17 files changed, 194 insertions, 76 deletions
diff --git a/net/8021q/vlan_core.c b/net/8021q/vlan_core.c
index 916061f681b6..68ced4bf158c 100644
--- a/net/8021q/vlan_core.c
+++ b/net/8021q/vlan_core.c
@@ -3,11 +3,20 @@
 #include <linux/if_vlan.h>
 #include "vlan.h"
+struct vlan_hwaccel_cb {
+        struct net_device       *dev;
+};
+static inline struct vlan_hwaccel_cb *vlan_hwaccel_cb(struct sk_buff *skb)
+{
+        return (struct vlan_hwaccel_cb *)skb->cb;
+}
 /* VLAN rx hw acceleration helper.  This acts like netif_{rx,receive_skb}(). */
 int __vlan_hwaccel_rx(struct sk_buff *skb, struct vlan_group *grp,
                      u16 vlan_tci, int polling)
 {
-        struct net_device_stats *stats;
+        struct vlan_hwaccel_cb *cb = vlan_hwaccel_cb(skb);
        if (skb_bond_should_drop(skb)) {
                dev_kfree_skb_any(skb);
@@ -15,23 +24,35 @@ int __vlan_hwaccel_rx(struct sk_buff *skb, struct vlan_group *grp,
        }
        skb->vlan_tci = vlan_tci;
+        cb->dev = vlan_group_get_device(grp, vlan_tci & VLAN_VID_MASK);
+        return (polling ? netif_receive_skb(skb) : netif_rx(skb));
+}
+EXPORT_SYMBOL(__vlan_hwaccel_rx);
+int vlan_hwaccel_do_receive(struct sk_buff *skb)
+{
+        struct vlan_hwaccel_cb *cb = vlan_hwaccel_cb(skb);
+        struct net_device *dev = cb->dev;
+        struct net_device_stats *stats;
        netif_nit_deliver(skb);
-        skb->dev = vlan_group_get_device(grp, vlan_tci & VLAN_VID_MASK);
+        if (dev == NULL) {
-        if (skb->dev == NULL) {
+                kfree_skb(skb);
-                dev_kfree_skb_any(skb);
+                return -1;
-                /* Not NET_RX_DROP, this is not being dropped
-                 * due to congestion. */
-                return NET_RX_SUCCESS;
        }
-        skb->dev->last_rx = jiffies;
+        skb->dev = dev;
+        skb->priority = vlan_get_ingress_priority(dev, skb->vlan_tci);
        skb->vlan_tci = 0;
-        stats = &skb->dev->stats;
+        dev->last_rx = jiffies;
+        stats = &dev->stats;
        stats->rx_packets++;
        stats->rx_bytes += skb->len;
-        skb->priority = vlan_get_ingress_priority(skb->dev, vlan_tci);
        switch (skb->pkt_type) {
        case PACKET_BROADCAST:
                break;
@@ -43,13 +64,12 @@ int __vlan_hwaccel_rx(struct sk_buff *skb, struct vlan_group *grp,
                 * This allows the VLAN to have a different MAC than the
                 * underlying device, and still route correctly. */
                if (!compare_ether_addr(eth_hdr(skb)->h_dest,
-                                        skb->dev->dev_addr))
+                                        dev->dev_addr))
                        skb->pkt_type = PACKET_HOST;
                break;
        };
-        return (polling ? netif_receive_skb(skb) : netif_rx(skb));
+        return 0;
 }
-EXPORT_SYMBOL(__vlan_hwaccel_rx);
 struct net_device *vlan_dev_real_dev(const struct net_device *dev)
 {
diff --git a/net/9p/client.c b/net/9p/client.c
index 67717f69412e..4b529454616d 100644
--- a/net/9p/client.c
+++ b/net/9p/client.c
@@ -189,6 +189,9 @@ static struct p9_req_t *p9_tag_alloc(struct p9_client *c, u16 tag)
                        printk(KERN_ERR "Couldn't grow tag array\n");
                        kfree(req->tc);
                        kfree(req->rc);
+                        kfree(req->wq);
+                        req->tc = req->rc = NULL;
+                        req->wq = NULL;
