153 files changed, 1568 insertions, 1006 deletions
diff --git a/net/8021q/vlan.c b/net/8021q/vlan.c
index 8836575f9d79..a29c5ab5815c 100644
--- a/net/8021q/vlan.c
+++ b/net/8021q/vlan.c
@@ -281,8 +281,11 @@ out_uninit_applicant:
        if (ngrp)
                vlan_gvrp_uninit_applicant(real_dev);
 out_free_group:
-        if (ngrp)
+        if (ngrp) {
-                vlan_group_free(ngrp);
+                hlist_del_rcu(&ngrp->hlist);
+                /* Free the group, after all cpu's are done. */
+                call_rcu(&ngrp->rcu, vlan_rcu_free);
+        }
        return err;
 }
diff --git a/net/8021q/vlan_netlink.c b/net/8021q/vlan_netlink.c
index 343146e1bceb..a91504850195 100644
--- a/net/8021q/vlan_netlink.c
+++ b/net/8021q/vlan_netlink.c
@@ -169,6 +169,7 @@ static size_t vlan_get_size(const struct net_device *dev)
        struct vlan_dev_info *vlan = vlan_dev_info(dev);
        return nla_total_size(2) +      /* IFLA_VLAN_ID */
+               sizeof(struct ifla_vlan_flags) + /* IFLA_VLAN_FLAGS */
               vlan_qos_map_size(vlan->nr_ingress_mappings) +
               vlan_qos_map_size(vlan->nr_egress_mappings);
 }
diff --git a/net/9p/client.c b/net/9p/client.c
index 5bf5f227dbe0..8af95b2dddd6 100644
--- a/net/9p/client.c
+++ b/net/9p/client.c
@@ -582,11 +582,9 @@ static struct p9_fid *p9_fid_create(struct p9_client *clnt)
        memset(&fid->qid, 0, sizeof(struct p9_qid));
        fid->mode = -1;
-        fid->rdir_fpos = 0;
        fid->uid = current_fsuid();
        fid->clnt = clnt;
-        fid->aux = NULL;
+        fid->rdir = NULL;
        spin_lock_irqsave(&clnt->lock, flags);
        list_add(&fid->flist, &clnt->fidlist);
        spin_unlock_irqrestore(&clnt->lock, flags);
@@ -609,6 +607,7 @@ static void p9_fid_destroy(struct p9_fid *fid)
        spin_lock_irqsave(&clnt->lock, flags);
        list_del(&fid->flist);
        spin_unlock_irqrestore(&clnt->lock, flags);
+        kfree(fid->rdir);
        kfree(fid);
 }
diff --git a/net/9p/trans_virtio.c b/net/9p/trans_virtio.c
index 9bf0b737aa51..ea1e3daabefe 100644
--- a/net/9p/trans_virtio.c
+++ b/net/9p/trans_virtio.c
@@ -200,7 +200,7 @@ p9_virtio_request(struct p9_client *client, struct p9_req_t *req)
        req->status = REQ_STATUS_SENT;
-        if (chan->vq->vq_ops->add_buf(chan->vq, chan->sg, out, in, req->tc)) {
+        if (chan->vq->vq_ops->add_buf(chan->vq, chan->sg, out, in, req->tc) < 0) {
                P9_DPRINTK(P9_DEBUG_TRANS,
                        "9p debug: virtio rpc add_buf returned failure");
                return -EIO;
@@ -334,8 +334,6 @@ static void p9_virtio_remove(struct virtio_device *vdev)
        }
 }
-#define VIRTIO_ID_9P 9
 static struct virtio_device_id id_table[] = {
        { VIRTIO_ID_9P, VIRTIO_DEV_ANY_ID },
        { 0 },
diff --git a/net/atm/common.c b/net/atm/common.c
index 8c4d843eb17f..950bd16d2383 100644
--- a/net/atm/common.c
+++ b/net/atm/common.c
@@ -679,7 +679,7 @@ static int check_qos(const struct atm_qos *qos)
 }
 int vcc_setsockopt(struct socket *sock, int level, int optname,
-                   char __user *optval, int optlen)
+                   char __user *optval, unsigned int optlen)
 {
        struct atm_vcc *vcc;
        unsigned long value;
diff --git a/net/atm/common.h b/net/atm/common.h
index 92e2981f479f..f48a76b6cdf4 100644
--- a/net/atm/common.h
+++ b/net/atm/common.h
@@ -21,7 +21,7 @@ unsigned int vcc_poll(struct file *file, struct socket *sock, poll_table *wait);
 int vcc_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg);
 int vcc_compat_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg);
 int vcc_setsockopt(struct socket *sock, int level, int optname,
-                   char __user *optval, int optlen);
+                   char __user *optval, unsigned int optlen);
 int vcc_getsockopt(struct socket *sock, int level, int optname,
                   char __user *optval, int __user *optlen);
diff --git a/net/atm/pvc.c b/net/atm/pvc.c
index e1d22d9430dd..d4c024504f99 100644
--- a/net/atm/pvc.c
+++ b/net/atm/pvc.c
@@ -59,7 +59,7 @@ static int pvc_connect(struct socket *sock,struct sockaddr *sockaddr,
 }
 static int pvc_setsockopt(struct socket *sock, int level, int optname,
-                          char __user *optval, int optlen)
+                          char __user *optval, unsigned int optlen)
 {
        struct sock *sk = sock->sk;
        int error;
diff --git a/net/atm/svc.c b/net/atm/svc.c
index 7b831b526d0b..f90d143c4b25 100644
--- a/net/atm/svc.c
+++ b/net/atm/svc.c
@@ -446,7 +446,7 @@ int svc_change_qos(struct atm_vcc *vcc,struct atm_qos *qos)
 static int svc_setsockopt(struct socket *sock, int level, int optname,
-                          char __user *optval, int optlen)
+                          char __user *optval, unsigned int optlen)
 {
        struct sock *sk = sock->sk;
        struct atm_vcc *vcc = ATM_SD(sock);
diff --git a/net/ax25/af_ax25.c b/net/ax25/af_ax25.c
index da0f64f82b57..f45460730371 100644
--- a/net/ax25/af_ax25.c
+++ b/net/ax25/af_ax25.c
@@ -358,6 +358,7 @@ static int ax25_ctl_ioctl(const unsigned int cmd, void __user *arg)
        ax25_dev *ax25_dev;
        ax25_cb *ax25;
        unsigned int k;
+        int ret = 0;
        if (copy_from_user(&ax25_ctl, arg, sizeof(ax25_ctl)))
                return -EFAULT;
@@ -388,57 +389,63 @@ static int ax25_ctl_ioctl(const unsigned int cmd, void __user *arg)
        case AX25_WINDOW:
                if (ax25->modulus == AX25_MODULUS) {
                        if (ax25_ctl.arg < 1 || ax25_ctl.arg > 7)
-                                return -EINVAL;
+                                goto einval_put;
                } else {
                        if (ax25_ctl.arg < 1 || ax25_ctl.arg > 63)
-                                return -EINVAL;
+                                goto einval_put;
                }
                ax25->window = ax25_ctl.arg;
                break;
        case AX25_T1:
                if (ax25_ctl.arg < 1)
-                        return -EINVAL;
+                        goto einval_put;
                ax25->rtt = (ax25_ctl.arg * HZ) / 2;
                ax25->t1  = ax25_ctl.arg * HZ;
                break;
        case AX25_T2:
                if (ax25_ctl.arg < 1)
-                        return -EINVAL;
+                        goto einval_put;
                ax25->t2 = ax25_ctl.arg * HZ;
                break;
        case AX25_N2:
                if (ax25_ctl.arg < 1 || ax25_ctl.arg > 31)
-                        return -EINVAL;
+                        goto einval_put;
                ax25->n2count = 0;
                ax25->n2 = ax25_ctl.arg;
                break;
        case AX25_T3:
                if (ax25_ctl.arg < 0)
-                        return -EINVAL;
+                        goto einval_put;
                ax25->t3 = ax25_ctl.arg * HZ;
                break;
        case AX25_IDLE:
                if (ax25_ctl.arg < 0)
-                        return -EINVAL;
+                        goto einval_put;
                ax25->idle = ax25_ctl.arg * 60 * HZ;
                break;
        case AX25_PACLEN:
                if (ax25_ctl.arg < 16 || ax25_ctl.arg > 65535)
-                        return -EINVAL;
+                        goto einval_put;
                ax25->paclen = ax25_ctl.arg;
                break;
        default:
-                return -EINVAL;
+                goto einval_put;
          }
-        return 0;
+out_put:
+        ax25_cb_put(ax25);
+        return ret;
+einval_put:
+        ret = -EINVAL;
+        goto out_put;
 }
 static void ax25_fillin_cb_from_dev(ax25_cb *ax25, ax25_dev *ax25_dev)
@@ -527,7 +534,7 @@ ax25_cb *ax25_create_cb(void)
 */
 static int ax25_setsockopt(struct socket *sock, int level, int optname,
-        char __user *optval, int optlen)
+        char __user *optval, unsigned int optlen)
 {
        struct sock *sk = sock->sk;
        ax25_cb *ax25;
@@ -634,15 +641,10 @@ static int ax25_setsockopt(struct socket *sock, int level, int optname,
        case SO_BINDTODEVICE:
                if (optlen > IFNAMSIZ)
-                        optlen=IFNAMSIZ;
+                        optlen = IFNAMSIZ;
-                if (copy_from_user(devname, optval, optlen)) {
-                res = -EFAULT;
-                        break;
-                }
-                dev = dev_get_by_name(&init_net, devname);
+                if (copy_from_user(devname, optval, optlen)) {
-                if (dev == NULL) {
+                        res = -EFAULT;
-                        res = -ENODEV;
                        break;
                }
@@ -650,12 +652,18 @@ static int ax25_setsockopt(struct socket *sock, int level, int optname,
                   (sock->state != SS_UNCONNECTED ||
                    sk->sk_state == TCP_LISTEN)) {
                        res = -EADDRNOTAVAIL;
-                        dev_put(dev);
+                        break;
+                }
+                dev = dev_get_by_name(&init_net, devname);
+                if (!dev) {
+                        res = -ENODEV;
                        break;
                }
                ax25->ax25_dev = ax25_dev_ax25dev(dev);
                ax25_fillin_cb(ax25, ax25->ax25_dev);
+                dev_put(dev);
                break;
        default:
@@ -893,7 +901,6 @@ struct sock *ax25_make_new(struct sock *osk, struct ax25_dev *ax25_dev)
        sock_init_data(NULL, sk);
-        sk->sk_destruct = ax25_free_sock;
        sk->sk_type     = osk->sk_type;
        sk->sk_priority = osk->sk_priority;
        sk->sk_protocol = osk->sk_protocol;
@@ -931,6 +938,7 @@ struct sock *ax25_make_new(struct sock *osk, struct ax25_dev *ax25_dev)
        }
        sk->sk_protinfo = ax25;
+        sk->sk_destruct = ax25_free_sock;
        ax25->sk    = sk;
        return sk;
@@ -1781,8 +1789,8 @@ static int ax25_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg)
                ax25_info.idletimer = ax25_display_timer(&ax25->idletimer) / (60 * HZ);
                ax25_info.n2count   = ax25->n2count;
                ax25_info.state     = ax25->state;
-                ax25_info.rcv_q     = sk_wmem_alloc_get(sk);
+                ax25_info.rcv_q     = sk_rmem_alloc_get(sk);
-                ax25_info.snd_q     = sk_rmem_alloc_get(sk);
+                ax25_info.snd_q     = sk_wmem_alloc_get(sk);
                ax25_info.vs        = ax25->vs;
                ax25_info.vr        = ax25->vr;
                ax25_info.va        = ax25->va;
diff --git a/net/bluetooth/hci_conn.c b/net/bluetooth/hci_conn.c
index a9750984f772..b7c4224f4e7d 100644
--- a/net/bluetooth/hci_conn.c
+++ b/net/bluetooth/hci_conn.c
@@ -211,6 +211,7 @@ struct hci_conn *hci_conn_add(struct hci_dev *hdev, int type, bdaddr_t *dst)
        conn->type  = type;
        conn->mode  = HCI_CM_ACTIVE;
        conn->state = BT_OPEN;
+        conn->auth_type = HCI_AT_GENERAL_BONDING;
        conn->power_save = 1;
        conn->disc_timeout = HCI_DISCONN_TIMEOUT;
diff --git a/net/bluetooth/hci_sock.c b/net/bluetooth/hci_sock.c
index 4f9621f759a0..75302a986067 100644
--- a/net/bluetooth/hci_sock.c
+++ b/net/bluetooth/hci_sock.c
@@ -466,7 +466,7 @@ drop:
        goto done;
 }
-static int hci_sock_setsockopt(struct socket *sock, int level, int optname, char __user *optval, int len)
+static int hci_sock_setsockopt(struct socket *sock, int level, int optname, char __user *optval, unsigned int len)
 {
        struct hci_ufilter uf = { .opcode = 0 };
        struct sock *sk = sock->sk;
diff --git a/net/bluetooth/hci_sysfs.c b/net/bluetooth/hci_sysfs.c
index 7f939ce29801..2bc6f6a8de68 100644
--- a/net/bluetooth/hci_sysfs.c
+++ b/net/bluetooth/hci_sysfs.c
@@ -92,6 +92,8 @@ static void add_conn(struct work_struct *work)
        dev_set_name(&conn->dev, "%s:%d", hdev->name, conn->handle);
+        dev_set_drvdata(&conn->dev, conn);
        if (device_add(&conn->dev) < 0) {
                BT_ERR("Failed to register connection device");
                return;
@@ -144,8 +146,6 @@ void hci_conn_init_sysfs(struct hci_conn *conn)
        conn->dev.class = bt_class;
        conn->dev.parent = &hdev->dev;
-        dev_set_drvdata(&conn->dev, conn);
        device_initialize(&conn->dev);
        INIT_WORK(&conn->work_add, add_conn);
diff --git a/net/bluetooth/hidp/core.c b/net/bluetooth/hidp/core.c
index 09bedeb5579c..49d8495d69be 100644
--- a/net/bluetooth/hidp/core.c
+++ b/net/bluetooth/hidp/core.c
@@ -577,11 +577,6 @@ static int hidp_session(void *arg)
        }
        if (session->hid) {
-                if (session->hid->claimed & HID_CLAIMED_INPUT)
-                        hidinput_disconnect(session->hid);
-                if (session->hid->claimed & HID_CLAIMED_HIDRAW)
-                        hidraw_disconnect(session->hid);
                hid_destroy_device(session->hid);
                session->hid = NULL;
        }
@@ -747,8 +742,6 @@ static void hidp_stop(struct hid_device *hid)
        skb_queue_purge(&session->ctrl_transmit);
        skb_queue_purge(&session->intr_transmit);
-        if (hid->claimed & HID_CLAIMED_INPUT)
-                hidinput_disconnect(hid);
        hid->claimed = 0;
 }
diff --git a/net/bluetooth/l2cap.c b/net/bluetooth/l2cap.c
index b03012564647..947f8bbb4bb3 100644
--- a/net/bluetooth/l2cap.c
+++ b/net/bluetooth/l2cap.c
@@ -555,12 +555,12 @@ static struct l2cap_conn *l2cap_conn_add(struct hci_conn *hcon, u8 status)
        conn->feat_mask = 0;
-        setup_timer(&conn->info_timer, l2cap_info_timeout,
-                                                (unsigned long) conn);
        spin_lock_init(&conn->lock);
        rwlock_init(&conn->chan_list.lock);
+        setup_timer(&conn->info_timer, l2cap_info_timeout,
+                                                (unsigned long) conn);
        conn->disc_reason = 0x13;
        return conn;
@@ -783,6 +783,9 @@ static void l2cap_sock_init(struct sock *sk, struct sock *parent)
        /* Default config options */
        pi->conf_len = 0;
        pi->flush_to = L2CAP_DEFAULT_FLUSH_TO;
+        skb_queue_head_init(TX_QUEUE(sk));
+        skb_queue_head_init(SREJ_QUEUE(sk));
+        INIT_LIST_HEAD(SREJ_LIST(sk));
 }
 static struct proto l2cap_proto = {
@@ -1698,7 +1701,7 @@ static int l2cap_sock_recvmsg(struct kiocb *iocb, struct socket *sock, struct ms
        return bt_sock_recvmsg(iocb, sock, msg, len, flags);
 }
-static int l2cap_sock_setsockopt_old(struct socket *sock, int optname, char __user *optval, int optlen)
+static int l2cap_sock_setsockopt_old(struct socket *sock, int optname, char __user *optval, unsigned int optlen)
 {
        struct sock *sk = sock->sk;
        struct l2cap_options opts;
@@ -1755,7 +1758,7 @@ static int l2cap_sock_setsockopt_old(struct socket *sock, int optname, char __us
        return err;
 }
-static int l2cap_sock_setsockopt(struct socket *sock, int level, int optname, char __user *optval, int optlen)
+static int l2cap_sock_setsockopt(struct socket *sock, int level, int optname, char __user *optval, unsigned int optlen)
 {
        struct sock *sk = sock->sk;
        struct bt_security sec;
@@ -2202,7 +2205,7 @@ static int l2cap_build_conf_req(struct sock *sk, void *data)
 {
        struct l2cap_pinfo *pi = l2cap_pi(sk);
        struct l2cap_conf_req *req = data;
-        struct l2cap_conf_rfc rfc = { .mode = L2CAP_MODE_ERTM };
+        struct l2cap_conf_rfc rfc = { .mode = L2CAP_MODE_BASIC };
        void *ptr = req->data;
        BT_DBG("sk %p", sk);
@@ -2391,6 +2394,10 @@ done:
                        rfc.monitor_timeout = L2CAP_DEFAULT_MONITOR_TO;
                        pi->conf_state |= L2CAP_CONF_MODE_DONE;
+                        l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC,
+                                        sizeof(rfc), (unsigned long) &rfc);
                        break;
                case L2CAP_MODE_STREAMING:
@@ -2398,6 +2405,10 @@ done:
                        pi->max_pdu_size = rfc.max_pdu_size;
                        pi->conf_state |= L2CAP_CONF_MODE_DONE;
+                        l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC,
+                                        sizeof(rfc), (unsigned long) &rfc);
                        break;
                default:
@@ -2407,9 +2418,6 @@ done:
                        rfc.mode = pi->mode;
                }
-                l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC,
-                                        sizeof(rfc), (unsigned long) &rfc);
                if (result == L2CAP_CONF_SUCCESS)
                        pi->conf_state |= L2CAP_CONF_OUTPUT_DONE;
        }
diff --git a/net/bluetooth/rfcomm/sock.c b/net/bluetooth/rfcomm/sock.c
index 0b85e8116859..8a20aaf1f231 100644
--- a/net/bluetooth/rfcomm/sock.c
+++ b/net/bluetooth/rfcomm/sock.c
@@ -730,7 +730,7 @@ out:
        return copied ? : err;
 }
-static int rfcomm_sock_setsockopt_old(struct socket *sock, int optname, char __user *optval, int optlen)
+static int rfcomm_sock_setsockopt_old(struct socket *sock, int optname, char __user *optval, unsigned int optlen)
 {
        struct sock *sk = sock->sk;
        int err = 0;
@@ -766,7 +766,7 @@ static int rfcomm_sock_setsockopt_old(struct socket *sock, int optname, char __u
        return err;
 }
-static int rfcomm_sock_setsockopt(struct socket *sock, int level, int optname, char __user *optval, int optlen)
+static int rfcomm_sock_setsockopt(struct socket *sock, int level, int optname, char __user *optval, unsigned int optlen)
 {
        struct sock *sk = sock->sk;
        struct bt_security sec;
diff --git a/net/bluetooth/sco.c b/net/bluetooth/sco.c
index 13c27f17192c..77f4153bdb5e 100644
--- a/net/bluetooth/sco.c
+++ b/net/bluetooth/sco.c
@@ -644,7 +644,7 @@ static int sco_sock_sendmsg(struct kiocb *iocb, struct socket *sock,
        return err;
 }
-static int sco_sock_setsockopt(struct socket *sock, int level, int optname, char __user *optval, int optlen)
+static int sco_sock_setsockopt(struct socket *sock, int level, int optname, char __user *optval, unsigned int optlen)
 {
        struct sock *sk = sock->sk;
        int err = 0;
diff --git a/net/bridge/br_if.c b/net/bridge/br_if.c
index 142ebac14176..4a9f52732655 100644
--- a/net/bridge/br_if.c
+++ b/net/bridge/br_if.c
@@ -377,12 +377,16 @@ int br_add_if(struct net_bridge *br, struct net_device *dev)
        struct net_bridge_port *p;
        int err = 0;
-        if (dev->flags & IFF_LOOPBACK || dev->type != ARPHRD_ETHER)
+        /* Don't allow bridging non-ethernet like devices */
+        if ((dev->flags & IFF_LOOPBACK) ||
