, flags);
        
@@ -386,11 +410,15 @@ ieee80211softmac_handle_reassoc_req(struct net_device * dev,
        struct ieee80211softmac_device *mac = ieee80211_priv(dev);
        struct ieee80211softmac_network *network;
+        if (unlikely(!mac->running))
+                return -ENODEV;
        network = ieee80211softmac_get_network_by_bssid(mac, resp->header.addr3);
        if (!network) {
                dprintkl(KERN_INFO PFX "reassoc request from unknown network\n");
                return 0;
        }
-        ieee80211softmac_assoc(mac, network);
+        schedule_work(&mac->associnfo.work);
        return 0;
 }
diff --git a/net/ieee80211/softmac/ieee80211softmac_auth.c b/net/ieee80211/softmac/ieee80211softmac_auth.c
index 9a0eac6c61eb..06e332624665 100644
--- a/net/ieee80211/softmac/ieee80211softmac_auth.c
+++ b/net/ieee80211/softmac/ieee80211softmac_auth.c
@@ -86,6 +86,11 @@ ieee80211softmac_auth_queue(void *data)
                
                /* Lock and set flags */
                spin_lock_irqsave(&mac->lock, flags);
+                if (unlikely(!mac->running)) {
+                        /* Prevent reschedule on workqueue flush */
+                        spin_unlock_irqrestore(&mac->lock, flags);
+                        return;
+                }
                net->authenticated = 0;
                net->authenticating = 1;
                /* add a timeout call so we eventually give up waiting for an auth reply */
@@ -124,6 +129,9 @@ ieee80211softmac_auth_resp(struct net_device *dev, struct ieee80211_auth *auth)
        unsigned long flags;
        u8 * data;
        
+        if (unlikely(!mac->running))
+                return -ENODEV;
        /* Find correct auth queue item */
        spin_lock_irqsave(&mac->lock, flags);
        list_for_each(list_ptr, &mac->auth_queue) {
@@ -298,8 +306,6 @@ ieee80211softmac_deauth_from_net(struct ieee80211softmac_device *mac,
        
        /* can't transmit data right now... */
        netif_carrier_off(mac->dev);
-        /* let's try to re-associate */
-        schedule_work(&mac->associnfo.work);
        spin_unlock_irqrestore(&mac->lock, flags);
 }
@@ -338,6 +344,9 @@ ieee80211softmac_deauth_resp(struct net_device *dev, struct ieee80211_deauth *de
        struct ieee80211softmac_network *net = NULL;
        struct ieee80211softmac_device *mac = ieee80211_priv(dev);
        
+        if (unlikely(!mac->running))
+                return -ENODEV;
        if (!deauth) {
                dprintk("deauth without deauth packet. eek!\n");
                return 0;
@@ -360,5 +369,8 @@ ieee80211softmac_deauth_resp(struct net_device *dev, struct ieee80211_deauth *de
        }
        ieee80211softmac_deauth_from_net(mac, net);
+        /* let's try to re-associate */
+        schedule_work(&mac->associnfo.work);
        return 0;
 }
diff --git a/net/ieee80211/softmac/ieee80211softmac_event.c b/net/ieee80211/softmac/ieee80211softmac_event.c
index 0a52bbda1e4c..8cc8f3f0f8e7 100644
--- a/net/ieee80211/softmac/ieee80211softmac_event.c
+++ b/net/ieee80211/softmac/ieee80211softmac_event.c
@@ -67,6 +67,7 @@ static char *event_descriptions[IEEE80211SOFTMAC_EVENT_LAST+1] = {
        "authenticating failed",
        "authenticating timed out",
        "associating failed because no suitable network was found",
+        "disassociated",
 };
@@ -128,13 +129,42 @@ void
 ieee80211softmac_call_events_locked(struct ieee80211softmac_device *mac, int event, void *event_ctx)
 {
        struct ieee80211softmac_event *eventptr, *tmp;
-        union iwreq_data wrqu;
+        struct ieee80211softmac_network *network;
-        char *msg;
        
        if (event >= 0) {
-                msg = event_descriptions[event];
+                union iwreq_data wrqu;
-                wrqu.data.length = strlen(msg);
+                int we_event;
-                wireless_send_event(mac->dev, IWEVCUSTOM, &wrqu, msg);
+                char *msg = NULL;
+                switch(event) {
+                case IEEE80211SOFTMAC_EVENT_ASSOCIATED:
+                        network = (struct ieee80211softmac_network *)event_ctx;
+                        wrqu.data.length = 0;
+                        wrqu.data.flags = 0;
+                        memcpy(wrqu.ap_addr.sa_data, &network->bssid[0], ETH_ALEN);
+                        wrqu.ap_addr.sa_family = ARPHRD_ETHER;
+                        we_event = SIOCGIWAP;
+                        break;
+                case IEEE80211SOFTMAC_EVENT_DISASSOCIATED:
+                        wrqu.data.length = 0;
+                        wrqu.data.flags = 0;
+                        memset(&wrqu, '\0', sizeof (union iwreq_data));
+                        wrqu.ap_addr.sa_family = ARPHRD_ETHER;
+                        we_event = SIOCGIWAP;
+                        break;
+                case IEEE80211SOFTMAC_EVENT_SCAN_FINISHED:
+                        wrqu.data.length = 0;
+                        wrqu.data.flags = 0;
+                        memset(&wrqu, '\0', sizeof (union iwreq_data));
+                        we_event = SIOCGIWSCAN;
+                        break;
+                default:
+                        msg = event_descriptions[event];
+                        wrqu.data.length = strlen(msg);
+                        we_event = IWEVCUSTOM;
+                        break;
+                }
+                wireless_send_event(mac->dev, we_event, &wrqu, msg);
        }
        if (!list_empty(&mac->events))
diff --git a/net/ieee80211/softmac/ieee80211softmac_io.c b/net/ieee80211/softmac/ieee80211softmac_io.c
index febc51dbb412..cc6cd56c85b1 100644
--- a/net/ieee80211/softmac/ieee80211softmac_io.c
+++ b/net/ieee80211/softmac/ieee80211softmac_io.c
@@ -180,9 +180,21 @@ ieee80211softmac_assoc_req(struct ieee80211_assoc_request **pkt,
        ieee80211softmac_hdr_3addr(mac, &((*pkt)->header), IEEE80211_STYPE_ASSOC_REQ, net->bssid, net->bssid);
        /* Fill in capability Info */
-        (*pkt)->capability = (mac->ieee->iw_mode == IW_MODE_MASTER) || (mac->ieee->iw_mode == IW_MODE_INFRA) ?
+        switch (mac->ieee->iw_mode) {
-                cpu_to_le16(WLAN_CAPABILITY_ESS) :
+        case IW_MODE_INFRA:
-                cpu_to_le16(WLAN_CAPABILITY_IBSS);
+                (*pkt)->capability = cpu_to_le16(WLAN_CAPABILITY_ESS);
+                break;
+        case IW_MODE_ADHOC:
+                (*pkt)->capability = cpu_to_le16(WLAN_CAPABILITY_IBSS);
+                break;
+        case IW_MODE_AUTO:
+                (*pkt)->capability = net->capabilities & (WLAN_CAPABILITY_ESS|WLAN_CAPABILITY_IBSS);
+                break;
+        default:
+                /* bleh. we don't ever go to these modes */
+                printk(KERN_ERR PFX "invalid iw_mode!\n");
+                break;
+        }
        /* Need to add this
        (*pkt)->capability |= mac->ieee->short_slot ? 
                        cpu_to_le16(WLAN_CAPABILITY_SHORT_SLOT_TIME) : 0;
diff --git a/net/ieee80211/softmac/ieee80211softmac_module.c b/net/ieee80211/softmac/ieee80211softmac_module.c
index 60f06a31f0d1..6252be2c0db9 100644
--- a/net/ieee80211/softmac/ieee80211softmac_module.c
+++ b/net/ieee80211/softmac/ieee80211softmac_module.c
@@ -45,6 +45,8 @@ struct net_device *alloc_ieee80211softmac(int sizeof_priv)
        softmac->ieee->handle_disassoc = ieee80211softmac_handle_disassoc;
        softmac->scaninfo = NULL;
+        softmac->associnfo.scan_retry = IEEE80211SOFTMAC_ASSOC_SCAN_RETRY_LIMIT;
        /* TODO: initialise all the other callbacks in the ieee struct
         *       (once they're written)
         */
@@ -87,6 +89,8 @@ ieee80211softmac_clear_pending_work(struct ieee80211softmac_device *sm)
        ieee80211softmac_wait_for_scan(sm);
        
        spin_lock_irqsave(&sm->lock, flags);
+        sm->running = 0;
        /* Free all pending assoc work items */
        cancel_delayed_work(&sm->associnfo.work);
        
@@ -202,6 +206,8 @@ void ieee80211softmac_start(struct net_device *dev)
                assert(0);
        if (mac->txrates_change)
                mac->txrates_change(dev, change, &oldrates);
+        mac->running = 1;
 }
 EXPORT_SYMBOL_GPL(ieee80211softmac_start);
diff --git a/net/ieee80211/softmac/ieee80211softmac_scan.c b/net/ieee80211/softmac/ieee80211softmac_scan.c
index bb9ab8b45d09..d31cf77498c4 100644
--- a/net/ieee80211/softmac/ieee80211softmac_scan.c
+++ b/net/ieee80211/softmac/ieee80211softmac_scan.c
@@ -47,6 +47,7 @@ ieee80211softmac_start_scan(struct ieee80211softmac_device *sm)
        sm->scanning = 1;
        spin_unlock_irqrestore(&sm->lock, flags);
+        netif_tx_disable(sm->ieee->dev);
        ret = sm->start_scan(sm->dev);
        if (ret) {
                spin_lock_irqsave(&sm->lock, flags);
@@ -114,7 +115,15 @@ void ieee80211softmac_scan(void *d)
                        // TODO: is this if correct, or should we do this only if scanning from assoc request?
                        if (sm->associnfo.req_essid.len)
                                ieee80211softmac_send_mgt_frame(sm, &sm->associnfo.req_essid, IEEE80211_STYPE_PROBE_REQ, 0);
+                        spin_lock_irqsave(&sm->lock, flags);
+                        if (unlikely(!sm->running)) {
+                                /* Prevent reschedule on workqueue flush */
+                                spin_unlock_irqrestore(&sm->lock, flags);
+                                break;
+                        }
                        schedule_delayed_work(&si->softmac_scan, IEEE80211SOFTMAC_PROBE_DELAY);
+                        spin_unlock_irqrestore(&sm->lock, flags);
                        return;
                } else {
                        dprintk(PFX "Not probing Channel %d (not allowed here)\n", si->channels[current_channel_idx].channel);
@@ -239,6 +248,7 @@ void ieee80211softmac_scan_finished(struct ieee80211softmac_device *sm)
                if (net)
                        sm->set_channel(sm->dev, net->channel);
        }
+        netif_wake_queue(sm->ieee->dev);
        ieee80211softmac_call_events(sm, IEEE80211SOFTMAC_EVENT_SCAN_FINISHED, NULL);
 }
 EXPORT_SYMBOL_GPL(ieee80211softmac_scan_finished);
diff --git a/net/ieee80211/softmac/ieee80211softmac_wx.c b/net/ieee80211/softmac/ieee80211softmac_wx.c
index b559aa9b5507..27edb2b5581a 100644
--- a/net/ieee80211/softmac/ieee80211softmac_wx.c
+++ b/net/ieee80211/softmac/ieee80211softmac_wx.c
@@ -27,7 +27,8 @@
 #include "ieee80211softmac_priv.h"
 #include <net/iw_handler.h>
+/* for is_broadcast_ether_addr and is_zero_ether_addr */
+#include <linux/etherdevice.h>
 int
 ieee80211softmac_wx_trigger_scan(struct net_device *net_dev,
@@ -41,13 +42,23 @@ ieee80211softmac_wx_trigger_scan(struct net_device *net_dev,
 EXPORT_SYMBOL_GPL(ieee80211softmac_wx_trigger_scan);
+/* if we're still scanning, return -EAGAIN so that userspace tools
+ * can get the complete scan results, otherwise return 0. */
 int
 ieee80211softmac_wx_get_scan_results(struct net_device *net_dev,
                                     struct iw_request_info *info,
                                     union iwreq_data *data,
                                     char *extra)
 {
+        unsigned long flags;
        struct ieee80211softmac_device *sm = ieee80211_priv(net_dev);
+        spin_lock_irqsave(&sm->lock, flags);
+        if (sm->scanning) {
+                spin_unlock_irqrestore(&sm->lock, flags);
+                return -EAGAIN;
+        }
+        spin_unlock_irqrestore(&sm->lock, flags);
        return ieee80211_wx_get_scan(sm->ieee, info, data, extra);
 }
 EXPORT_SYMBOL_GPL(ieee80211softmac_wx_get_scan_results);
@@ -73,7 +84,6 @@ ieee80211softmac_wx_set_essid(struct net_device *net_dev,
                        sm->associnfo.static_essid = 1;
                }
        }
-        sm->associnfo.scan_retry = IEEE80211SOFTMAC_ASSOC_SCAN_RETRY_LIMIT;
        /* set our requested ESSID length.
         * If applicable, we have already copied the data in */
@@ -300,8 +310,6 @@ ieee80211softmac_wx_set_wap(struct net_device *net_dev,
                            char *extra)
 {
        struct ieee80211softmac_device *mac = ieee80211_priv(net_dev);
-        static const unsigned char any[] = {0xff, 0xff, 0xff, 0xff, 0xff, 0xff};
-        static const unsigned char off[] = {0x00, 0x00, 0x00, 0x00, 0x00, 0x00};
        unsigned long flags;
        /* sanity check */
@@ -310,10 +318,17 @@ ieee80211softmac_wx_set_wap(struct net_device *net_dev,
        }
        spin_lock_irqsave(&mac->lock, flags);
-        if (!memcmp(any, data->ap_addr.sa_data, ETH_ALEN) ||
+        if (is_broadcast_ether_addr(data->ap_addr.sa_data)) {
-            !memcmp(off, data->ap_addr.sa_data, ETH_ALEN)) {
+                /* the bssid we have is not to be fixed any longer,
-                schedule_work(&mac->associnfo.work);
+                 * and we should reassociate to the best AP. */
-                goto out;
+                mac->associnfo.bssfixed = 0;
+                /* force reassociation */
+                mac->associnfo.bssvalid = 0;
+                if (mac->associated)
+                        schedule_work(&mac->associnfo.work);
+        } else if (is_zero_ether_addr(data->ap_addr.sa_data)) {
+                /* the bssid we have is no longer fixed */
+                mac->associnfo.bssfixed = 0;
        } else {
                if (!memcmp(mac->associnfo.bssid, data->ap_addr.sa_data, ETH_ALEN)) {
                        if (mac->associnfo.associating || mac->associated) {
@@ -323,12 +338,14 @@ ieee80211softmac_wx_set_wap(struct net_device *net_dev,
                } else {
                        /* copy new value in data->ap_addr.sa_data to bssid */
                        memcpy(mac->associnfo.bssid, data->ap_addr.sa_data, ETH_ALEN);
-                }       
+                }
+                /* tell the other code that this bssid should be used no matter what */
+                mac->associnfo.bssfixed = 1;
                /* queue associate if new bssid or (old one again and not associated) */
                schedule_work(&mac->associnfo.work);
        }
-out:
+ out:
        spin_unlock_irqrestore(&mac->lock, flags);
        return 0;
 }
diff --git a/net/ipv4/af_inet.c b/net/ipv4/af_inet.c
index dc206f1f914f..0a277453526b 100644
--- a/net/ipv4/af_inet.c
+++ b/net/ipv4/af_inet.c
@@ -1257,7 +1257,7 @@ out_unregister_udp_proto:
        goto out;
 }
-module_init(inet_init);
+fs_initcall(inet_init);
 /* ------------------------------------------------------------------------ */
diff --git a/net/ipv4/arp.c b/net/ipv4/arp.c
index 041dadde31af..4749d504c629 100644
--- a/net/ipv4/arp.c
+++ b/net/ipv4/arp.c
@@ -928,7 +928,8 @@ static void parp_redo(struct sk_buff *skb)
 *      Receive an arp request from the device layer.
 */
-int arp_rcv(struct sk_buff *skb, struct net_device *dev, struct packet_type *pt, struct net_device *orig_dev)
+static int arp_rcv(struct sk_buff *skb, struct net_device *dev,
+                   struct packet_type *pt, struct net_device *orig_dev)
 {
        struct arphdr *arp;
@@ -1417,7 +1418,6 @@ static int __init arp_proc_init(void)
 EXPORT_SYMBOL(arp_broken_ops);
 EXPORT_SYMBOL(arp_find);
-EXPORT_SYMBOL(arp_rcv);
 EXPORT_SYMBOL(arp_create);
 EXPORT_SYMBOL(arp_xmit);
 EXPORT_SYMBOL(arp_send);
diff --git a/net/ipv4/devinet.c b/net/ipv4/devinet.c
index 81c2f7885292..54419b27686f 100644
--- a/net/ipv4/devinet.c
+++ b/net/ipv4/devinet.c
@@ -1556,7 +1556,6 @@ void __init devinet_init(void)
 #endif
 }
-EXPORT_SYMBOL(devinet_ioctl);
 EXPORT_SYMBOL(in_dev_finish_destroy);
 EXPORT_SYMBOL(inet_select_addr);
 EXPORT_SYMBOL(inetdev_by_index);
diff --git a/net/ipv4/fib_frontend.c b/net/ipv4/fib_frontend.c
index 4e3d3811dea2..cdde96390960 100644
--- a/net/ipv4/fib_frontend.c
+++ b/net/ipv4/fib_frontend.c
@@ -666,4 +666,3 @@ void __init ip_fib_init(void)
 }
 EXPORT_SYMBOL(inet_addr_type);
-EXPORT_SYMBOL(ip_rt_ioctl);
diff --git a/net/ipv4/inet_hashtables.c b/net/ipv4/inet_hashtables.c
index ef7366fc132f..ee9b5515b9ae 100644
--- a/net/ipv4/inet_hashtables.c
+++ b/net/ipv4/inet_hashtables.c
@@ -43,8 +43,6 @@ struct inet_bind_bucket *inet_bind_bucket_create(kmem_cache_t *cachep,
        return tb;
 }
-EXPORT_SYMBOL(inet_bind_bucket_create);
 /*
 * Caller must hold hashbucket lock for this tb with local BH disabled
 */
@@ -64,8 +62,6 @@ void inet_bind_hash(struct sock *sk, struct inet_bind_bucket *tb,
        inet_csk(sk)->icsk_bind_hash = tb;
 }
-EXPORT_SYMBOL(inet_bind_hash);
 /*
 * Get rid of any references to a local port held by the given sock.