                        return ERR_PTR(-ENOMEM);
                }
                req->tc->sdata = (char *) req->tc + sizeof(struct p9_fcall);
@@ -311,12 +314,6 @@ static void p9_free_req(struct p9_client *c, struct p9_req_t *r)
        r->status = REQ_STATUS_IDLE;
        if (tag != P9_NOTAG && p9_idpool_check(tag, c->tagpool))
                p9_idpool_put(tag, c->tagpool);
-        /* if this was a flush request we have to free response fcall */
-        if (r->rc->id == P9_RFLUSH) {
-                kfree(r->tc);
-                kfree(r->rc);
-        }
 }
 /**
@@ -611,19 +608,21 @@ reterr:
 static struct p9_fid *p9_fid_create(struct p9_client *clnt)
 {
-        int err;
+        int ret;
        struct p9_fid *fid;
+        unsigned long flags;
        P9_DPRINTK(P9_DEBUG_FID, "clnt %p\n", clnt);
        fid = kmalloc(sizeof(struct p9_fid), GFP_KERNEL);
        if (!fid)
                return ERR_PTR(-ENOMEM);
-        fid->fid = p9_idpool_get(clnt->fidpool);
+        ret = p9_idpool_get(clnt->fidpool);
        if (fid->fid < 0) {
-                err = -ENOSPC;
+                ret = -ENOSPC;
                goto error;
        }
+        fid->fid = ret;
        memset(&fid->qid, 0, sizeof(struct p9_qid));
        fid->mode = -1;
@@ -632,27 +631,28 @@ static struct p9_fid *p9_fid_create(struct p9_client *clnt)
        fid->clnt = clnt;
        fid->aux = NULL;
-        spin_lock(&clnt->lock);
+        spin_lock_irqsave(&clnt->lock, flags);
        list_add(&fid->flist, &clnt->fidlist);
-        spin_unlock(&clnt->lock);
+        spin_unlock_irqrestore(&clnt->lock, flags);
        return fid;
 error:
        kfree(fid);
-        return ERR_PTR(err);
+        return ERR_PTR(ret);
 }
 static void p9_fid_destroy(struct p9_fid *fid)
 {
        struct p9_client *clnt;
+        unsigned long flags;
        P9_DPRINTK(P9_DEBUG_FID, "fid %d\n", fid->fid);
        clnt = fid->clnt;
        p9_idpool_put(fid->fid, clnt->fidpool);
-        spin_lock(&clnt->lock);
+        spin_lock_irqsave(&clnt->lock, flags);
        list_del(&fid->flist);
-        spin_unlock(&clnt->lock);
+        spin_unlock_irqrestore(&clnt->lock, flags);
        kfree(fid);
 }
@@ -818,7 +818,9 @@ struct p9_fid *p9_client_attach(struct p9_client *clnt, struct p9_fid *afid,
        }
        P9_DPRINTK(P9_DEBUG_9P, "<<< RATTACH qid %x.%llx.%x\n",
-                                        qid.type, qid.path, qid.version);
+                                        qid.type,
+                                        (unsigned long long)qid.path,
+                                        qid.version);
        memmove(&fid->qid, &qid, sizeof(struct p9_qid));
@@ -865,7 +867,9 @@ p9_client_auth(struct p9_client *clnt, char *uname, u32 n_uname, char *aname)
        }
        P9_DPRINTK(P9_DEBUG_9P, "<<< RAUTH qid %x.%llx.%x\n",
-                                        qid.type, qid.path, qid.version);
+                                        qid.type,
+                                        (unsigned long long)qid.path,
+                                        qid.version);
        memmove(&afid->qid, &qid, sizeof(struct p9_qid));
        p9_free_req(clnt, req);
@@ -930,7 +934,8 @@ struct p9_fid *p9_client_walk(struct p9_fid *oldfid, int nwname, char **wnames,
        for (count = 0; count < nwqids; count++)
                P9_DPRINTK(P9_DEBUG_9P, "<<<     [%d] %x.%llx.%x\n",
-                        count, wqids[count].type, wqids[count].path,
+                        count, wqids[count].type,