+            dev->type != ARPHRD_ETHER || dev->addr_len != ETH_ALEN)
                return -EINVAL;
+        /* No bridging of bridges */
        if (dev->netdev_ops->ndo_start_xmit == br_dev_xmit)
                return -ELOOP;
+        /* Device is already being bridged */
        if (dev->br_port != NULL)
                return -EBUSY;
@@ -432,6 +436,7 @@ err2:
        br_fdb_delete_by_port(br, p, 1);
 err1:
        kobject_put(&p->kobj);
+        p = NULL; /* kobject_put frees */
 err0:
        dev_set_promiscuity(dev, -1);
 put_back:
diff --git a/net/bridge/br_netfilter.c b/net/bridge/br_netfilter.c
index 907a82e9023d..a16a2342f6bf 100644
--- a/net/bridge/br_netfilter.c
+++ b/net/bridge/br_netfilter.c
@@ -965,12 +965,12 @@ static struct nf_hook_ops br_nf_ops[] __read_mostly = {
 #ifdef CONFIG_SYSCTL
 static
-int brnf_sysctl_call_tables(ctl_table * ctl, int write, struct file *filp,
+int brnf_sysctl_call_tables(ctl_table * ctl, int write,
                            void __user * buffer, size_t * lenp, loff_t * ppos)
 {
        int ret;
-        ret = proc_dointvec(ctl, write, filp, buffer, lenp, ppos);
+        ret = proc_dointvec(ctl, write, buffer, lenp, ppos);
        if (write && *(int *)(ctl->data))
                *(int *)(ctl->data) = 1;
diff --git a/net/can/bcm.c b/net/can/bcm.c
index 597da4f8f888..e8d58f33fe09 100644
--- a/net/can/bcm.c
+++ b/net/can/bcm.c
@@ -132,23 +132,27 @@ static inline struct bcm_sock *bcm_sk(const struct sock *sk)
 /*
 * procfs functions
 */
-static char *bcm_proc_getifname(int ifindex)
+static char *bcm_proc_getifname(char *result, int ifindex)
 {
        struct net_device *dev;
        if (!ifindex)
                return "any";
-        /* no usage counting */
+        read_lock(&dev_base_lock);
        dev = __dev_get_by_index(&init_net, ifindex);
        if (dev)
-                return dev->name;
+                strcpy(result, dev->name);
+        else
+                strcpy(result, "???");
+        read_unlock(&dev_base_lock);
-        return "???";
+        return result;
 }
 static int bcm_proc_show(struct seq_file *m, void *v)
 {
+        char ifname[IFNAMSIZ];
        struct sock *sk = (struct sock *)m->private;
        struct bcm_sock *bo = bcm_sk(sk);
        struct bcm_op *op;
@@ -157,7 +161,7 @@ static int bcm_proc_show(struct seq_file *m, void *v)
        seq_printf(m, " / sk %p", sk);
        seq_printf(m, " / bo %p", bo);
        seq_printf(m, " / dropped %lu", bo->dropped_usr_msgs);
-        seq_printf(m, " / bound %s", bcm_proc_getifname(bo->ifindex));
+        seq_printf(m, " / bound %s", bcm_proc_getifname(ifname, bo->ifindex));
        seq_printf(m, " <<<\n");
        list_for_each_entry(op, &bo->rx_ops, list) {
@@ -169,7 +173,7 @@ static int bcm_proc_show(struct seq_file *m, void *v)
                        continue;
                seq_printf(m, "rx_op: %03X %-5s ",
-                                op->can_id, bcm_proc_getifname(op->ifindex));
+                                op->can_id, bcm_proc_getifname(ifname, op->ifindex));
                seq_printf(m, "[%d]%c ", op->nframes,
                                (op->flags & RX_CHECK_DLC)?'d':' ');
                if (op->kt_ival1.tv64)
@@ -194,7 +198,8 @@ static int bcm_proc_show(struct seq_file *m, void *v)
        list_for_each_entry(op, &bo->tx_ops, list) {
                seq_printf(m, "tx_op: %03X %s [%d] ",
-                                op->can_id, bcm_proc_getifname(op->ifindex),
+                                op->can_id,
+                                bcm_proc_getifname(ifname, op->ifindex),
                                op->nframes);
                if (op->kt_ival1.tv64)
diff --git a/net/can/raw.c b/net/can/raw.c
index db3152df7d2b..b5e897922d32 100644
--- a/net/can/raw.c
+++ b/net/can/raw.c
@@ -411,7 +411,7 @@ static int raw_getname(struct socket *sock, struct sockaddr *uaddr,
 }
 static int raw_setsockopt(struct socket *sock, int level, int optname,
-                          char __user *optval, int optlen)
+                          char __user *optval, unsigned int optlen)
 {
        struct sock *sk = sock->sk;
        struct raw_sock *ro = raw_sk(sk);
diff --git a/net/compat.c b/net/compat.c
index 12728b17a226..a407c3addbae 100644
--- a/net/compat.c
+++ b/net/compat.c
@@ -331,7 +331,7 @@ struct compat_sock_fprog {
 };
 static int do_set_attach_filter(struct socket *sock, int level, int optname,
-                                char __user *optval, int optlen)
+                                char __user *optval, unsigned int optlen)
 {
        struct compat_sock_fprog __user *fprog32 = (struct compat_sock_fprog __user *)optval;
        struct sock_fprog __user *kfprog = compat_alloc_user_space(sizeof(struct sock_fprog));
@@ -351,7 +351,7 @@ static int do_set_attach_filter(struct socket *sock, int level, int optname,
 }
 static int do_set_sock_timeout(struct socket *sock, int level,
-                int optname, char __user *optval, int optlen)
+                int optname, char __user *optval, unsigned int optlen)
 {
        struct compat_timeval __user *up = (struct compat_timeval __user *) optval;
        struct timeval ktime;
@@ -373,7 +373,7 @@ static int do_set_sock_timeout(struct socket *sock, int level,
 }
 static int compat_sock_setsockopt(struct socket *sock, int level, int optname,
-                                char __user *optval, int optlen)
+                                char __user *optval, unsigned int optlen)
 {
        if (optname == SO_ATTACH_FILTER)
                return do_set_attach_filter(sock, level, optname,
@@ -385,7 +385,7 @@ static int compat_sock_setsockopt(struct socket *sock, int level, int optname,
 }
 asmlinkage long compat_sys_setsockopt(int fd, int level, int optname,
-                                char __user *optval, int optlen)
+                                char __user *optval, unsigned int optlen)
 {
        int err;
        struct socket *sock;
@@ -558,8 +558,8 @@ struct compat_group_filter {
 int compat_mc_setsockopt(struct sock *sock, int level, int optname,
-        char __user *optval, int optlen,
+        char __user *optval, unsigned int optlen,
-        int (*setsockopt)(struct sock *,int,int,char __user *,int))
+        int (*setsockopt)(struct sock *,int,int,char __user *,unsigned int))
 {
        char __user     *koptval = optval;
        int             koptlen = optlen;
diff --git a/net/core/datagram.c b/net/core/datagram.c
index 1c6cf3a1a4f6..4ade3011bb3c 100644
--- a/net/core/datagram.c
+++ b/net/core/datagram.c
@@ -224,6 +224,15 @@ void skb_free_datagram(struct sock *sk, struct sk_buff *skb)
        consume_skb(skb);
        sk_mem_reclaim_partial(sk);
 }
+EXPORT_SYMBOL(skb_free_datagram);
+void skb_free_datagram_locked(struct sock *sk, struct sk_buff *skb)
+{
+        lock_sock(sk);
+        skb_free_datagram(sk, skb);
+        release_sock(sk);
+}
+EXPORT_SYMBOL(skb_free_datagram_locked);
 /**
 *      skb_kill_datagram - Free a datagram skbuff forcibly
@@ -752,5 +761,4 @@ unsigned int datagram_poll(struct file *file, struct socket *sock,
 EXPORT_SYMBOL(datagram_poll);
 EXPORT_SYMBOL(skb_copy_and_csum_datagram_iovec);
 EXPORT_SYMBOL(skb_copy_datagram_iovec);
-EXPORT_SYMBOL(skb_free_datagram);
 EXPORT_SYMBOL(skb_recv_datagram);
diff --git a/net/core/dev.c b/net/core/dev.c
index 560c8c9c03ab..fe10551d3671 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -942,14 +942,15 @@ rollback:
        ret = notifier_to_errno(ret);
        if (ret) {
-                if (err) {
+                /* err >= 0 after dev_alloc_name() or stores the first errno */
-                        printk(KERN_ERR
+                if (err >= 0) {
-                               "%s: name change rollback failed: %d.\n",
-                               dev->name, ret);
-                } else {
                        err = ret;
                        memcpy(dev->name, oldname, IFNAMSIZ);
                        goto rollback;
+                } else {
+                        printk(KERN_ERR
+                               "%s: name change rollback failed: %d.\n",
+                               dev->name, ret);
                }
        }
@@ -2288,6 +2289,9 @@ int netif_receive_skb(struct sk_buff *skb)
        int ret = NET_RX_DROP;
        __be16 type;
+        if (!skb->tstamp.tv64)
+                net_timestamp(skb);
        if (skb->vlan_tci && vlan_hwaccel_do_receive(skb))
                return NET_RX_SUCCESS;
@@ -2295,9 +2299,6 @@ int netif_receive_skb(struct sk_buff *skb)
        if (netpoll_receive_skb(skb))
                return NET_RX_DROP;
-        if (!skb->tstamp.tv64)
-                net_timestamp(skb);
        if (!skb->iif)
                skb->iif = skb->dev->ifindex;
diff --git a/net/core/net-sysfs.c b/net/core/net-sysfs.c
index 7d4c57523b09..427ded841224 100644
--- a/net/core/net-sysfs.c
+++ b/net/core/net-sysfs.c
@@ -16,7 +16,7 @@
 #include <net/sock.h>
 #include <linux/rtnetlink.h>
 #include <linux/wireless.h>
-#include <net/iw_handler.h>
+#include <net/wext.h>
 #include "net-sysfs.h"
@@ -363,18 +363,16 @@ static ssize_t wireless_show(struct device *d, char *buf,
                                               char *))
 {
        struct net_device *dev = to_net_dev(d);
-        const struct iw_statistics *iw = NULL;
+        const struct iw_statistics *iw;
        ssize_t ret = -EINVAL;
-        read_lock(&dev_base_lock);
+        rtnl_lock();
        if (dev_isalive(dev)) {
-                if (dev->wireless_handlers &&
+                iw = get_wireless_stats(dev);
-                    dev->wireless_handlers->get_wireless_stats)
+                if (iw)
-                        iw = dev->wireless_handlers->get_wireless_stats(dev);
-                if (iw != NULL)
                        ret = (*format)(iw, buf);
        }
-        read_unlock(&dev_base_lock);
+        rtnl_unlock();
        return ret;
 }
@@ -505,7 +503,7 @@ int netdev_register_kobject(struct net_device *net)
        *groups++ = &netstat_group;
 #ifdef CONFIG_WIRELESS_EXT_SYSFS
-        if (net->wireless_handlers && net->wireless_handlers->get_wireless_stats)
+        if (net->wireless_handlers || net->ieee80211_ptr)
                *groups++ = &wireless_group;
 #endif
 #endif /* CONFIG_SYSFS */
diff --git a/net/core/pktgen.c b/net/core/pktgen.c
index 0bcecbf06581..6e79e96cb4f2 100644
--- a/net/core/pktgen.c
+++ b/net/core/pktgen.c
@@ -192,11 +192,10 @@
 #define F_QUEUE_MAP_CPU (1<<14) /* queue map mirrors smp_processor_id() */
 /* Thread control flag bits */
-#define T_TERMINATE   (1<<0)
+#define T_STOP        (1<<0)    /* Stop run */
-#define T_STOP        (1<<1)    /* Stop run */
+#define T_RUN         (1<<1)    /* Start run */
-#define T_RUN         (1<<2)    /* Start run */
+#define T_REMDEVALL   (1<<2)    /* Remove all devs */
-#define T_REMDEVALL   (1<<3)    /* Remove all devs */
+#define T_REMDEV      (1<<3)    /* Remove one dev */
-#define T_REMDEV      (1<<4)    /* Remove one dev */
 /* If lock -- can be removed after some work */
 #define   if_lock(t)           spin_lock(&(t->if_lock));
@@ -336,6 +335,7 @@ struct pktgen_dev {
        __u32 cur_src_mac_offset;
        __be32 cur_saddr;
        __be32 cur_daddr;
+        __u16 ip_id;
        __u16 cur_udp_dst;
        __u16 cur_udp_src;
        __u16 cur_queue_map;
@@ -363,6 +363,7 @@ struct pktgen_dev {
                                  * device name (not when the inject is
                                  * started as it used to do.)
                                  */
+        char odevname[32];
        struct flow_state *flows;
        unsigned cflows;        /* Concurrent flows (config) */
        unsigned lflow;         /* Flow length  (config) */
@@ -426,7 +427,7 @@ static const char version[] =
 static int pktgen_remove_device(struct pktgen_thread *t, struct pktgen_dev *i);
 static int pktgen_add_device(struct pktgen_thread *t, const char *ifname);
 static struct pktgen_dev *pktgen_find_dev(struct pktgen_thread *t,
-                                          const char *ifname);
+                                          const char *ifname, bool exact);
 static int pktgen_device_event(struct notifier_block *, unsigned long, void *);
 static void pktgen_run_all_threads(void);
 static void pktgen_reset_all_threads(void);
@@ -528,7 +529,7 @@ static int pktgen_if_show(struct seq_file *seq, void *v)
        seq_printf(seq,
                   "     frags: %d  delay: %llu  clone_skb: %d  ifname: %s\n",
                   pkt_dev->nfrags, (unsigned long long) pkt_dev->delay,
-                   pkt_dev->clone_skb, pkt_dev->odev->name);
+                   pkt_dev->clone_skb, pkt_dev->odevname);
        seq_printf(seq, "     flows: %u flowlen: %u\n", pkt_dev->cflows,
                   pkt_dev->lflow);
@@ -965,7 +966,7 @@ static ssize_t pktgen_if_write(struct file *file,
                if (value == 0x7FFFFFFF)
                        pkt_dev->delay = ULLONG_MAX;
                else
-                        pkt_dev->delay = (u64)value * NSEC_PER_USEC;
+                        pkt_dev->delay = (u64)value;
                sprintf(pg_result, "OK: delay=%llu",
                        (unsigned long long) pkt_dev->delay);
@@ -1688,13 +1689,13 @@ static int pktgen_thread_show(struct seq_file *seq, void *v)
        if_lock(t);
        list_for_each_entry(pkt_dev, &t->if_list, list)
                if (pkt_dev->running)
-                        seq_printf(seq, "%s ", pkt_dev->odev->name);
+                        seq_printf(seq, "%s ", pkt_dev->odevname);
        seq_printf(seq, "\nStopped: ");
        list_for_each_entry(pkt_dev, &t->if_list, list)
                if (!pkt_dev->running)
-                        seq_printf(seq, "%s ", pkt_dev->odev->name);
+                        seq_printf(seq, "%s ", pkt_dev->odevname);
        if (t->result[0])
                seq_printf(seq, "\nResult: %s\n", t->result);
@@ -1817,9 +1818,10 @@ static struct pktgen_dev *__pktgen_NN_threads(const char *ifname, int remove)
 {
        struct pktgen_thread *t;
        struct pktgen_dev *pkt_dev = NULL;
+        bool exact = (remove == FIND);
        list_for_each_entry(t, &pktgen_threads, th_list) {
-                pkt_dev = pktgen_find_dev(t, ifname);
+                pkt_dev = pktgen_find_dev(t, ifname, exact);
                if (pkt_dev) {
                        if (remove) {
                                if_lock(t);
@@ -1994,7 +1996,7 @@ static void pktgen_setup_inject(struct pktgen_dev *pkt_dev)
                       "queue_map_min (zero-based) (%d) exceeds valid range "
                       "[0 - %d] for (%d) queues on %s, resetting\n",
                       pkt_dev->queue_map_min, (ntxq ?: 1) - 1, ntxq,
-                       pkt_dev->odev->name);
+                       pkt_dev->odevname);
                pkt_dev->queue_map_min = ntxq - 1;
        }
        if (pkt_dev->queue_map_max >= ntxq) {
@@ -2002,7 +2004,7 @@ static void pktgen_setup_inject(struct pktgen_dev *pkt_dev)
                       "queue_map_max (zero-based) (%d) exceeds valid range "
                       "[0 - %d] for (%d) queues on %s, resetting\n",
                       pkt_dev->queue_map_max, (ntxq ?: 1) - 1, ntxq,
-                       pkt_dev->odev->name);
+                       pkt_dev->odevname);
                pkt_dev->queue_map_max = ntxq - 1;
        }
@@ -2105,18 +2107,20 @@ static void pktgen_setup_inject(struct pktgen_dev *pkt_dev)
 static void spin(struct pktgen_dev *pkt_dev, ktime_t spin_until)
 {
-        ktime_t start;
+        ktime_t start_time, end_time;
-        s32 remaining;
+        s64 remaining;
        struct hrtimer_sleeper t;
        hrtimer_init_on_stack(&t.timer, CLOCK_MONOTONIC, HRTIMER_MODE_ABS);
        hrtimer_set_expires(&t.timer, spin_until);
        remaining = ktime_to_us(hrtimer_expires_remaining(&t.timer));
-        if (remaining <= 0)
+        if (remaining <= 0) {
+                pkt_dev->next_tx = ktime_add_ns(spin_until, pkt_dev->delay);
                return;
+        }
-        start = ktime_now();
+        start_time = ktime_now();
        if (remaining < 100)
                udelay(remaining);      /* really small just spin */
        else {
@@ -2135,7 +2139,10 @@ static void spin(struct pktgen_dev *pkt_dev, ktime_t spin_until)
                } while (t.task && pkt_dev->running && !signal_pending(current));
                __set_current_state(TASK_RUNNING);
        }
-        pkt_dev->idle_acc += ktime_to_ns(ktime_sub(ktime_now(), start));
+        end_time = ktime_now();
+        pkt_dev->idle_acc += ktime_to_ns(ktime_sub(end_time, start_time));
+        pkt_dev->next_tx = ktime_add_ns(end_time, pkt_dev->delay);
 }
 static inline void set_pkt_overhead(struct pktgen_dev *pkt_dev)
@@ -2208,7 +2215,7 @@ static void set_cur_queue_map(struct pktgen_dev *pkt_dev)
        if (pkt_dev->flags & F_QUEUE_MAP_CPU)
                pkt_dev->cur_queue_map = smp_processor_id();
-        else if (pkt_dev->queue_map_min < pkt_dev->queue_map_max) {
+        else if (pkt_dev->queue_map_min <= pkt_dev->queue_map_max) {
                __u16 t;
                if (pkt_dev->flags & F_QUEUE_MAP_RND) {
                        t = random32() %
@@ -2626,6 +2633,8 @@ static struct sk_buff *fill_packet_ipv4(struct net_device *odev,
        iph->protocol = IPPROTO_UDP;    /* UDP */
        iph->saddr = pkt_dev->cur_saddr;
        iph->daddr = pkt_dev->cur_daddr;
+        iph->id = htons(pkt_dev->ip_id);
+        pkt_dev->ip_id++;
        iph->frag_off = 0;
        iplen = 20 + 8 + datalen;
        iph->tot_len = htons(iplen);
@@ -2637,24 +2646,26 @@ static struct sk_buff *fill_packet_ipv4(struct net_device *odev,
        skb->dev = odev;
        skb->pkt_type = PACKET_HOST;
-        if (pkt_dev->nfrags <= 0)
+        if (pkt_dev->nfrags <= 0) {
                pgh = (struct pktgen_hdr *)skb_put(skb, datalen);
-        else {
+                memset(pgh + 1, 0, datalen - sizeof(struct pktgen_hdr));
+        } else {
                int frags = pkt_dev->nfrags;
-                int i;
+                int i, len;
                pgh = (struct pktgen_hdr *)(((char *)(udph)) + 8);
                if (frags > MAX_SKB_FRAGS)
                        frags = MAX_SKB_FRAGS;
                if (datalen > frags * PAGE_SIZE) {
-                        skb_put(skb, datalen - frags * PAGE_SIZE);
+                        len = datalen - frags * PAGE_SIZE;
+                        memset(skb_put(skb, len), 0, len);
                        datalen = frags * PAGE_SIZE;
                }
                i = 0;
                while (datalen > 0) {