 */
diff --git a/net/ipv4/ip_input.c b/net/ipv4/ip_input.c
index 18d7fad474d7..c9026dbf4c93 100644
--- a/net/ipv4/ip_input.c
+++ b/net/ipv4/ip_input.c
@@ -337,7 +337,7 @@ static inline int ip_rcv_finish(struct sk_buff *skb)
         *      Initialise the virtual path cache for the packet. It describes
         *      how the packet travels inside Linux networking.
         */ 
-        if (likely(skb->dst == NULL)) {
+        if (skb->dst == NULL) {
                int err = ip_route_input(skb, iph->daddr, iph->saddr, iph->tos,
                                         skb->dev);
                if (unlikely(err)) {
diff --git a/net/ipv4/ip_options.c b/net/ipv4/ip_options.c
index 9bebad07bf2e..cbcae6544622 100644
--- a/net/ipv4/ip_options.c
+++ b/net/ipv4/ip_options.c
@@ -209,7 +209,7 @@ int ip_options_echo(struct ip_options * dopt, struct sk_buff * skb)
 void ip_options_fragment(struct sk_buff * skb) 
 {
-        unsigned char * optptr = skb->nh.raw;
+        unsigned char * optptr = skb->nh.raw + sizeof(struct iphdr);
        struct ip_options * opt = &(IPCB(skb)->opt);
        int  l = opt->optlen;
        int  optlen;
diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c
index 8dcba3887f04..cff9c3a72daf 100644
--- a/net/ipv4/ip_output.c
+++ b/net/ipv4/ip_output.c
@@ -904,7 +904,7 @@ alloc_new_skb:
                         * because we have no idea what fragment will be
                         * the last.
                         */
-                        if (datalen == length)
+                        if (datalen == length + fraggap)
                                alloclen += rt->u.dst.trailer_len;
                        if (transhdrlen) {
diff --git a/net/ipv4/ipcomp.c b/net/ipv4/ipcomp.c
index 04a429465665..95278b22b669 100644
--- a/net/ipv4/ipcomp.c
+++ b/net/ipv4/ipcomp.c
@@ -210,7 +210,7 @@ static void ipcomp4_err(struct sk_buff *skb, u32 info)
            skb->h.icmph->code != ICMP_FRAG_NEEDED)
                return;
-        spi = ntohl(ntohs(ipch->cpi));
+        spi = htonl(ntohs(ipch->cpi));
        x = xfrm_state_lookup((xfrm_address_t *)&iph->daddr,
                              spi, IPPROTO_COMP, AF_INET);
        if (!x)
@@ -290,11 +290,8 @@ static void ipcomp_free_scratches(void)
        if (!scratches)
                return;
-        for_each_possible_cpu(i) {
+        for_each_possible_cpu(i)
-                void *scratch = *per_cpu_ptr(scratches, i);
+                vfree(*per_cpu_ptr(scratches, i));
-                if (scratch)
-                        vfree(scratch);
-        }
        free_percpu(scratches);
 }
diff --git a/net/ipv4/netfilter/Kconfig b/net/ipv4/netfilter/Kconfig
index c60fd5c4ea1e..d4072533da21 100644
--- a/net/ipv4/netfilter/Kconfig
+++ b/net/ipv4/netfilter/Kconfig
@@ -170,8 +170,8 @@ config IP_NF_PPTP
          Documentation/modules.txt.  If unsure, say `N'.
 config IP_NF_H323
-        tristate  'H.323 protocol support'
+        tristate  'H.323 protocol support (EXPERIMENTAL)'
-        depends on IP_NF_CONNTRACK
+        depends on IP_NF_CONNTRACK && EXPERIMENTAL
        help
          H.323 is a VoIP signalling protocol from ITU-T. As one of the most
          important VoIP protocols, it is widely used by voice hardware and
@@ -345,7 +345,7 @@ config IP_NF_TARGET_LOG
          To compile it as a module, choose M here.  If unsure, say N.
 config IP_NF_TARGET_ULOG
-        tristate "ULOG target support (OBSOLETE)"
+        tristate "ULOG target support"
        depends on IP_NF_IPTABLES
        ---help---
diff --git a/net/ipv4/netfilter/arp_tables.c b/net/ipv4/netfilter/arp_tables.c
index c2d92f99a2b8..d0d19192026d 100644
--- a/net/ipv4/netfilter/arp_tables.c
+++ b/net/ipv4/netfilter/arp_tables.c
@@ -948,7 +948,7 @@ static int do_add_counters(void __user *user, unsigned int len)
        write_lock_bh(&t->lock);
        private = t->private;
-        if (private->number != paddc->num_counters) {
+        if (private->number != tmp.num_counters) {
                ret = -EINVAL;
                goto unlock_up_free;
        }
diff --git a/net/ipv4/netfilter/ip_conntrack_core.c b/net/ipv4/netfilter/ip_conntrack_core.c
index 979a2eac6f00..a297da7bbef5 100644
--- a/net/ipv4/netfilter/ip_conntrack_core.c
+++ b/net/ipv4/netfilter/ip_conntrack_core.c
@@ -1318,6 +1318,7 @@ getorigdst(struct sock *sk, int optval, void __user *user, int *len)
                        .tuple.dst.u.tcp.port;
                sin.sin_addr.s_addr = ct->tuplehash[IP_CT_DIR_ORIGINAL]
                        .tuple.dst.ip;
+                memset(sin.sin_zero, 0, sizeof(sin.sin_zero));
                DEBUGP("SO_ORIGINAL_DST: %u.%u.%u.%u %u\n",
                       NIPQUAD(sin.sin_addr.s_addr), ntohs(sin.sin_port));
diff --git a/net/ipv4/netfilter/ip_conntrack_helper_h323.c b/net/ipv4/netfilter/ip_conntrack_helper_h323.c
index 2c2fb700d835..518f581d39ec 100644
--- a/net/ipv4/netfilter/ip_conntrack_helper_h323.c
+++ b/net/ipv4/netfilter/ip_conntrack_helper_h323.c
@@ -162,6 +162,8 @@ static int get_tpkt_data(struct sk_buff **pskb, struct ip_conntrack *ct,
        /* Validate TPKT length */
        tpktlen = tpkt[2] * 256 + tpkt[3];
+        if (tpktlen < 4)
+                goto clear_out;
        if (tpktlen > tcpdatalen) {
                if (tcpdatalen == 4) {  /* Separate TPKT header */
                        /* Netmeeting sends TPKT header and data separately */
diff --git a/net/ipv4/netfilter/ip_conntrack_helper_h323_asn1.c b/net/ipv4/netfilter/ip_conntrack_helper_h323_asn1.c
index 48078002e450..26dfecadb335 100644
--- a/net/ipv4/netfilter/ip_conntrack_helper_h323_asn1.c
+++ b/net/ipv4/netfilter/ip_conntrack_helper_h323_asn1.c
@@ -2,7 +2,7 @@
 * ip_conntrack_helper_h323_asn1.c - BER and PER decoding library for H.323
 *                                   conntrack/NAT module.
 *
- * Copyright (c) 2006 by Jing Min Zhao <zhaojingmin@hotmail.com>
+ * Copyright (c) 2006 by Jing Min Zhao <zhaojingmin@users.sourceforge.net>
 *
 * This source code is licensed under General Public License version 2.
 *
@@ -528,14 +528,15 @@ int decode_seq(bitstr_t * bs, field_t * f, char *base, int level)
                        /* Decode */
                        if ((err = (Decoders[son->type]) (bs, son, base,
-                                                          level + 1)) >
+                                                          level + 1)) <
-                            H323_ERROR_STOP)
+                            H323_ERROR_NONE)
                                return err;
                        bs->cur = beg + len;
                        bs->bit = 0;
                } else if ((err = (Decoders[son->type]) (bs, son, base,
-                                                         level + 1)))
+                                                         level + 1)) <
+                           H323_ERROR_NONE)
                        return err;
        }
@@ -554,7 +555,7 @@ int decode_seq(bitstr_t * bs, field_t * f, char *base, int level)
        /* Decode the extension components */
        for (opt = 0; opt < bmp2_len; opt++, i++, son++) {
-                if (son->attr & STOP) {
+                if (i < f->ub && son->attr & STOP) {
                        PRINT("%*.s%s\n", (level + 1) * TAB_SIZE, " ",
                              son->name);
                        return H323_ERROR_STOP;
@@ -584,8 +585,8 @@ int decode_seq(bitstr_t * bs, field_t * f, char *base, int level)
                beg = bs->cur;
                if ((err = (Decoders[son->type]) (bs, son, base,
-                                                  level + 1)) >
+                                                  level + 1)) <
-                    H323_ERROR_STOP)
+                    H323_ERROR_NONE)
                        return err;
                bs->cur = beg + len;
@@ -660,18 +661,20 @@ int decode_seqof(bitstr_t * bs, field_t * f, char *base, int level)
                                                          i <
                                                          effective_count ?
                                                          base : NULL,
-                                                          level + 1)) >
+                                                          level + 1)) <
-                            H323_ERROR_STOP)
+                            H323_ERROR_NONE)
                                return err;
                        bs->cur = beg + len;
                        bs->bit = 0;
                } else
-                    if ((err = (Decoders[son->type]) (bs, son,
+                        if ((err = (Decoders[son->type]) (bs, son,
-                                                      i < effective_count ?
+                                                          i <
-                                                      base : NULL,
+                                                          effective_count ?
-                                                      level + 1)))
+                                                          base : NULL,
-                        return err;
+                                                          level + 1)) <
+                            H323_ERROR_NONE)
+                                return err;
                if (base)
                        base += son->offset;
@@ -703,6 +706,10 @@ int decode_choice(bitstr_t * bs, field_t * f, char *base, int level)
                type = get_bits(bs, f->sz);
        }
+        /* Write Type */
+        if (base)
+                *(unsigned *) base = type;
        /* Check Range */
        if (type >= f->ub) {    /* Newer version? */
                BYTE_ALIGN(bs);
@@ -712,10 +719,6 @@ int decode_choice(bitstr_t * bs, field_t * f, char *base, int level)
                return H323_ERROR_NONE;
        }
-        /* Write Type */
-        if (base)
-                *(unsigned *) base = type;
        /* Transfer to son level */
        son = &f->fields[type];
        if (son->attr & STOP) {
@@ -735,13 +738,14 @@ int decode_choice(bitstr_t * bs, field_t * f, char *base, int level)
                }
                beg = bs->cur;
-                if ((err = (Decoders[son->type]) (bs, son, base, level + 1)) >
+                if ((err = (Decoders[son->type]) (bs, son, base, level + 1)) <
-                    H323_ERROR_STOP)
+                    H323_ERROR_NONE)
                        return err;
                bs->cur = beg + len;
                bs->bit = 0;
-        } else if ((err = (Decoders[son->type]) (bs, son, base, level + 1)))
+        } else if ((err = (Decoders[son->type]) (bs, son, base, level + 1)) <
+                   H323_ERROR_NONE)
                return err;
        return H323_ERROR_NONE;
diff --git a/net/ipv4/netfilter/ip_conntrack_helper_pptp.c b/net/ipv4/netfilter/ip_conntrack_helper_pptp.c
index 7d3ba4302e9e..8ccfe17bb253 100644
--- a/net/ipv4/netfilter/ip_conntrack_helper_pptp.c
+++ b/net/ipv4/netfilter/ip_conntrack_helper_pptp.c
@@ -469,8 +469,8 @@ pptp_inbound_pkt(struct sk_buff **pskb,
                        DEBUGP("%s but no session\n", pptp_msg_name[msg]);
                        break;
                }
-                if (info->sstate != PPTP_CALL_IN_REP
+                if (info->cstate != PPTP_CALL_IN_REP
-                    && info->sstate != PPTP_CALL_IN_CONF) {
+                    && info->cstate != PPTP_CALL_IN_CONF) {
                        DEBUGP("%s but never sent IN_CALL_REPLY\n",
                                pptp_msg_name[msg]);
                        break;
diff --git a/net/ipv4/netfilter/ip_conntrack_proto_sctp.c b/net/ipv4/netfilter/ip_conntrack_proto_sctp.c
index 5259abd0fb42..0416073c5600 100644
--- a/net/ipv4/netfilter/ip_conntrack_proto_sctp.c
+++ b/net/ipv4/netfilter/ip_conntrack_proto_sctp.c
@@ -235,12 +235,15 @@ static int do_basic_checks(struct ip_conntrack *conntrack,
                        flag = 1;
                }
-                /* Cookie Ack/Echo chunks not the first OR 
+                /*
-                   Init / Init Ack / Shutdown compl chunks not the only chunks */
+                 * Cookie Ack/Echo chunks not the first OR
-                if ((sch->type == SCTP_CID_COOKIE_ACK 
+                 * Init / Init Ack / Shutdown compl chunks not the only chunks
+                 * OR zero-length.