+                        (unsigned long long)wqids[count].path,
                        wqids[count].version);
        if (nwname)
@@ -980,7 +985,9 @@ int p9_client_open(struct p9_fid *fid, int mode)
        }
        P9_DPRINTK(P9_DEBUG_9P, "<<< ROPEN qid %x.%llx.%x iounit %x\n",
-                                qid.type, qid.path, qid.version, iounit);
+                                qid.type,
+                                (unsigned long long)qid.path,
+                                qid.version, iounit);
        fid->mode = mode;
        fid->iounit = iounit;
@@ -1023,7 +1030,9 @@ int p9_client_fcreate(struct p9_fid *fid, char *name, u32 perm, int mode,
        }
        P9_DPRINTK(P9_DEBUG_9P, "<<< RCREATE qid %x.%llx.%x iounit %x\n",
-                                qid.type, qid.path, qid.version, iounit);
+                                qid.type,
+                                (unsigned long long)qid.path,
+                                qid.version, iounit);
        fid->mode = mode;
        fid->iounit = iounit;
@@ -1230,9 +1239,9 @@ struct p9_wstat *p9_client_stat(struct p9_fid *fid)
                "<<<    name=%s uid=%s gid=%s muid=%s extension=(%s)\n"
                "<<<    uid=%d gid=%d n_muid=%d\n",
                ret->size, ret->type, ret->dev, ret->qid.type,
-                ret->qid.path, ret->qid.version, ret->mode,
+                (unsigned long long)ret->qid.path, ret->qid.version, ret->mode,
-                ret->atime, ret->mtime, ret->length, ret->name,
+                ret->atime, ret->mtime, (unsigned long long)ret->length,
-                ret->uid, ret->gid, ret->muid, ret->extension,
+                ret->name, ret->uid, ret->gid, ret->muid, ret->extension,
                ret->n_uid, ret->n_gid, ret->n_muid);
 free_and_error:
@@ -1255,9 +1264,9 @@ int p9_client_wstat(struct p9_fid *fid, struct p9_wstat *wst)
                "     name=%s uid=%s gid=%s muid=%s extension=(%s)\n"
                "     uid=%d gid=%d n_muid=%d\n",
                wst->size, wst->type, wst->dev, wst->qid.type,
-                wst->qid.path, wst->qid.version, wst->mode,
+                (unsigned long long)wst->qid.path, wst->qid.version, wst->mode,
-                wst->atime, wst->mtime, wst->length, wst->name,
+                wst->atime, wst->mtime, (unsigned long long)wst->length,
-                wst->uid, wst->gid, wst->muid, wst->extension,
+                wst->name, wst->uid, wst->gid, wst->muid, wst->extension,
                wst->n_uid, wst->n_gid, wst->n_muid);
        err = 0;
        clnt = fid->clnt;
diff --git a/net/9p/trans_rdma.c b/net/9p/trans_rdma.c
index 8d6cc4777aae..2f1fe5fc1228 100644
--- a/net/9p/trans_rdma.c
+++ b/net/9p/trans_rdma.c
@@ -45,7 +45,6 @@
 #include <net/9p/transport.h>
 #include <rdma/ib_verbs.h>
 #include <rdma/rdma_cm.h>
-#include <rdma/ib_verbs.h>
 #define P9_PORT                 5640
 #define P9_RDMA_SQ_DEPTH        32
@@ -589,6 +588,9 @@ rdma_create_trans(struct p9_client *client, const char *addr, char *args)
        if (IS_ERR(rdma->cm_id))
                goto error;
+        /* Associate the client with the transport */
+        client->trans = rdma;
        /* Resolve the server's address */
        rdma->addr.sin_family = AF_INET;
        rdma->addr.sin_addr.s_addr = in_aton(addr);
@@ -669,7 +671,6 @@ rdma_create_trans(struct p9_client *client, const char *addr, char *args)
        if (err || (rdma->state != P9_RDMA_CONNECTED))