-                        struct page *page = alloc_pages(GFP_KERNEL, 0);
+                        struct page *page = alloc_pages(GFP_KERNEL | __GFP_ZERO, 0);
                        skb_shinfo(skb)->frags[i].page = page;
                        skb_shinfo(skb)->frags[i].page_offset = 0;
                        skb_shinfo(skb)->frags[i].size =
@@ -3253,7 +3264,7 @@ static int pktgen_stop_device(struct pktgen_dev *pkt_dev)
        if (!pkt_dev->running) {
                printk(KERN_WARNING "pktgen: interface: %s is already "
-                       "stopped\n", pkt_dev->odev->name);
+                       "stopped\n", pkt_dev->odevname);
                return -EINVAL;
        }
@@ -3365,19 +3376,29 @@ static void pktgen_rem_thread(struct pktgen_thread *t)
        mutex_unlock(&pktgen_thread_lock);
 }
-static void idle(struct pktgen_dev *pkt_dev)
+static void pktgen_resched(struct pktgen_dev *pkt_dev)
 {
        ktime_t idle_start = ktime_now();
+        schedule();
+        pkt_dev->idle_acc += ktime_to_ns(ktime_sub(ktime_now(), idle_start));
+}
-        if (need_resched())
+static void pktgen_wait_for_skb(struct pktgen_dev *pkt_dev)
-                schedule();
+{
-        else
+        ktime_t idle_start = ktime_now();
-                cpu_relax();
+        while (atomic_read(&(pkt_dev->skb->users)) != 1) {
+                if (signal_pending(current))
+                        break;
+                if (need_resched())
+                        pktgen_resched(pkt_dev);
+                else
+                        cpu_relax();
+        }
        pkt_dev->idle_acc += ktime_to_ns(ktime_sub(ktime_now(), idle_start));
 }
 static void pktgen_xmit(struct pktgen_dev *pkt_dev)
 {
        struct net_device *odev = pkt_dev->odev;
@@ -3387,36 +3408,21 @@ static void pktgen_xmit(struct pktgen_dev *pkt_dev)
        u16 queue_map;
        int ret;
-        if (pkt_dev->delay) {
+        /* If device is offline, then don't send */
-                spin(pkt_dev, pkt_dev->next_tx);
+        if (unlikely(!netif_running(odev) || !netif_carrier_ok(odev))) {
+                pktgen_stop_device(pkt_dev);
-                /* This is max DELAY, this has special meaning of
+                return;
-                 * "never transmit"
-                 */
-                if (pkt_dev->delay == ULLONG_MAX) {
-                        pkt_dev->next_tx = ktime_add_ns(ktime_now(), ULONG_MAX);
-                        return;
-                }
-        }
-        if (!pkt_dev->skb) {
-                set_cur_queue_map(pkt_dev);
-                queue_map = pkt_dev->cur_queue_map;
-        } else {
-                queue_map = skb_get_queue_mapping(pkt_dev->skb);
        }
-        txq = netdev_get_tx_queue(odev, queue_map);
+        /* This is max DELAY, this has special meaning of
-        /* Did we saturate the queue already? */
+         * "never transmit"
-        if (netif_tx_queue_stopped(txq) || netif_tx_queue_frozen(txq)) {
+         */
-                /* If device is down, then all queues are permnantly frozen */
+        if (unlikely(pkt_dev->delay == ULLONG_MAX)) {
-                if (netif_running(odev))
+                pkt_dev->next_tx = ktime_add_ns(ktime_now(), ULONG_MAX);
-                        idle(pkt_dev);
-                else
-                        pktgen_stop_device(pkt_dev);
                return;
        }
+        /* If no skb or clone count exhausted then get new one */
        if (!pkt_dev->skb || (pkt_dev->last_ok &&
                              ++pkt_dev->clone_count >= pkt_dev->clone_skb)) {
                /* build a new pkt */
@@ -3435,54 +3441,45 @@ static void pktgen_xmit(struct pktgen_dev *pkt_dev)
                pkt_dev->clone_count = 0;       /* reset counter */
        }
-        /* fill_packet() might have changed the queue */
+        if (pkt_dev->delay && pkt_dev->last_ok)
+                spin(pkt_dev, pkt_dev->next_tx);
        queue_map = skb_get_queue_mapping(pkt_dev->skb);
        txq = netdev_get_tx_queue(odev, queue_map);
        __netif_tx_lock_bh(txq);
-        if (unlikely(netif_tx_queue_stopped(txq) || netif_tx_queue_frozen(txq)))
+        atomic_inc(&(pkt_dev->skb->users));
-                pkt_dev->last_ok = 0;
-        else {
-                atomic_inc(&(pkt_dev->skb->users));
-        retry_now:
+        if (unlikely(netif_tx_queue_stopped(txq) || netif_tx_queue_frozen(txq)))
+                ret = NETDEV_TX_BUSY;
+        else
                ret = (*xmit)(pkt_dev->skb, odev);
-                switch (ret) {
-                case NETDEV_TX_OK:
+        switch (ret) {
-                        txq_trans_update(txq);
+        case NETDEV_TX_OK:
-                        pkt_dev->last_ok = 1;
+                txq_trans_update(txq);
-                        pkt_dev->sofar++;
+                pkt_dev->last_ok = 1;
-                        pkt_dev->seq_num++;
+                pkt_dev->sofar++;
-                        pkt_dev->tx_bytes += pkt_dev->cur_pkt_size;
+                pkt_dev->seq_num++;
-                        break;
+                pkt_dev->tx_bytes += pkt_dev->cur_pkt_size;
-                case NETDEV_TX_LOCKED:
+                break;
-                        cpu_relax();
+        default: /* Drivers are not supposed to return other values! */
-                        goto retry_now;
+                if (net_ratelimit())
-                default: /* Drivers are not supposed to return other values! */
+                        pr_info("pktgen: %s xmit error: %d\n",
-                        if (net_ratelimit())
+                                pkt_dev->odevname, ret);
-                                pr_info("pktgen: %s xmit error: %d\n",
+                pkt_dev->errors++;
-                                        odev->name, ret);
+                /* fallthru */
-                        pkt_dev->errors++;
+        case NETDEV_TX_LOCKED:
-                        /* fallthru */
+        case NETDEV_TX_BUSY:
-                case NETDEV_TX_BUSY:
+                /* Retry it next time */
-                        /* Retry it next time */
+                atomic_dec(&(pkt_dev->skb->users));
-                        atomic_dec(&(pkt_dev->skb->users));
+                pkt_dev->last_ok = 0;
-                        pkt_dev->last_ok = 0;
-                }
-                if (pkt_dev->delay)
-                        pkt_dev->next_tx = ktime_add_ns(ktime_now(),
-                                                        pkt_dev->delay);
        }
        __netif_tx_unlock_bh(txq);
        /* If pkt_dev->count is zero, then run forever */
        if ((pkt_dev->count != 0) && (pkt_dev->sofar >= pkt_dev->count)) {
-                while (atomic_read(&(pkt_dev->skb->users)) != 1) {
+                pktgen_wait_for_skb(pkt_dev);
-                        if (signal_pending(current))
-                                break;
-                        idle(pkt_dev);
-                }
                /* Done with this */
                pktgen_stop_device(pkt_dev);
@@ -3515,20 +3512,24 @@ static int pktgen_thread_worker(void *arg)
        while (!kthread_should_stop()) {
                pkt_dev = next_to_run(t);
-                if (!pkt_dev &&
+                if (unlikely(!pkt_dev && t->control == 0)) {
-                    (t->control & (T_STOP | T_RUN | T_REMDEVALL | T_REMDEV))
+                        wait_event_interruptible_timeout(t->queue,
-                    == 0) {
+                                                         t->control != 0,
-                        prepare_to_wait(&(t->queue), &wait,
+                                                         HZ/10);
-                                        TASK_INTERRUPTIBLE);
+                        continue;
-                        schedule_timeout(HZ / 10);
-                        finish_wait(&(t->queue), &wait);
                }
                __set_current_state(TASK_RUNNING);
-                if (pkt_dev)
+                if (likely(pkt_dev)) {
                        pktgen_xmit(pkt_dev);
+                        if (need_resched())
+                                pktgen_resched(pkt_dev);
+                        else
+                                cpu_relax();
+                }
                if (t->control & T_STOP) {
                        pktgen_stop(t);
                        t->control &= ~(T_STOP);
@@ -3567,13 +3568,18 @@ static int pktgen_thread_worker(void *arg)
 }
 static struct pktgen_dev *pktgen_find_dev(struct pktgen_thread *t,
-                                          const char *ifname)
+                                          const char *ifname, bool exact)
 {
        struct pktgen_dev *p, *pkt_dev = NULL;
-        if_lock(t);
+        size_t len = strlen(ifname);
+        if_lock(t);
        list_for_each_entry(p, &t->if_list, list)
-                if (strncmp(p->odev->name, ifname, IFNAMSIZ) == 0) {
+                if (strncmp(p->odevname, ifname, len) == 0) {
+                        if (p->odevname[len]) {
+                                if (exact || p->odevname[len] != '@')
+                                        continue;
+                        }
                        pkt_dev = p;
                        break;
                }
@@ -3629,6 +3635,7 @@ static int pktgen_add_device(struct pktgen_thread *t, const char *ifname)
        if (!pkt_dev)
                return -ENOMEM;
+        strcpy(pkt_dev->odevname, ifname);
        pkt_dev->flows = vmalloc(MAX_CFLOWS * sizeof(struct flow_state));
        if (pkt_dev->flows == NULL) {
                kfree(pkt_dev);
diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index 80a96166df39..ec85681a7dd8 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -2701,7 +2701,8 @@ int skb_gro_receive(struct sk_buff **head, struct sk_buff *skb)
                NAPI_GRO_CB(skb)->free = 1;
                goto done;
-        }
+        } else if (skb_gro_len(p) != pinfo->gso_size)
+                return -E2BIG;
        headroom = skb_headroom(p);
        nskb = netdev_alloc_skb(p->dev, headroom + skb_gro_offset(p));
diff --git a/net/core/sock.c b/net/core/sock.c
index 30d5446512f9..7626b6aacd68 100644
--- a/net/core/sock.c
+++ b/net/core/sock.c
@@ -446,7 +446,7 @@ static inline void sock_valbool_flag(struct sock *sk, int bit, int valbool)
 */
 int sock_setsockopt(struct socket *sock, int level, int optname,
-                    char __user *optval, int optlen)
+                    char __user *optval, unsigned int optlen)
 {
        struct sock *sk = sock->sk;
        int val;
@@ -1206,12 +1206,12 @@ EXPORT_SYMBOL_GPL(sk_setup_caps);
 void __init sk_init(void)
 {
-        if (num_physpages <= 4096) {
+        if (totalram_pages <= 4096) {
                sysctl_wmem_max = 32767;
                sysctl_rmem_max = 32767;
                sysctl_wmem_default = 32767;
                sysctl_rmem_default = 32767;
-        } else if (num_physpages >= 131072) {
+        } else if (totalram_pages >= 131072) {
                sysctl_wmem_max = 131071;
                sysctl_rmem_max = 131071;
        }
@@ -1228,17 +1228,22 @@ void __init sk_init(void)
 void sock_wfree(struct sk_buff *skb)
 {
        struct sock *sk = skb->sk;
-        int res;
+        unsigned int len = skb->truesize;
-        /* In case it might be waiting for more memory. */
+        if (!sock_flag(sk, SOCK_USE_WRITE_QUEUE)) {
-        res = atomic_sub_return(skb->truesize, &sk->sk_wmem_alloc);
+                /*
-        if (!sock_flag(sk, SOCK_USE_WRITE_QUEUE))
+                 * Keep a reference on sk_wmem_alloc, this will be released
+                 * after sk_write_space() call
+                 */
+                atomic_sub(len - 1, &sk->sk_wmem_alloc);
                sk->sk_write_space(sk);
+                len = 1;
+        }
        /*
-         * if sk_wmem_alloc reached 0, we are last user and should
+         * if sk_wmem_alloc reaches 0, we must finish what sk_free()
-         * free this sock, as sk_free() call could not do it.
+         * could not do because of in-flight packets
         */
-        if (res == 0)
+        if (atomic_sub_and_test(len, &sk->sk_wmem_alloc))
                __sk_free(sk);
 }
 EXPORT_SYMBOL(sock_wfree);
@@ -1697,7 +1702,7 @@ int sock_no_shutdown(struct socket *sock, int how)
 EXPORT_SYMBOL(sock_no_shutdown);
 int sock_no_setsockopt(struct socket *sock, int level, int optname,
-                    char __user *optval, int optlen)
+                    char __user *optval, unsigned int optlen)
 {
        return -EOPNOTSUPP;
 }
@@ -2018,7 +2023,7 @@ EXPORT_SYMBOL(sock_common_recvmsg);
 *      Set socket options on an inet socket.
 */
 int sock_common_setsockopt(struct socket *sock, int level, int optname,
-                           char __user *optval, int optlen)
+                           char __user *optval, unsigned int optlen)
 {
        struct sock *sk = sock->sk;
@@ -2028,7 +2033,7 @@ EXPORT_SYMBOL(sock_common_setsockopt);
 #ifdef CONFIG_COMPAT
 int compat_sock_common_setsockopt(struct socket *sock, int level, int optname,
-                                  char __user *optval, int optlen)
+                                  char __user *optval, unsigned int optlen)
 {
        struct sock *sk = sock->sk;
diff --git a/net/dcb/dcbnl.c b/net/dcb/dcbnl.c
index e0879bfb7dd5..ac1205df6c86 100644
--- a/net/dcb/dcbnl.c
+++ b/net/dcb/dcbnl.c
@@ -194,7 +194,7 @@ static int dcbnl_reply(u8 value, u8 event, u8 cmd, u8 attr, u32 pid,
        nlmsg_end(dcbnl_skb, nlh);
        ret = rtnl_unicast(dcbnl_skb, &init_net, pid);
        if (ret)
-                goto err;
+                return -EINVAL;
        return 0;
 nlmsg_failure:
@@ -275,7 +275,7 @@ static int dcbnl_getpfccfg(struct net_device *netdev, struct nlattr **tb,
        ret = rtnl_unicast(dcbnl_skb, &init_net, pid);
        if (ret)
-                goto err;
+                goto err_out;
        return 0;
 nlmsg_failure:
@@ -316,12 +316,11 @@ static int dcbnl_getperm_hwaddr(struct net_device *netdev, struct nlattr **tb,
        ret = rtnl_unicast(dcbnl_skb, &init_net, pid);
        if (ret)
-                goto err;
+                goto err_out;
        return 0;
 nlmsg_failure:
-err:
        kfree_skb(dcbnl_skb);
 err_out:
        return -EINVAL;
@@ -383,7 +382,7 @@ static int dcbnl_getcap(struct net_device *netdev, struct nlattr **tb,
        ret = rtnl_unicast(dcbnl_skb, &init_net, pid);
        if (ret)
-                goto err;
+                goto err_out;
        return 0;
 nlmsg_failure:
@@ -460,7 +459,7 @@ static int dcbnl_getnumtcs(struct net_device *netdev, struct nlattr **tb,
        ret = rtnl_unicast(dcbnl_skb, &init_net, pid);
        if (ret) {
                ret = -EINVAL;
-                goto err;
+                goto err_out;
        }
        return 0;
@@ -799,7 +798,7 @@ static int __dcbnl_pg_getcfg(struct net_device *netdev, struct nlattr **tb,
        ret = rtnl_unicast(dcbnl_skb, &init_net, pid);
        if (ret)
-                goto err;
+                goto err_out;
        return 0;
@@ -1063,7 +1062,7 @@ static int dcbnl_bcn_getcfg(struct net_device *netdev, struct nlattr **tb,
        ret = rtnl_unicast(dcbnl_skb, &init_net, pid);
        if (ret)
-                goto err;
+                goto err_out;
        return 0;
diff --git a/net/dccp/dccp.h b/net/dccp/dccp.h
index d6bc47363b1c..5ef32c2f0d6a 100644
--- a/net/dccp/dccp.h
+++ b/net/dccp/dccp.h
@@ -290,14 +290,14 @@ extern int	   dccp_disconnect(struct sock *sk, int flags);
 extern int         dccp_getsockopt(struct sock *sk, int level, int optname,
                                   char __user *optval, int __user *optlen);
 extern int         dccp_setsockopt(struct sock *sk, int level, int optname,
-                                   char __user *optval, int optlen);
+                                   char __user *optval, unsigned int optlen);
 #ifdef CONFIG_COMPAT
 extern int         compat_dccp_getsockopt(struct sock *sk,
                                int level, int optname,
                                char __user *optval, int __user *optlen);
 extern int         compat_dccp_setsockopt(struct sock *sk,
                                int level, int optname,
-                                char __user *optval, int optlen);
+                                char __user *optval, unsigned int optlen);
 #endif
 extern int         dccp_ioctl(struct sock *sk, int cmd, unsigned long arg);
 extern int         dccp_sendmsg(struct kiocb *iocb, struct sock *sk,
diff --git a/net/dccp/proto.c b/net/dccp/proto.c
index 923db06c7e55..a156319fd0ac 100644
--- a/net/dccp/proto.c
+++ b/net/dccp/proto.c
@@ -393,7 +393,7 @@ out:
 EXPORT_SYMBOL_GPL(dccp_ioctl);
 static int dccp_setsockopt_service(struct sock *sk, const __be32 service,
-                                   char __user *optval, int optlen)
+                                   char __user *optval, unsigned int optlen)
 {
        struct dccp_sock *dp = dccp_sk(sk);
        struct dccp_service_list *sl = NULL;
@@ -464,7 +464,7 @@ static int dccp_setsockopt_cscov(struct sock *sk, int cscov, bool rx)
 }
 static int dccp_setsockopt_ccid(struct sock *sk, int type,
-                                char __user *optval, int optlen)
+                                char __user *optval, unsigned int optlen)
 {
        u8 *val;
        int rc = 0;
@@ -494,7 +494,7 @@ static int dccp_setsockopt_ccid(struct sock *sk, int type,
 }
 static int do_dccp_setsockopt(struct sock *sk, int level, int optname,
-                char __user *optval, int optlen)
+                char __user *optval, unsigned int optlen)
 {
        struct dccp_sock *dp = dccp_sk(sk);
        int val, err = 0;
@@ -546,7 +546,7 @@ static int do_dccp_setsockopt(struct sock *sk, int level, int optname,
 }
 int dccp_setsockopt(struct sock *sk, int level, int optname,
-                    char __user *optval, int optlen)
+                    char __user *optval, unsigned int optlen)
 {
        if (level != SOL_DCCP)
                return inet_csk(sk)->icsk_af_ops->setsockopt(sk, level,
@@ -559,7 +559,7 @@ EXPORT_SYMBOL_GPL(dccp_setsockopt);
 #ifdef CONFIG_COMPAT
 int compat_dccp_setsockopt(struct sock *sk, int level, int optname,
-                           char __user *optval, int optlen)
+                           char __user *optval, unsigned int optlen)
 {
        if (level != SOL_DCCP)
                return inet_csk_compat_setsockopt(sk, level, optname,
@@ -1049,10 +1049,10 @@ static int __init dccp_init(void)
         *
         * The methodology is similar to that of the buffer cache.