+                 */
+                if (((sch->type == SCTP_CID_COOKIE_ACK
                        || sch->type == SCTP_CID_COOKIE_ECHO
                        || flag)
-                     && count !=0 ) {
+                      && count !=0) || !sch->length) {
                        DEBUGP("Basic checks failed\n");
                        return 1;
                }
diff --git a/net/ipv4/netfilter/ip_nat_proto_gre.c b/net/ipv4/netfilter/ip_nat_proto_gre.c
index 6c4899d8046a..96ceabaec402 100644
--- a/net/ipv4/netfilter/ip_nat_proto_gre.c
+++ b/net/ipv4/netfilter/ip_nat_proto_gre.c
@@ -49,15 +49,15 @@ gre_in_range(const struct ip_conntrack_tuple *tuple,
             const union ip_conntrack_manip_proto *min,
             const union ip_conntrack_manip_proto *max)
 {
-        u_int32_t key;
+        __be16 key;
        if (maniptype == IP_NAT_MANIP_SRC)
                key = tuple->src.u.gre.key;
        else
                key = tuple->dst.u.gre.key;
-        return ntohl(key) >= ntohl(min->gre.key)
+        return ntohs(key) >= ntohs(min->gre.key)
-                && ntohl(key) <= ntohl(max->gre.key);
+                && ntohs(key) <= ntohs(max->gre.key);
 }
 /* generate unique tuple ... */
@@ -81,14 +81,14 @@ gre_unique_tuple(struct ip_conntrack_tuple *tuple,
                min = 1;
                range_size = 0xffff;
        } else {
-                min = ntohl(range->min.gre.key);
+                min = ntohs(range->min.gre.key);
-                range_size = ntohl(range->max.gre.key) - min + 1;
+                range_size = ntohs(range->max.gre.key) - min + 1;
        }
        DEBUGP("min = %u, range_size = %u\n", min, range_size); 
        for (i = 0; i < range_size; i++, key++) {
-                *keyptr = htonl(min + key % range_size);
+                *keyptr = htons(min + key % range_size);
                if (!ip_nat_used_tuple(tuple, conntrack))
                        return 1;
        }
diff --git a/net/ipv4/netfilter/ip_nat_snmp_basic.c b/net/ipv4/netfilter/ip_nat_snmp_basic.c
index c62253845538..c33244263b90 100644
--- a/net/ipv4/netfilter/ip_nat_snmp_basic.c
+++ b/net/ipv4/netfilter/ip_nat_snmp_basic.c
@@ -768,6 +768,7 @@ static unsigned char snmp_object_decode(struct asn1_ctx *ctx,
                        len *= sizeof(unsigned long);
                        *obj = kmalloc(sizeof(struct snmp_object) + len, GFP_ATOMIC);
                        if (*obj == NULL) {
+                                kfree(lp);
                                kfree(id);
                                if (net_ratelimit())
                                        printk("OOM in bsalg (%d)\n", __LINE__);
@@ -1003,12 +1004,12 @@ static unsigned char snmp_trap_decode(struct asn1_ctx *ctx,
                
        return 1;
+err_addr_free:
+        kfree((unsigned long *)trap->ip_address);
 err_id_free:
        kfree(trap->id);
-err_addr_free:
-        kfree((unsigned long *)trap->ip_address);
-        
        return 0;
 }
@@ -1126,11 +1127,10 @@ static int snmp_parse_mangle(unsigned char *msg,
                struct snmp_v1_trap trap;
                unsigned char ret = snmp_trap_decode(&ctx, &trap, map, check);
                
-                /* Discard trap allocations regardless */
+                if (ret) {
-                kfree(trap.id);
+                        kfree(trap.id);
-                kfree((unsigned long *)trap.ip_address);
+                        kfree((unsigned long *)trap.ip_address);
-                
+                } else 
-                if (!ret)
                        return ret;
                
        } else {
diff --git a/net/ipv4/netfilter/ip_nat_standalone.c b/net/ipv4/netfilter/ip_nat_standalone.c
index 8f760b28617e..67e676783da9 100644
--- a/net/ipv4/netfilter/ip_nat_standalone.c
+++ b/net/ipv4/netfilter/ip_nat_standalone.c
@@ -219,8 +219,10 @@ ip_nat_out(unsigned int hooknum,
           const struct net_device *out,
           int (*okfn)(struct sk_buff *))
 {
+#ifdef CONFIG_XFRM
        struct ip_conntrack *ct;
        enum ip_conntrack_info ctinfo;
+#endif
        unsigned int ret;
        /* root is playing with raw sockets. */
diff --git a/net/ipv4/netfilter/ip_tables.c b/net/ipv4/netfilter/ip_tables.c
index d25ac8ba6eba..cee3397ec277 100644
--- a/net/ipv4/netfilter/ip_tables.c
+++ b/net/ipv4/netfilter/ip_tables.c
@@ -956,15 +956,16 @@ struct compat_ipt_standard_target
        compat_int_t verdict;
 };
-#define IPT_ST_OFFSET   (sizeof(struct ipt_standard_target) - \
-                                sizeof(struct compat_ipt_standard_target))
 struct compat_ipt_standard
 {
        struct compat_ipt_entry entry;
        struct compat_ipt_standard_target target;
 };
+#define IPT_ST_LEN              XT_ALIGN(sizeof(struct ipt_standard_target))
+#define IPT_ST_COMPAT_LEN       COMPAT_XT_ALIGN(sizeof(struct compat_ipt_standard_target))
+#define IPT_ST_OFFSET           (IPT_ST_LEN - IPT_ST_COMPAT_LEN)
 static int compat_ipt_standard_fn(void *target,
                void **dstptr, int *size, int convert)
 {
@@ -975,35 +976,29 @@ static int compat_ipt_standard_fn(void *target,
        ret = 0;
        switch (convert) {
                case COMPAT_TO_USER:
-                        pst = (struct ipt_standard_target *)target;
+                        pst = target;
                        memcpy(&compat_st.target, &pst->target,
-                                        sizeof(struct ipt_entry_target));
+                                sizeof(compat_st.target));
                        compat_st.verdict = pst->verdict;
                        if (compat_st.verdict > 0)
                                compat_st.verdict -=
                                        compat_calc_jump(compat_st.verdict);
-                        compat_st.target.u.user.target_size =
+                        compat_st.target.u.user.target_size = IPT_ST_COMPAT_LEN;
-                        sizeof(struct compat_ipt_standard_target);
+                        if (copy_to_user(*dstptr, &compat_st, IPT_ST_COMPAT_LEN))
-                        if (__copy_to_user(*dstptr, &compat_st,
-                                sizeof(struct compat_ipt_standard_target)))
                                ret = -EFAULT;
                        *size -= IPT_ST_OFFSET;
-                        *dstptr += sizeof(struct compat_ipt_standard_target);
+                        *dstptr += IPT_ST_COMPAT_LEN;
                        break;
                case COMPAT_FROM_USER:
-                        pcompat_st =
+                        pcompat_st = target;
-                                (struct compat_ipt_standard_target *)target;
+                        memcpy(&st.target, &pcompat_st->target, IPT_ST_COMPAT_LEN);
-                        memcpy(&st.target, &pcompat_st->target,
-                                        sizeof(struct ipt_entry_target));
                        st.verdict = pcompat_st->verdict;
                        if (st.verdict > 0)
                                st.verdict += compat_calc_jump(st.verdict);
-                        st.target.u.user.target_size =
+                        st.target.u.user.target_size = IPT_ST_LEN;
-                        sizeof(struct ipt_standard_target);
+                        memcpy(*dstptr, &st, IPT_ST_LEN);
-                        memcpy(*dstptr, &st,
-                                        sizeof(struct ipt_standard_target));
                        *size += IPT_ST_OFFSET;
-                        *dstptr += sizeof(struct ipt_standard_target);
+                        *dstptr += IPT_ST_LEN;
                        break;
                case COMPAT_CALC_SIZE:
                        *size += IPT_ST_OFFSET;
@@ -1446,7 +1441,7 @@ static int compat_copy_entry_to_user(struct ipt_entry *e,
        ret = -EFAULT;
        origsize = *size;
        ce = (struct compat_ipt_entry __user *)*dstptr;
-        if (__copy_to_user(ce, e, sizeof(struct ipt_entry)))
+        if (copy_to_user(ce, e, sizeof(struct ipt_entry)))
                goto out;
        *dstptr += sizeof(struct compat_ipt_entry);
@@ -1464,9 +1459,9 @@ static int compat_copy_entry_to_user(struct ipt_entry *e,
                goto out;
        ret = -EFAULT;
        next_offset = e->next_offset - (origsize - *size);
-        if (__put_user(target_offset, &ce->target_offset))
+        if (put_user(target_offset, &ce->target_offset))
                goto out;
-        if (__put_user(next_offset, &ce->next_offset))
+        if (put_user(next_offset, &ce->next_offset))
                goto out;
        return 0;
 out:
diff --git a/net/ipv4/netfilter/ipt_LOG.c b/net/ipv4/netfilter/ipt_LOG.c
index 39fd4c2a2386..b98f7b08b084 100644
--- a/net/ipv4/netfilter/ipt_LOG.c
+++ b/net/ipv4/netfilter/ipt_LOG.c
@@ -428,7 +428,7 @@ ipt_log_target(struct sk_buff **pskb,
        if (loginfo->logflags & IPT_LOG_NFLOG)
                nf_log_packet(PF_INET, hooknum, *pskb, in, out, &li,
-                              loginfo->prefix);
+                              "%s", loginfo->prefix);
        else
                ipt_log_packet(PF_INET, hooknum, *pskb, in, out, &li,
                               loginfo->prefix);
diff --git a/net/ipv4/netfilter/ipt_recent.c b/net/ipv4/netfilter/ipt_recent.c
index 143843285702..b847ee409efb 100644
--- a/net/ipv4/netfilter/ipt_recent.c
+++ b/net/ipv4/netfilter/ipt_recent.c
@@ -821,6 +821,7 @@ checkentry(const char *tablename,
        /* Create our proc 'status' entry. */
        curr_table->status_proc = create_proc_entry(curr_table->name, ip_list_perms, proc_net_ipt_recent);
        if (!curr_table->status_proc) {
+                vfree(hold);
                printk(KERN_INFO RECENT_NAME ": checkentry: unable to allocate for /proc entry.\n");
                /* Destroy the created table */
                spin_lock_bh(&recent_lock);
@@ -845,7 +846,6 @@ checkentry(const char *tablename,
                spin_unlock_bh(&recent_lock);
                vfree(curr_table->time_info);
                vfree(curr_table->hash_table);
-                vfree(hold);
                vfree(curr_table->table);
                vfree(curr_table);
                return 0;
diff --git a/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c b/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c
index 5bc9f64d7b5b..77d974443c7b 100644
--- a/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c
+++ b/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c
@@ -348,6 +348,7 @@ getorigdst(struct sock *sk, int optval, void __user *user, int *len)
                        .tuple.dst.u.tcp.port;
                sin.sin_addr.s_addr = ct->tuplehash[IP_CT_DIR_ORIGINAL]
                        .tuple.dst.u3.ip;
+                memset(sin.sin_zero, 0, sizeof(sin.sin_zero));
                DEBUGP("SO_ORIGINAL_DST: %u.%u.%u.%u %u\n",
                       NIPQUAD(sin.sin_addr.s_addr), ntohs(sin.sin_port));
diff --git a/net/ipv4/route.c b/net/ipv4/route.c
index ff434821909f..cc9423de7311 100644
--- a/net/ipv4/route.c
+++ b/net/ipv4/route.c
@@ -2741,7 +2741,10 @@ int inet_rtm_getroute(struct sk_buff *in_skb, struct nlmsghdr* nlh, void *arg)
        /* Reserve room for dummy headers, this skb can pass
           through good chunk of routing engine.
         */
-        skb->mac.raw = skb->data;
+        skb->mac.raw = skb->nh.raw = skb->data;
+        /* Bugfix: need to give ip_route_input enough of an IP header to not gag. */
+        skb->nh.iph->protocol = IPPROTO_ICMP;
        skb_reserve(skb, MAX_HEADER + sizeof(struct iphdr));
        if (rta[RTA_SRC - 1])
diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
index 87f68e787d0c..e2b7b8055037 100644
--- a/net/ipv4/tcp.c
+++ b/net/ipv4/tcp.c
@@ -1468,6 +1468,7 @@ void tcp_close(struct sock *sk, long timeout)
 {
        struct sk_buff *skb;
        int data_was_unread = 0;
+        int state;
        lock_sock(sk);
        sk->sk_shutdown = SHUTDOWN_MASK;
@@ -1544,6 +1545,11 @@ void tcp_close(struct sock *sk, long timeout)
        sk_stream_wait_close(sk, timeout);
 adjudge_to_death:
+        state = sk->sk_state;
+        sock_hold(sk);
+        sock_orphan(sk);
+        atomic_inc(sk->sk_prot->orphan_count);
        /* It is the last release_sock in its life. It will remove backlog. */
        release_sock(sk);
@@ -1555,8 +1561,9 @@ adjudge_to_death:
        bh_lock_sock(sk);
        BUG_TRAP(!sock_owned_by_user(sk));
-        sock_hold(sk);
+        /* Have we already been destroyed by a softirq or backlog? */
-        sock_orphan(sk);
+        if (state != TCP_CLOSE && sk->sk_state == TCP_CLOSE)
+                goto out;
        /*      This is a (useful) BSD violating of the RFC. There is a
         *      problem with TCP as specified in that the other end could
@@ -1584,7 +1591,6 @@ adjudge_to_death:
                        if (tmo > TCP_TIMEWAIT_LEN) {
                                inet_csk_reset_keepalive_timer(sk, tcp_fin_time(sk));
                        } else {
-                                atomic_inc(sk->sk_prot->orphan_count);
                                tcp_time_wait(sk, TCP_FIN_WAIT2, tmo);
                                goto out;
                        }
@@ -1603,7 +1609,6 @@ adjudge_to_death:
                        NET_INC_STATS_BH(LINUX_MIB_TCPABORTONMEMORY);
                }
        }
-        atomic_inc(sk->sk_prot->orphan_count);
        if (sk->sk_state == TCP_CLOSE)
                inet_csk_destroy_sock(sk);
diff --git a/net/ipv4/tcp_highspeed.c b/net/ipv4/tcp_highspeed.c
index e0e9d1383c7c..ba7c63ca5bb1 100644
--- a/net/ipv4/tcp_highspeed.c
+++ b/net/ipv4/tcp_highspeed.c
@@ -135,10 +135,11 @@ static void hstcp_cong_avoid(struct sock *sk, u32 adk, u32 rtt,
                /* Do additive increase */
                if (tp->snd_cwnd < tp->snd_cwnd_clamp) {
-                        tp->snd_cwnd_cnt += ca->ai;
+                        /* cwnd = cwnd + a(w) / cwnd */
+                        tp->snd_cwnd_cnt += ca->ai + 1;
                        if (tp->snd_cwnd_cnt >= tp->snd_cwnd) {
-                                tp->snd_cwnd++;
                                tp->snd_cwnd_cnt -= tp->snd_cwnd;
+                                tp->snd_cwnd++;
                        }
                }
        }
diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
index 195d83584558..4a538bc1683d 100644
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -1662,6 +1662,8 @@ static void tcp_update_scoreboard(struct sock *sk, struct tcp_sock *tp)
                        if (!(TCP_SKB_CB(skb)->sacked&TCPCB_TAGBITS)) {
                                TCP_SKB_CB(skb)->sacked |= TCPCB_LOST;
                                tp->lost_out += tcp_skb_pcount(skb);
+                                if (IsReno(tp))
+                                        tcp_remove_reno_sacks(sk, tp, tcp_skb_pcount(skb) + 1);
                                /* clear xmit_retrans hint */
                                if (tp->retransmit_skb_hint &&
@@ -4559,7 +4561,6 @@ discard:
 EXPORT_SYMBOL(sysctl_tcp_ecn);
 EXPORT_SYMBOL(sysctl_tcp_reordering);
-EXPORT_SYMBOL(sysctl_tcp_abc);
 EXPORT_SYMBOL(tcp_parse_options);
 EXPORT_SYMBOL(tcp_rcv_established);
 EXPORT_SYMBOL(tcp_rcv_state_process);
diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
index 9e85c0416109..672950e54c49 100644
--- a/net/ipv4/tcp_ipv4.c
+++ b/net/ipv4/tcp_ipv4.c
@@ -1859,5 +1859,4 @@ EXPORT_SYMBOL(tcp_proc_unregister);
 #endif
 EXPORT_SYMBOL(sysctl_local_port_range);
 EXPORT_SYMBOL(sysctl_tcp_low_latency);
-EXPORT_SYMBOL(sysctl_tcp_tw_reuse);
diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
index 9d79546d384e..f33c9dddaa12 100644
--- a/net/ipv4/tcp_output.c
+++ b/net/ipv4/tcp_output.c
@@ -59,9 +59,6 @@ int sysctl_tcp_tso_win_divisor = 3;
 int sysctl_tcp_mtu_probing = 0;
 int sysctl_tcp_base_mss = 512;
-EXPORT_SYMBOL(sysctl_tcp_mtu_probing);
-EXPORT_SYMBOL(sysctl_tcp_base_mss);
 static void update_send_head(struct sock *sk, struct tcp_sock *tp,
                             struct sk_buff *skb)
 {
@@ -468,7 +465,7 @@ static int tcp_transmit_skb(struct sock *sk, struct sk_buff *skb, int clone_it,
        TCP_INC_STATS(TCP_MIB_OUTSEGS);
        err = icsk->icsk_af_ops->queue_xmit(skb, 0);
-        if (unlikely(err <= 0))
+        if (likely(err <= 0))
                return err;
        tcp_enter_cwr(sk);
@@ -536,6 +533,7 @@ int tcp_fragment(struct sock *sk, struct sk_buff *skb, u32 len, unsigned int mss
        struct tcp_sock *tp = tcp_sk(sk);
        struct sk_buff *buff;
        int nsize, old_factor;
+        int nlen;
        u16 flags;
        BUG_ON(len > skb->len);
@@ -554,7 +552,11 @@ int tcp_fragment(struct sock *sk, struct sk_buff *skb, u32 len, unsigned int mss
        buff = sk_stream_alloc_skb(sk, nsize, GFP_ATOMIC);
        if (buff == NULL)
                return -ENOMEM; /* We'll just try again later. */
        sk_charge_skb(sk, buff);
+        nlen = skb->len - len - nsize;
+        buff->truesize += nlen;
+        skb->truesize -= nlen;
        /* Correct the sequence numbers. */
        TCP_SKB_CB(buff)->seq = TCP_SKB_CB(skb)->seq + len;
@@ -640,7 +642,7 @@ int tcp_fragment(struct sock *sk, struct sk_buff *skb, u32 len, unsigned int mss
 * eventually). The difference is that pulled data not copied, but
 * immediately discarded.
 */
-static unsigned char *__pskb_trim_head(struct sk_buff *skb, int len)
+static void __pskb_trim_head(struct sk_buff *skb, int len)
 {
        int i, k, eat;
@@ -665,7 +667,6 @@ static unsigned char *__pskb_trim_head(struct sk_buff *skb, int len)
        skb->tail = skb->data;
        skb->data_len -= len;
        skb->len = skb->data_len;
-        return skb->tail;
 }
 int tcp_trim_head(struct sock *sk, struct sk_buff *skb, u32 len)
@@ -674,12 +675,11 @@ int tcp_trim_head(struct sock *sk, struct sk_buff *skb, u32 len)
            pskb_expand_head(skb, 0, 0, GFP_ATOMIC))
                return -ENOMEM;
-        if (len <= skb_headlen(skb)) {
+        /* If len == headlen, we avoid __skb_pull to preserve alignment. */
+        if (unlikely(len < skb_headlen(skb)))
                __skb_pull(skb, len);
-        } else {
+        else
-                if (__pskb_trim_head(skb, len-skb_headlen(skb)) == NULL)
+                __pskb_trim_head(skb, len - skb_headlen(skb));
-                        return -ENOMEM;
-        }
        TCP_SKB_CB(skb)->seq += len;
        skb->ip_summed = CHECKSUM_HW;
@@ -1040,7 +1040,8 @@ static int tso_fragment(struct sock *sk, struct sk_buff *skb, unsigned int len,
        if (unlikely(buff == NULL))
                return -ENOMEM;
-        buff->truesize = nlen;
+        sk_charge_skb(sk, buff);
+        buff->truesize += nlen;
        skb->truesize -= nlen;
        /* Correct the sequence numbers. */
diff --git a/net/ipv4/xfrm4_output.c b/net/ipv4/xfrm4_output.c
index 32ad229b4fed..4ef8efaf6a67 100644
--- a/net/ipv4/xfrm4_output.c
+++ b/net/ipv4/xfrm4_output.c
@@ -62,7 +62,7 @@ static void xfrm4_encap(struct sk_buff *skb)
        top_iph->frag_off = (flags & XFRM_STATE_NOPMTUDISC) ?
                0 : (iph->frag_off & htons(IP_DF));
        if (!top_iph->frag_off)
-                __ip_select_ident(top_iph, dst, 0);
+                __ip_select_ident(top_iph, dst->child, 0);
        top_iph->ttl = dst_metric(dst->child, RTAX_HOPLIMIT);
diff --git a/net/ipv4/xfrm4_policy.c b/net/ipv4/xfrm4_policy.c
index f285bbf296e2..8604c747bca5 100644
--- a/net/ipv4/xfrm4_policy.c
+++ b/net/ipv4/xfrm4_policy.c
@@ -221,7 +221,7 @@ _decode_session4(struct sk_buff *skb, struct flowi *fl)
                        if (pskb_may_pull(skb, xprth + 4 - skb->data)) {
                                u16 *ipcomp_hdr = (u16 *)xprth;
-                                fl->fl_ipsec_spi = ntohl(ntohs(ipcomp_hdr[1]));
+                                fl->fl_ipsec_spi = htonl(ntohs(ipcomp_hdr[1]));
                        }
                        break;
                default:
diff --git a/net/ipv6/exthdrs.c b/net/ipv6/exthdrs.c
index 2a1e7e45b890..a18d4256372c 100644
--- a/net/ipv6/exthdrs.c
+++ b/net/ipv6/exthdrs.c
@@ -485,15 +485,27 @@ static struct tlvtype_proc tlvprochopopt_lst[] = {
        { -1, }
 };
-int ipv6_parse_hopopts(struct sk_buff *skb, int nhoff)
+int ipv6_parse_hopopts(struct sk_buff *skb)
 {
        struct inet6_skb_parm *opt = IP6CB(skb);
+        /*
+         * skb->nh.raw is equal to skb->data, and
+         * skb->h.raw - skb->nh.raw is always equal to
+         * sizeof(struct ipv6hdr) by definition of
+         * hop-by-hop options.