                goto error;
-        client->trans = rdma;
        client->status = Connected;
        return 0;
diff --git a/net/core/dev.c b/net/core/dev.c
index d9038e328cc1..9174c77d3112 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -2218,6 +2218,9 @@ int netif_receive_skb(struct sk_buff *skb)
        int ret = NET_RX_DROP;
        __be16 type;
+        if (skb->vlan_tci && vlan_hwaccel_do_receive(skb))
+                return NET_RX_SUCCESS;
        /* if we've gotten here through NAPI, check netpoll */
        if (netpoll_receive_skb(skb))
                return NET_RX_DROP;
diff --git a/net/core/scm.c b/net/core/scm.c
index 10f5c65f6a47..ab242cc1acca 100644
--- a/net/core/scm.c
+++ b/net/core/scm.c
@@ -75,6 +75,7 @@ static int scm_fp_copy(struct cmsghdr *cmsg, struct scm_fp_list **fplp)
                if (!fpl)
                        return -ENOMEM;
                *fplp = fpl;
+                INIT_LIST_HEAD(&fpl->list);
                fpl->count = 0;
        }
        fpp = &fpl->fp[fpl->count];
@@ -106,9 +107,25 @@ void __scm_destroy(struct scm_cookie *scm)
        if (fpl) {
                scm->fp = NULL;
-                for (i=fpl->count-1; i>=0; i--)
+                if (current->scm_work_list) {
-                        fput(fpl->fp[i]);
+                        list_add_tail(&fpl->list, current->scm_work_list);
-                kfree(fpl);
+                } else {
+                        LIST_HEAD(work_list);
+                        current->scm_work_list = &work_list;
+                        list_add(&fpl->list, &work_list);
+                        while (!list_empty(&work_list)) {
+                                fpl = list_first_entry(&work_list, struct scm_fp_list, list);
+                                list_del(&fpl->list);
+                                for (i=fpl->count-1; i>=0; i--)
+                                        fput(fpl->fp[i]);
+                                kfree(fpl);
+                        }
+                        current->scm_work_list = NULL;
+                }
        }
 }
@@ -284,6 +301,7 @@ struct scm_fp_list *scm_fp_dup(struct scm_fp_list *fpl)
        new_fpl = kmalloc(sizeof(*fpl), GFP_KERNEL);
        if (new_fpl) {
+                INIT_LIST_HEAD(&new_fpl->list);
                for (i=fpl->count-1; i>=0; i--)
                        get_file(fpl->fp[i]);
                memcpy(new_fpl, fpl, sizeof(*fpl));
diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
index eccb7165a80c..c5aca0bb116a 100644
--- a/net/ipv4/tcp.c
+++ b/net/ipv4/tcp.c
@@ -1374,8 +1374,7 @@ int tcp_recvmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
                            sk->sk_state == TCP_CLOSE ||
                            (sk->sk_shutdown & RCV_SHUTDOWN) ||
                            !timeo ||
-                            signal_pending(current) ||
+                            signal_pending(current))
-                            (flags & MSG_PEEK))
                                break;
                } else {
                        if (sock_flag(sk, SOCK_DONE))
diff --git a/net/ipv4/xfrm4_state.c b/net/ipv4/xfrm4_state.c
index 07735ed280d7..55dc6beab9aa 100644
--- a/net/ipv4/xfrm4_state.c
+++ b/net/ipv4/xfrm4_state.c
@@ -33,6 +33,7 @@ __xfrm4_init_tempsel(struct xfrm_state *x, struct flowi *fl,
        x->sel.dport_mask = htons(0xffff);
        x->sel.sport = xfrm_flowi_sport(fl);
        x->sel.sport_mask = htons(0xffff);
+        x->sel.family = AF_INET;