         */
-        if (num_physpages >= (128 * 1024))
+        if (totalram_pages >= (128 * 1024))
-                goal = num_physpages >> (21 - PAGE_SHIFT);
+                goal = totalram_pages >> (21 - PAGE_SHIFT);
        else
-                goal = num_physpages >> (23 - PAGE_SHIFT);
+                goal = totalram_pages >> (23 - PAGE_SHIFT);
        if (thash_entries)
                goal = (thash_entries *
diff --git a/net/decnet/af_decnet.c b/net/decnet/af_decnet.c
index 77d40289653c..7a58c87baf17 100644
--- a/net/decnet/af_decnet.c
+++ b/net/decnet/af_decnet.c
@@ -157,7 +157,7 @@ static struct hlist_head dn_sk_hash[DN_SK_HASH_SIZE];
 static struct hlist_head dn_wild_sk;
 static atomic_t decnet_memory_allocated;
-static int __dn_setsockopt(struct socket *sock, int level, int optname, char __user *optval, int optlen, int flags);
+static int __dn_setsockopt(struct socket *sock, int level, int optname, char __user *optval, unsigned int optlen, int flags);
 static int __dn_getsockopt(struct socket *sock, int level, int optname, char __user *optval, int __user *optlen, int flags);
 static struct hlist_head *dn_find_list(struct sock *sk)
@@ -1325,7 +1325,7 @@ out:
        return err;
 }
-static int dn_setsockopt(struct socket *sock, int level, int optname, char __user *optval, int optlen)
+static int dn_setsockopt(struct socket *sock, int level, int optname, char __user *optval, unsigned int optlen)
 {
        struct sock *sk = sock->sk;
        int err;
@@ -1337,7 +1337,7 @@ static int dn_setsockopt(struct socket *sock, int level, int optname, char __use
        return err;
 }
-static int __dn_setsockopt(struct socket *sock, int level,int optname, char __user *optval, int optlen, int flags)
+static int __dn_setsockopt(struct socket *sock, int level,int optname, char __user *optval, unsigned int optlen, int flags)
 {
        struct  sock *sk = sock->sk;
        struct dn_scp *scp = DN_SK(sk);
diff --git a/net/decnet/dn_dev.c b/net/decnet/dn_dev.c
index 1c6a5bb6f0c8..6e1f085db06a 100644
--- a/net/decnet/dn_dev.c
+++ b/net/decnet/dn_dev.c
@@ -164,7 +164,7 @@ static int max_t3[] = { 8191 }; /* Must fit in 16 bits when multiplied by BCT3MU
 static int min_priority[1];
 static int max_priority[] = { 127 }; /* From DECnet spec */
-static int dn_forwarding_proc(ctl_table *, int, struct file *,
+static int dn_forwarding_proc(ctl_table *, int,
                        void __user *, size_t *, loff_t *);
 static int dn_forwarding_sysctl(ctl_table *table,
                        void __user *oldval, size_t __user *oldlenp,
@@ -274,7 +274,6 @@ static void dn_dev_sysctl_unregister(struct dn_dev_parms *parms)
 }
 static int dn_forwarding_proc(ctl_table *table, int write,
-                                struct file *filep,
                                void __user *buffer,
                                size_t *lenp, loff_t *ppos)
 {
@@ -290,7 +289,7 @@ static int dn_forwarding_proc(ctl_table *table, int write,
        dn_db = dev->dn_ptr;
        old = dn_db->parms.forwarding;
-        err = proc_dointvec(table, write, filep, buffer, lenp, ppos);
+        err = proc_dointvec(table, write, buffer, lenp, ppos);
        if ((err >= 0) && write) {
                if (dn_db->parms.forwarding < 0)
diff --git a/net/decnet/dn_route.c b/net/decnet/dn_route.c
index 9383d3e5a1ab..57662cabaf9b 100644
--- a/net/decnet/dn_route.c
+++ b/net/decnet/dn_route.c
@@ -1750,7 +1750,7 @@ void __init dn_route_init(void)
        dn_route_timer.expires = jiffies + decnet_dst_gc_interval * HZ;
        add_timer(&dn_route_timer);
-        goal = num_physpages >> (26 - PAGE_SHIFT);
+        goal = totalram_pages >> (26 - PAGE_SHIFT);
        for(order = 0; (1UL << order) < goal; order++)
                /* NOTHING */;
diff --git a/net/decnet/sysctl_net_decnet.c b/net/decnet/sysctl_net_decnet.c
index 5bcd592ae6dd..2036568beea9 100644
--- a/net/decnet/sysctl_net_decnet.c
+++ b/net/decnet/sysctl_net_decnet.c
@@ -165,7 +165,6 @@ static int dn_node_address_strategy(ctl_table *table,
 }
 static int dn_node_address_handler(ctl_table *table, int write,
-                                struct file *filp,
                                void __user *buffer,
                                size_t *lenp, loff_t *ppos)
 {
@@ -264,11 +263,10 @@ static int dn_def_dev_strategy(ctl_table *table,
                        return -ENODEV;
                rv = -ENODEV;
-                if (dev->dn_ptr != NULL) {
+                if (dev->dn_ptr != NULL)
                        rv = dn_dev_set_default(dev, 1);
-                        if (rv)
+                if (rv)
-                                dev_put(dev);
+                        dev_put(dev);
-                }
        }
        return rv;
@@ -276,7 +274,6 @@ static int dn_def_dev_strategy(ctl_table *table,
 static int dn_def_dev_handler(ctl_table *table, int write,
-                                struct file * filp,
                                void __user *buffer,
                                size_t *lenp, loff_t *ppos)
 {
diff --git a/net/ieee802154/dgram.c b/net/ieee802154/dgram.c
index 51593a48f2dd..a413b1bf4465 100644
--- a/net/ieee802154/dgram.c
+++ b/net/ieee802154/dgram.c
@@ -414,7 +414,7 @@ static int dgram_getsockopt(struct sock *sk, int level, int optname,
 }
 static int dgram_setsockopt(struct sock *sk, int level, int optname,
-                    char __user *optval, int optlen)
+                    char __user *optval, unsigned int optlen)
 {
        struct dgram_sock *ro = dgram_sk(sk);
        int val;
diff --git a/net/ieee802154/raw.c b/net/ieee802154/raw.c
index 13198859982e..30e74eee07d6 100644
--- a/net/ieee802154/raw.c
+++ b/net/ieee802154/raw.c
@@ -244,7 +244,7 @@ static int raw_getsockopt(struct sock *sk, int level, int optname,
 }
 static int raw_setsockopt(struct sock *sk, int level, int optname,
-                    char __user *optval, int optlen)
+                    char __user *optval, unsigned int optlen)
 {
        return -EOPNOTSUPP;
 }
diff --git a/net/ipv4/af_inet.c b/net/ipv4/af_inet.c
index 58c4b0f7c4aa..57737b8d1711 100644
--- a/net/ipv4/af_inet.c
+++ b/net/ipv4/af_inet.c
@@ -1119,6 +1119,7 @@ int inet_sk_rebuild_header(struct sock *sk)
 {
        struct flowi fl = {
                .oif = sk->sk_bound_dev_if,
+                .mark = sk->sk_mark,
                .nl_u = {
                        .ip4_u = {
                                .daddr  = daddr,
diff --git a/net/ipv4/devinet.c b/net/ipv4/devinet.c
index 07336c6201f0..5df2f6a0b0f0 100644
--- a/net/ipv4/devinet.c
+++ b/net/ipv4/devinet.c
@@ -1077,12 +1077,16 @@ static int inetdev_event(struct notifier_block *this, unsigned long event,
                ip_mc_up(in_dev);
                /* fall through */
        case NETDEV_CHANGEADDR:
-                if (IN_DEV_ARP_NOTIFY(in_dev))
+                /* Send gratuitous ARP to notify of link change */
-                        arp_send(ARPOP_REQUEST, ETH_P_ARP,
+                if (IN_DEV_ARP_NOTIFY(in_dev)) {
-                                 in_dev->ifa_list->ifa_address,
+                        struct in_ifaddr *ifa = in_dev->ifa_list;
-                                 dev,
-                                 in_dev->ifa_list->ifa_address,
+                        if (ifa)
-                                 NULL, dev->dev_addr, NULL);
+                                arp_send(ARPOP_REQUEST, ETH_P_ARP,
+                                         ifa->ifa_address, dev,
+                                         ifa->ifa_address, NULL,
+                                         dev->dev_addr, NULL);
+                }
                break;
        case NETDEV_DOWN:
                ip_mc_down(in_dev);
@@ -1270,10 +1274,10 @@ static void inet_forward_change(struct net *net)
 }
 static int devinet_conf_proc(ctl_table *ctl, int write,
-                             struct file *filp, void __user *buffer,
+                             void __user *buffer,
                             size_t *lenp, loff_t *ppos)
 {
-        int ret = proc_dointvec(ctl, write, filp, buffer, lenp, ppos);
+        int ret = proc_dointvec(ctl, write, buffer, lenp, ppos);
        if (write) {
                struct ipv4_devconf *cnf = ctl->extra1;
@@ -1342,12 +1346,12 @@ static int devinet_conf_sysctl(ctl_table *table,
 }
 static int devinet_sysctl_forward(ctl_table *ctl, int write,
-                                  struct file *filp, void __user *buffer,
+                                  void __user *buffer,
                                  size_t *lenp, loff_t *ppos)
 {
        int *valp = ctl->data;
        int val = *valp;
-        int ret = proc_dointvec(ctl, write, filp, buffer, lenp, ppos);
+        int ret = proc_dointvec(ctl, write, buffer, lenp, ppos);
        if (write && *valp != val) {
                struct net *net = ctl->extra2;
@@ -1372,12 +1376,12 @@ static int devinet_sysctl_forward(ctl_table *ctl, int write,
 }
 int ipv4_doint_and_flush(ctl_table *ctl, int write,
-                         struct file *filp, void __user *buffer,
+                         void __user *buffer,
                         size_t *lenp, loff_t *ppos)
 {
        int *valp = ctl->data;
        int val = *valp;
-        int ret = proc_dointvec(ctl, write, filp, buffer, lenp, ppos);
+        int ret = proc_dointvec(ctl, write, buffer, lenp, ppos);
        struct net *net = ctl->extra2;
        if (write && *valp != val)
diff --git a/net/ipv4/fib_frontend.c b/net/ipv4/fib_frontend.c
index e2f950592566..aa00398be80e 100644
--- a/net/ipv4/fib_frontend.c
+++ b/net/ipv4/fib_frontend.c
@@ -229,14 +229,17 @@ unsigned int inet_dev_addr_type(struct net *net, const struct net_device *dev,
 */
 int fib_validate_source(__be32 src, __be32 dst, u8 tos, int oif,
-                        struct net_device *dev, __be32 *spec_dst, u32 *itag)
+                        struct net_device *dev, __be32 *spec_dst,
+                        u32 *itag, u32 mark)
 {
        struct in_device *in_dev;
        struct flowi fl = { .nl_u = { .ip4_u =
                                      { .daddr = src,
                                        .saddr = dst,
                                        .tos = tos } },
+                            .mark = mark,
                            .iif = oif };
        struct fib_result res;
        int no_addr, rpf;
        int ret;
diff --git a/net/ipv4/inet_connection_sock.c b/net/ipv4/inet_connection_sock.c
index 22cd19ee44e5..537731b3bcb3 100644
--- a/net/ipv4/inet_connection_sock.c
+++ b/net/ipv4/inet_connection_sock.c
@@ -446,6 +446,28 @@ extern int sysctl_tcp_synack_retries;
 EXPORT_SYMBOL_GPL(inet_csk_reqsk_queue_hash_add);
+/* Decide when to expire the request and when to resend SYN-ACK */
+static inline void syn_ack_recalc(struct request_sock *req, const int thresh,
+                                  const int max_retries,
+                                  const u8 rskq_defer_accept,
+                                  int *expire, int *resend)
+{
+        if (!rskq_defer_accept) {
+                *expire = req->retrans >= thresh;
+                *resend = 1;
+                return;
+        }
+        *expire = req->retrans >= thresh &&
+                  (!inet_rsk(req)->acked || req->retrans >= max_retries);
+        /*
+         * Do not resend while waiting for data after ACK,
+         * start to resend on end of deferring period to give
+         * last chance for data or ACK to create established socket.
+         */
+        *resend = !inet_rsk(req)->acked ||
+                  req->retrans >= rskq_defer_accept - 1;
+}
 void inet_csk_reqsk_queue_prune(struct sock *parent,
                                const unsigned long interval,
                                const unsigned long timeout,
@@ -501,9 +523,15 @@ void inet_csk_reqsk_queue_prune(struct sock *parent,
                reqp=&lopt->syn_table[i];
                while ((req = *reqp) != NULL) {
                        if (time_after_eq(now, req->expires)) {
-                                if ((req->retrans < thresh ||
+                                int expire = 0, resend = 0;
-                                     (inet_rsk(req)->acked && req->retrans < max_retries))
-                                    && !req->rsk_ops->rtx_syn_ack(parent, req)) {
+                                syn_ack_recalc(req, thresh, max_retries,
+                                               queue->rskq_defer_accept,
+                                               &expire, &resend);
+                                if (!expire &&
+                                    (!resend ||
+                                     !req->rsk_ops->rtx_syn_ack(parent, req) ||
+                                     inet_rsk(req)->acked)) {
                                        unsigned long timeo;
                                        if (req->retrans++ == 0)
@@ -714,7 +742,7 @@ int inet_csk_compat_getsockopt(struct sock *sk, int level, int optname,
 EXPORT_SYMBOL_GPL(inet_csk_compat_getsockopt);
 int inet_csk_compat_setsockopt(struct sock *sk, int level, int optname,
-                               char __user *optval, int optlen)
+                               char __user *optval, unsigned int optlen)
 {
        const struct inet_connection_sock *icsk = inet_csk(sk);
diff --git a/net/ipv4/ip_fragment.c b/net/ipv4/ip_fragment.c
index 575f9bd51ccd..d3fe10be7219 100644
--- a/net/ipv4/ip_fragment.c
+++ b/net/ipv4/ip_fragment.c
@@ -563,7 +563,7 @@ out_oversize:
                printk(KERN_INFO "Oversized IP packet from %pI4.\n",
                        &qp->saddr);
 out_fail:
-        IP_INC_STATS_BH(dev_net(dev), IPSTATS_MIB_REASMFAILS);
+        IP_INC_STATS_BH(net, IPSTATS_MIB_REASMFAILS);
        return err;
 }
diff --git a/net/ipv4/ip_gre.c b/net/ipv4/ip_gre.c
index d9645c94a067..143333852624 100644
--- a/net/ipv4/ip_gre.c
+++ b/net/ipv4/ip_gre.c
@@ -66,10 +66,7 @@
   solution, but it supposes maintaing new variable in ALL
   skb, even if no tunneling is used.
-   Current solution: t->recursion lock breaks dead loops. It looks
+   Current solution: HARD_TX_LOCK lock breaks dead loops.
-   like dev->tbusy flag, but I preferred new variable, because
-   the semantics is different. One day, when hard_start_xmit
-   will be multithreaded we will have to use skb->encapsulation.
@@ -678,11 +675,6 @@ static netdev_tx_t ipgre_tunnel_xmit(struct sk_buff *skb, struct net_device *dev
        __be32 dst;
        int    mtu;
-        if (tunnel->recursion++) {
-                stats->collisions++;
-                goto tx_error;
-        }
        if (dev->type == ARPHRD_ETHER)
                IPCB(skb)->flags = 0;
@@ -820,7 +812,6 @@ static netdev_tx_t ipgre_tunnel_xmit(struct sk_buff *skb, struct net_device *dev
                        ip_rt_put(rt);
                        stats->tx_dropped++;
                        dev_kfree_skb(skb);
-                        tunnel->recursion--;
                        return NETDEV_TX_OK;
                }
                if (skb->sk)
@@ -888,7 +879,6 @@ static netdev_tx_t ipgre_tunnel_xmit(struct sk_buff *skb, struct net_device *dev
        nf_reset(skb);
        IPTUNNEL_XMIT();
-        tunnel->recursion--;
        return NETDEV_TX_OK;
 tx_error_icmp:
@@ -897,7 +887,6 @@ tx_error_icmp:
 tx_error:
        stats->tx_errors++;
        dev_kfree_skb(skb);
-        tunnel->recursion--;
        return NETDEV_TX_OK;
 }
@@ -1475,7 +1464,7 @@ static void ipgre_tap_setup(struct net_device *dev)
        ether_setup(dev);
-        dev->netdev_ops         = &ipgre_netdev_ops;
+        dev->netdev_ops         = &ipgre_tap_netdev_ops;
        dev->destructor         = free_netdev;
        dev->iflink             = 0;
@@ -1536,25 +1525,29 @@ static int ipgre_changelink(struct net_device *dev, struct nlattr *tb[],
                if (t->dev != dev)
                        return -EEXIST;
        } else {
-                unsigned nflags = 0;
                t = nt;
-                if (ipv4_is_multicast(p.iph.daddr))
+                if (dev->type != ARPHRD_ETHER) {
-                        nflags = IFF_BROADCAST;
+                        unsigned nflags = 0;
-                else if (p.iph.daddr)
-                        nflags = IFF_POINTOPOINT;
-                if ((dev->flags ^ nflags) &
+                        if (ipv4_is_multicast(p.iph.daddr))
-                    (IFF_POINTOPOINT | IFF_BROADCAST))
+                                nflags = IFF_BROADCAST;
-                        return -EINVAL;
+                        else if (p.iph.daddr)
+                                nflags = IFF_POINTOPOINT;
+                        if ((dev->flags ^ nflags) &
+                            (IFF_POINTOPOINT | IFF_BROADCAST))
+                                return -EINVAL;
+                }
                ipgre_tunnel_unlink(ign, t);
                t->parms.iph.saddr = p.iph.saddr;
                t->parms.iph.daddr = p.iph.daddr;
                t->parms.i_key = p.i_key;
-                memcpy(dev->dev_addr, &p.iph.saddr, 4);
+                if (dev->type != ARPHRD_ETHER) {
-                memcpy(dev->broadcast, &p.iph.daddr, 4);
+                        memcpy(dev->dev_addr, &p.iph.saddr, 4);
+                        memcpy(dev->broadcast, &p.iph.daddr, 4);
+                }
                ipgre_tunnel_link(ign, t);
                netdev_state_change(dev);
        }
diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c
index 9fe5d7b81580..f9895180f481 100644
--- a/net/ipv4/ip_output.c
+++ b/net/ipv4/ip_output.c
@@ -335,6 +335,7 @@ int ip_queue_xmit(struct sk_buff *skb, int ipfragok)
                {
                        struct flowi fl = { .oif = sk->sk_bound_dev_if,
+                                            .mark = sk->sk_mark,
                                            .nl_u = { .ip4_u =
                                                      { .daddr = daddr,
                                                        .saddr = inet->saddr,
diff --git a/net/ipv4/ip_sockglue.c b/net/ipv4/ip_sockglue.c
index fc7993e9061f..e982b5c1ee17 100644
--- a/net/ipv4/ip_sockglue.c
+++ b/net/ipv4/ip_sockglue.c
@@ -440,7 +440,7 @@ out:
 */
 static int do_ip_setsockopt(struct sock *sk, int level,
-                            int optname, char __user *optval, int optlen)
+                            int optname, char __user *optval, unsigned int optlen)
 {
        struct inet_sock *inet = inet_sk(sk);
        int val = 0, err;
@@ -611,6 +611,9 @@ static int do_ip_setsockopt(struct sock *sk, int level,
                 *      Check the arguments are allowable
                 */
+                if (optlen < sizeof(struct in_addr))
+                        goto e_inval;
                err = -EFAULT;
                if (optlen >= sizeof(struct ip_mreqn)) {
                        if (copy_from_user(&mreq, optval, sizeof(mreq)))
@@ -631,17 +634,16 @@ static int do_ip_setsockopt(struct sock *sk, int level,
                                break;
                        }
                        dev = ip_dev_find(sock_net(sk), mreq.imr_address.s_addr);
-                        if (dev) {
+                        if (dev)
                                mreq.imr_ifindex = dev->ifindex;
-                                dev_put(dev);
-                        }
                } else
-                        dev = __dev_get_by_index(sock_net(sk), mreq.imr_ifindex);
+                        dev = dev_get_by_index(sock_net(sk), mreq.imr_ifindex);
                err = -EADDRNOTAVAIL;
                if (!dev)
                        break;
+                dev_put(dev);
                err = -EINVAL;
                if (sk->sk_bound_dev_if &&
@@ -947,7 +949,7 @@ e_inval:
 }
 int ip_setsockopt(struct sock *sk, int level,
-                int optname, char __user *optval, int optlen)
+                int optname, char __user *optval, unsigned int optlen)
 {
        int err;
@@ -972,7 +974,7 @@ EXPORT_SYMBOL(ip_setsockopt);
 #ifdef CONFIG_COMPAT
 int compat_ip_setsockopt(struct sock *sk, int level, int optname,
-                         char __user *optval, int optlen)
+                         char __user *optval, unsigned int optlen)
 {
        int err;
diff --git a/net/ipv4/ipip.c b/net/ipv4/ipip.c
index 62548cb0923c..ae40ed1ba560 100644
--- a/net/ipv4/ipip.c
+++ b/net/ipv4/ipip.c
@@ -402,11 +402,6 @@ static netdev_tx_t ipip_tunnel_xmit(struct sk_buff *skb, struct net_device *dev)
        __be32 dst = tiph->daddr;
        int    mtu;
-        if (tunnel->recursion++) {
-                stats->collisions++;
-                goto tx_error;
-        }
        if (skb->protocol != htons(ETH_P_IP))
                goto tx_error;
@@ -443,25 +438,27 @@ static netdev_tx_t ipip_tunnel_xmit(struct sk_buff *skb, struct net_device *dev)
                goto tx_error;
        }
-        if (tiph->frag_off)
+        df |= old_iph->frag_off & htons(IP_DF);
+        if (df) {
                mtu = dst_mtu(&rt->u.dst) - sizeof(struct iphdr);
-        else
-                mtu = skb_dst(skb) ? dst_mtu(skb_dst(skb)) : dev->mtu;
-        if (mtu < 68) {
+                if (mtu < 68) {
-                stats->collisions++;
+                        stats->collisions++;
-                ip_rt_put(rt);
+                        ip_rt_put(rt);
-                goto tx_error;
+                        goto tx_error;
-        }
+                }
-        if (skb_dst(skb))
-                skb_dst(skb)->ops->update_pmtu(skb_dst(skb), mtu);
-        df |= (old_iph->frag_off&htons(IP_DF));
+                if (skb_dst(skb))
+                        skb_dst(skb)->ops->update_pmtu(skb_dst(skb), mtu);
-        if ((old_iph->frag_off&htons(IP_DF)) && mtu < ntohs(old_iph->tot_len)) {
+                if ((old_iph->frag_off & htons(IP_DF)) &&
-                icmp_send(skb, ICMP_DEST_UNREACH, ICMP_FRAG_NEEDED, htonl(mtu));
+                    mtu < ntohs(old_iph->tot_len)) {
-                ip_rt_put(rt);
+                        icmp_send(skb, ICMP_DEST_UNREACH, ICMP_FRAG_NEEDED,
-                goto tx_error;
+                                  htonl(mtu));
+                        ip_rt_put(rt);
+                        goto tx_error;
+                }
        }
        if (tunnel->err_count > 0) {
@@ -485,7 +482,6 @@ static netdev_tx_t ipip_tunnel_xmit(struct sk_buff *skb, struct net_device *dev)
                        ip_rt_put(rt);
                        stats->tx_dropped++;
                        dev_kfree_skb(skb);
-                        tunnel->recursion--;
                        return NETDEV_TX_OK;
                }
                if (skb->sk)
@@ -523,7 +519,6 @@ static netdev_tx_t ipip_tunnel_xmit(struct sk_buff *skb, struct net_device *dev)
        nf_reset(skb);
        IPTUNNEL_XMIT();
-        tunnel->recursion--;
        return NETDEV_TX_OK;
 tx_error_icmp:
@@ -531,7 +526,6 @@ tx_error_icmp:
 tx_error:
        stats->tx_errors++;
        dev_kfree_skb(skb);
-        tunnel->recursion--;
        return NETDEV_TX_OK;
 }
diff --git a/net/ipv4/ipmr.c b/net/ipv4/ipmr.c
index c43ec2d51ce2..99508d66a642 100644
--- a/net/ipv4/ipmr.c
+++ b/net/ipv4/ipmr.c
@@ -483,8 +483,10 @@ static int vif_add(struct net *net, struct vifctl *vifc, int mrtsock)
                return -EINVAL;
        }
-        if ((in_dev = __in_dev_get_rtnl(dev)) == NULL)
+        if ((in_dev = __in_dev_get_rtnl(dev)) == NULL) {
+                dev_put(dev);
                return -EADDRNOTAVAIL;
+        }
        IPV4_DEVCONF(in_dev->cnf, MC_FORWARDING)++;
        ip_rt_multicast_event(in_dev);
@@ -931,7 +933,7 @@ static void mrtsock_destruct(struct sock *sk)
 *      MOSPF/PIM router set up we can clean this up.