+         */
+        if (!pskb_may_pull(skb, sizeof(struct ipv6hdr) + 8) ||
+            !pskb_may_pull(skb, sizeof(struct ipv6hdr) + ((skb->h.raw[1] + 1) << 3))) {
+                kfree_skb(skb);
+                return -1;
+        }
        opt->hop = sizeof(struct ipv6hdr);
        if (ip6_parse_tlv(tlvprochopopt_lst, skb)) {
                skb->h.raw += (skb->h.raw[1]+1)<<3;
                opt->nhoff = sizeof(struct ipv6hdr);
-                return sizeof(struct ipv6hdr);
+                return 1;
        }
        return -1;
 }
diff --git a/net/ipv6/inet6_connection_sock.c b/net/ipv6/inet6_connection_sock.c
index f8f3a37a1494..eb2865d5ae28 100644
--- a/net/ipv6/inet6_connection_sock.c
+++ b/net/ipv6/inet6_connection_sock.c
@@ -173,6 +173,7 @@ int inet6_csk_xmit(struct sk_buff *skb, int ipfragok)
                if (err) {
                        sk->sk_err_soft = -err;
+                        kfree_skb(skb);
                        return err;
                }
@@ -181,6 +182,7 @@ int inet6_csk_xmit(struct sk_buff *skb, int ipfragok)
                if ((err = xfrm_lookup(&dst, &fl, sk, 0)) < 0) {
                        sk->sk_route_caps = 0;
+                        kfree_skb(skb);
                        return err;
                }
diff --git a/net/ipv6/ip6_input.c b/net/ipv6/ip6_input.c
index 29f73592e68e..aceee252503d 100644
--- a/net/ipv6/ip6_input.c
+++ b/net/ipv6/ip6_input.c
@@ -114,11 +114,10 @@ int ipv6_rcv(struct sk_buff *skb, struct net_device *dev, struct packet_type *pt
        }
        if (hdr->nexthdr == NEXTHDR_HOP) {
-                if (ipv6_parse_hopopts(skb, IP6CB(skb)->nhoff) < 0) {
+                if (ipv6_parse_hopopts(skb) < 0) {
                        IP6_INC_STATS_BH(IPSTATS_MIB_INHDRERRORS);
                        return 0;
                }
-                hdr = skb->nh.ipv6h;
        }
        return NF_HOOK(PF_INET6,NF_IP6_PRE_ROUTING, skb, dev, NULL, ip6_rcv_finish);
diff --git a/net/ipv6/ipcomp6.c b/net/ipv6/ipcomp6.c
index 05eb67def39f..48636436028a 100644
--- a/net/ipv6/ipcomp6.c
+++ b/net/ipv6/ipcomp6.c
@@ -208,7 +208,7 @@ static void ipcomp6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
        if (type != ICMPV6_DEST_UNREACH && type != ICMPV6_PKT_TOOBIG)
                return;
-        spi = ntohl(ntohs(ipcomph->cpi));
+        spi = htonl(ntohs(ipcomph->cpi));
        x = xfrm_state_lookup((xfrm_address_t *)&iph->daddr, spi, IPPROTO_COMP, AF_INET6);
        if (!x)
                return;
diff --git a/net/ipv6/netfilter/ip6_tables.c b/net/ipv6/netfilter/ip6_tables.c
index 642b4b11464f..2e72f89a7019 100644
--- a/net/ipv6/netfilter/ip6_tables.c
+++ b/net/ipv6/netfilter/ip6_tables.c
@@ -288,19 +288,6 @@ ip6t_do_table(struct sk_buff **pskb,
        table_base = (void *)private->entries[smp_processor_id()];
        e = get_entry(table_base, private->hook_entry[hook]);
-#ifdef CONFIG_NETFILTER_DEBUG
-        /* Check noone else using our table */
-        if (((struct ip6t_entry *)table_base)->comefrom != 0xdead57ac
-            && ((struct ip6t_entry *)table_base)->comefrom != 0xeeeeeeec) {
-                printk("ASSERT: CPU #%u, %s comefrom(%p) = %X\n",
-                       smp_processor_id(),
-                       table->name,
-                       &((struct ip6t_entry *)table_base)->comefrom,
-                       ((struct ip6t_entry *)table_base)->comefrom);
-        }
-        ((struct ip6t_entry *)table_base)->comefrom = 0x57acc001;
-#endif
        /* For return from builtin chain */
        back = get_entry(table_base, private->underflow[hook]);
@@ -1116,7 +1103,7 @@ do_add_counters(void __user *user, unsigned int len)
        write_lock_bh(&t->lock);
        private = t->private;
-        if (private->number != paddc->num_counters) {
+        if (private->number != tmp.num_counters) {
                ret = -EINVAL;
                goto unlock_up_free;
        }
diff --git a/net/ipv6/netfilter/ip6t_LOG.c b/net/ipv6/netfilter/ip6t_LOG.c
index a96c0de14b00..73c6300109d6 100644
--- a/net/ipv6/netfilter/ip6t_LOG.c
+++ b/net/ipv6/netfilter/ip6t_LOG.c
@@ -439,7 +439,7 @@ ip6t_log_target(struct sk_buff **pskb,
        if (loginfo->logflags & IP6T_LOG_NFLOG)
                nf_log_packet(PF_INET6, hooknum, *pskb, in, out, &li,
-                              loginfo->prefix);
+                              "%s", loginfo->prefix);
        else
                ip6t_log_packet(PF_INET6, hooknum, *pskb, in, out, &li,
                                loginfo->prefix);
diff --git a/net/ipv6/netfilter/ip6t_eui64.c b/net/ipv6/netfilter/ip6t_eui64.c
index 94dbdb8b458d..4f6b84c8f4ab 100644
--- a/net/ipv6/netfilter/ip6t_eui64.c
+++ b/net/ipv6/netfilter/ip6t_eui64.c
@@ -40,7 +40,7 @@ match(const struct sk_buff *skb,
        memset(eui64, 0, sizeof(eui64));
-        if (eth_hdr(skb)->h_proto == ntohs(ETH_P_IPV6)) {
+        if (eth_hdr(skb)->h_proto == htons(ETH_P_IPV6)) {
                if (skb->nh.ipv6h->version == 0x6) {
                        memcpy(eui64, eth_hdr(skb)->h_source, 3);
                        memcpy(eui64 + 5, eth_hdr(skb)->h_source + 3, 3);
diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index 79078747a646..8a777932786d 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -280,10 +280,13 @@ static int inline rt6_check_neigh(struct rt6_info *rt)
 {
        struct neighbour *neigh = rt->rt6i_nexthop;
        int m = 0;
-        if (neigh) {
+        if (rt->rt6i_flags & RTF_NONEXTHOP ||
+            !(rt->rt6i_flags & RTF_GATEWAY))
+                m = 1;
+        else if (neigh) {
                read_lock_bh(&neigh->lock);
                if (neigh->nud_state & NUD_VALID)
-                        m = 1;
+                        m = 2;
                read_unlock_bh(&neigh->lock);
        }
        return m;
@@ -292,15 +295,18 @@ static int inline rt6_check_neigh(struct rt6_info *rt)
 static int rt6_score_route(struct rt6_info *rt, int oif,
                           int strict)
 {
-        int m = rt6_check_dev(rt, oif);
+        int m, n;
+                
+        m = rt6_check_dev(rt, oif);
        if (!m && (strict & RT6_SELECT_F_IFACE))
                return -1;
 #ifdef CONFIG_IPV6_ROUTER_PREF
        m |= IPV6_DECODE_PREF(IPV6_EXTRACT_PREF(rt->rt6i_flags)) << 2;
 #endif
-        if (rt6_check_neigh(rt))
+        n = rt6_check_neigh(rt);
+        if (n > 1)
                m |= 16;
-        else if (strict & RT6_SELECT_F_REACHABLE)
+        else if (!n && strict & RT6_SELECT_F_REACHABLE)
                return -1;
        return m;
 }
@@ -317,7 +323,7 @@ static struct rt6_info *rt6_select(struct rt6_info **head, int oif,
                  __FUNCTION__, head, head ? *head : NULL, oif);
        for (rt = rt0, metric = rt0->rt6i_metric;
-             rt && rt->rt6i_metric == metric;
+             rt && rt->rt6i_metric == metric && (!last || rt != rt0);
             rt = rt->u.next) {
                int m;
@@ -343,9 +349,12 @@ static struct rt6_info *rt6_select(struct rt6_info **head, int oif,
            (strict & RT6_SELECT_F_REACHABLE) &&
            last && last != rt0) {
                /* no entries matched; do round-robin */
+                static spinlock_t lock = SPIN_LOCK_UNLOCKED;
+                spin_lock(&lock);
                *head = rt0->u.next;
                rt0->u.next = last->u.next;
                last->u.next = rt0;
+                spin_unlock(&lock);
        }
        RT6_TRACE("%s() => %p, score=%d\n",
diff --git a/net/ipv6/xfrm6_policy.c b/net/ipv6/xfrm6_policy.c
index 91cce8b2d7a5..88c840f1beb6 100644
--- a/net/ipv6/xfrm6_policy.c
+++ b/net/ipv6/xfrm6_policy.c
@@ -191,16 +191,18 @@ error:
 static inline void
 _decode_session6(struct sk_buff *skb, struct flowi *fl)
 {
-        u16 offset = sizeof(struct ipv6hdr);
+        u16 offset = skb->h.raw - skb->nh.raw;
        struct ipv6hdr *hdr = skb->nh.ipv6h;
-        struct ipv6_opt_hdr *exthdr = (struct ipv6_opt_hdr*)(skb->nh.raw + offset);
+        struct ipv6_opt_hdr *exthdr;
-        u8 nexthdr = skb->nh.ipv6h->nexthdr;
+        u8 nexthdr = skb->nh.raw[IP6CB(skb)->nhoff];
        memset(fl, 0, sizeof(struct flowi));
        ipv6_addr_copy(&fl->fl6_dst, &hdr->daddr);
        ipv6_addr_copy(&fl->fl6_src, &hdr->saddr);
        while (pskb_may_pull(skb, skb->nh.raw + offset + 1 - skb->data)) {
+                exthdr = (struct ipv6_opt_hdr*)(skb->nh.raw + offset);
                switch (nexthdr) {
                case NEXTHDR_ROUTING:
                case NEXTHDR_HOP:
diff --git a/net/ipx/af_ipx.c b/net/ipx/af_ipx.c
index 2dbf134d5266..811d998725bc 100644
--- a/net/ipx/af_ipx.c
+++ b/net/ipx/af_ipx.c
@@ -944,9 +944,9 @@ out:
        return rc;
 }
-static int ipx_map_frame_type(unsigned char type)
+static __be16 ipx_map_frame_type(unsigned char type)
 {
-        int rc = 0;
+        __be16 rc = 0;
        switch (type) {
        case IPX_FRAME_ETHERII: rc = htons(ETH_P_IPX);          break;
diff --git a/net/ipx/ipx_route.c b/net/ipx/ipx_route.c
index 67774448efd9..a394c6fe19a2 100644
--- a/net/ipx/ipx_route.c
+++ b/net/ipx/ipx_route.c
@@ -119,7 +119,7 @@ out:
        return rc;
 }
-static int ipxrtr_delete(long net)
+static int ipxrtr_delete(__u32 net)
 {
        struct ipx_route *r, *tmp;
        int rc;
diff --git a/net/irda/iriap.c b/net/irda/iriap.c
index 254f90746900..2d2e2b1919f4 100644
--- a/net/irda/iriap.c
+++ b/net/irda/iriap.c
@@ -544,7 +544,8 @@ static void iriap_getvaluebyclass_response(struct iriap_cb *self,
 {
        struct sk_buff *tx_skb;
        int n;
-        __u32 tmp_be32, tmp_be16;
+        __u32 tmp_be32;
+        __be16 tmp_be16;
        __u8 *fp;
        IRDA_DEBUG(4, "%s()\n", __FUNCTION__);
diff --git a/net/irda/irias_object.c b/net/irda/irias_object.c
index c6d169fbdceb..82e665c79991 100644
--- a/net/irda/irias_object.c
+++ b/net/irda/irias_object.c
@@ -257,7 +257,6 @@ struct ias_attrib *irias_find_attrib(struct ias_object *obj, char *name)
        /* Unsafe (locking), attrib might change */
        return attrib;
 }
-EXPORT_SYMBOL(irias_find_attrib);
 /*
 * Function irias_add_attribute (obj, attrib)
@@ -484,7 +483,6 @@ struct ias_value *irias_new_string_value(char *string)
        return value;
 }
-EXPORT_SYMBOL(irias_new_string_value);
 /*
 * Function irias_new_octseq_value (octets, len)
@@ -519,7 +517,6 @@ struct ias_value *irias_new_octseq_value(__u8 *octseq , int len)
        memcpy(value->t.oct_seq, octseq , len);
        return value;
 }
-EXPORT_SYMBOL(irias_new_octseq_value);
 struct ias_value *irias_new_missing_value(void)
 {
diff --git a/net/irda/irlap.c b/net/irda/irlap.c
index 7029618f5719..a16528657b4c 100644
--- a/net/irda/irlap.c
+++ b/net/irda/irlap.c
@@ -884,7 +884,8 @@ static void irlap_change_speed(struct irlap_cb *self, __u32 speed, int now)
        if (now) {
                /* Send down empty frame to trigger speed change */
                skb = dev_alloc_skb(0);
-                irlap_queue_xmit(self, skb);
+                if (skb)
+                        irlap_queue_xmit(self, skb);
        }
 }
diff --git a/net/llc/llc_input.c b/net/llc/llc_input.c
index 8f3addf0724c..d62e0f9b9da3 100644
--- a/net/llc/llc_input.c
+++ b/net/llc/llc_input.c
@@ -118,7 +118,8 @@ static inline int llc_fixup_skb(struct sk_buff *skb)
                u16 pdulen = eth_hdr(skb)->h_proto,
                    data_size = ntohs(pdulen) - llc_len;
-                skb_trim(skb, data_size);
+                if (unlikely(pskb_trim_rcsum(skb, data_size)))
+                        return 0;
        }
        return 1;
 }
diff --git a/net/netfilter/nf_conntrack_core.c b/net/netfilter/nf_conntrack_core.c
index e581190fb6c3..f9b83f91371a 100644
--- a/net/netfilter/nf_conntrack_core.c
+++ b/net/netfilter/nf_conntrack_core.c
@@ -178,9 +178,6 @@ static struct {
        /* allocated slab cache + modules which uses this slab cache */
        int use;
-        /* Initialization */
-        int (*init_conntrack)(struct nf_conn *, u_int32_t);
 } nf_ct_cache[NF_CT_F_NUM];
 /* protect members of nf_ct_cache except of "use" */
@@ -208,10 +205,8 @@ nf_ct_proto_find_get(u_int16_t l3proto, u_int8_t protocol)
        preempt_disable();
        p = __nf_ct_proto_find(l3proto, protocol);
-        if (p) {
+        if (!try_module_get(p->me))
-                if (!try_module_get(p->me))
+                p = &nf_conntrack_generic_protocol;
-                        p = &nf_conntrack_generic_protocol;
-        }
        preempt_enable();
        
        return p;
@@ -229,10 +224,8 @@ nf_ct_l3proto_find_get(u_int16_t l3proto)
        preempt_disable();
        p = __nf_ct_l3proto_find(l3proto);
-        if (p) {
+        if (!try_module_get(p->me))
-                if (!try_module_get(p->me))
+                p = &nf_conntrack_generic_l3proto;
-                        p = &nf_conntrack_generic_l3proto;
-        }
        preempt_enable();
        return p;
diff --git a/net/netfilter/nf_conntrack_l3proto_generic.c b/net/netfilter/nf_conntrack_l3proto_generic.c
index 7de4f06c63c5..3fc58e454d4e 100644
--- a/net/netfilter/nf_conntrack_l3proto_generic.c
+++ b/net/netfilter/nf_conntrack_l3proto_generic.c
@@ -94,5 +94,4 @@ struct nf_conntrack_l3proto nf_conntrack_generic_l3proto = {
        .print_conntrack = generic_print_conntrack,
        .prepare         = generic_prepare,
        .get_features    = generic_get_features,
-        .me              = THIS_MODULE,
 };
diff --git a/net/netfilter/nf_conntrack_proto_sctp.c b/net/netfilter/nf_conntrack_proto_sctp.c
index 9cccc325b687..0c6da496cfa9 100644
--- a/net/netfilter/nf_conntrack_proto_sctp.c
+++ b/net/netfilter/nf_conntrack_proto_sctp.c
@@ -240,12 +240,15 @@ static int do_basic_checks(struct nf_conn *conntrack,
                        flag = 1;
                }
-                /* Cookie Ack/Echo chunks not the first OR 
+                /*
-                   Init / Init Ack / Shutdown compl chunks not the only chunks */
+                 * Cookie Ack/Echo chunks not the first OR
-                if ((sch->type == SCTP_CID_COOKIE_ACK 
+                 * Init / Init Ack / Shutdown compl chunks not the only chunks
+                 * OR zero-length.