        x->sel.prefixlen_d = 32;
        x->sel.prefixlen_s = 32;
        x->sel.proto = fl->proto;
diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index eea9542728ca..d9da5eb9dcb2 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -2483,8 +2483,10 @@ static int addrconf_notify(struct notifier_block *this, unsigned long event,
                        if (!idev && dev->mtu >= IPV6_MIN_MTU)
                                idev = ipv6_add_dev(dev);
-                        if (idev)
+                        if (idev) {
                                idev->if_flags |= IF_READY;
+                                run_pending = 1;
+                        }
                } else {
                        if (!addrconf_qdisc_ok(dev)) {
                                /* device is still not ready. */
diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c
index 71e259e866a1..8b48512ebf6a 100644
--- a/net/ipv6/udp.c
+++ b/net/ipv6/udp.c
@@ -138,6 +138,7 @@ int udpv6_recvmsg(struct kiocb *iocb, struct sock *sk,
        int peeked;
        int err;
        int is_udplite = IS_UDPLITE(sk);
+        int is_udp4;
        if (addr_len)
                *addr_len=sizeof(struct sockaddr_in6);
@@ -158,6 +159,8 @@ try_again:
        else if (copied < ulen)
                msg->msg_flags |= MSG_TRUNC;
+        is_udp4 = (skb->protocol == htons(ETH_P_IP));
        /*
         * If checksum is needed at all, try to do it while copying the
         * data.  If the data is truncated, or if we only want a partial
@@ -180,9 +183,14 @@ try_again:
        if (err)
                goto out_free;
-        if (!peeked)
+        if (!peeked) {
-                UDP6_INC_STATS_USER(sock_net(sk),
+                if (is_udp4)
-                                UDP_MIB_INDATAGRAMS, is_udplite);
+                        UDP_INC_STATS_USER(sock_net(sk),
+                                        UDP_MIB_INDATAGRAMS, is_udplite);
+                else
+                        UDP6_INC_STATS_USER(sock_net(sk),
+                                        UDP_MIB_INDATAGRAMS, is_udplite);
+        }
        sock_recv_timestamp(msg, sk, skb);
@@ -196,7 +204,7 @@ try_again:
                sin6->sin6_flowinfo = 0;
                sin6->sin6_scope_id = 0;
-                if (skb->protocol == htons(ETH_P_IP))
+                if (is_udp4)
                        ipv6_addr_set(&sin6->sin6_addr, 0, 0,
                                      htonl(0xffff), ip_hdr(skb)->saddr);
                else {
@@ -207,7 +215,7 @@ try_again:
                }
        }
-        if (skb->protocol == htons(ETH_P_IP)) {
+        if (is_udp4) {
                if (inet->cmsg_flags)
                        ip_cmsg_recv(msg, skb);
        } else {
@@ -228,8 +236,14 @@ out:
 csum_copy_err:
        lock_sock(sk);
-        if (!skb_kill_datagram(sk, skb, flags))
+        if (!skb_kill_datagram(sk, skb, flags)) {
-                UDP6_INC_STATS_USER(sock_net(sk), UDP_MIB_INERRORS, is_udplite);
+                if (is_udp4)
+                        UDP_INC_STATS_USER(sock_net(sk),
+                                        UDP_MIB_INERRORS, is_udplite);
+                else
+                        UDP6_INC_STATS_USER(sock_net(sk),
+                                        UDP_MIB_INERRORS, is_udplite);
+        }
        release_sock(sk);
        if (flags & MSG_DONTWAIT)
diff --git a/net/ipv6/xfrm6_state.c b/net/ipv6/xfrm6_state.c
index 89884a4f23aa..60c78cfc2737 100644