 */
-int ip_mroute_setsockopt(struct sock *sk, int optname, char __user *optval, int optlen)
+int ip_mroute_setsockopt(struct sock *sk, int optname, char __user *optval, unsigned int optlen)
 {
        int ret;
        struct vifctl vif;
diff --git a/net/ipv4/netfilter/nf_nat_core.c b/net/ipv4/netfilter/nf_nat_core.c
index 68afc6ecd343..fe1a64479dd0 100644
--- a/net/ipv4/netfilter/nf_nat_core.c
+++ b/net/ipv4/netfilter/nf_nat_core.c
@@ -750,6 +750,8 @@ static int __init nf_nat_init(void)
        BUG_ON(nfnetlink_parse_nat_setup_hook != NULL);
        rcu_assign_pointer(nfnetlink_parse_nat_setup_hook,
                           nfnetlink_parse_nat_setup);
+        BUG_ON(nf_ct_nat_offset != NULL);
+        rcu_assign_pointer(nf_ct_nat_offset, nf_nat_get_offset);
        return 0;
 cleanup_extend:
@@ -764,6 +766,7 @@ static void __exit nf_nat_cleanup(void)
        nf_ct_extend_unregister(&nat_extend);
        rcu_assign_pointer(nf_nat_seq_adjust_hook, NULL);
        rcu_assign_pointer(nfnetlink_parse_nat_setup_hook, NULL);
+        rcu_assign_pointer(nf_ct_nat_offset, NULL);
        synchronize_net();
 }
diff --git a/net/ipv4/netfilter/nf_nat_helper.c b/net/ipv4/netfilter/nf_nat_helper.c
index 09172a65d9b6..f9520fa3aba9 100644
--- a/net/ipv4/netfilter/nf_nat_helper.c
+++ b/net/ipv4/netfilter/nf_nat_helper.c
@@ -73,6 +73,28 @@ adjust_tcp_sequence(u32 seq,
        DUMP_OFFSET(this_way);
 }
+/* Get the offset value, for conntrack */
+s16 nf_nat_get_offset(const struct nf_conn *ct,
+                      enum ip_conntrack_dir dir,
+                      u32 seq)
+{
+        struct nf_conn_nat *nat = nfct_nat(ct);
+        struct nf_nat_seq *this_way;
+        s16 offset;
+        if (!nat)
+                return 0;
+        this_way = &nat->seq[dir];
+        spin_lock_bh(&nf_nat_seqofs_lock);
+        offset = after(seq, this_way->correction_pos)
+                 ? this_way->offset_after : this_way->offset_before;
+        spin_unlock_bh(&nf_nat_seqofs_lock);
+        return offset;
+}
+EXPORT_SYMBOL_GPL(nf_nat_get_offset);
 /* Frobs data inside this packet, which is linear. */
 static void mangle_contents(struct sk_buff *skb,
                            unsigned int dataoff,
@@ -189,11 +211,6 @@ nf_nat_mangle_tcp_packet(struct sk_buff *skb,
                adjust_tcp_sequence(ntohl(tcph->seq),
                                    (int)rep_len - (int)match_len,
                                    ct, ctinfo);
-                /* Tell TCP window tracking about seq change */
-                nf_conntrack_tcp_update(skb, ip_hdrlen(skb),
-                                        ct, CTINFO2DIR(ctinfo),
-                                        (int)rep_len - (int)match_len);
                nf_conntrack_event_cache(IPCT_NATSEQADJ, ct);
        }
        return 1;
@@ -415,12 +432,7 @@ nf_nat_seq_adjust(struct sk_buff *skb,
        tcph->seq = newseq;
        tcph->ack_seq = newack;
-        if (!nf_nat_sack_adjust(skb, tcph, ct, ctinfo))
+        return nf_nat_sack_adjust(skb, tcph, ct, ctinfo);
-                return 0;
-        nf_conntrack_tcp_update(skb, ip_hdrlen(skb), ct, dir, seqoff);
-        return 1;
 }
 /* Setup NAT on this expected conntrack so it follows master. */
diff --git a/net/ipv4/raw.c b/net/ipv4/raw.c
index ebb1e5848bc6..ab996f9c0fe0 100644
--- a/net/ipv4/raw.c
+++ b/net/ipv4/raw.c
@@ -352,13 +352,24 @@ static int raw_send_hdrinc(struct sock *sk, void *from, size_t length,
        skb->ip_summed = CHECKSUM_NONE;
        skb->transport_header = skb->network_header;
-        err = memcpy_fromiovecend((void *)iph, from, 0, length);
+        err = -EFAULT;
-        if (err)
+        if (memcpy_fromiovecend((void *)iph, from, 0, length))
-                goto error_fault;
+                goto error_free;
-        /* We don't modify invalid header */
        iphlen = iph->ihl * 4;
-        if (iphlen >= sizeof(*iph) && iphlen <= length) {
+        /*
+         * We don't want to modify the ip header, but we do need to
+         * be sure that it won't cause problems later along the network
+         * stack.  Specifically we want to make sure that iph->ihl is a
+         * sane value.  If ihl points beyond the length of the buffer passed
+         * in, reject the frame as invalid
+         */
+        err = -EINVAL;
+        if (iphlen > length)
+                goto error_free;
+        if (iphlen >= sizeof(*iph)) {
                if (!iph->saddr)
                        iph->saddr = rt->rt_src;
                iph->check   = 0;
@@ -381,8 +392,7 @@ static int raw_send_hdrinc(struct sock *sk, void *from, size_t length,
 out:
        return 0;
-error_fault:
+error_free:
-        err = -EFAULT;
        kfree_skb(skb);
 error:
        IP_INC_STATS(net, IPSTATS_MIB_OUTDISCARDS);
@@ -741,7 +751,7 @@ out:	return ret;
 }
 static int do_raw_setsockopt(struct sock *sk, int level, int optname,
-                          char __user *optval, int optlen)
+                          char __user *optval, unsigned int optlen)
 {
        if (optname == ICMP_FILTER) {
                if (inet_sk(sk)->num != IPPROTO_ICMP)
@@ -753,7 +763,7 @@ static int do_raw_setsockopt(struct sock *sk, int level, int optname,
 }
 static int raw_setsockopt(struct sock *sk, int level, int optname,
-                          char __user *optval, int optlen)
+                          char __user *optval, unsigned int optlen)
 {
        if (level != SOL_RAW)
                return ip_setsockopt(sk, level, optname, optval, optlen);
@@ -762,7 +772,7 @@ static int raw_setsockopt(struct sock *sk, int level, int optname,
 #ifdef CONFIG_COMPAT
 static int compat_raw_setsockopt(struct sock *sk, int level, int optname,
-                                 char __user *optval, int optlen)
+                                 char __user *optval, unsigned int optlen)
 {
        if (level != SOL_RAW)
                return compat_ip_setsockopt(sk, level, optname, optval, optlen);
diff --git a/net/ipv4/route.c b/net/ipv4/route.c
index 91867d3e6328..5b1050a5d874 100644
--- a/net/ipv4/route.c
+++ b/net/ipv4/route.c
@@ -1854,7 +1854,7 @@ static int ip_route_input_mc(struct sk_buff *skb, __be32 daddr, __be32 saddr,
                        goto e_inval;
                spec_dst = inet_select_addr(dev, 0, RT_SCOPE_LINK);
        } else if (fib_validate_source(saddr, 0, tos, 0,
-                                        dev, &spec_dst, &itag) < 0)
+                                        dev, &spec_dst, &itag, 0) < 0)
                goto e_inval;
        rth = dst_alloc(&ipv4_dst_ops);
@@ -1967,7 +1967,7 @@ static int __mkroute_input(struct sk_buff *skb,
        err = fib_validate_source(saddr, daddr, tos, FIB_RES_OIF(*res),
-                                  in_dev->dev, &spec_dst, &itag);
+                                  in_dev->dev, &spec_dst, &itag, skb->mark);
        if (err < 0) {
                ip_handle_martian_source(in_dev->dev, in_dev, skb, daddr,
                                         saddr);
@@ -2141,7 +2141,7 @@ static int ip_route_input_slow(struct sk_buff *skb, __be32 daddr, __be32 saddr,
                int result;
                result = fib_validate_source(saddr, daddr, tos,
                                             net->loopback_dev->ifindex,
-                                             dev, &spec_dst, &itag);
+                                             dev, &spec_dst, &itag, skb->mark);
                if (result < 0)
                        goto martian_source;
                if (result)
@@ -2170,7 +2170,7 @@ brd_input:
                spec_dst = inet_select_addr(dev, 0, RT_SCOPE_LINK);
        else {
                err = fib_validate_source(saddr, 0, tos, 0, dev, &spec_dst,
-                                          &itag);
+                                          &itag, skb->mark);
                if (err < 0)
                        goto martian_source;
                if (err)
@@ -3036,7 +3036,7 @@ void ip_rt_multicast_event(struct in_device *in_dev)
 #ifdef CONFIG_SYSCTL
 static int ipv4_sysctl_rtcache_flush(ctl_table *__ctl, int write,
-                                        struct file *filp, void __user *buffer,
+                                        void __user *buffer,
                                        size_t *lenp, loff_t *ppos)
 {
        if (write) {
@@ -3046,7 +3046,7 @@ static int ipv4_sysctl_rtcache_flush(ctl_table *__ctl, int write,
                memcpy(&ctl, __ctl, sizeof(ctl));
                ctl.data = &flush_delay;
-                proc_dointvec(&ctl, write, filp, buffer, lenp, ppos);
+                proc_dointvec(&ctl, write, buffer, lenp, ppos);
                net = (struct net *)__ctl->extra1;
                rt_cache_flush(net, flush_delay);
@@ -3106,12 +3106,11 @@ static void rt_secret_reschedule(int old)
 }
 static int ipv4_sysctl_rt_secret_interval(ctl_table *ctl, int write,
-                                          struct file *filp,
                                          void __user *buffer, size_t *lenp,
                                          loff_t *ppos)
 {
        int old = ip_rt_secret_interval;
-        int ret = proc_dointvec_jiffies(ctl, write, filp, buffer, lenp, ppos);
+        int ret = proc_dointvec_jiffies(ctl, write, buffer, lenp, ppos);
        rt_secret_reschedule(old);
@@ -3414,7 +3413,7 @@ int __init ip_rt_init(void)
                alloc_large_system_hash("IP route cache",
                                        sizeof(struct rt_hash_bucket),
                                        rhash_entries,
-                                        (num_physpages >= 128 * 1024) ?
+                                        (totalram_pages >= 128 * 1024) ?
                                        15 : 17,
                                        0,
                                        &rt_hash_log,
diff --git a/net/ipv4/sysctl_net_ipv4.c b/net/ipv4/sysctl_net_ipv4.c
index 4710d219f06a..2dcf04d9b005 100644
--- a/net/ipv4/sysctl_net_ipv4.c
+++ b/net/ipv4/sysctl_net_ipv4.c
@@ -36,7 +36,7 @@ static void set_local_port_range(int range[2])
 }
 /* Validate changes from /proc interface. */
-static int ipv4_local_port_range(ctl_table *table, int write, struct file *filp,
+static int ipv4_local_port_range(ctl_table *table, int write,
                                 void __user *buffer,
                                 size_t *lenp, loff_t *ppos)
 {
@@ -51,7 +51,7 @@ static int ipv4_local_port_range(ctl_table *table, int write, struct file *filp,
        };
        inet_get_local_port_range(range, range + 1);
-        ret = proc_dointvec_minmax(&tmp, write, filp, buffer, lenp, ppos);
+        ret = proc_dointvec_minmax(&tmp, write, buffer, lenp, ppos);
        if (write && ret == 0) {
                if (range[1] < range[0])
@@ -91,7 +91,7 @@ static int ipv4_sysctl_local_port_range(ctl_table *table,
 }
-static int proc_tcp_congestion_control(ctl_table *ctl, int write, struct file * filp,
+static int proc_tcp_congestion_control(ctl_table *ctl, int write,
                                       void __user *buffer, size_t *lenp, loff_t *ppos)
 {
        char val[TCP_CA_NAME_MAX];
@@ -103,7 +103,7 @@ static int proc_tcp_congestion_control(ctl_table *ctl, int write, struct file *
        tcp_get_default_congestion_control(val);
-        ret = proc_dostring(&tbl, write, filp, buffer, lenp, ppos);
+        ret = proc_dostring(&tbl, write, buffer, lenp, ppos);
        if (write && ret == 0)
                ret = tcp_set_default_congestion_control(val);
        return ret;
@@ -129,7 +129,7 @@ static int sysctl_tcp_congestion_control(ctl_table *table,
 }
 static int proc_tcp_available_congestion_control(ctl_table *ctl,
-                                                 int write, struct file * filp,
+                                                 int write,
                                                 void __user *buffer, size_t *lenp,
                                                 loff_t *ppos)
 {
@@ -140,13 +140,13 @@ static int proc_tcp_available_congestion_control(ctl_table *ctl,
        if (!tbl.data)
                return -ENOMEM;
        tcp_get_available_congestion_control(tbl.data, TCP_CA_BUF_MAX);
-        ret = proc_dostring(&tbl, write, filp, buffer, lenp, ppos);
+        ret = proc_dostring(&tbl, write, buffer, lenp, ppos);
        kfree(tbl.data);
        return ret;
 }
 static int proc_allowed_congestion_control(ctl_table *ctl,
-                                           int write, struct file * filp,
+                                           int write,
                                           void __user *buffer, size_t *lenp,
                                           loff_t *ppos)
 {
@@ -158,7 +158,7 @@ static int proc_allowed_congestion_control(ctl_table *ctl,
                return -ENOMEM;
        tcp_get_allowed_congestion_control(tbl.data, tbl.maxlen);
-        ret = proc_dostring(&tbl, write, filp, buffer, lenp, ppos);
+        ret = proc_dostring(&tbl, write, buffer, lenp, ppos);
        if (write && ret == 0)
                ret = tcp_set_allowed_congestion_control(tbl.data);
        kfree(tbl.data);
diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
index 19a0612b8a20..f1813bc71088 100644
--- a/net/ipv4/tcp.c
+++ b/net/ipv4/tcp.c
@@ -326,6 +326,43 @@ void tcp_enter_memory_pressure(struct sock *sk)
 EXPORT_SYMBOL(tcp_enter_memory_pressure);
+/* Convert seconds to retransmits based on initial and max timeout */
+static u8 secs_to_retrans(int seconds, int timeout, int rto_max)
+{
+        u8 res = 0;
+        if (seconds > 0) {
+                int period = timeout;
+                res = 1;
+                while (seconds > period && res < 255) {
+                        res++;
+                        timeout <<= 1;
+                        if (timeout > rto_max)
+                                timeout = rto_max;
+                        period += timeout;
+                }
+        }
+        return res;
+}
+/* Convert retransmits to seconds based on initial and max timeout */
+static int retrans_to_secs(u8 retrans, int timeout, int rto_max)
+{
+        int period = 0;
+        if (retrans > 0) {
+                period = timeout;
+                while (--retrans) {
+                        timeout <<= 1;
+                        if (timeout > rto_max)
+                                timeout = rto_max;
+                        period += timeout;
+                }
+        }
+        return period;
+}
 /*
 *      Wait for a TCP event.
 *
@@ -580,7 +617,7 @@ ssize_t tcp_splice_read(struct socket *sock, loff_t *ppos,
        lock_sock(sk);
-        timeo = sock_rcvtimeo(sk, flags & SPLICE_F_NONBLOCK);
+        timeo = sock_rcvtimeo(sk, sock->file->f_flags & O_NONBLOCK);
        while (tss.len) {
                ret = __tcp_splice_read(sk, &tss);
                if (ret < 0)
@@ -1146,7 +1183,9 @@ void tcp_cleanup_rbuf(struct sock *sk, int copied)
 #if TCP_DEBUG
        struct sk_buff *skb = skb_peek(&sk->sk_receive_queue);
-        WARN_ON(skb && !before(tp->copied_seq, TCP_SKB_CB(skb)->end_seq));
+        WARN(skb && !before(tp->copied_seq, TCP_SKB_CB(skb)->end_seq),
+             KERN_INFO "cleanup rbuf bug: copied %X seq %X rcvnxt %X\n",
+             tp->copied_seq, TCP_SKB_CB(skb)->end_seq, tp->rcv_nxt);
 #endif
        if (inet_csk_ack_scheduled(sk)) {
@@ -1393,11 +1432,13 @@ int tcp_recvmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
                        /* Now that we have two receive queues this
                         * shouldn't happen.