+                 */
+                if (((sch->type == SCTP_CID_COOKIE_ACK
                        || sch->type == SCTP_CID_COOKIE_ECHO
                        || flag)
-                     && count !=0 ) {
+                      && count !=0) || !sch->length) {
                        DEBUGP("Basic checks failed\n");
                        return 1;
                }
diff --git a/net/netfilter/nfnetlink_log.c b/net/netfilter/nfnetlink_log.c
index c60273cad778..61cdda4e5d3b 100644
--- a/net/netfilter/nfnetlink_log.c
+++ b/net/netfilter/nfnetlink_log.c
@@ -321,7 +321,7 @@ static int
 nfulnl_set_flags(struct nfulnl_instance *inst, u_int16_t flags)
 {
        spin_lock_bh(&inst->lock);
-        inst->flags = ntohs(flags);
+        inst->flags = flags;
        spin_unlock_bh(&inst->lock);
        return 0;
@@ -902,7 +902,7 @@ nfulnl_recv_config(struct sock *ctnl, struct sk_buff *skb,
        if (nfula[NFULA_CFG_FLAGS-1]) {
                u_int16_t flags =
                        *(u_int16_t *)NFA_DATA(nfula[NFULA_CFG_FLAGS-1]);
-                nfulnl_set_flags(inst, ntohl(flags));
+                nfulnl_set_flags(inst, ntohs(flags));
        }
 out_put:
diff --git a/net/netfilter/x_tables.c b/net/netfilter/x_tables.c
index 00cf0a4f4d92..99293c63ff73 100644
--- a/net/netfilter/x_tables.c
+++ b/net/netfilter/x_tables.c
@@ -289,7 +289,7 @@ int xt_compat_match(void *match, void **dstptr, int *size, int convert)
                case COMPAT_TO_USER:
                        pm = (struct xt_entry_match *)match;
                        msize = pm->u.user.match_size;
-                        if (__copy_to_user(*dstptr, pm, msize)) {
+                        if (copy_to_user(*dstptr, pm, msize)) {
                                ret = -EFAULT;
                                break;
                        }
@@ -366,7 +366,7 @@ int xt_compat_target(void *target, void **dstptr, int *size, int convert)
                case COMPAT_TO_USER:
                        pt = (struct xt_entry_target *)target;
                        tsize = pt->u.user.target_size;
-                        if (__copy_to_user(*dstptr, pt, tsize)) {
+                        if (copy_to_user(*dstptr, pt, tsize)) {
                                ret = -EFAULT;
                                break;
                        }
@@ -529,6 +529,7 @@ int xt_register_table(struct xt_table *table,
        /* Simplifies replace_table code. */
        table->private = bootstrap;
+        rwlock_init(&table->lock);
        if (!xt_replace_table(table, 0, newinfo, &ret))
                goto unlock;
@@ -538,7 +539,6 @@ int xt_register_table(struct xt_table *table,
        /* save number of initial entries */
        private->initial_entries = private->number;
-        rwlock_init(&table->lock);
        list_prepend(&xt[table->af].tables, table);
        ret = 0;
diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c
index 2a233ffcf618..3862e73d14d7 100644
--- a/net/netlink/af_netlink.c
+++ b/net/netlink/af_netlink.c
@@ -56,12 +56,12 @@
 #include <linux/mm.h>
 #include <linux/types.h>
 #include <linux/audit.h>
+#include <linux/selinux.h>
 #include <net/sock.h>
 #include <net/scm.h>
 #include <net/netlink.h>
-#define Nprintk(a...)
 #define NLGRPSZ(x)      (ALIGN(x, sizeof(unsigned long) * 8) / 8)
 struct netlink_sock {
@@ -1157,6 +1157,7 @@ static int netlink_sendmsg(struct kiocb *kiocb, struct socket *sock,
        NETLINK_CB(skb).dst_pid = dst_pid;
        NETLINK_CB(skb).dst_group = dst_group;
        NETLINK_CB(skb).loginuid = audit_get_loginuid(current->audit_context);
+        selinux_get_task_sid(current, &(NETLINK_CB(skb).sid));
        memcpy(NETLINK_CREDS(skb), &siocb->scm->creds, sizeof(struct ucred));
        /* What can I do? Netlink is asynchronous, so that
diff --git a/net/netrom/af_netrom.c b/net/netrom/af_netrom.c
index d44981f5a619..3669cb953e6e 100644
--- a/net/netrom/af_netrom.c
+++ b/net/netrom/af_netrom.c
@@ -425,11 +425,16 @@ static int nr_create(struct socket *sock, int protocol)
        nr_init_timers(sk);
-        nr->t1     = sysctl_netrom_transport_timeout;
+        nr->t1     =
-        nr->t2     = sysctl_netrom_transport_acknowledge_delay;
+                msecs_to_jiffies(sysctl_netrom_transport_timeout);
-        nr->n2     = sysctl_netrom_transport_maximum_tries;
+        nr->t2     =
-        nr->t4     = sysctl_netrom_transport_busy_delay;
+                msecs_to_jiffies(sysctl_netrom_transport_acknowledge_delay);
-        nr->idle   = sysctl_netrom_transport_no_activity_timeout;
+        nr->n2     =
+                msecs_to_jiffies(sysctl_netrom_transport_maximum_tries);
+        nr->t4     =
+                msecs_to_jiffies(sysctl_netrom_transport_busy_delay);
+        nr->idle   =
+                msecs_to_jiffies(sysctl_netrom_transport_no_activity_timeout);
        nr->window = sysctl_netrom_transport_requested_window_size;
        nr->bpqext = 1;
@@ -1365,8 +1370,6 @@ static struct notifier_block nr_dev_notifier = {
 static struct net_device **dev_nr;
-static char banner[] __initdata = KERN_INFO "G4KLX NET/ROM for Linux. Version 0.7 for AX25.037 Linux 2.4\n";
 static int __init nr_proto_init(void)
 {
        int i;
@@ -1414,7 +1417,6 @@ static int __init nr_proto_init(void)
        }
                
        register_netdevice_notifier(&nr_dev_notifier);
-        printk(banner);
        ax25_protocol_register(AX25_P_NETROM, nr_route_frame);
        ax25_linkfail_register(nr_link_failed);
diff --git a/net/netrom/nr_dev.c b/net/netrom/nr_dev.c
index 509afddae569..621e5586ab03 100644
--- a/net/netrom/nr_dev.c
+++ b/net/netrom/nr_dev.c
@@ -185,7 +185,6 @@ static struct net_device_stats *nr_get_stats(struct net_device *dev)
 void nr_setup(struct net_device *dev)
 {
-        SET_MODULE_OWNER(dev);
        dev->mtu                = NR_MAX_PACKET_SIZE;
        dev->hard_start_xmit    = nr_xmit;
        dev->open               = nr_open;
diff --git a/net/rose/af_rose.c b/net/rose/af_rose.c
index ea65396d1619..55564efccf11 100644
--- a/net/rose/af_rose.c
+++ b/net/rose/af_rose.c
@@ -518,11 +518,11 @@ static int rose_create(struct socket *sock, int protocol)
        init_timer(&rose->timer);
        init_timer(&rose->idletimer);
-        rose->t1   = sysctl_rose_call_request_timeout;
+        rose->t1   = msecs_to_jiffies(sysctl_rose_call_request_timeout);
-        rose->t2   = sysctl_rose_reset_request_timeout;
+        rose->t2   = msecs_to_jiffies(sysctl_rose_reset_request_timeout);
-        rose->t3   = sysctl_rose_clear_request_timeout;
+        rose->t3   = msecs_to_jiffies(sysctl_rose_clear_request_timeout);
-        rose->hb   = sysctl_rose_ack_hold_back_timeout;
+        rose->hb   = msecs_to_jiffies(sysctl_rose_ack_hold_back_timeout);
-        rose->idle = sysctl_rose_no_activity_timeout;
+        rose->idle = msecs_to_jiffies(sysctl_rose_no_activity_timeout);
        rose->state = ROSE_STATE_0;
@@ -1469,8 +1469,6 @@ static struct notifier_block rose_dev_notifier = {
 static struct net_device **dev_rose;
-static const char banner[] = KERN_INFO "F6FBB/G4KLX ROSE for Linux. Version 0.62 for AX25.037 Linux 2.4\n";
 static int __init rose_proto_init(void)
 {
        int i;
@@ -1519,7 +1517,6 @@ static int __init rose_proto_init(void)
        sock_register(&rose_family_ops);
        register_netdevice_notifier(&rose_dev_notifier);
-        printk(banner);
        ax25_protocol_register(AX25_P_ROSE, rose_route_frame);
        ax25_linkfail_register(rose_link_failed);
diff --git a/net/rose/rose_dev.c b/net/rose/rose_dev.c
index d297af737d10..2a1bf8e119e5 100644
--- a/net/rose/rose_dev.c
+++ b/net/rose/rose_dev.c
@@ -135,7 +135,6 @@ static struct net_device_stats *rose_get_stats(struct net_device *dev)
 void rose_setup(struct net_device *dev)
 {
-        SET_MODULE_OWNER(dev);
        dev->mtu                = ROSE_MAX_PACKET_SIZE - 2;
        dev->hard_start_xmit    = rose_xmit;
        dev->open               = rose_open;
diff --git a/net/rose/rose_link.c b/net/rose/rose_link.c
index 09e9e9d04d92..bd86a63960ce 100644
--- a/net/rose/rose_link.c
+++ b/net/rose/rose_link.c
@@ -40,7 +40,8 @@ void rose_start_ftimer(struct rose_neigh *neigh)
        neigh->ftimer.data     = (unsigned long)neigh;
        neigh->ftimer.function = &rose_ftimer_expiry;
-        neigh->ftimer.expires  = jiffies + sysctl_rose_link_fail_timeout;
+        neigh->ftimer.expires  =
+                jiffies + msecs_to_jiffies(sysctl_rose_link_fail_timeout);
        add_timer(&neigh->ftimer);
 }
@@ -51,7 +52,8 @@ static void rose_start_t0timer(struct rose_neigh *neigh)
        neigh->t0timer.data     = (unsigned long)neigh;
        neigh->t0timer.function = &rose_t0timer_expiry;
-        neigh->t0timer.expires  = jiffies + sysctl_rose_restart_request_timeout;
+        neigh->t0timer.expires  =
+                jiffies + msecs_to_jiffies(sysctl_rose_restart_request_timeout);
        add_timer(&neigh->t0timer);
 }
diff --git a/net/rose/rose_route.c b/net/rose/rose_route.c
index 8631b65a7312..a22542fa1bc8 100644
--- a/net/rose/rose_route.c
+++ b/net/rose/rose_route.c
@@ -48,8 +48,6 @@ static DEFINE_SPINLOCK(rose_route_list_lock);
 struct rose_neigh *rose_loopback_neigh;
-static void rose_remove_neigh(struct rose_neigh *);
 /*
 *      Add a new route to a node, and in the process add the node and the
 *      neighbour if it is new.
@@ -235,11 +233,8 @@ static void rose_remove_neigh(struct rose_neigh *rose_neigh)
        skb_queue_purge(&rose_neigh->queue);
-        spin_lock_bh(&rose_neigh_list_lock);
        if ((s = rose_neigh_list) == rose_neigh) {
                rose_neigh_list = rose_neigh->next;
-                spin_unlock_bh(&rose_neigh_list_lock);
                kfree(rose_neigh->digipeat);
                kfree(rose_neigh);
                return;
@@ -248,7 +243,6 @@ static void rose_remove_neigh(struct rose_neigh *rose_neigh)
        while (s != NULL && s->next != NULL) {
                if (s->next == rose_neigh) {
                        s->next = rose_neigh->next;
-                        spin_unlock_bh(&rose_neigh_list_lock);
                        kfree(rose_neigh->digipeat);
                        kfree(rose_neigh);
                        return;
@@ -256,7 +250,6 @@ static void rose_remove_neigh(struct rose_neigh *rose_neigh)
                s = s->next;
        }
-        spin_unlock_bh(&rose_neigh_list_lock);
 }
 /*
diff --git a/net/sched/act_ipt.c b/net/sched/act_ipt.c
index 6056d20ef429..37640c6fc014 100644
--- a/net/sched/act_ipt.c
+++ b/net/sched/act_ipt.c
@@ -69,6 +69,11 @@ ipt_init_target(struct ipt_entry_target *t, char *table, unsigned int hook)
        DPRINTK("ipt_init_target: found %s\n", target->name);
        t->u.kernel.target = target;
+        ret = xt_check_target(target, AF_INET, t->u.target_size - sizeof(*t),
+                              table, hook, 0, 0);
+        if (ret)
+                return ret;
        if (t->u.kernel.target->checkentry
            && !t->u.kernel.target->checkentry(table, NULL,
                                               t->u.kernel.target, t->data,
diff --git a/net/sched/sch_generic.c b/net/sched/sch_generic.c
index 31eb83717c26..138ea92ed268 100644
--- a/net/sched/sch_generic.c
+++ b/net/sched/sch_generic.c
@@ -193,8 +193,10 @@ static void dev_watchdog(unsigned long arg)
                    netif_running(dev) &&
                    netif_carrier_ok(dev)) {
                        if (netif_queue_stopped(dev) &&
-                            (jiffies - dev->trans_start) > dev->watchdog_timeo) {
+                            time_after(jiffies, dev->trans_start + dev->watchdog_timeo)) {
-                                printk(KERN_INFO "NETDEV WATCHDOG: %s: transmit timed out\n", dev->name);
+                                printk(KERN_INFO "NETDEV WATCHDOG: %s: transmit timed out\n",
+                                       dev->name);
                                dev->tx_timeout(dev);
                        }
                        if (!mod_timer(&dev->watchdog_timer, jiffies + dev->watchdog_timeo))
diff --git a/net/sched/sch_hfsc.c b/net/sched/sch_hfsc.c
index 91132f6871d7..f1c7bd29f2cd 100644
--- a/net/sched/sch_hfsc.c
+++ b/net/sched/sch_hfsc.c
@@ -974,10 +974,10 @@ hfsc_adjust_levels(struct hfsc_class *cl)
        do {
                level = 0;
                list_for_each_entry(p, &cl->children, siblings) {
-                        if (p->level > level)
+                        if (p->level >= level)
-                                level = p->level;
+                                level = p->level + 1;
                }
-                cl->level = level + 1;
+                cl->level = level;
        } while ((cl = cl->cl_parent) != NULL);
 }
diff --git a/net/sched/sch_netem.c b/net/sched/sch_netem.c
index 7228d30512c7..5a4a4d0ae502 100644
--- a/net/sched/sch_netem.c
+++ b/net/sched/sch_netem.c
@@ -167,7 +167,7 @@ static int netem_enqueue(struct sk_buff *skb, struct Qdisc *sch)
        if (count == 0) {
                sch->qstats.drops++;
                kfree_skb(skb);
-                return NET_XMIT_DROP;
+                return NET_XMIT_BYPASS;
        }
        /*
diff --git a/net/sctp/input.c b/net/sctp/input.c
index d117ebc75cf8..1662f9cc869e 100644
--- a/net/sctp/input.c
+++ b/net/sctp/input.c
@@ -73,6 +73,8 @@ static struct sctp_association *__sctp_lookup_association(
                                        const union sctp_addr *peer,
                                        struct sctp_transport **pt);
+static void sctp_add_backlog(struct sock *sk, struct sk_buff *skb);
 /* Calculate the SCTP checksum of an SCTP packet.  */
 static inline int sctp_rcv_checksum(struct sk_buff *skb)
@@ -186,7 +188,6 @@ int sctp_rcv(struct sk_buff *skb)
         */
        if (sk->sk_bound_dev_if && (sk->sk_bound_dev_if != af->skb_iif(skb)))
        {
-                sock_put(sk);
                if (asoc) {
                        sctp_association_put(asoc);
                        asoc = NULL;
@@ -197,7 +198,6 @@ int sctp_rcv(struct sk_buff *skb)
                sk = sctp_get_ctl_sock();
                ep = sctp_sk(sk)->ep;
                sctp_endpoint_hold(ep);
-                sock_hold(sk);
                rcvr = &ep->base;
        }
@@ -253,25 +253,18 @@ int sctp_rcv(struct sk_buff *skb)
         */
        sctp_bh_lock_sock(sk);
-        /* It is possible that the association could have moved to a different
-         * socket if it is peeled off. If so, update the sk.
-         */ 
-        if (sk != rcvr->sk) {
-                sctp_bh_lock_sock(rcvr->sk);
-                sctp_bh_unlock_sock(sk);
-                sk = rcvr->sk;
-        }
        if (sock_owned_by_user(sk))
-                sk_add_backlog(sk, skb);
+                sctp_add_backlog(sk, skb);
        else
-                sctp_backlog_rcv(sk, skb);
+                sctp_inq_push(&chunk->rcvr->inqueue, chunk);
-        /* Release the sock and the sock ref we took in the lookup calls.
-         * The asoc/ep ref will be released in sctp_backlog_rcv.
-         */
        sctp_bh_unlock_sock(sk);
-        sock_put(sk);
+        /* Release the asoc/ep ref we took in the lookup calls. */
+        if (asoc)
+                sctp_association_put(asoc);
+        else
+                sctp_endpoint_put(ep);
        return 0;
@@ -280,8 +273,7 @@ discard_it:
        return 0;
 discard_release:
-        /* Release any structures we may be holding. */
+        /* Release the asoc/ep ref we took in the lookup calls. */
-        sock_put(sk);
        if (asoc)
                sctp_association_put(asoc);
        else
@@ -290,56 +282,87 @@ discard_release:
        goto discard_it;
 }
-/* Handle second half of inbound skb processing.  If the sock was busy,
+/* Process the backlog queue of the socket.  Every skb on
- * we may have need to delay processing until later when the sock is
+ * the backlog holds a ref on an association or endpoint.
- * released (on the backlog).   If not busy, we call this routine
+ * We hold this ref throughout the state machine to make
- * directly from the bottom half.
+ * sure that the structure we need is still around.
 */
 int sctp_backlog_rcv(struct sock *sk, struct sk_buff *skb)
 {
        struct sctp_chunk *chunk = SCTP_INPUT_CB(skb)->chunk;
-        struct sctp_inq *inqueue = NULL;
+        struct sctp_inq *inqueue = &chunk->rcvr->inqueue;
        struct sctp_ep_common *rcvr = NULL;
+        int backloged = 0;
        rcvr = chunk->rcvr;
-        BUG_TRAP(rcvr->sk == sk);
+        /* If the rcvr is dead then the association or endpoint
+         * has been deleted and we can safely drop the chunk
-        if (rcvr->dead) {
+         * and refs that we are holding.
-                sctp_chunk_free(chunk);
+         */
-        } else {
+        if (rcvr->dead) {
-                inqueue = &chunk->rcvr->inqueue;
+                sctp_chunk_free(chunk);
-                sctp_inq_push(inqueue, chunk);
+                goto done;
-        }
+        }
-        /* Release the asoc/ep ref we took in the lookup calls in sctp_rcv. */ 
+        if (unlikely(rcvr->sk != sk)) {
-        if (SCTP_EP_TYPE_ASSOCIATION == rcvr->type)
+                /* In this case, the association moved from one socket to
-                sctp_association_put(sctp_assoc(rcvr));
+                 * another.  We are currently sitting on the backlog of the
-        else
+                 * old socket, so we need to move.