--- a/net/ipv6/xfrm6_state.c
+++ b/net/ipv6/xfrm6_state.c
@@ -34,6 +34,7 @@ __xfrm6_init_tempsel(struct xfrm_state *x, struct flowi *fl,
        x->sel.dport_mask = htons(0xffff);
        x->sel.sport = xfrm_flowi_sport(fl);
        x->sel.sport_mask = htons(0xffff);
+        x->sel.family = AF_INET6;
        x->sel.prefixlen_d = 128;
        x->sel.prefixlen_s = 128;
        x->sel.proto = fl->proto;
diff --git a/net/netfilter/nf_conntrack_helper.c b/net/netfilter/nf_conntrack_helper.c
index 9c06b9f86ad4..c39b6a994133 100644
--- a/net/netfilter/nf_conntrack_helper.c
+++ b/net/netfilter/nf_conntrack_helper.c
@@ -21,6 +21,7 @@
 #include <linux/kernel.h>
 #include <linux/netdevice.h>
 #include <linux/rculist.h>
+#include <linux/rtnetlink.h>
 #include <net/netfilter/nf_conntrack.h>
 #include <net/netfilter/nf_conntrack_l3proto.h>
@@ -167,10 +168,12 @@ void nf_conntrack_helper_unregister(struct nf_conntrack_helper *me)
         */
        synchronize_rcu();
+        rtnl_lock();
        spin_lock_bh(&nf_conntrack_lock);
        for_each_net(net)
                __nf_conntrack_helper_unregister(me, net);
        spin_unlock_bh(&nf_conntrack_lock);
+        rtnl_unlock();
 }
 EXPORT_SYMBOL_GPL(nf_conntrack_helper_unregister);
diff --git a/net/netfilter/nf_conntrack_proto.c b/net/netfilter/nf_conntrack_proto.c
index a59a307e685d..592d73344d46 100644
--- a/net/netfilter/nf_conntrack_proto.c
+++ b/net/netfilter/nf_conntrack_proto.c
@@ -22,6 +22,7 @@
 #include <linux/notifier.h>
 #include <linux/kernel.h>
 #include <linux/netdevice.h>
+#include <linux/rtnetlink.h>
 #include <net/netfilter/nf_conntrack.h>
 #include <net/netfilter/nf_conntrack_l3proto.h>
@@ -221,8 +222,10 @@ void nf_conntrack_l3proto_unregister(struct nf_conntrack_l3proto *proto)
        synchronize_rcu();
        /* Remove all contrack entries for this protocol */
+        rtnl_lock();
        for_each_net(net)
                nf_ct_iterate_cleanup(net, kill_l3proto, proto);
+        rtnl_unlock();
 }
 EXPORT_SYMBOL_GPL(nf_conntrack_l3proto_unregister);
@@ -333,8 +336,10 @@ void nf_conntrack_l4proto_unregister(struct nf_conntrack_l4proto *l4proto)
        synchronize_rcu();
        /* Remove all contrack entries for this protocol */
+        rtnl_lock();
        for_each_net(net)
                nf_ct_iterate_cleanup(net, kill_l4proto, l4proto);
+        rtnl_unlock();
 }
 EXPORT_SYMBOL_GPL(nf_conntrack_l4proto_unregister);
diff --git a/net/rfkill/rfkill.c b/net/rfkill/rfkill.c
index f949a482b007..25ba3bd57e66 100644
--- a/net/rfkill/rfkill.c
+++ b/net/rfkill/rfkill.c
@@ -603,7 +603,7 @@ static int rfkill_check_duplicity(const struct rfkill *rfkill)
        }
        /* 0: first switch of its kind */
-        return test_bit(rfkill->type, seen);
+        return (test_bit(rfkill->type, seen)) ? 1 : 0;
 }
 static int rfkill_add_switch(struct rfkill *rfkill)
diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c
index 4d3c6071b9a4..eb90f77bb0e2 100644
--- a/net/unix/af_unix.c
+++ b/net/unix/af_unix.c
@@ -1302,14 +1302,23 @@ static void unix_destruct_fds(struct sk_buff *skb)
        sock_wfree(skb);
 }
-static void unix_attach_fds(struct scm_cookie *scm, struct sk_buff *skb)
+static int unix_attach_fds(struct scm_cookie *scm, struct sk_buff *skb)
 {
        int i;
+        /*
+         * Need to duplicate file references for the sake of garbage
+         * collection.  Otherwise a socket in the fps might become a
+         * candidate for GC while the skb is not yet queued.