                         */
-                        if (before(*seq, TCP_SKB_CB(skb)->seq)) {
+                        if (WARN(before(*seq, TCP_SKB_CB(skb)->seq),
-                                printk(KERN_INFO "recvmsg bug: copied %X "
+                             KERN_INFO "recvmsg bug: copied %X "
-                                       "seq %X\n", *seq, TCP_SKB_CB(skb)->seq);
+                                       "seq %X rcvnxt %X fl %X\n", *seq,
+                                       TCP_SKB_CB(skb)->seq, tp->rcv_nxt,
+                                       flags))
                                break;
-                        }
                        offset = *seq - TCP_SKB_CB(skb)->seq;
                        if (tcp_hdr(skb)->syn)
                                offset--;
@@ -1405,7 +1446,10 @@ int tcp_recvmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
                                goto found_ok_skb;
                        if (tcp_hdr(skb)->fin)
                                goto found_fin_ok;
-                        WARN_ON(!(flags & MSG_PEEK));
+                        WARN(!(flags & MSG_PEEK), KERN_INFO "recvmsg bug 2: "
+                                        "copied %X seq %X rcvnxt %X fl %X\n",
+                                        *seq, TCP_SKB_CB(skb)->seq,
+                                        tp->rcv_nxt, flags);
                }
                /* Well, if we have backlog, try to process it now yet. */
@@ -2032,7 +2076,7 @@ int tcp_disconnect(struct sock *sk, int flags)
 *      Socket option code for TCP.
 */
 static int do_tcp_setsockopt(struct sock *sk, int level,
-                int optname, char __user *optval, int optlen)
+                int optname, char __user *optval, unsigned int optlen)
 {
        struct tcp_sock *tp = tcp_sk(sk);
        struct inet_connection_sock *icsk = inet_csk(sk);
@@ -2047,7 +2091,7 @@ static int do_tcp_setsockopt(struct sock *sk, int level,
                        return -EINVAL;
                val = strncpy_from_user(name, optval,
-                                        min(TCP_CA_NAME_MAX-1, optlen));
+                                        min_t(long, TCP_CA_NAME_MAX-1, optlen));
                if (val < 0)
                        return -EFAULT;
                name[val] = 0;
@@ -2163,16 +2207,10 @@ static int do_tcp_setsockopt(struct sock *sk, int level,
                break;
        case TCP_DEFER_ACCEPT:
-                icsk->icsk_accept_queue.rskq_defer_accept = 0;
+                /* Translate value in seconds to number of retransmits */
-                if (val > 0) {
+                icsk->icsk_accept_queue.rskq_defer_accept =
-                        /* Translate value in seconds to number of
+                        secs_to_retrans(val, TCP_TIMEOUT_INIT / HZ,
-                         * retransmits */
+                                        TCP_RTO_MAX / HZ);
-                        while (icsk->icsk_accept_queue.rskq_defer_accept < 32 &&
-                               val > ((TCP_TIMEOUT_INIT / HZ) <<
-                                       icsk->icsk_accept_queue.rskq_defer_accept))
-                                icsk->icsk_accept_queue.rskq_defer_accept++;
-                        icsk->icsk_accept_queue.rskq_defer_accept++;
-                }
                break;
        case TCP_WINDOW_CLAMP:
@@ -2220,7 +2258,7 @@ static int do_tcp_setsockopt(struct sock *sk, int level,
 }
 int tcp_setsockopt(struct sock *sk, int level, int optname, char __user *optval,
-                   int optlen)
+                   unsigned int optlen)
 {
        struct inet_connection_sock *icsk = inet_csk(sk);
@@ -2232,7 +2270,7 @@ int tcp_setsockopt(struct sock *sk, int level, int optname, char __user *optval,
 #ifdef CONFIG_COMPAT
 int compat_tcp_setsockopt(struct sock *sk, int level, int optname,
-                          char __user *optval, int optlen)
+                          char __user *optval, unsigned int optlen)
 {
        if (level != SOL_TCP)
                return inet_csk_compat_setsockopt(sk, level, optname,
@@ -2353,8 +2391,8 @@ static int do_tcp_getsockopt(struct sock *sk, int level,
                        val = (val ? : sysctl_tcp_fin_timeout) / HZ;
                break;
        case TCP_DEFER_ACCEPT:
-                val = !icsk->icsk_accept_queue.rskq_defer_accept ? 0 :
+                val = retrans_to_secs(icsk->icsk_accept_queue.rskq_defer_accept,
-                        ((TCP_TIMEOUT_INIT / HZ) << (icsk->icsk_accept_queue.rskq_defer_accept - 1));
+                                      TCP_TIMEOUT_INIT / HZ, TCP_RTO_MAX / HZ);
                break;
        case TCP_WINDOW_CLAMP:
                val = tp->window_clamp;
@@ -2862,7 +2900,7 @@ void __init tcp_init(void)
                alloc_large_system_hash("TCP established",
                                        sizeof(struct inet_ehash_bucket),
                                        thash_entries,
-                                        (num_physpages >= 128 * 1024) ?
+                                        (totalram_pages >= 128 * 1024) ?
                                        13 : 15,
                                        0,
                                        &tcp_hashinfo.ehash_size,
@@ -2879,7 +2917,7 @@ void __init tcp_init(void)
                alloc_large_system_hash("TCP bind",
                                        sizeof(struct inet_bind_hashbucket),
                                        tcp_hashinfo.ehash_size,
-                                        (num_physpages >= 128 * 1024) ?
+                                        (totalram_pages >= 128 * 1024) ?
                                        13 : 15,
                                        0,
                                        &tcp_hashinfo.bhash_size,
diff --git a/net/ipv4/tcp_minisocks.c b/net/ipv4/tcp_minisocks.c
index 624c3c9b3c2b..4c03598ed924 100644
--- a/net/ipv4/tcp_minisocks.c
+++ b/net/ipv4/tcp_minisocks.c
@@ -641,8 +641,8 @@ struct sock *tcp_check_req(struct sock *sk, struct sk_buff *skb,
        if (!(flg & TCP_FLAG_ACK))
                return NULL;
-        /* If TCP_DEFER_ACCEPT is set, drop bare ACK. */
+        /* While TCP_DEFER_ACCEPT is active, drop bare ACK. */
-        if (inet_csk(sk)->icsk_accept_queue.rskq_defer_accept &&
+        if (req->retrans < inet_csk(sk)->icsk_accept_queue.rskq_defer_accept &&
            TCP_SKB_CB(skb)->end_seq == tcp_rsk(req)->rcv_isn + 1) {
                inet_rsk(req)->acked = 1;
                return NULL;
diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
index 5200aab0ca97..fcd278a7080e 100644
--- a/net/ipv4/tcp_output.c
+++ b/net/ipv4/tcp_output.c
@@ -361,6 +361,7 @@ static inline int tcp_urg_mode(const struct tcp_sock *tp)
 #define OPTION_SACK_ADVERTISE   (1 << 0)
 #define OPTION_TS               (1 << 1)
 #define OPTION_MD5              (1 << 2)
+#define OPTION_WSCALE           (1 << 3)
 struct tcp_out_options {
        u8 options;             /* bit field of OPTION_* */
@@ -427,7 +428,7 @@ static void tcp_options_write(__be32 *ptr, struct tcp_sock *tp,
                               TCPOLEN_SACK_PERM);
        }
-        if (unlikely(opts->ws)) {
+        if (unlikely(OPTION_WSCALE & opts->options)) {
                *ptr++ = htonl((TCPOPT_NOP << 24) |
                               (TCPOPT_WINDOW << 16) |
                               (TCPOLEN_WINDOW << 8) |
@@ -494,8 +495,8 @@ static unsigned tcp_syn_options(struct sock *sk, struct sk_buff *skb,
        }
        if (likely(sysctl_tcp_window_scaling)) {
                opts->ws = tp->rx_opt.rcv_wscale;
-                if (likely(opts->ws))
+                opts->options |= OPTION_WSCALE;
-                        size += TCPOLEN_WSCALE_ALIGNED;
+                size += TCPOLEN_WSCALE_ALIGNED;
        }
        if (likely(sysctl_tcp_sack)) {
                opts->options |= OPTION_SACK_ADVERTISE;
@@ -537,8 +538,8 @@ static unsigned tcp_synack_options(struct sock *sk,
        if (likely(ireq->wscale_ok)) {
                opts->ws = ireq->rcv_wscale;
-                if (likely(opts->ws))
+                opts->options |= OPTION_WSCALE;
-                        size += TCPOLEN_WSCALE_ALIGNED;
+                size += TCPOLEN_WSCALE_ALIGNED;
        }
        if (likely(doing_ts)) {
                opts->options |= OPTION_TS;
diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
index ebaaa7f973d7..0fa9f70e4b19 100644
--- a/net/ipv4/udp.c
+++ b/net/ipv4/udp.c
@@ -696,6 +696,7 @@ int udp_sendmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
        if (rt == NULL) {
                struct flowi fl = { .oif = ipc.oif,
+                                    .mark = sk->sk_mark,
                                    .nl_u = { .ip4_u =
                                              { .daddr = faddr,
                                                .saddr = saddr,
@@ -840,6 +841,42 @@ out:
        return ret;
 }
+/**
+ *      first_packet_length     - return length of first packet in receive queue
+ *      @sk: socket
+ *
+ *      Drops all bad checksum frames, until a valid one is found.
+ *      Returns the length of found skb, or 0 if none is found.
+ */
+static unsigned int first_packet_length(struct sock *sk)
+{
+        struct sk_buff_head list_kill, *rcvq = &sk->sk_receive_queue;
+        struct sk_buff *skb;
+        unsigned int res;
+        __skb_queue_head_init(&list_kill);
+        spin_lock_bh(&rcvq->lock);
+        while ((skb = skb_peek(rcvq)) != NULL &&
+                udp_lib_checksum_complete(skb)) {
+                UDP_INC_STATS_BH(sock_net(sk), UDP_MIB_INERRORS,
+                                 IS_UDPLITE(sk));
+                __skb_unlink(skb, rcvq);
+                __skb_queue_tail(&list_kill, skb);
+        }
+        res = skb ? skb->len : 0;
+        spin_unlock_bh(&rcvq->lock);
+        if (!skb_queue_empty(&list_kill)) {
+                lock_sock(sk);
+                __skb_queue_purge(&list_kill);
+                sk_mem_reclaim_partial(sk);
+                release_sock(sk);
+        }
+        return res;
+}
 /*
 *      IOCTL requests applicable to the UDP protocol
 */
@@ -856,21 +893,16 @@ int udp_ioctl(struct sock *sk, int cmd, unsigned long arg)
        case SIOCINQ:
        {
-                struct sk_buff *skb;
+                unsigned int amount = first_packet_length(sk);
-                unsigned long amount;
-                amount = 0;
+                if (amount)
-                spin_lock_bh(&sk->sk_receive_queue.lock);
-                skb = skb_peek(&sk->sk_receive_queue);
-                if (skb != NULL) {
                        /*
                         * We will only return the amount
                         * of this packet since that is all
                         * that will be read.
                         */
-                        amount = skb->len - sizeof(struct udphdr);
+                        amount -= sizeof(struct udphdr);
-                }
-                spin_unlock_bh(&sk->sk_receive_queue.lock);
                return put_user(amount, (int __user *)arg);
        }
@@ -967,9 +999,7 @@ try_again:
                err = ulen;
 out_free:
-        lock_sock(sk);
+        skb_free_datagram_locked(sk, skb);
-        skb_free_datagram(sk, skb);
-        release_sock(sk);
 out:
        return err;
@@ -1359,7 +1389,7 @@ void udp_destroy_sock(struct sock *sk)
 *      Socket option code for UDP
 */
 int udp_lib_setsockopt(struct sock *sk, int level, int optname,
-                       char __user *optval, int optlen,
+                       char __user *optval, unsigned int optlen,
                       int (*push_pending_frames)(struct sock *))
 {
        struct udp_sock *up = udp_sk(sk);
@@ -1441,7 +1471,7 @@ int udp_lib_setsockopt(struct sock *sk, int level, int optname,
 EXPORT_SYMBOL(udp_lib_setsockopt);
 int udp_setsockopt(struct sock *sk, int level, int optname,
-                   char __user *optval, int optlen)
+                   char __user *optval, unsigned int optlen)
 {
        if (level == SOL_UDP  ||  level == SOL_UDPLITE)
                return udp_lib_setsockopt(sk, level, optname, optval, optlen,
@@ -1451,7 +1481,7 @@ int udp_setsockopt(struct sock *sk, int level, int optname,
 #ifdef CONFIG_COMPAT
 int compat_udp_setsockopt(struct sock *sk, int level, int optname,
-                          char __user *optval, int optlen)
+                          char __user *optval, unsigned int optlen)
 {
        if (level == SOL_UDP  ||  level == SOL_UDPLITE)
                return udp_lib_setsockopt(sk, level, optname, optval, optlen,
@@ -1539,29 +1569,11 @@ unsigned int udp_poll(struct file *file, struct socket *sock, poll_table *wait)
 {
        unsigned int mask = datagram_poll(file, sock, wait);
        struct sock *sk = sock->sk;
-        int     is_lite = IS_UDPLITE(sk);
        /* Check for false positives due to checksum errors */
-        if ((mask & POLLRDNORM) &&
+        if ((mask & POLLRDNORM) && !(file->f_flags & O_NONBLOCK) &&
-            !(file->f_flags & O_NONBLOCK) &&
+            !(sk->sk_shutdown & RCV_SHUTDOWN) && !first_packet_length(sk))
-            !(sk->sk_shutdown & RCV_SHUTDOWN)) {
+                mask &= ~(POLLIN | POLLRDNORM);
-                struct sk_buff_head *rcvq = &sk->sk_receive_queue;
-                struct sk_buff *skb;
-                spin_lock_bh(&rcvq->lock);
-                while ((skb = skb_peek(rcvq)) != NULL &&
-                       udp_lib_checksum_complete(skb)) {
-                        UDP_INC_STATS_BH(sock_net(sk),
-                                        UDP_MIB_INERRORS, is_lite);
-                        __skb_unlink(skb, rcvq);
-                        kfree_skb(skb);
-                }
-                spin_unlock_bh(&rcvq->lock);
-                /* nothing to see, move along */
-                if (skb == NULL)
-                        mask &= ~(POLLIN | POLLRDNORM);
-        }
        return mask;
diff --git a/net/ipv4/udp_impl.h b/net/ipv4/udp_impl.h
index 9f4a6165f722..aaad650d47d9 100644
--- a/net/ipv4/udp_impl.h
+++ b/net/ipv4/udp_impl.h
@@ -11,13 +11,13 @@ extern void 	__udp4_lib_err(struct sk_buff *, u32, struct udp_table *);
 extern int      udp_v4_get_port(struct sock *sk, unsigned short snum);
 extern int      udp_setsockopt(struct sock *sk, int level, int optname,
-                               char __user *optval, int optlen);
+                               char __user *optval, unsigned int optlen);
 extern int      udp_getsockopt(struct sock *sk, int level, int optname,
                               char __user *optval, int __user *optlen);
 #ifdef CONFIG_COMPAT
 extern int      compat_udp_setsockopt(struct sock *sk, int level, int optname,
-                                      char __user *optval, int optlen);
+                                      char __user *optval, unsigned int optlen);
 extern int      compat_udp_getsockopt(struct sock *sk, int level, int optname,
                                      char __user *optval, int __user *optlen);
 #endif
diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index 55f486d89c88..1fd0a3d775d2 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -3986,14 +3986,14 @@ static void ipv6_ifa_notify(int event, struct inet6_ifaddr *ifp)
 #ifdef CONFIG_SYSCTL
 static
-int addrconf_sysctl_forward(ctl_table *ctl, int write, struct file * filp,
+int addrconf_sysctl_forward(ctl_table *ctl, int write,
                           void __user *buffer, size_t *lenp, loff_t *ppos)
 {
        int *valp = ctl->data;
        int val = *valp;
        int ret;
-        ret = proc_dointvec(ctl, write, filp, buffer, lenp, ppos);
+        ret = proc_dointvec(ctl, write, buffer, lenp, ppos);
        if (write)
                ret = addrconf_fixup_forwarding(ctl, valp, val);
@@ -4090,14 +4090,14 @@ static int addrconf_disable_ipv6(struct ctl_table *table, int *p, int old)
 }
 static
-int addrconf_sysctl_disable(ctl_table *ctl, int write, struct file * filp,
+int addrconf_sysctl_disable(ctl_table *ctl, int write,
                            void __user *buffer, size_t *lenp, loff_t *ppos)
 {
        int *valp = ctl->data;
        int val = *valp;
        int ret;
-        ret = proc_dointvec(ctl, write, filp, buffer, lenp, ppos);
+        ret = proc_dointvec(ctl, write, buffer, lenp, ppos);
        if (write)
                ret = addrconf_disable_ipv6(ctl, valp, val);
diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c
index 7d25bbe32110..c595bbe1ed99 100644
--- a/net/ipv6/ip6_tunnel.c
+++ b/net/ipv6/ip6_tunnel.c
@@ -1043,11 +1043,6 @@ ip6_tnl_xmit(struct sk_buff *skb, struct net_device *dev)
        struct net_device_stats *stats = &t->dev->stats;
        int ret;
-        if (t->recursion++) {
-                stats->collisions++;
-                goto tx_err;
-        }
        switch (skb->protocol) {
        case htons(ETH_P_IP):
                ret = ip4ip6_tnl_xmit(skb, dev);
@@ -1062,14 +1057,12 @@ ip6_tnl_xmit(struct sk_buff *skb, struct net_device *dev)
        if (ret < 0)
                goto tx_err;
-        t->recursion--;
        return NETDEV_TX_OK;
 tx_err:
        stats->tx_errors++;
        stats->tx_dropped++;
        kfree_skb(skb);
-        t->recursion--;
        return NETDEV_TX_OK;
 }
diff --git a/net/ipv6/ip6mr.c b/net/ipv6/ip6mr.c
index 3907510c2ce3..716153941fc4 100644
--- a/net/ipv6/ip6mr.c
+++ b/net/ipv6/ip6mr.c
@@ -324,7 +324,7 @@ static int ipmr_mfc_seq_show(struct seq_file *seq, void *v)
        return 0;
 }
-static struct seq_operations ipmr_mfc_seq_ops = {
+static const struct seq_operations ipmr_mfc_seq_ops = {
        .start = ipmr_mfc_seq_start,
        .next  = ipmr_mfc_seq_next,
        .stop  = ipmr_mfc_seq_stop,
@@ -1281,7 +1281,7 @@ int ip6mr_sk_done(struct sock *sk)
 *      MOSPF/PIM router set up we can clean this up.