-                sctp_endpoint_put(sctp_ep(rcvr));
+                 * However, since we are here in the process context we
-  
+                 * need to take make sure that the user doesn't own
+                 * the new socket when we process the packet.
+                 * If the new socket is user-owned, queue the chunk to the
+                 * backlog of the new socket without dropping any refs.
+                 * Otherwise, we can safely push the chunk on the inqueue.
+                 */
+                sk = rcvr->sk;
+                sctp_bh_lock_sock(sk);
+                if (sock_owned_by_user(sk)) {
+                        sk_add_backlog(sk, skb);
+                        backloged = 1;
+                } else
+                        sctp_inq_push(inqueue, chunk);
+                sctp_bh_unlock_sock(sk);
+                /* If the chunk was backloged again, don't drop refs */
+                if (backloged)
+                        return 0;
+        } else {
+                sctp_inq_push(inqueue, chunk);
+        }
+done:
+        /* Release the refs we took in sctp_add_backlog */
+        if (SCTP_EP_TYPE_ASSOCIATION == rcvr->type)
+                sctp_association_put(sctp_assoc(rcvr));
+        else if (SCTP_EP_TYPE_SOCKET == rcvr->type)
+                sctp_endpoint_put(sctp_ep(rcvr));
+        else
+                BUG();
        return 0;
 }
-void sctp_backlog_migrate(struct sctp_association *assoc, 
+static void sctp_add_backlog(struct sock *sk, struct sk_buff *skb)
-                          struct sock *oldsk, struct sock *newsk)
 {
-        struct sk_buff *skb;
+        struct sctp_chunk *chunk = SCTP_INPUT_CB(skb)->chunk;
-        struct sctp_chunk *chunk;
+        struct sctp_ep_common *rcvr = chunk->rcvr;
-        skb = oldsk->sk_backlog.head;
+        /* Hold the assoc/ep while hanging on the backlog queue.
-        oldsk->sk_backlog.head = oldsk->sk_backlog.tail = NULL;
+         * This way, we know structures we need will not disappear from us
-        while (skb != NULL) {
+         */
-                struct sk_buff *next = skb->next;
+        if (SCTP_EP_TYPE_ASSOCIATION == rcvr->type)
+                sctp_association_hold(sctp_assoc(rcvr));
-                chunk = SCTP_INPUT_CB(skb)->chunk;
+        else if (SCTP_EP_TYPE_SOCKET == rcvr->type)
-                skb->next = NULL;
+                sctp_endpoint_hold(sctp_ep(rcvr));
-                if (&assoc->base == chunk->rcvr)
+        else
-                        sk_add_backlog(newsk, skb);
+                BUG();
-                else
-                        sk_add_backlog(oldsk, skb);
+        sk_add_backlog(sk, skb);
-                skb = next;
-        }
 }
 /* Handle icmp frag needed error. */
@@ -412,7 +435,7 @@ struct sock *sctp_err_lookup(int family, struct sk_buff *skb,
        union sctp_addr daddr;
        struct sctp_af *af;
        struct sock *sk = NULL;
-        struct sctp_association *asoc = NULL;
+        struct sctp_association *asoc;
        struct sctp_transport *transport = NULL;
        *app = NULL; *tpp = NULL;
@@ -453,7 +476,6 @@ struct sock *sctp_err_lookup(int family, struct sk_buff *skb,
        return sk;
 out:
-        sock_put(sk);
        if (asoc)
                sctp_association_put(asoc);
        return NULL;
@@ -463,7 +485,6 @@ out:
 void sctp_err_finish(struct sock *sk, struct sctp_association *asoc)
 {
        sctp_bh_unlock_sock(sk);
-        sock_put(sk);
        if (asoc)
                sctp_association_put(asoc);
 }
@@ -490,7 +511,7 @@ void sctp_v4_err(struct sk_buff *skb, __u32 info)
        int type = skb->h.icmph->type;
        int code = skb->h.icmph->code;
        struct sock *sk;
-        struct sctp_association *asoc;
+        struct sctp_association *asoc = NULL;
        struct sctp_transport *transport;
        struct inet_sock *inet;
        char *saveip, *savesctp;
@@ -716,7 +737,6 @@ static struct sctp_endpoint *__sctp_rcv_lookup_endpoint(const union sctp_addr *l
 hit:
        sctp_endpoint_hold(ep);
-        sock_hold(epb->sk);
        read_unlock(&head->lock);
        return ep;
 }
@@ -818,7 +838,6 @@ static struct sctp_association *__sctp_lookup_association(
 hit:
        *pt = transport;
        sctp_association_hold(asoc);
-        sock_hold(epb->sk);
        read_unlock(&head->lock);
        return asoc;
 }
@@ -846,7 +865,6 @@ int sctp_has_association(const union sctp_addr *laddr,
        struct sctp_transport *transport;
        if ((asoc = sctp_lookup_association(laddr, paddr, &transport))) {
-                sock_put(asoc->base.sk);
                sctp_association_put(asoc);
                return 1;
        }
diff --git a/net/sctp/inqueue.c b/net/sctp/inqueue.c
index 297b8951463e..cf0c767d43ae 100644
--- a/net/sctp/inqueue.c
+++ b/net/sctp/inqueue.c
@@ -149,6 +149,7 @@ struct sctp_chunk *sctp_inq_pop(struct sctp_inq *queue)
                /* This is the first chunk in the packet.  */
                chunk->singleton = 1;
                ch = (sctp_chunkhdr_t *) chunk->skb->data;
+                chunk->data_accepted = 0;
        }
        chunk->chunk_hdr = ch;
diff --git a/net/sctp/sm_sideeffect.c b/net/sctp/sm_sideeffect.c
index 8d1dc24bab4c..c5beb2ad7ef7 100644
--- a/net/sctp/sm_sideeffect.c
+++ b/net/sctp/sm_sideeffect.c
@@ -498,10 +498,6 @@ static void sctp_cmd_assoc_failed(sctp_cmd_seq_t *commands,
        sctp_add_cmd_sf(commands, SCTP_CMD_NEW_STATE,
                        SCTP_STATE(SCTP_STATE_CLOSED));
-        /* Set sk_err to ECONNRESET on a 1-1 style socket. */
-        if (!sctp_style(asoc->base.sk, UDP))
-                asoc->base.sk->sk_err = ECONNRESET; 
        /* SEND_FAILED sent later when cleaning up the association. */
        asoc->outqueue.error = error;
        sctp_add_cmd_sf(commands, SCTP_CMD_DELETE_TCB, SCTP_NULL());
@@ -838,6 +834,15 @@ static void sctp_cmd_del_non_primary(struct sctp_association *asoc)
        return;
 }
+/* Helper function to set sk_err on a 1-1 style socket. */
+static void sctp_cmd_set_sk_err(struct sctp_association *asoc, int error)
+{
+        struct sock *sk = asoc->base.sk;
+        if (!sctp_style(sk, UDP))
+                sk->sk_err = error;
+}
 /* These three macros allow us to pull the debugging code out of the
 * main flow of sctp_do_sm() to keep attention focused on the real
 * functionality there.
@@ -1458,6 +1463,9 @@ static int sctp_cmd_interpreter(sctp_event_t event_type,
                        local_cork = 0;
                        asoc->peer.retran_path = t;
                        break;
+                case SCTP_CMD_SET_SK_ERR:
+                        sctp_cmd_set_sk_err(asoc, cmd->obj.error);
+                        break;
                default:
                        printk(KERN_WARNING "Impossible command: %u, %p\n",
                               cmd->verb, cmd->obj.ptr);
diff --git a/net/sctp/sm_statefuns.c b/net/sctp/sm_statefuns.c
index 2b9a832b29a7..8bc279219a72 100644
--- a/net/sctp/sm_statefuns.c
+++ b/net/sctp/sm_statefuns.c
@@ -93,7 +93,7 @@ static sctp_disposition_t sctp_sf_shut_8_4_5(const struct sctp_endpoint *ep,
 static struct sctp_sackhdr *sctp_sm_pull_sack(struct sctp_chunk *chunk);
 static sctp_disposition_t sctp_stop_t1_and_abort(sctp_cmd_seq_t *commands,
-                                           __u16 error,
+                                           __u16 error, int sk_err,
                                           const struct sctp_association *asoc,
                                           struct sctp_transport *transport);
@@ -448,7 +448,7 @@ sctp_disposition_t sctp_sf_do_5_1C_ack(const struct sctp_endpoint *ep,
        __u32 init_tag;
        struct sctp_chunk *err_chunk;
        struct sctp_packet *packet;
-        sctp_disposition_t ret;
+        __u16 error;
        if (!sctp_vtag_verify(chunk, asoc))
                return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
@@ -480,11 +480,9 @@ sctp_disposition_t sctp_sf_do_5_1C_ack(const struct sctp_endpoint *ep,
                        goto nomem;
                sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(reply));
-                sctp_add_cmd_sf(commands, SCTP_CMD_NEW_STATE,
+                return sctp_stop_t1_and_abort(commands, SCTP_ERROR_INV_PARAM,
-                                SCTP_STATE(SCTP_STATE_CLOSED));
+                                              ECONNREFUSED, asoc,
-                SCTP_INC_STATS(SCTP_MIB_ABORTEDS);
+                                              chunk->transport);
-                sctp_add_cmd_sf(commands, SCTP_CMD_DELETE_TCB, SCTP_NULL());
-                return SCTP_DISPOSITION_DELETE_TCB;
        }
        /* Verify the INIT chunk before processing it. */
@@ -511,27 +509,16 @@ sctp_disposition_t sctp_sf_do_5_1C_ack(const struct sctp_endpoint *ep,
                                sctp_add_cmd_sf(commands, SCTP_CMD_SEND_PKT,
                                                SCTP_PACKET(packet));
                                SCTP_INC_STATS(SCTP_MIB_OUTCTRLCHUNKS);
-                                sctp_add_cmd_sf(commands, SCTP_CMD_NEW_STATE,
+                                error = SCTP_ERROR_INV_PARAM;
-                                                SCTP_STATE(SCTP_STATE_CLOSED));
-                                sctp_add_cmd_sf(commands, SCTP_CMD_DELETE_TCB,
-                                                SCTP_NULL());
-                                return SCTP_DISPOSITION_CONSUME;
                        } else {
-                                sctp_add_cmd_sf(commands, SCTP_CMD_NEW_STATE,
+                                error = SCTP_ERROR_NO_RESOURCE;
-                                                SCTP_STATE(SCTP_STATE_CLOSED));
-                                sctp_add_cmd_sf(commands, SCTP_CMD_DELETE_TCB,
-                                                SCTP_NULL());
-                                return SCTP_DISPOSITION_NOMEM;
                        }
                } else {
-                        ret = sctp_sf_tabort_8_4_8(ep, asoc, type, arg,
+                        sctp_sf_tabort_8_4_8(ep, asoc, type, arg, commands);
-                                                   commands);
+                        error = SCTP_ERROR_INV_PARAM;
-                        sctp_add_cmd_sf(commands, SCTP_CMD_NEW_STATE,
-                                        SCTP_STATE(SCTP_STATE_CLOSED));
-                        sctp_add_cmd_sf(commands, SCTP_CMD_DELETE_TCB,
-                                        SCTP_NULL());
-                        return ret;
                }
+                return sctp_stop_t1_and_abort(commands, error, ECONNREFUSED,
+                                                asoc, chunk->transport);
        }
        /* Tag the variable length parameters.  Note that we never
@@ -636,8 +623,9 @@ sctp_disposition_t sctp_sf_do_5_1D_ce(const struct sctp_endpoint *ep,
         */
        chunk->subh.cookie_hdr =
                (struct sctp_signed_cookie *)chunk->skb->data;
-        skb_pull(chunk->skb,
+        if (!pskb_pull(chunk->skb, ntohs(chunk->chunk_hdr->length) -
-                 ntohs(chunk->chunk_hdr->length) - sizeof(sctp_chunkhdr_t));
+                                         sizeof(sctp_chunkhdr_t)))
+                goto nomem;
        /* 5.1 D) Upon reception of the COOKIE ECHO chunk, Endpoint
         * "Z" will reply with a COOKIE ACK chunk after building a TCB
@@ -885,6 +873,8 @@ sctp_disposition_t sctp_sf_sendbeat_8_3(const struct sctp_endpoint *ep,
        struct sctp_transport *transport = (struct sctp_transport *) arg;
        if (asoc->overall_error_count >= asoc->max_retrans) {
+                sctp_add_cmd_sf(commands, SCTP_CMD_SET_SK_ERR,
+                                SCTP_ERROR(ETIMEDOUT));
                /* CMD_ASSOC_FAILED calls CMD_DELETE_TCB. */
                sctp_add_cmd_sf(commands, SCTP_CMD_ASSOC_FAILED,
                                SCTP_U32(SCTP_ERROR_NO_ERROR));
@@ -965,7 +955,8 @@ sctp_disposition_t sctp_sf_beat_8_3(const struct sctp_endpoint *ep,
         */
        chunk->subh.hb_hdr = (sctp_heartbeathdr_t *) chunk->skb->data;
        paylen = ntohs(chunk->chunk_hdr->length) - sizeof(sctp_chunkhdr_t);
-        skb_pull(chunk->skb, paylen);
+        if (!pskb_pull(chunk->skb, paylen))
+                goto nomem;
        reply = sctp_make_heartbeat_ack(asoc, chunk,
                                        chunk->subh.hb_hdr, paylen);
@@ -1028,6 +1019,12 @@ sctp_disposition_t sctp_sf_backbeat_8_3(const struct sctp_endpoint *ep,
                                                  commands);
        hbinfo = (sctp_sender_hb_info_t *) chunk->skb->data;
+        /* Make sure that the length of the parameter is what we expect */
+        if (ntohs(hbinfo->param_hdr.length) !=
+                                    sizeof(sctp_sender_hb_info_t)) {
+                return SCTP_DISPOSITION_DISCARD;
+        }
        from_addr = hbinfo->daddr;
        link = sctp_assoc_lookup_paddr(asoc, &from_addr);
@@ -1860,8 +1857,9 @@ sctp_disposition_t sctp_sf_do_5_2_4_dupcook(const struct sctp_endpoint *ep,
         * are in good shape.
         */
        chunk->subh.cookie_hdr = (struct sctp_signed_cookie *)chunk->skb->data;
-        skb_pull(chunk->skb, ntohs(chunk->chunk_hdr->length) -
+        if (!pskb_pull(chunk->skb, ntohs(chunk->chunk_hdr->length) -
-                 sizeof(sctp_chunkhdr_t));
+                                        sizeof(sctp_chunkhdr_t)))
+                goto nomem;
        /* In RFC 2960 5.2.4 3, if both Verification Tags in the State Cookie
         * of a duplicate COOKIE ECHO match the Verification Tags of the
@@ -2123,6 +2121,8 @@ static sctp_disposition_t sctp_sf_do_5_2_6_stale(const struct sctp_endpoint *ep,
        int attempts = asoc->init_err_counter + 1;
        if (attempts > asoc->max_init_attempts) {
+                sctp_add_cmd_sf(commands, SCTP_CMD_SET_SK_ERR,
+                                SCTP_ERROR(ETIMEDOUT));
                sctp_add_cmd_sf(commands, SCTP_CMD_INIT_FAILED,
                                SCTP_U32(SCTP_ERROR_STALE_COOKIE));
                return SCTP_DISPOSITION_DELETE_TCB;
@@ -2259,6 +2259,7 @@ sctp_disposition_t sctp_sf_do_9_1_abort(const struct sctp_endpoint *ep,
        if (len >= sizeof(struct sctp_chunkhdr) + sizeof(struct sctp_errhdr))
                error = ((sctp_errhdr_t *)chunk->skb->data)->cause;
+        sctp_add_cmd_sf(commands, SCTP_CMD_SET_SK_ERR, SCTP_ERROR(ECONNRESET));
        /* ASSOC_FAILED will DELETE_TCB. */
        sctp_add_cmd_sf(commands, SCTP_CMD_ASSOC_FAILED, SCTP_U32(error));
        SCTP_INC_STATS(SCTP_MIB_ABORTEDS);
@@ -2303,7 +2304,8 @@ sctp_disposition_t sctp_sf_cookie_wait_abort(const struct sctp_endpoint *ep,
        if (len >= sizeof(struct sctp_chunkhdr) + sizeof(struct sctp_errhdr))
                error = ((sctp_errhdr_t *)chunk->skb->data)->cause;
-        return sctp_stop_t1_and_abort(commands, error, asoc, chunk->transport);
+        return sctp_stop_t1_and_abort(commands, error, ECONNREFUSED, asoc,
+                                      chunk->transport);
 }
 /*
@@ -2315,7 +2317,8 @@ sctp_disposition_t sctp_sf_cookie_wait_icmp_abort(const struct sctp_endpoint *ep
                                        void *arg,
                                        sctp_cmd_seq_t *commands)
 {
-        return sctp_stop_t1_and_abort(commands, SCTP_ERROR_NO_ERROR, asoc,
+        return sctp_stop_t1_and_abort(commands, SCTP_ERROR_NO_ERROR,
+                                      ENOPROTOOPT, asoc,
                                      (struct sctp_transport *)arg);
 }
@@ -2340,7 +2343,7 @@ sctp_disposition_t sctp_sf_cookie_echoed_abort(const struct sctp_endpoint *ep,
 * This is common code called by several sctp_sf_*_abort() functions above.