+         */
+        UNIXCB(skb).fp = scm_fp_dup(scm->fp);
+        if (!UNIXCB(skb).fp)
+                return -ENOMEM;
        for (i=scm->fp->count-1; i>=0; i--)
                unix_inflight(scm->fp->fp[i]);
-        UNIXCB(skb).fp = scm->fp;
        skb->destructor = unix_destruct_fds;
-        scm->fp = NULL;
+        return 0;
 }
 /*
@@ -1368,8 +1377,11 @@ static int unix_dgram_sendmsg(struct kiocb *kiocb, struct socket *sock,
                goto out;
        memcpy(UNIXCREDS(skb), &siocb->scm->creds, sizeof(struct ucred));
-        if (siocb->scm->fp)
+        if (siocb->scm->fp) {
-                unix_attach_fds(siocb->scm, skb);
+                err = unix_attach_fds(siocb->scm, skb);
+                if (err)
+                        goto out_free;
+        }
        unix_get_secdata(siocb->scm, skb);
        skb_reset_transport_header(skb);
@@ -1538,8 +1550,13 @@ static int unix_stream_sendmsg(struct kiocb *kiocb, struct socket *sock,
                size = min_t(int, size, skb_tailroom(skb));
                memcpy(UNIXCREDS(skb), &siocb->scm->creds, sizeof(struct ucred));
-                if (siocb->scm->fp)
+                if (siocb->scm->fp) {
-                        unix_attach_fds(siocb->scm, skb);
+                        err = unix_attach_fds(siocb->scm, skb);
+                        if (err) {
+                                kfree_skb(skb);
+                                goto out_err;
+                        }
+                }
                if ((err = memcpy_fromiovec(skb_put(skb,size), msg->msg_iov, size)) != 0) {
                        kfree_skb(skb);
diff --git a/net/unix/garbage.c b/net/unix/garbage.c
index 2a27b84f740b..6d4a9a8de5ef 100644
--- a/net/unix/garbage.c
+++ b/net/unix/garbage.c
@@ -186,8 +186,17 @@ static void scan_inflight(struct sock *x, void (*func)(struct unix_sock *),
                                 */
                                struct sock *sk = unix_get_socket(*fp++);
                                if (sk) {
-                                        hit = true;
+                                        struct unix_sock *u = unix_sk(sk);
-                                        func(unix_sk(sk));
+                                        /*
+                                         * Ignore non-candidates, they could
+                                         * have been added to the queues after
+                                         * starting the garbage collection
+                                         */
+                                        if (u->gc_candidate) {
+                                                hit = true;
+                                                func(u);
+                                        }
                                }
                        }
                        if (hit && hitlist != NULL) {
@@ -249,11 +258,11 @@ static void inc_inflight_move_tail(struct unix_sock *u)
 {
        atomic_long_inc(&u->inflight);
        /*
-         * If this is still a candidate, move it to the end of the
+         * If this still might be part of a cycle, move it to the end
-         * list, so that it's checked even if it was already passed
+         * of the list, so that it's checked even if it was already
-         * over
+         * passed over
         */
-        if (u->gc_candidate)
+        if (u->gc_maybe_cycle)
                list_move_tail(&u->link, &gc_candidates);
 }
@@ -267,6 +276,7 @@ void unix_gc(void)
        struct unix_sock *next;
        struct sk_buff_head hitlist;
        struct list_head cursor;
+        LIST_HEAD(not_cycle_list);
        spin_lock(&unix_gc_lock);
@@ -282,10 +292,14 @@ void unix_gc(void)
         *
         * Holding unix_gc_lock will protect these candidates from
         * being detached, and hence from gaining an external
-         * reference.  This also means, that since there are no
+         * reference.  Since there are no possible receivers, all
-         * possible receivers, the receive queues of these sockets are
+         * buffers currently on the candidates' queues stay there
-         * static during the GC, even though the dequeue is done
+         * during the garbage collection.