 */
-int ip6_mroute_setsockopt(struct sock *sk, int optname, char __user *optval, int optlen)
+int ip6_mroute_setsockopt(struct sock *sk, int optname, char __user *optval, unsigned int optlen)
 {
        int ret;
        struct mif6ctl vif;
diff --git a/net/ipv6/ipv6_sockglue.c b/net/ipv6/ipv6_sockglue.c
index f5e0682b402d..4f7aaf6996a3 100644
--- a/net/ipv6/ipv6_sockglue.c
+++ b/net/ipv6/ipv6_sockglue.c
@@ -123,7 +123,7 @@ struct ipv6_txoptions *ipv6_update_options(struct sock *sk,
 }
 static int do_ipv6_setsockopt(struct sock *sk, int level, int optname,
-                    char __user *optval, int optlen)
+                    char __user *optval, unsigned int optlen)
 {
        struct ipv6_pinfo *np = inet6_sk(sk);
        struct net *net = sock_net(sk);
@@ -496,13 +496,17 @@ done:
                        goto e_inval;
                if (val) {
+                        struct net_device *dev;
                        if (sk->sk_bound_dev_if && sk->sk_bound_dev_if != val)
                                goto e_inval;
-                        if (__dev_get_by_index(net, val) == NULL) {
+                        dev = dev_get_by_index(net, val);
+                        if (!dev) {
                                retv = -ENODEV;
                                break;
                        }
+                        dev_put(dev);
                }
                np->mcast_oif = val;
                retv = 0;
@@ -773,7 +777,7 @@ e_inval:
 }
 int ipv6_setsockopt(struct sock *sk, int level, int optname,
-                    char __user *optval, int optlen)
+                    char __user *optval, unsigned int optlen)
 {
        int err;
@@ -801,7 +805,7 @@ EXPORT_SYMBOL(ipv6_setsockopt);
 #ifdef CONFIG_COMPAT
 int compat_ipv6_setsockopt(struct sock *sk, int level, int optname,
-                           char __user *optval, int optlen)
+                           char __user *optval, unsigned int optlen)
 {
        int err;
diff --git a/net/ipv6/ndisc.c b/net/ipv6/ndisc.c
index 7015478797f6..f74e4e2cdd06 100644
--- a/net/ipv6/ndisc.c
+++ b/net/ipv6/ndisc.c
@@ -658,7 +658,6 @@ void ndisc_send_rs(struct net_device *dev, const struct in6_addr *saddr,
                     &icmp6h, NULL,
                     send_sllao ? ND_OPT_SOURCE_LL_ADDR : 0);
 }
-EXPORT_SYMBOL(ndisc_send_rs);
 static void ndisc_error_report(struct neighbour *neigh, struct sk_buff *skb)
@@ -1735,7 +1734,7 @@ static void ndisc_warn_deprecated_sysctl(struct ctl_table *ctl,
        }
 }
-int ndisc_ifinfo_sysctl_change(struct ctl_table *ctl, int write, struct file * filp, void __user *buffer, size_t *lenp, loff_t *ppos)
+int ndisc_ifinfo_sysctl_change(struct ctl_table *ctl, int write, void __user *buffer, size_t *lenp, loff_t *ppos)
 {
        struct net_device *dev = ctl->extra1;
        struct inet6_dev *idev;
@@ -1746,16 +1745,16 @@ int ndisc_ifinfo_sysctl_change(struct ctl_table *ctl, int write, struct file * f
                ndisc_warn_deprecated_sysctl(ctl, "syscall", dev ? dev->name : "default");
        if (strcmp(ctl->procname, "retrans_time") == 0)
-                ret = proc_dointvec(ctl, write, filp, buffer, lenp, ppos);
+                ret = proc_dointvec(ctl, write, buffer, lenp, ppos);
        else if (strcmp(ctl->procname, "base_reachable_time") == 0)
                ret = proc_dointvec_jiffies(ctl, write,
-                                            filp, buffer, lenp, ppos);
+                                            buffer, lenp, ppos);
        else if ((strcmp(ctl->procname, "retrans_time_ms") == 0) ||
                 (strcmp(ctl->procname, "base_reachable_time_ms") == 0))
                ret = proc_dointvec_ms_jiffies(ctl, write,
-                                               filp, buffer, lenp, ppos);
+                                               buffer, lenp, ppos);
        else
                ret = -1;
diff --git a/net/ipv6/raw.c b/net/ipv6/raw.c
index 7d675b8d82d3..4f24570b0869 100644
--- a/net/ipv6/raw.c
+++ b/net/ipv6/raw.c
@@ -957,7 +957,7 @@ static int rawv6_geticmpfilter(struct sock *sk, int level, int optname,
 static int do_rawv6_setsockopt(struct sock *sk, int level, int optname,
-                            char __user *optval, int optlen)
+                            char __user *optval, unsigned int optlen)
 {
        struct raw6_sock *rp = raw6_sk(sk);
        int val;
@@ -1000,7 +1000,7 @@ static int do_rawv6_setsockopt(struct sock *sk, int level, int optname,
 }
 static int rawv6_setsockopt(struct sock *sk, int level, int optname,
-                          char __user *optval, int optlen)
+                          char __user *optval, unsigned int optlen)
 {
        switch(level) {
                case SOL_RAW:
@@ -1024,7 +1024,7 @@ static int rawv6_setsockopt(struct sock *sk, int level, int optname,
 #ifdef CONFIG_COMPAT
 static int compat_rawv6_setsockopt(struct sock *sk, int level, int optname,
-                                   char __user *optval, int optlen)
+                                   char __user *optval, unsigned int optlen)
 {
        switch (level) {
        case SOL_RAW:
diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index 77aecbe8ff6c..d6fe7646a8ff 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -2524,13 +2524,13 @@ static const struct file_operations rt6_stats_seq_fops = {
 #ifdef CONFIG_SYSCTL
 static
-int ipv6_sysctl_rtcache_flush(ctl_table *ctl, int write, struct file * filp,
+int ipv6_sysctl_rtcache_flush(ctl_table *ctl, int write,
                              void __user *buffer, size_t *lenp, loff_t *ppos)
 {
        struct net *net = current->nsproxy->net_ns;
        int delay = net->ipv6.sysctl.flush_delay;
        if (write) {
-                proc_dointvec(ctl, write, filp, buffer, lenp, ppos);
+                proc_dointvec(ctl, write, buffer, lenp, ppos);
                fib6_run_gc(delay <= 0 ? ~0UL : (unsigned long)delay, net);
                return 0;
        } else
diff --git a/net/ipv6/sit.c b/net/ipv6/sit.c
index 0ae4f6448187..dbd19a78ca73 100644
--- a/net/ipv6/sit.c
+++ b/net/ipv6/sit.c
@@ -15,7 +15,6 @@
 * Roger Venning <r.venning@telstra.com>:       6to4 support
 * Nate Thompson <nate@thebog.net>:             6to4 support
 * Fred Templin <fred.l.templin@boeing.com>:    isatap support
- * Sascha Hlusiak <mail@saschahlusiak.de>:      stateless autoconf for isatap
 */
 #include <linux/module.h>
@@ -223,44 +222,6 @@ failed:
        return NULL;
 }
-static void ipip6_tunnel_rs_timer(unsigned long data)
-{
-        struct ip_tunnel_prl_entry *p = (struct ip_tunnel_prl_entry *) data;
-        struct inet6_dev *ifp;
-        struct inet6_ifaddr *addr;
-        spin_lock(&p->lock);
-        ifp = __in6_dev_get(p->tunnel->dev);
-        read_lock_bh(&ifp->lock);
-        for (addr = ifp->addr_list; addr; addr = addr->if_next) {
-                struct in6_addr rtr;
-                if (!(ipv6_addr_type(&addr->addr) & IPV6_ADDR_LINKLOCAL))
-                        continue;
-                /* Send RS to guessed linklocal address of router
-                 *
-                 * Better: send to ff02::2 encapsuled in unicast directly
-                 * to router-v4 instead of guessing the v6 address.
-                 *
-                 * Cisco/Windows seem to not set the u/l bit correctly,
-                 * so we won't guess right.
-                 */
-                ipv6_addr_set(&rtr,  htonl(0xFE800000), 0, 0, 0);
-                if (!__ipv6_isatap_ifid(rtr.s6_addr + 8,
-                                        p->addr)) {
-                        ndisc_send_rs(p->tunnel->dev, &addr->addr, &rtr);
-                }
-        }
-        read_unlock_bh(&ifp->lock);
-        mod_timer(&p->rs_timer, jiffies + HZ * p->rs_delay);
-        spin_unlock(&p->lock);
-        return;
-}
 static struct ip_tunnel_prl_entry *
 __ipip6_tunnel_locate_prl(struct ip_tunnel *t, __be32 addr)
 {
@@ -313,13 +274,12 @@ static int ipip6_tunnel_get_prl(struct ip_tunnel *t,
        c = 0;
        for (prl = t->prl; prl; prl = prl->next) {
-                if (c > cmax)
+                if (c >= cmax)
                        break;
                if (kprl.addr != htonl(INADDR_ANY) && prl->addr != kprl.addr)
                        continue;
                kp[c].addr = prl->addr;
                kp[c].flags = prl->flags;
-                kp[c].rs_delay = prl->rs_delay;
                c++;
                if (kprl.addr != htonl(INADDR_ANY))
                        break;
@@ -369,23 +329,11 @@ ipip6_tunnel_add_prl(struct ip_tunnel *t, struct ip_tunnel_prl *a, int chg)
        }
        p->next = t->prl;
-        p->tunnel = t;
        t->prl = p;
        t->prl_count++;
-        spin_lock_init(&p->lock);
-        setup_timer(&p->rs_timer, ipip6_tunnel_rs_timer, (unsigned long) p);
 update:
        p->addr = a->addr;
        p->flags = a->flags;
-        p->rs_delay = a->rs_delay;
-        if (p->rs_delay == 0)
-                p->rs_delay = IPTUNNEL_RS_DEFAULT_DELAY;
-        spin_lock(&p->lock);
-        del_timer(&p->rs_timer);
-        if (p->flags & PRL_DEFAULT)
-                mod_timer(&p->rs_timer, jiffies + 1);
-        spin_unlock(&p->lock);
 out:
        write_unlock(&ipip6_lock);
        return err;
@@ -404,9 +352,6 @@ ipip6_tunnel_del_prl(struct ip_tunnel *t, struct ip_tunnel_prl *a)
                        if ((*p)->addr == a->addr) {
                                x = *p;
                                *p = x->next;
-                                spin_lock(&x->lock);
-                                del_timer(&x->rs_timer);
-                                spin_unlock(&x->lock);
                                kfree(x);
                                t->prl_count--;
                                goto out;
@@ -417,9 +362,6 @@ ipip6_tunnel_del_prl(struct ip_tunnel *t, struct ip_tunnel_prl *a)
                while (t->prl) {
                        x = t->prl;
                        t->prl = t->prl->next;
-                        spin_lock(&x->lock);
-                        del_timer(&x->rs_timer);
-                        spin_unlock(&x->lock);
                        kfree(x);
                        t->prl_count--;
                }
@@ -626,11 +568,6 @@ static netdev_tx_t ipip6_tunnel_xmit(struct sk_buff *skb,
        struct in6_addr *addr6;
        int addr_type;
-        if (tunnel->recursion++) {
-                stats->collisions++;
-                goto tx_error;
-        }
        if (skb->protocol != htons(ETH_P_IPV6))
                goto tx_error;
@@ -753,7 +690,6 @@ static netdev_tx_t ipip6_tunnel_xmit(struct sk_buff *skb,
                        ip_rt_put(rt);
                        stats->tx_dropped++;
                        dev_kfree_skb(skb);
-                        tunnel->recursion--;
                        return NETDEV_TX_OK;
                }
                if (skb->sk)
@@ -794,7 +730,6 @@ static netdev_tx_t ipip6_tunnel_xmit(struct sk_buff *skb,
        nf_reset(skb);
        IPTUNNEL_XMIT();
-        tunnel->recursion--;
        return NETDEV_TX_OK;
 tx_error_icmp:
@@ -802,7 +737,6 @@ tx_error_icmp:
 tx_error:
        stats->tx_errors++;
        dev_kfree_skb(skb);
-        tunnel->recursion--;
        return NETDEV_TX_OK;
 }
diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c
index b265b7047d3e..cf538ed5ef6a 100644
--- a/net/ipv6/udp.c
+++ b/net/ipv6/udp.c
@@ -288,9 +288,7 @@ try_again:
                err = ulen;
 out_free:
-        lock_sock(sk);
+        skb_free_datagram_locked(sk, skb);
-        skb_free_datagram(sk, skb);
-        release_sock(sk);
 out:
        return err;
@@ -1044,7 +1042,7 @@ void udpv6_destroy_sock(struct sock *sk)
 *      Socket option code for UDP
 */
 int udpv6_setsockopt(struct sock *sk, int level, int optname,
-                     char __user *optval, int optlen)
+                     char __user *optval, unsigned int optlen)
 {
        if (level == SOL_UDP  ||  level == SOL_UDPLITE)
                return udp_lib_setsockopt(sk, level, optname, optval, optlen,
@@ -1054,7 +1052,7 @@ int udpv6_setsockopt(struct sock *sk, int level, int optname,
 #ifdef CONFIG_COMPAT
 int compat_udpv6_setsockopt(struct sock *sk, int level, int optname,
-                            char __user *optval, int optlen)
+                            char __user *optval, unsigned int optlen)
 {
        if (level == SOL_UDP  ||  level == SOL_UDPLITE)
                return udp_lib_setsockopt(sk, level, optname, optval, optlen,
diff --git a/net/ipv6/udp_impl.h b/net/ipv6/udp_impl.h
index 6bb303471e20..d7571046bfc4 100644
--- a/net/ipv6/udp_impl.h
+++ b/net/ipv6/udp_impl.h
@@ -16,10 +16,10 @@ extern int	udp_v6_get_port(struct sock *sk, unsigned short snum);
 extern int      udpv6_getsockopt(struct sock *sk, int level, int optname,
                                 char __user *optval, int __user *optlen);
 extern int      udpv6_setsockopt(struct sock *sk, int level, int optname,
-                                 char __user *optval, int optlen);
+                                 char __user *optval, unsigned int optlen);
 #ifdef CONFIG_COMPAT
 extern int      compat_udpv6_setsockopt(struct sock *sk, int level, int optname,
-                                        char __user *optval, int optlen);
+                                        char __user *optval, unsigned int optlen);
 extern int      compat_udpv6_getsockopt(struct sock *sk, int level, int optname,
                                       char __user *optval, int __user *optlen);
 #endif
diff --git a/net/ipx/af_ipx.c b/net/ipx/af_ipx.c
index f1118d92a191..66c7a20011f3 100644
--- a/net/ipx/af_ipx.c
+++ b/net/ipx/af_ipx.c
@@ -1292,7 +1292,7 @@ const char *ipx_device_name(struct ipx_interface *intrfc)
 * socket object. */
 static int ipx_setsockopt(struct socket *sock, int level, int optname,
-                          char __user *optval, int optlen)
+                          char __user *optval, unsigned int optlen)
 {
        struct sock *sk = sock->sk;
        int opt;
diff --git a/net/irda/af_irda.c b/net/irda/af_irda.c
index 50b43c57d5d8..dd35641835f4 100644
--- a/net/irda/af_irda.c
+++ b/net/irda/af_irda.c
@@ -1826,7 +1826,7 @@ static int irda_compat_ioctl(struct socket *sock, unsigned int cmd, unsigned lon
 *
 */
 static int irda_setsockopt(struct socket *sock, int level, int optname,
-                           char __user *optval, int optlen)
+                           char __user *optval, unsigned int optlen)
 {
        struct sock *sk = sock->sk;
        struct irda_sock *self = irda_sk(sk);
diff --git a/net/irda/ircomm/ircomm_tty_attach.c b/net/irda/ircomm/ircomm_tty_attach.c
index eafc010907c2..3c1754023022 100644
--- a/net/irda/ircomm/ircomm_tty_attach.c
+++ b/net/irda/ircomm/ircomm_tty_attach.c
@@ -30,6 +30,7 @@
 ********************************************************************/
 #include <linux/init.h>
+#include <linux/sched.h>
 #include <net/irda/irda.h>
 #include <net/irda/irlmp.h>
diff --git a/net/irda/irlan/irlan_common.c b/net/irda/irlan/irlan_common.c
index 62116829b817..315ead3cb926 100644
--- a/net/irda/irlan/irlan_common.c
+++ b/net/irda/irlan/irlan_common.c
@@ -30,6 +30,7 @@
 #include <linux/init.h>
 #include <linux/errno.h>
 #include <linux/proc_fs.h>
+#include <linux/sched.h>
 #include <linux/seq_file.h>
 #include <linux/random.h>
 #include <linux/netdevice.h>
diff --git a/net/irda/irlan/irlan_eth.c b/net/irda/irlan/irlan_eth.c
index 7b6b631f647f..d340110f5c0c 100644
--- a/net/irda/irlan/irlan_eth.c
+++ b/net/irda/irlan/irlan_eth.c
@@ -30,6 +30,7 @@
 #include <linux/inetdevice.h>
 #include <linux/if_arp.h>
 #include <linux/module.h>
+#include <linux/sched.h>
 #include <net/arp.h>
 #include <net/irda/irda.h>
diff --git a/net/irda/irnet/irnet_irda.c b/net/irda/irnet/irnet_irda.c
index cf9a4b531a98..cccc2e93234f 100644
--- a/net/irda/irnet/irnet_irda.c
+++ b/net/irda/irnet/irnet_irda.c
@@ -9,6 +9,7 @@
 */
 #include "irnet_irda.h"         /* Private header */
+#include <linux/sched.h>
 #include <linux/seq_file.h>
 #include <asm/unaligned.h>
diff --git a/net/irda/irnet/irnet_ppp.c b/net/irda/irnet/irnet_ppp.c
index 68cbcb19cbd8..7dea882dbb75 100644
--- a/net/irda/irnet/irnet_ppp.c
+++ b/net/irda/irnet/irnet_ppp.c
@@ -13,6 +13,7 @@
 *      2) as a control channel (write commands, read events)
 */
+#include <linux/sched.h>
 #include <linux/smp_lock.h>
 #include "irnet_ppp.h"          /* Private header */
 /* Please put other headers in irnet.h - Thanks */
diff --git a/net/irda/irsysctl.c b/net/irda/irsysctl.c
index 57f8817c3979..5c86567e5a78 100644
--- a/net/irda/irsysctl.c
+++ b/net/irda/irsysctl.c
@@ -73,12 +73,12 @@ static int min_lap_keepalive_time = 100;	/* 100us */
 /* For other sysctl, I've no idea of the range. Maybe Dag could help
 * us on that - Jean II */
-static int do_devname(ctl_table *table, int write, struct file *filp,
+static int do_devname(ctl_table *table, int write,
                      void __user *buffer, size_t *lenp, loff_t *ppos)
 {
        int ret;
-        ret = proc_dostring(table, write, filp, buffer, lenp, ppos);
+        ret = proc_dostring(table, write, buffer, lenp, ppos);
        if (ret == 0 && write) {
                struct ias_value *val;
@@ -90,12 +90,12 @@ static int do_devname(ctl_table *table, int write, struct file *filp,
 }
-static int do_discovery(ctl_table *table, int write, struct file *filp,
+static int do_discovery(ctl_table *table, int write,
                    void __user *buffer, size_t *lenp, loff_t *ppos)
 {
       int ret;
-       ret = proc_dointvec(table, write, filp, buffer, lenp, ppos);
+       ret = proc_dointvec(table, write, buffer, lenp, ppos);
       if (ret)
               return ret;
diff --git a/net/iucv/af_iucv.c b/net/iucv/af_iucv.c
index d985d163dcfc..bada1b9c670b 100644
--- a/net/iucv/af_iucv.c
+++ b/net/iucv/af_iucv.c
@@ -1387,7 +1387,7 @@ static int iucv_sock_release(struct socket *sock)
 /* getsockopt and setsockopt */
 static int iucv_sock_setsockopt(struct socket *sock, int level, int optname,
-                                char __user *optval, int optlen)
+                                char __user *optval, unsigned int optlen)
 {
        struct sock *sk = sock->sk;
        struct iucv_sock *iucv = iucv_sk(sk);
diff --git a/net/llc/af_llc.c b/net/llc/af_llc.c
index c45eee1c0e8d..7aa4fd170104 100644
--- a/net/llc/af_llc.c
+++ b/net/llc/af_llc.c
@@ -973,7 +973,7 @@ static int llc_ui_ioctl(struct socket *sock, unsigned int cmd,
 *      Set various connection specific parameters.