 */
 static sctp_disposition_t sctp_stop_t1_and_abort(sctp_cmd_seq_t *commands,
-                                           __u16 error,
+                                           __u16 error, int sk_err,
                                           const struct sctp_association *asoc,
                                           struct sctp_transport *transport)
 {
@@ -2350,6 +2353,7 @@ static sctp_disposition_t sctp_stop_t1_and_abort(sctp_cmd_seq_t *commands,
        SCTP_INC_STATS(SCTP_MIB_ABORTEDS);
        sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP,
                        SCTP_TO(SCTP_EVENT_TIMEOUT_T1_INIT));
+        sctp_add_cmd_sf(commands, SCTP_CMD_SET_SK_ERR, SCTP_ERROR(sk_err));
        /* CMD_INIT_FAILED will DELETE_TCB. */
        sctp_add_cmd_sf(commands, SCTP_CMD_INIT_FAILED,
                        SCTP_U32(error));
@@ -3333,6 +3337,8 @@ sctp_disposition_t sctp_sf_do_asconf_ack(const struct sctp_endpoint *ep,
                sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP,
                                SCTP_TO(SCTP_EVENT_TIMEOUT_T4_RTO));
                sctp_add_cmd_sf(commands, SCTP_CMD_DISCARD_PACKET,SCTP_NULL());
+                sctp_add_cmd_sf(commands, SCTP_CMD_SET_SK_ERR,
+                                SCTP_ERROR(ECONNABORTED));
                sctp_add_cmd_sf(commands, SCTP_CMD_ASSOC_FAILED,
                                SCTP_U32(SCTP_ERROR_ASCONF_ACK));
                SCTP_INC_STATS(SCTP_MIB_ABORTEDS);
@@ -3359,6 +3365,8 @@ sctp_disposition_t sctp_sf_do_asconf_ack(const struct sctp_endpoint *ep,
                 * processing the rest of the chunks in the packet.
                 */
                sctp_add_cmd_sf(commands, SCTP_CMD_DISCARD_PACKET,SCTP_NULL());
+                sctp_add_cmd_sf(commands, SCTP_CMD_SET_SK_ERR,
+                                SCTP_ERROR(ECONNABORTED));
                sctp_add_cmd_sf(commands, SCTP_CMD_ASSOC_FAILED,
                                SCTP_U32(SCTP_ERROR_ASCONF_ACK));
                SCTP_INC_STATS(SCTP_MIB_ABORTEDS);
@@ -3711,9 +3719,13 @@ static sctp_disposition_t sctp_sf_violation_chunklen(
        if (asoc->state <= SCTP_STATE_COOKIE_ECHOED) {
                sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP,
                                SCTP_TO(SCTP_EVENT_TIMEOUT_T1_INIT));
+                sctp_add_cmd_sf(commands, SCTP_CMD_SET_SK_ERR,
+                                SCTP_ERROR(ECONNREFUSED));
                sctp_add_cmd_sf(commands, SCTP_CMD_INIT_FAILED,
                                SCTP_U32(SCTP_ERROR_PROTO_VIOLATION));
        } else {
+                sctp_add_cmd_sf(commands, SCTP_CMD_SET_SK_ERR,
+                                SCTP_ERROR(ECONNABORTED));
                sctp_add_cmd_sf(commands, SCTP_CMD_ASSOC_FAILED,
                                SCTP_U32(SCTP_ERROR_PROTO_VIOLATION));
                SCTP_DEC_STATS(SCTP_MIB_CURRESTAB);
@@ -4031,6 +4043,8 @@ sctp_disposition_t sctp_sf_do_9_1_prm_abort(
         * TCB.  This is a departure from our typical NOMEM handling.
         */
+        sctp_add_cmd_sf(commands, SCTP_CMD_SET_SK_ERR,
+                        SCTP_ERROR(ECONNABORTED));
        /* Delete the established association. */
        sctp_add_cmd_sf(commands, SCTP_CMD_ASSOC_FAILED,
                        SCTP_U32(SCTP_ERROR_USER_ABORT));
@@ -4172,6 +4186,8 @@ sctp_disposition_t sctp_sf_cookie_wait_prm_abort(
         * TCB.  This is a departure from our typical NOMEM handling.
         */
+        sctp_add_cmd_sf(commands, SCTP_CMD_SET_SK_ERR,
+                        SCTP_ERROR(ECONNREFUSED));
        /* Delete the established association. */
        sctp_add_cmd_sf(commands, SCTP_CMD_INIT_FAILED,
                        SCTP_U32(SCTP_ERROR_USER_ABORT));
@@ -4540,6 +4556,8 @@ sctp_disposition_t sctp_sf_do_6_3_3_rtx(const struct sctp_endpoint *ep,
        struct sctp_transport *transport = arg;
        if (asoc->overall_error_count >= asoc->max_retrans) {
+                sctp_add_cmd_sf(commands, SCTP_CMD_SET_SK_ERR,
+                                SCTP_ERROR(ETIMEDOUT));
                /* CMD_ASSOC_FAILED calls CMD_DELETE_TCB. */
                sctp_add_cmd_sf(commands, SCTP_CMD_ASSOC_FAILED,
                                SCTP_U32(SCTP_ERROR_NO_ERROR));
@@ -4659,6 +4677,8 @@ sctp_disposition_t sctp_sf_t1_init_timer_expire(const struct sctp_endpoint *ep,
                SCTP_DEBUG_PRINTK("Giving up on INIT, attempts: %d"
                                  " max_init_attempts: %d\n",
                                  attempts, asoc->max_init_attempts);
+                sctp_add_cmd_sf(commands, SCTP_CMD_SET_SK_ERR,
+                                SCTP_ERROR(ETIMEDOUT));
                sctp_add_cmd_sf(commands, SCTP_CMD_INIT_FAILED,
                                SCTP_U32(SCTP_ERROR_NO_ERROR));
                return SCTP_DISPOSITION_DELETE_TCB;
@@ -4708,6 +4728,8 @@ sctp_disposition_t sctp_sf_t1_cookie_timer_expire(const struct sctp_endpoint *ep
                sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(repl));
        } else {
+                sctp_add_cmd_sf(commands, SCTP_CMD_SET_SK_ERR,
+                                SCTP_ERROR(ETIMEDOUT));
                sctp_add_cmd_sf(commands, SCTP_CMD_INIT_FAILED,
                                SCTP_U32(SCTP_ERROR_NO_ERROR));
                return SCTP_DISPOSITION_DELETE_TCB;
@@ -4739,6 +4761,8 @@ sctp_disposition_t sctp_sf_t2_timer_expire(const struct sctp_endpoint *ep,
        SCTP_DEBUG_PRINTK("Timer T2 expired.\n");
        if (asoc->overall_error_count >= asoc->max_retrans) {
+                sctp_add_cmd_sf(commands, SCTP_CMD_SET_SK_ERR,
+                                SCTP_ERROR(ETIMEDOUT));
                /* Note:  CMD_ASSOC_FAILED calls CMD_DELETE_TCB. */
                sctp_add_cmd_sf(commands, SCTP_CMD_ASSOC_FAILED,
                                SCTP_U32(SCTP_ERROR_NO_ERROR));
@@ -4814,6 +4838,8 @@ sctp_disposition_t sctp_sf_t4_timer_expire(
        if (asoc->overall_error_count >= asoc->max_retrans) {
                sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP,
                                SCTP_TO(SCTP_EVENT_TIMEOUT_T4_RTO));
+                sctp_add_cmd_sf(commands, SCTP_CMD_SET_SK_ERR,
+                                SCTP_ERROR(ETIMEDOUT));
                sctp_add_cmd_sf(commands, SCTP_CMD_ASSOC_FAILED,
                                SCTP_U32(SCTP_ERROR_NO_ERROR));
                SCTP_INC_STATS(SCTP_MIB_ABORTEDS);
@@ -4867,6 +4893,8 @@ sctp_disposition_t sctp_sf_t5_timer_expire(const struct sctp_endpoint *ep,
                goto nomem;
        sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(reply));
+        sctp_add_cmd_sf(commands, SCTP_CMD_SET_SK_ERR,
+                        SCTP_ERROR(ETIMEDOUT));
        sctp_add_cmd_sf(commands, SCTP_CMD_ASSOC_FAILED,
                        SCTP_U32(SCTP_ERROR_NO_ERROR));
@@ -5151,7 +5179,9 @@ static int sctp_eat_data(const struct sctp_association *asoc,
        int tmp;
        __u32 tsn;
        int account_value;
+        struct sctp_tsnmap *map = (struct sctp_tsnmap *)&asoc->peer.tsn_map;
        struct sock *sk = asoc->base.sk;
+        int rcvbuf_over = 0;
        data_hdr = chunk->subh.data_hdr = (sctp_datahdr_t *)chunk->skb->data;
        skb_pull(chunk->skb, sizeof(sctp_datahdr_t));
@@ -5162,10 +5192,16 @@ static int sctp_eat_data(const struct sctp_association *asoc,
        /* ASSERT:  Now skb->data is really the user data.  */
        /*
-         * if we are established, and we have used up our receive
+         * If we are established, and we have used up our receive buffer
-         * buffer memory, drop the frame
+         * memory, think about droping the frame.
-         */
+         * Note that we have an opportunity to improve performance here.
-        if (asoc->state == SCTP_STATE_ESTABLISHED) {
+         * If we accept one chunk from an skbuff, we have to keep all the
+         * memory of that skbuff around until the chunk is read into user
+         * space. Therefore, once we accept 1 chunk we may as well accept all
+         * remaining chunks in the skbuff. The data_accepted flag helps us do
+         * that.
+         */
+        if ((asoc->state == SCTP_STATE_ESTABLISHED) && (!chunk->data_accepted)) {
                /*
                 * If the receive buffer policy is 1, then each
                 * association can allocate up to sk_rcvbuf bytes
@@ -5176,9 +5212,25 @@ static int sctp_eat_data(const struct sctp_association *asoc,
                        account_value = atomic_read(&asoc->rmem_alloc);
                else
                        account_value = atomic_read(&sk->sk_rmem_alloc);
+                if (account_value > sk->sk_rcvbuf) {
-                if (account_value > sk->sk_rcvbuf)
+                        /*
-                        return SCTP_IERROR_IGNORE_TSN;
+                         * We need to make forward progress, even when we are
+                         * under memory pressure, so we always allow the
+                         * next tsn after the ctsn ack point to be accepted.
+                         * This lets us avoid deadlocks in which we have to
+                         * drop frames that would otherwise let us drain the
+                         * receive queue.
+                         */
+                        if ((sctp_tsnmap_get_ctsn(map) + 1) != tsn)
+                                return SCTP_IERROR_IGNORE_TSN;
+                        /*
+                         * We're going to accept the frame but we should renege
+                         * to make space for it. This will send us down that
+                         * path later in this function.
+                         */
+                        rcvbuf_over = 1;
+                }
        }
        /* Process ECN based congestion.
@@ -5226,6 +5278,7 @@ static int sctp_eat_data(const struct sctp_association *asoc,
        datalen -= sizeof(sctp_data_chunk_t);
        deliver = SCTP_CMD_CHUNK_ULP;
+        chunk->data_accepted = 1;
        /* Think about partial delivery. */
        if ((datalen >= asoc->rwnd) && (!asoc->ulpq.pd_mode)) {
@@ -5242,7 +5295,8 @@ static int sctp_eat_data(const struct sctp_association *asoc,
         * large spill over.
         */
        if (!asoc->rwnd || asoc->rwnd_over ||
-            (datalen > asoc->rwnd + asoc->frag_point)) {
+            (datalen > asoc->rwnd + asoc->frag_point) ||
+            rcvbuf_over) {
                /* If this is the next TSN, consider reneging to make
                 * room.   Note: Playing nice with a confused sender.  A
@@ -5250,8 +5304,8 @@ static int sctp_eat_data(const struct sctp_association *asoc,
                 * space and in the future we may want to detect and
                 * do more drastic reneging.
                 */
-                if (sctp_tsnmap_has_gap(&asoc->peer.tsn_map) &&
+                if (sctp_tsnmap_has_gap(map) &&
-                    (sctp_tsnmap_get_ctsn(&asoc->peer.tsn_map) + 1) == tsn) {
+                    (sctp_tsnmap_get_ctsn(map) + 1) == tsn) {
                        SCTP_DEBUG_PRINTK("Reneging for tsn:%u\n", tsn);
                        deliver = SCTP_CMD_RENEGE;
                } else {
@@ -5280,6 +5334,8 @@ static int sctp_eat_data(const struct sctp_association *asoc,
                 * processing the rest of the chunks in the packet.
                 */
                sctp_add_cmd_sf(commands, SCTP_CMD_DISCARD_PACKET,SCTP_NULL());
+                sctp_add_cmd_sf(commands, SCTP_CMD_SET_SK_ERR,
+                                SCTP_ERROR(ECONNABORTED));
                sctp_add_cmd_sf(commands, SCTP_CMD_ASSOC_FAILED,
                                SCTP_U32(SCTP_ERROR_NO_DATA));
                SCTP_INC_STATS(SCTP_MIB_ABORTEDS);
diff --git a/net/sctp/sm_statetable.c b/net/sctp/sm_statetable.c
index 75ef10408764..8bcca5676151 100644
--- a/net/sctp/sm_statetable.c
+++ b/net/sctp/sm_statetable.c
@@ -366,9 +366,9 @@ const sctp_sm_table_entry_t *sctp_sm_lookup_event(sctp_event_t event_type,
        /* SCTP_STATE_EMPTY */ \
        {.fn = sctp_sf_ootb, .name = "sctp_sf_ootb"}, \
        /* SCTP_STATE_CLOSED */ \
-        {.fn = sctp_sf_bug, .name = "sctp_sf_bug"}, \
+        {.fn = sctp_sf_discard_chunk, .name = "sctp_sf_discard_chunk"}, \
        /* SCTP_STATE_COOKIE_WAIT */ \
-        {.fn = sctp_sf_bug, .name = "sctp_sf_bug"}, \
+        {.fn = sctp_sf_discard_chunk, .name = "sctp_sf_discard_chunk"}, \
        /* SCTP_STATE_COOKIE_ECHOED */ \
        {.fn = sctp_sf_do_ecne, .name = "sctp_sf_do_ecne"}, \
        /* SCTP_STATE_ESTABLISHED */ \
@@ -380,7 +380,7 @@ const sctp_sm_table_entry_t *sctp_sm_lookup_event(sctp_event_t event_type,
        /* SCTP_STATE_SHUTDOWN_RECEIVED */ \
        {.fn = sctp_sf_do_ecne, .name = "sctp_sf_do_ecne"}, \
        /* SCTP_STATE_SHUTDOWN_ACK_SENT */ \
-        {.fn = sctp_sf_bug, .name = "sctp_sf_bug"}, \
+        {.fn = sctp_sf_discard_chunk, .name = "sctp_sf_discard_chunk"}, \
 } /* TYPE_SCTP_ECN_ECNE */
 #define TYPE_SCTP_ECN_CWR { \
@@ -401,7 +401,7 @@ const sctp_sm_table_entry_t *sctp_sm_lookup_event(sctp_event_t event_type,
        /* SCTP_STATE_SHUTDOWN_RECEIVED */ \
        {.fn = sctp_sf_discard_chunk, .name = "sctp_sf_discard_chunk"}, \
        /* SCTP_STATE_SHUTDOWN_ACK_SENT */ \
-        {.fn = sctp_sf_bug, .name = "sctp_sf_bug"}, \
+        {.fn = sctp_sf_discard_chunk, .name = "sctp_sf_discard_chunk"}, \
 } /* TYPE_SCTP_ECN_CWR */
 #define TYPE_SCTP_SHUTDOWN_COMPLETE { \
@@ -647,7 +647,7 @@ chunk_event_table_unknown[SCTP_STATE_NUM_STATES] = {
        /* SCTP_STATE_EMPTY */ \
        {.fn = sctp_sf_bug, .name = "sctp_sf_bug"}, \
        /* SCTP_STATE_CLOSED */ \
-        {.fn = sctp_sf_bug, .name = "sctp_sf_bug"}, \
+        {.fn = sctp_sf_error_closed, .name = "sctp_sf_error_closed"}, \
        /* SCTP_STATE_COOKIE_WAIT */ \
        {.fn = sctp_sf_do_prm_requestheartbeat,               \
         .name = "sctp_sf_do_prm_requestheartbeat"},          \
diff --git a/net/sctp/socket.c b/net/sctp/socket.c
index b6e4b89539b3..174d4d35e951 100644
--- a/net/sctp/socket.c
+++ b/net/sctp/socket.c
@@ -1057,6 +1057,7 @@ static int __sctp_connect(struct sock* sk,
        inet_sk(sk)->dport = htons(asoc->peer.port);
        af = sctp_get_af_specific(to.sa.sa_family);
        af->to_sk_daddr(&to, sk);
+        sk->sk_err = 0;
        timeo = sock_sndtimeo(sk, sk->sk_socket->file->f_flags & O_NONBLOCK);
        err = sctp_wait_for_connect(asoc, &timeo);
@@ -1228,7 +1229,7 @@ SCTP_STATIC void sctp_close(struct sock *sk, long timeout)
        ep = sctp_sk(sk)->ep;
-        /* Walk all associations on a socket, not on an endpoint.  */
+        /* Walk all associations on an endpoint.  */
        list_for_each_safe(pos, temp, &ep->asocs) {
                asoc = list_entry(pos, struct sctp_association, asocs);
@@ -1241,13 +1242,13 @@ SCTP_STATIC void sctp_close(struct sock *sk, long timeout)
                        if (sctp_state(asoc, CLOSED)) {
                                sctp_unhash_established(asoc);
                                sctp_association_free(asoc);
+                                continue;
+                        }
+                }
-                        } else if (sock_flag(sk, SOCK_LINGER) &&
+                if (sock_flag(sk, SOCK_LINGER) && !sk->sk_lingertime)
-                                   !sk->sk_lingertime)
+                        sctp_primitive_ABORT(asoc, NULL);
-                                sctp_primitive_ABORT(asoc, NULL);
+                else
-                        else
-                                sctp_primitive_SHUTDOWN(asoc, NULL);
-                } else
                        sctp_primitive_SHUTDOWN(asoc, NULL);
        }
@@ -5317,6 +5318,7 @@ static int sctp_wait_for_sndbuf(struct sctp_association *asoc, long *timeo_p,
                 */
                sctp_release_sock(sk);
                current_timeo = schedule_timeout(current_timeo);
+                BUG_ON(sk != asoc->base.sk);
                sctp_lock_sock(sk);
                *timeo_p = current_timeo;
@@ -5604,12 +5606,14 @@ static void sctp_sock_migrate(struct sock *oldsk, struct sock *newsk,
         */
        newsp->type = type;
-        spin_lock_bh(&oldsk->sk_lock.slock);
+        /* Mark the new socket "in-use" by the user so that any packets
-        /* Migrate the backlog from oldsk to newsk. */
+         * that may arrive on the association after we've moved it are
-        sctp_backlog_migrate(assoc, oldsk, newsk);
+         * queued to the backlog.  This prevents a potential race between
-        /* Migrate the association to the new socket. */
+         * backlog processing on the old socket and new-packet processing
+         * on the new socket.