-         * before the detach without atomicity guarantees.
+         *
+         * We also know that no new candidate can be added onto the
+         * receive queues.  Other, non candidate sockets _can_ be
+         * added to queue, so we must make sure only to touch
+         * candidates.
         */
        list_for_each_entry_safe(u, next, &gc_inflight_list, link) {
                long total_refs;
@@ -299,6 +313,7 @@ void unix_gc(void)
                if (total_refs == inflight_refs) {
                        list_move_tail(&u->link, &gc_candidates);
                        u->gc_candidate = 1;
+                        u->gc_maybe_cycle = 1;
                }
        }
@@ -325,14 +340,24 @@ void unix_gc(void)
                list_move(&cursor, &u->link);
                if (atomic_long_read(&u->inflight) > 0) {
-                        list_move_tail(&u->link, &gc_inflight_list);
+                        list_move_tail(&u->link, &not_cycle_list);
-                        u->gc_candidate = 0;
+                        u->gc_maybe_cycle = 0;
                        scan_children(&u->sk, inc_inflight_move_tail, NULL);
                }
        }
        list_del(&cursor);
        /*
+         * not_cycle_list contains those sockets which do not make up a
+         * cycle.  Restore these to the inflight list.
+         */
+        while (!list_empty(&not_cycle_list)) {
+                u = list_entry(not_cycle_list.next, struct unix_sock, link);
+                u->gc_candidate = 0;
+                list_move_tail(&u->link, &gc_inflight_list);
+        }
+        /*
         * Now gc_candidates contains only garbage.  Restore original
         * inflight counters for these as well, and remove the skbuffs
         * which are creating the cycle(s).
diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c
index 25872747762c..058f04f54b90 100644
--- a/net/xfrm/xfrm_policy.c
+++ b/net/xfrm/xfrm_policy.c
@@ -315,9 +315,9 @@ static void xfrm_policy_kill(struct xfrm_policy *policy)
                return;
        }
-        spin_lock(&xfrm_policy_gc_lock);
+        spin_lock_bh(&xfrm_policy_gc_lock);
        hlist_add_head(&policy->bydst, &xfrm_policy_gc_list);
-        spin_unlock(&xfrm_policy_gc_lock);
+        spin_unlock_bh(&xfrm_policy_gc_lock);
        schedule_work(&xfrm_policy_gc_work);
 }
diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c
index 4a8a1abb59ee..a278a6f3b991 100644
--- a/net/xfrm/xfrm_user.c
+++ b/net/xfrm/xfrm_user.c
@@ -1816,7 +1816,7 @@ static int copy_to_user_kmaddress(struct xfrm_kmaddress *k, struct sk_buff *skb)
        uk.family = k->family;
        uk.reserved = k->reserved;
        memcpy(&uk.local, &k->local, sizeof(uk.local));
-        memcpy(&uk.remote, &k->local, sizeof(uk.remote));
+        memcpy(&uk.remote, &k->remote, sizeof(uk.remote));
        return nla_put(skb, XFRMA_KMADDRESS, sizeof(uk), &uk);
 }