+         */
+        sctp_lock_sock(newsk);
        sctp_assoc_migrate(assoc, newsk);
-        spin_unlock_bh(&oldsk->sk_lock.slock);
        /* If the association on the newsk is already closed before accept()
         * is called, set RCV_SHUTDOWN flag.
@@ -5618,6 +5622,7 @@ static void sctp_sock_migrate(struct sock *oldsk, struct sock *newsk,
                newsk->sk_shutdown |= RCV_SHUTDOWN;
        newsk->sk_state = SCTP_SS_ESTABLISHED;
+        sctp_release_sock(newsk);
 }
 /* This proto struct describes the ULP interface for SCTP.  */
diff --git a/net/sctp/ulpqueue.c b/net/sctp/ulpqueue.c
index 2080b2d28c98..575e556aeb3e 100644
--- a/net/sctp/ulpqueue.c
+++ b/net/sctp/ulpqueue.c
@@ -279,6 +279,7 @@ static inline void sctp_ulpq_store_reasm(struct sctp_ulpq *ulpq,
 static struct sctp_ulpevent *sctp_make_reassembled_event(struct sk_buff_head *queue, struct sk_buff *f_frag, struct sk_buff *l_frag)
 {
        struct sk_buff *pos;
+        struct sk_buff *new = NULL;
        struct sctp_ulpevent *event;
        struct sk_buff *pnext, *last;
        struct sk_buff *list = skb_shinfo(f_frag)->frag_list;
@@ -297,11 +298,33 @@ static struct sctp_ulpevent *sctp_make_reassembled_event(struct sk_buff_head *qu
         */
        if (last)
                last->next = pos;
-        else
+        else {
-                skb_shinfo(f_frag)->frag_list = pos;
+                if (skb_cloned(f_frag)) {
+                        /* This is a cloned skb, we can't just modify
+                         * the frag_list.  We need a new skb to do that.
+                         * Instead of calling skb_unshare(), we'll do it
+                         * ourselves since we need to delay the free.
+                         */
+                        new = skb_copy(f_frag, GFP_ATOMIC);
+                        if (!new)
+                                return NULL;    /* try again later */
+                        new->sk = f_frag->sk;
+                        skb_shinfo(new)->frag_list = pos;
+                } else
+                        skb_shinfo(f_frag)->frag_list = pos;
+        }
        /* Remove the first fragment from the reassembly queue.  */
        __skb_unlink(f_frag, queue);
+        /* if we did unshare, then free the old skb and re-assign */
+        if (new) {
+                kfree_skb(f_frag);
+                f_frag = new;
+        }
        while (pos) {
                pnext = pos->next;
diff --git a/net/socket.c b/net/socket.c
index 23898f45f713..02948b622bd2 100644
--- a/net/socket.c
+++ b/net/socket.c
@@ -267,6 +267,8 @@ int move_addr_to_user(void *kaddr, int klen, void __user *uaddr, int __user *ule
                return -EINVAL;
        if(len)
        {
+                if (audit_sockaddr(klen, kaddr))
+                        return -ENOMEM;
                if(copy_to_user(uaddr,kaddr,len))
                        return -EFAULT;
        }
@@ -490,6 +492,7 @@ static struct socket *sockfd_lookup_light(int fd, int *err, int *fput_needed)
        struct file *file;
        struct socket *sock;
+        *err = -EBADF;
        file = fget_light(fd, fput_needed);
        if (file) {
                sock = sock_from_file(file, err);
diff --git a/net/sunrpc/auth_gss/auth_gss.c b/net/sunrpc/auth_gss/auth_gss.c
index 900ef31f5a0e..519ebc17c028 100644
--- a/net/sunrpc/auth_gss/auth_gss.c
+++ b/net/sunrpc/auth_gss/auth_gss.c
@@ -794,7 +794,6 @@ gss_create_cred(struct rpc_auth *auth, struct auth_cred *acred, int flags)
 out_err:
        dprintk("RPC:      gss_create_cred failed with error %d\n", err);
-        if (cred) gss_destroy_cred(&cred->gc_base);
        return ERR_PTR(err);
 }
diff --git a/net/sunrpc/auth_gss/gss_krb5_crypto.c b/net/sunrpc/auth_gss/gss_krb5_crypto.c
index 97c981fa6b8e..76b969e6904f 100644
--- a/net/sunrpc/auth_gss/gss_krb5_crypto.c
+++ b/net/sunrpc/auth_gss/gss_krb5_crypto.c
@@ -212,7 +212,6 @@ make_checksum(s32 cksumtype, char *header, int hdrlen, struct xdr_buf *body,
        char                            *cksumname;
        struct crypto_tfm               *tfm = NULL; /* XXX add to ctx? */
        struct scatterlist              sg[1];
-        u32                             code = GSS_S_FAILURE;
        switch (cksumtype) {
                case CKSUMTYPE_RSA_MD5:
@@ -221,13 +220,11 @@ make_checksum(s32 cksumtype, char *header, int hdrlen, struct xdr_buf *body,
                default:
                        dprintk("RPC:      krb5_make_checksum:"
                                " unsupported checksum %d", cksumtype);
-                        goto out;
+                        return GSS_S_FAILURE;
        }
        if (!(tfm = crypto_alloc_tfm(cksumname, CRYPTO_TFM_REQ_MAY_SLEEP)))
-                goto out;
+                return GSS_S_FAILURE;
        cksum->len = crypto_tfm_alg_digestsize(tfm);
-        if ((cksum->data = kmalloc(cksum->len, GFP_KERNEL)) == NULL)
-                goto out;
        crypto_digest_init(tfm);
        sg_set_buf(sg, header, hdrlen);
@@ -235,10 +232,8 @@ make_checksum(s32 cksumtype, char *header, int hdrlen, struct xdr_buf *body,
        process_xdr_buf(body, body_offset, body->len - body_offset,
                        checksummer, tfm);
        crypto_digest_final(tfm, cksum->data);
-        code = 0;
-out:
        crypto_free_tfm(tfm);
-        return code;
+        return 0;
 }
 EXPORT_SYMBOL(make_checksum);
diff --git a/net/sunrpc/cache.c b/net/sunrpc/cache.c
index 3ac4193a78ed..7026b0866b7b 100644
--- a/net/sunrpc/cache.c
+++ b/net/sunrpc/cache.c
@@ -159,6 +159,7 @@ struct cache_head *sunrpc_cache_update(struct cache_detail *detail,
                detail->update(tmp, new);
        tmp->next = *head;
        *head = tmp;
+        detail->entries++;
        cache_get(tmp);
        is_new = cache_fresh_locked(tmp, new->expiry_time);
        cache_fresh_locked(old, 0);
diff --git a/net/sunrpc/stats.c b/net/sunrpc/stats.c
index dea529666d69..15c2db26767b 100644
--- a/net/sunrpc/stats.c
+++ b/net/sunrpc/stats.c
@@ -176,7 +176,8 @@ void rpc_count_iostats(struct rpc_task *task)
        op_metrics->om_execute += execute;
 }
-void _print_name(struct seq_file *seq, unsigned int op, struct rpc_procinfo *procs)
+static void _print_name(struct seq_file *seq, unsigned int op,
+                        struct rpc_procinfo *procs)
 {
        if (procs[op].p_name)
                seq_printf(seq, "\t%12s: ", procs[op].p_name);
diff --git a/net/sysctl_net.c b/net/sysctl_net.c
index 55538f6b60ff..58a1b6b42ddd 100644
--- a/net/sysctl_net.c
+++ b/net/sysctl_net.c
@@ -37,14 +37,6 @@ struct ctl_table net_table[] = {
                .mode           = 0555,
                .child          = core_table,
        },
-#ifdef CONFIG_NET
-        {
-                .ctl_name       = NET_ETHER,
-                .procname       = "ethernet",
-                .mode           = 0555,
-                .child          = ether_table,
-        },
-#endif
 #ifdef CONFIG_INET
        {
                .ctl_name       = NET_IPV4,
diff --git a/net/tipc/name_distr.c b/net/tipc/name_distr.c
index 953307a9df1d..a3bbc891f959 100644
--- a/net/tipc/name_distr.c
+++ b/net/tipc/name_distr.c
@@ -229,8 +229,7 @@ static void node_is_down(struct publication *publ)
                                     publ->node, publ->ref, publ->key);
        assert(p == publ);
        write_unlock_bh(&tipc_nametbl_lock);
-        if (publ)
+        kfree(publ);
-                kfree(publ);
 }
 /**
diff --git a/net/x25/x25_timer.c b/net/x25/x25_timer.c
index 0a92e1da3922..71ff3088f6fe 100644
--- a/net/x25/x25_timer.c
+++ b/net/x25/x25_timer.c
@@ -114,8 +114,9 @@ static void x25_heartbeat_expiry(unsigned long param)
                        if (sock_flag(sk, SOCK_DESTROY) ||
                            (sk->sk_state == TCP_LISTEN &&
                             sock_flag(sk, SOCK_DEAD))) {
+                                bh_unlock_sock(sk);
                                x25_destroy_socket(sk);
-                                goto unlock;
+                                return;
                        }
                        break;
@@ -128,7 +129,6 @@ static void x25_heartbeat_expiry(unsigned long param)
        }
 restart_heartbeat:
        x25_start_heartbeat(sk);
-unlock:
        bh_unlock_sock(sk);
 }
diff --git a/net/xfrm/xfrm_input.c b/net/xfrm/xfrm_input.c
index b54971059f16..891a6090cc09 100644
--- a/net/xfrm/xfrm_input.c
+++ b/net/xfrm/xfrm_input.c
@@ -62,7 +62,7 @@ int xfrm_parse_spi(struct sk_buff *skb, u8 nexthdr, u32 *spi, u32 *seq)
        case IPPROTO_COMP:
                if (!pskb_may_pull(skb, sizeof(struct ip_comp_hdr)))
                        return -EINVAL;
-                *spi = ntohl(ntohs(*(u16*)(skb->h.raw + 2)));
+                *spi = htonl(ntohs(*(u16*)(skb->h.raw + 2)));
                *seq = 0;
                return 0;
        default:
diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c
index c3725fe2a8fb..b469c8b54613 100644
--- a/net/xfrm/xfrm_policy.c
+++ b/net/xfrm/xfrm_policy.c
@@ -57,12 +57,12 @@ int xfrm_register_type(struct xfrm_type *type, unsigned short family)
                return -EAFNOSUPPORT;
        typemap = afinfo->type_map;
-        write_lock(&typemap->lock);
+        write_lock_bh(&typemap->lock);
        if (likely(typemap->map[type->proto] == NULL))
                typemap->map[type->proto] = type;
        else
                err = -EEXIST;
-        write_unlock(&typemap->lock);
+        write_unlock_bh(&typemap->lock);
        xfrm_policy_put_afinfo(afinfo);
        return err;
 }
@@ -78,12 +78,12 @@ int xfrm_unregister_type(struct xfrm_type *type, unsigned short family)
                return -EAFNOSUPPORT;
        typemap = afinfo->type_map;
-        write_lock(&typemap->lock);
+        write_lock_bh(&typemap->lock);
        if (unlikely(typemap->map[type->proto] != type))
                err = -ENOENT;
        else
                typemap->map[type->proto] = NULL;
-        write_unlock(&typemap->lock);
+        write_unlock_bh(&typemap->lock);
        xfrm_policy_put_afinfo(afinfo);
        return err;
 }
@@ -1251,7 +1251,7 @@ int xfrm_policy_register_afinfo(struct xfrm_policy_afinfo *afinfo)
                return -EINVAL;
        if (unlikely(afinfo->family >= NPROTO))
                return -EAFNOSUPPORT;
-        write_lock(&xfrm_policy_afinfo_lock);
+        write_lock_bh(&xfrm_policy_afinfo_lock);
        if (unlikely(xfrm_policy_afinfo[afinfo->family] != NULL))
                err = -ENOBUFS;
        else {
@@ -1268,7 +1268,7 @@ int xfrm_policy_register_afinfo(struct xfrm_policy_afinfo *afinfo)
                        afinfo->garbage_collect = __xfrm_garbage_collect;
                xfrm_policy_afinfo[afinfo->family] = afinfo;
        }
-        write_unlock(&xfrm_policy_afinfo_lock);
+        write_unlock_bh(&xfrm_policy_afinfo_lock);
        return err;
 }
 EXPORT_SYMBOL(xfrm_policy_register_afinfo);
@@ -1280,7 +1280,7 @@ int xfrm_policy_unregister_afinfo(struct xfrm_policy_afinfo *afinfo)
                return -EINVAL;
        if (unlikely(afinfo->family >= NPROTO))
                return -EAFNOSUPPORT;
-        write_lock(&xfrm_policy_afinfo_lock);
+        write_lock_bh(&xfrm_policy_afinfo_lock);
        if (likely(xfrm_policy_afinfo[afinfo->family] != NULL)) {
                if (unlikely(xfrm_policy_afinfo[afinfo->family] != afinfo))
                        err = -EINVAL;
@@ -1294,7 +1294,7 @@ int xfrm_policy_unregister_afinfo(struct xfrm_policy_afinfo *afinfo)
                        afinfo->garbage_collect = NULL;
                }
        }
-        write_unlock(&xfrm_policy_afinfo_lock);
+        write_unlock_bh(&xfrm_policy_afinfo_lock);
        return err;
 }
 EXPORT_SYMBOL(xfrm_policy_unregister_afinfo);
diff --git a/net/xfrm/xfrm_state.c b/net/xfrm/xfrm_state.c
index a8e14dc1b04e..93a2f36ad3db 100644
--- a/net/xfrm/xfrm_state.c
+++ b/net/xfrm/xfrm_state.c
@@ -805,16 +805,22 @@ void xfrm_replay_notify(struct xfrm_state *x, int event)
        case XFRM_REPLAY_UPDATE:
                if (x->replay_maxdiff &&
                    (x->replay.seq - x->preplay.seq < x->replay_maxdiff) &&
-                    (x->replay.oseq - x->preplay.oseq < x->replay_maxdiff))
+                    (x->replay.oseq - x->preplay.oseq < x->replay_maxdiff)) {
-                        return;
+                        if (x->xflags & XFRM_TIME_DEFER)
+                                event = XFRM_REPLAY_TIMEOUT;
+                        else
+                                return;
+                }
                break;
        case XFRM_REPLAY_TIMEOUT:
                if ((x->replay.seq == x->preplay.seq) &&
                    (x->replay.bitmap == x->preplay.bitmap) &&
-                    (x->replay.oseq == x->preplay.oseq))
+                    (x->replay.oseq == x->preplay.oseq)) {
+                        x->xflags |= XFRM_TIME_DEFER;
                        return;
+                }
                break;
        }
@@ -825,8 +831,10 @@ void xfrm_replay_notify(struct xfrm_state *x, int event)
        km_state_notify(x, &c);
        if (x->replay_maxage &&
-            !mod_timer(&x->rtimer, jiffies + x->replay_maxage))
+            !mod_timer(&x->rtimer, jiffies + x->replay_maxage)) {
                xfrm_state_hold(x);
+                x->xflags &= ~XFRM_TIME_DEFER;
+        }
 }
 EXPORT_SYMBOL(xfrm_replay_notify);
@@ -836,10 +844,15 @@ static void xfrm_replay_timer_handler(unsigned long data)
        spin_lock(&x->lock);
-        if (xfrm_aevent_is_on() && x->km.state == XFRM_STATE_VALID)
+        if (x->km.state == XFRM_STATE_VALID) {
-                xfrm_replay_notify(x, XFRM_REPLAY_TIMEOUT);
+                if (xfrm_aevent_is_on())
+                        xfrm_replay_notify(x, XFRM_REPLAY_TIMEOUT);
+                else
+                        x->xflags |= XFRM_TIME_DEFER;
+        }
        spin_unlock(&x->lock);
+        xfrm_state_put(x);
 }
 int xfrm_replay_check(struct xfrm_state *x, u32 seq)
@@ -1048,7 +1061,7 @@ int xfrm_state_register_afinfo(struct xfrm_state_afinfo *afinfo)
                return -EINVAL;
        if (unlikely(afinfo->family >= NPROTO))
                return -EAFNOSUPPORT;
-        write_lock(&xfrm_state_afinfo_lock);
+        write_lock_bh(&xfrm_state_afinfo_lock);
        if (unlikely(xfrm_state_afinfo[afinfo->family] != NULL))
                err = -ENOBUFS;
        else {
@@ -1056,7 +1069,7 @@ int xfrm_state_register_afinfo(struct xfrm_state_afinfo *afinfo)
                afinfo->state_byspi = xfrm_state_byspi;
                xfrm_state_afinfo[afinfo->family] = afinfo;
        }
-        write_unlock(&xfrm_state_afinfo_lock);
+        write_unlock_bh(&xfrm_state_afinfo_lock);
        return err;
 }
 EXPORT_SYMBOL(xfrm_state_register_afinfo);
@@ -1068,7 +1081,7 @@ int xfrm_state_unregister_afinfo(struct xfrm_state_afinfo *afinfo)
                return -EINVAL;
        if (unlikely(afinfo->family >= NPROTO))
                return -EAFNOSUPPORT;
-        write_lock(&xfrm_state_afinfo_lock);
+        write_lock_bh(&xfrm_state_afinfo_lock);
        if (likely(xfrm_state_afinfo[afinfo->family] != NULL)) {
                if (unlikely(xfrm_state_afinfo[afinfo->family] != afinfo))
                        err = -EINVAL;
@@ -1078,7 +1091,7 @@ int xfrm_state_unregister_afinfo(struct xfrm_state_afinfo *afinfo)
                        afinfo->state_bydst = NULL;
                }
        }
-        write_unlock(&xfrm_state_afinfo_lock);
+        write_unlock_bh(&xfrm_state_afinfo_lock);
        return err;
 }
 EXPORT_SYMBOL(xfrm_state_unregister_afinfo);