 */
 static int llc_ui_setsockopt(struct socket *sock, int level, int optname,
-                             char __user *optval, int optlen)
+                             char __user *optval, unsigned int optlen)
 {
        struct sock *sk = sock->sk;
        struct llc_sock *llc = llc_sk(sk);
diff --git a/net/mac80211/agg-tx.c b/net/mac80211/agg-tx.c
index bd765f30dba2..206fd82f0c76 100644
--- a/net/mac80211/agg-tx.c
+++ b/net/mac80211/agg-tx.c
@@ -173,12 +173,14 @@ static void sta_addba_resp_timer_expired(unsigned long data)
        /* check if the TID waits for addBA response */
        spin_lock_bh(&sta->lock);
-        if (!(*state & HT_ADDBA_REQUESTED_MSK)) {
+        if ((*state & (HT_ADDBA_REQUESTED_MSK | HT_ADDBA_RECEIVED_MSK)) !=
+                                                HT_ADDBA_REQUESTED_MSK) {
                spin_unlock_bh(&sta->lock);
                *state = HT_AGG_STATE_IDLE;
 #ifdef CONFIG_MAC80211_HT_DEBUG
                printk(KERN_DEBUG "timer expired on tid %d but we are not "
-                                "expecting addBA response there", tid);
+                                "(or no longer) expecting addBA response there",
+                        tid);
 #endif
                return;
        }
@@ -668,24 +670,23 @@ void ieee80211_process_addba_resp(struct ieee80211_local *local,
        spin_lock_bh(&sta->lock);
-        if (!(*state & HT_ADDBA_REQUESTED_MSK)) {
+        if (!(*state & HT_ADDBA_REQUESTED_MSK))
-                spin_unlock_bh(&sta->lock);
+                goto out;
-                return;
-        }
        if (mgmt->u.action.u.addba_resp.dialog_token !=
                sta->ampdu_mlme.tid_tx[tid]->dialog_token) {
-                spin_unlock_bh(&sta->lock);
 #ifdef CONFIG_MAC80211_HT_DEBUG
                printk(KERN_DEBUG "wrong addBA response token, tid %d\n", tid);
 #endif /* CONFIG_MAC80211_HT_DEBUG */
-                return;
+                goto out;
        }
-        del_timer_sync(&sta->ampdu_mlme.tid_tx[tid]->addba_resp_timer);
+        del_timer(&sta->ampdu_mlme.tid_tx[tid]->addba_resp_timer);
 #ifdef CONFIG_MAC80211_HT_DEBUG
        printk(KERN_DEBUG "switched off addBA timer for tid %d \n", tid);
 #endif /* CONFIG_MAC80211_HT_DEBUG */
        if (le16_to_cpu(mgmt->u.action.u.addba_resp.status)
                        == WLAN_STATUS_SUCCESS) {
                u8 curstate = *state;
@@ -699,5 +700,7 @@ void ieee80211_process_addba_resp(struct ieee80211_local *local,
        } else {
                ___ieee80211_stop_tx_ba_session(sta, tid, WLAN_BACK_INITIATOR);
        }
+ out:
        spin_unlock_bh(&sta->lock);
 }
diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c
index 5608f6c68413..7b5131bd6fa1 100644
--- a/net/mac80211/cfg.c
+++ b/net/mac80211/cfg.c
@@ -72,6 +72,9 @@ static int ieee80211_change_iface(struct wiphy *wiphy,
        struct ieee80211_sub_if_data *sdata;
        int ret;
+        if (netif_running(dev))
+                return -EBUSY;
        if (!nl80211_type_check(type))
                return -EINVAL;
@@ -81,9 +84,6 @@ static int ieee80211_change_iface(struct wiphy *wiphy,
        if (ret)
                return ret;
-        if (netif_running(sdata->dev))
-                return -EBUSY;
        if (ieee80211_vif_is_mesh(&sdata->vif) && params->mesh_id_len)
                ieee80211_sdata_set_mesh_id(sdata,
                                            params->mesh_id_len,
diff --git a/net/mac80211/ht.c b/net/mac80211/ht.c
index 0891bfb06996..48ef1a282b91 100644
--- a/net/mac80211/ht.c
+++ b/net/mac80211/ht.c
@@ -153,7 +153,7 @@ void ieee80211_process_delba(struct ieee80211_sub_if_data *sdata,
        if (net_ratelimit())
                printk(KERN_DEBUG "delba from %pM (%s) tid %d reason code %d\n",
                        mgmt->sa, initiator ? "initiator" : "recipient", tid,
-                        mgmt->u.action.u.delba.reason_code);
+                        le16_to_cpu(mgmt->u.action.u.delba.reason_code));
 #endif /* CONFIG_MAC80211_HT_DEBUG */
        if (initiator == WLAN_BACK_INITIATOR)
diff --git a/net/mac80211/ibss.c b/net/mac80211/ibss.c
index 920ec8792f4b..f1362f32c17d 100644
--- a/net/mac80211/ibss.c
+++ b/net/mac80211/ibss.c
@@ -73,6 +73,7 @@ static void __ieee80211_sta_join_ibss(struct ieee80211_sub_if_data *sdata,
        struct ieee80211_mgmt *mgmt;
        u8 *pos;
        struct ieee80211_supported_band *sband;
+        struct cfg80211_bss *bss;
        u32 bss_change;
        u8 supp_rates[IEEE80211_MAX_SUPP_RATES];
@@ -177,8 +178,9 @@ static void __ieee80211_sta_join_ibss(struct ieee80211_sub_if_data *sdata,
        mod_timer(&ifibss->timer,
                  round_jiffies(jiffies + IEEE80211_IBSS_MERGE_INTERVAL));
-        cfg80211_inform_bss_frame(local->hw.wiphy, local->hw.conf.channel,
+        bss = cfg80211_inform_bss_frame(local->hw.wiphy, local->hw.conf.channel,
-                                  mgmt, skb->len, 0, GFP_KERNEL);
+                                        mgmt, skb->len, 0, GFP_KERNEL);
+        cfg80211_put_bss(bss);
        cfg80211_ibss_joined(sdata->dev, ifibss->bssid, GFP_KERNEL);
 }
@@ -538,13 +540,12 @@ static void ieee80211_sta_find_ibss(struct ieee80211_sub_if_data *sdata)
                                       WLAN_CAPABILITY_PRIVACY,
                                       capability);
+        if (bss) {
 #ifdef CONFIG_MAC80211_IBSS_DEBUG
-        if (bss)
                printk(KERN_DEBUG "   sta_find_ibss: selected %pM current "
                       "%pM\n", bss->cbss.bssid, ifibss->bssid);
 #endif /* CONFIG_MAC80211_IBSS_DEBUG */
-        if (bss && memcmp(ifibss->bssid, bss->cbss.bssid, ETH_ALEN)) {
                printk(KERN_DEBUG "%s: Selected IBSS BSSID %pM"
                       " based on configured SSID\n",
                       sdata->dev->name, bss->cbss.bssid);
@@ -552,8 +553,7 @@ static void ieee80211_sta_find_ibss(struct ieee80211_sub_if_data *sdata)
                ieee80211_sta_join_ibss(sdata, bss);
                ieee80211_rx_bss_put(local, bss);
                return;
-        } else if (bss)
+        }
-                ieee80211_rx_bss_put(local, bss);
 #ifdef CONFIG_MAC80211_IBSS_DEBUG
        printk(KERN_DEBUG "   did not try to join ibss\n");
@@ -829,7 +829,7 @@ void ieee80211_ibss_notify_scan_completed(struct ieee80211_local *local)
                if (!sdata->u.ibss.ssid_len)
                        continue;
                sdata->u.ibss.last_scan_completed = jiffies;
-                ieee80211_sta_find_ibss(sdata);
+                mod_timer(&sdata->u.ibss.timer, 0);
        }
        mutex_unlock(&local->iflist_mtx);
 }
diff --git a/net/mac80211/ieee80211_i.h b/net/mac80211/ieee80211_i.h
index 588005c84a6d..a910bf1f092f 100644
--- a/net/mac80211/ieee80211_i.h
+++ b/net/mac80211/ieee80211_i.h
@@ -662,6 +662,14 @@ struct ieee80211_local {
        bool suspended;
        /*
+         * Resuming is true while suspended, but when we're reprogramming the
+         * hardware -- at that time it's allowed to use ieee80211_queue_work()
+         * again even though some other parts of the stack are still suspended
+         * and we still drop received frames to avoid waking the stack.
+         */
+        bool resuming;
+        /*
         * quiescing is true during the suspend process _only_ to
         * ease timer cancelling etc.
         */
diff --git a/net/mac80211/mesh_hwmp.c b/net/mac80211/mesh_hwmp.c
index e12a786e26b8..29b82e98effa 100644
--- a/net/mac80211/mesh_hwmp.c
+++ b/net/mac80211/mesh_hwmp.c
@@ -259,7 +259,7 @@ static u32 airtime_link_metric_get(struct ieee80211_local *local,
 * @hwmp_ie: hwmp information element (PREP or PREQ)
 *
 * This function updates the path routing information to the originator and the
- * transmitter of a HWMP PREQ or PREP fram.
+ * transmitter of a HWMP PREQ or PREP frame.
 *
 * Returns: metric to frame originator or 0 if the frame should not be further
 * processed
diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
index 97a278a2f48e..dc5049d58c51 100644
--- a/net/mac80211/mlme.c
+++ b/net/mac80211/mlme.c
@@ -1388,8 +1388,8 @@ ieee80211_rx_mgmt_disassoc(struct ieee80211_sub_if_data *sdata,
        reason_code = le16_to_cpu(mgmt->u.disassoc.reason_code);
-        printk(KERN_DEBUG "%s: disassociated (Reason: %u)\n",
+        printk(KERN_DEBUG "%s: disassociated from %pM (Reason: %u)\n",
-                        sdata->dev->name, reason_code);
+                        sdata->dev->name, mgmt->sa, reason_code);
        ieee80211_set_disassoc(sdata, false);
        return RX_MGMT_CFG80211_DISASSOC;
@@ -1457,8 +1457,7 @@ ieee80211_rx_mgmt_assoc_resp(struct ieee80211_sub_if_data *sdata,
        if (status_code != WLAN_STATUS_SUCCESS) {
                printk(KERN_DEBUG "%s: AP denied association (code=%d)\n",
                       sdata->dev->name, status_code);
-                list_del(&wk->list);
+                wk->state = IEEE80211_MGD_STATE_IDLE;
-                kfree(wk);
                return RX_MGMT_CFG80211_ASSOC;
        }
@@ -1675,7 +1674,7 @@ static void ieee80211_rx_mgmt_probe_resp(struct ieee80211_sub_if_data *sdata,
        /* direct probe may be part of the association flow */
        if (wk && wk->state == IEEE80211_MGD_STATE_PROBE) {
-                printk(KERN_DEBUG "%s direct probe responded\n",
+                printk(KERN_DEBUG "%s: direct probe responded\n",
                       sdata->dev->name);
                wk->tries = 0;
                wk->state = IEEE80211_MGD_STATE_AUTH;
@@ -2502,9 +2501,6 @@ int ieee80211_mgd_deauth(struct ieee80211_sub_if_data *sdata,
        struct ieee80211_mgd_work *wk;
        const u8 *bssid = NULL;
-        printk(KERN_DEBUG "%s: deauthenticating by local choice (reason=%d)\n",
-               sdata->dev->name, req->reason_code);
        mutex_lock(&ifmgd->mtx);
        if (ifmgd->associated && &ifmgd->associated->cbss == req->bss) {
@@ -2532,6 +2528,9 @@ int ieee80211_mgd_deauth(struct ieee80211_sub_if_data *sdata,
        mutex_unlock(&ifmgd->mtx);
+        printk(KERN_DEBUG "%s: deauthenticating from %pM by local choice (reason=%d)\n",
+               sdata->dev->name, bssid, req->reason_code);
        ieee80211_send_deauth_disassoc(sdata, bssid,
                        IEEE80211_STYPE_DEAUTH, req->reason_code,
                        cookie);
@@ -2545,9 +2544,6 @@ int ieee80211_mgd_disassoc(struct ieee80211_sub_if_data *sdata,
 {
        struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
-        printk(KERN_DEBUG "%s: disassociating by local choice (reason=%d)\n",
-               sdata->dev->name, req->reason_code);
        mutex_lock(&ifmgd->mtx);
        /*
@@ -2561,6 +2557,9 @@ int ieee80211_mgd_disassoc(struct ieee80211_sub_if_data *sdata,
                return -ENOLINK;
        }
+        printk(KERN_DEBUG "%s: disassociating from %pM by local choice (reason=%d)\n",
+               sdata->dev->name, req->bss->bssid, req->reason_code);
        ieee80211_set_disassoc(sdata, false);
        mutex_unlock(&ifmgd->mtx);
diff --git a/net/mac80211/rc80211_pid_debugfs.c b/net/mac80211/rc80211_pid_debugfs.c
index a59043fbb0ff..45667054a5f3 100644
--- a/net/mac80211/rc80211_pid_debugfs.c
+++ b/net/mac80211/rc80211_pid_debugfs.c
@@ -6,6 +6,7 @@
 * published by the Free Software Foundation.
 */
+#include <linux/sched.h>
 #include <linux/spinlock.h>
 #include <linux/poll.h>
 #include <linux/netdevice.h>
diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
index c01588f9d453..7170bf4565a8 100644
--- a/net/mac80211/rx.c
+++ b/net/mac80211/rx.c
@@ -2164,11 +2164,17 @@ static void __ieee80211_rx_handle_packet(struct ieee80211_hw *hw,
        skb = rx.skb;
-        list_for_each_entry_rcu(sdata, &local->interfaces, list) {
+        if (rx.sdata && ieee80211_is_data(hdr->frame_control)) {
+                rx.flags |= IEEE80211_RX_RA_MATCH;
+                prepares = prepare_for_handlers(rx.sdata, &rx, hdr);
+                if (prepares)
+                        prev = rx.sdata;
+        } else list_for_each_entry_rcu(sdata, &local->interfaces, list) {
                if (!netif_running(sdata->dev))
                        continue;
-                if (sdata->vif.type == NL80211_IFTYPE_MONITOR)
+                if (sdata->vif.type == NL80211_IFTYPE_MONITOR ||
+                    sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
                        continue;
                rx.flags |= IEEE80211_RX_RA_MATCH;
@@ -2447,6 +2453,8 @@ void ieee80211_rx(struct ieee80211_hw *hw, struct sk_buff *skb)
        struct ieee80211_supported_band *sband;
        struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
+        WARN_ON_ONCE(softirq_count() == 0);
        if (WARN_ON(status->band < 0 ||
                    status->band >= IEEE80211_NUM_BANDS))
                goto drop;
diff --git a/net/mac80211/scan.c b/net/mac80211/scan.c
index 039901109fa1..71e10cabf811 100644
--- a/net/mac80211/scan.c
+++ b/net/mac80211/scan.c
@@ -90,8 +90,8 @@ ieee80211_bss_info_update(struct ieee80211_local *local,
                bss->dtim_period = tim_ie->dtim_period;
        }
-        /* set default value for buggy APs */
+        /* set default value for buggy AP/no TIM element */
-        if (!elems->tim || bss->dtim_period == 0)
+        if (bss->dtim_period == 0)
                bss->dtim_period = 1;
        bss->supp_rates_len = 0;
diff --git a/net/mac80211/sta_info.c b/net/mac80211/sta_info.c
index eec001491e66..594f2318c3d8 100644
--- a/net/mac80211/sta_info.c
+++ b/net/mac80211/sta_info.c
@@ -361,6 +361,7 @@ int sta_info_insert(struct sta_info *sta)
                                             u.ap);
                drv_sta_notify(local, &sdata->vif, STA_NOTIFY_ADD, &sta->sta);
+                sdata = sta->sdata;
        }
 #ifdef CONFIG_MAC80211_VERBOSE_DEBUG
@@ -496,6 +497,7 @@ static void __sta_info_unlink(struct sta_info **sta)
                drv_sta_notify(local, &sdata->vif, STA_NOTIFY_REMOVE,
                               &(*sta)->sta);
+                sdata = (*sta)->sdata;
        }
        if (ieee80211_vif_is_mesh(&sdata->vif)) {
diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c
index 5143d203256b..eaa4118de988 100644
--- a/net/mac80211/tx.c
+++ b/net/mac80211/tx.c
@@ -367,7 +367,10 @@ ieee80211_tx_h_unicast_ps_buf(struct ieee80211_tx_data *tx)
        struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)tx->skb->data;
        u32 staflags;
-        if (unlikely(!sta || ieee80211_is_probe_resp(hdr->frame_control)))
+        if (unlikely(!sta || ieee80211_is_probe_resp(hdr->frame_control)
+                        || ieee80211_is_auth(hdr->frame_control)
+                        || ieee80211_is_assoc_resp(hdr->frame_control)
+                        || ieee80211_is_reassoc_resp(hdr->frame_control)))
                return TX_CONTINUE;
        staflags = get_sta_flags(sta);
@@ -1442,7 +1445,7 @@ static void ieee80211_xmit(struct ieee80211_sub_if_data *sdata,
                                if (tmp_sdata->vif.type != NL80211_IFTYPE_AP)
                                        continue;
                                if (compare_ether_addr(tmp_sdata->dev->dev_addr,
-                                                       hdr->addr2)) {
+                                                       hdr->addr2) == 0) {
                                        dev_hold(tmp_sdata->dev);
                                        dev_put(sdata->dev);
                                        sdata = tmp_sdata;
@@ -1701,7 +1704,8 @@ netdev_tx_t ieee80211_subif_start_xmit(struct sk_buff *skb,
        if (!is_multicast_ether_addr(hdr.addr1)) {
                rcu_read_lock();
                sta = sta_info_get(local, hdr.addr1);
-                if (sta)
+                /* XXX: in the future, use sdata to look up the sta */
+                if (sta && sta->sdata == sdata)
                        sta_flags = get_sta_flags(sta);
                rcu_read_unlock();
        }
diff --git a/net/mac80211/util.c b/net/mac80211/util.c
index dd6564321369..e6c08da8da26 100644
--- a/net/mac80211/util.c
+++ b/net/mac80211/util.c
@@ -339,7 +339,7 @@ void ieee80211_add_pending_skb(struct ieee80211_local *local,
        struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
        if (WARN_ON(!info->control.vif)) {
-                kfree(skb);
+                kfree_skb(skb);
                return;
        }
@@ -367,7 +367,7 @@ int ieee80211_add_pending_skbs(struct ieee80211_local *local,
                struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
                if (WARN_ON(!info->control.vif)) {
-                        kfree(skb);
+                        kfree_skb(skb);
                        continue;
                }
@@ -520,9 +520,9 @@ EXPORT_SYMBOL_GPL(ieee80211_iterate_active_interfaces_atomic);
 */
 static bool ieee80211_can_queue_work(struct ieee80211_local *local)
 {
-        if (WARN(local->suspended, "queueing ieee80211 work while "
+        if (WARN(local->suspended && !local->resuming,
-                 "going to suspend\n"))
+                 "queueing ieee80211 work while going to suspend\n"))
-                return false;
+                return false;
        return true;
 }
@@ -1025,13 +1025,9 @@ int ieee80211_reconfig(struct ieee80211_local *local)
        struct sta_info *sta;
        unsigned long flags;
        int res;
-        bool from_suspend = local->suspended;
-        /*
+        if (local->suspended)
-         * We're going to start the hardware, at that point
+                local->resuming = true;
-         * we are no longer suspended and can RX frames.
-         */
-        local->suspended = false;
        /* restart hardware */
        if (local->open_count) {
@@ -1129,11 +1125,14 @@ int ieee80211_reconfig(struct ieee80211_local *local)
         * If this is for hw restart things are still running.
         * We may want to change that later, however.
         */
-        if (!from_suspend)
+        if (!local->suspended)
                return 0;
 #ifdef CONFIG_PM
+        /* first set suspended false, then resuming */
        local->suspended = false;
+        mb();
+        local->resuming = false;
        list_for_each_entry(sdata, &local->interfaces, list) {
                switch(sdata->vif.type) {
diff --git a/net/netfilter/ipvs/ip_vs_ctl.c b/net/netfilter/ipvs/ip_vs_ctl.c
index fba2892b99e1..446e9bd4b4bc 100644
--- a/net/netfilter/ipvs/ip_vs_ctl.c
+++ b/net/netfilter/ipvs/ip_vs_ctl.c
@@ -1496,14 +1496,14 @@ static int ip_vs_zero_all(void)
 static int
-proc_do_defense_mode(ctl_table *table, int write, struct file * filp,
+proc_do_defense_mode(ctl_table *table, int write,
                     void __user *buffer, size_t *lenp, loff_t *ppos)
 {
        int *valp = table->data;
        int val = *valp;
        int rc;
-        rc = proc_dointvec(table, write, filp, buffer, lenp, ppos);
+        rc = proc_dointvec(table, write, buffer, lenp, ppos);
        if (write && (*valp != val)) {
                if ((*valp < 0) || (*valp > 3)) {
                        /* Restore the correct value */
@@ -1517,7 +1517,7 @@ proc_do_defense_mode(ctl_table *table, int write, struct file * filp,
 static int
-proc_do_sync_threshold(ctl_table *table, int write, struct file *filp,
+proc_do_sync_threshold(ctl_table *table, int write,
                       void __user *buffer, size_t *lenp, loff_t *ppos)
 {
        int *valp = table->data;
@@ -1527,7 +1527,7 @@ proc_do_sync_threshold(ctl_table *table, int write, struct file *filp,
        /* backup the value first */
        memcpy(val, valp, sizeof(val));
-        rc = proc_dointvec(table, write, filp, buffer, lenp, ppos);
+        rc = proc_dointvec(table, write, buffer, lenp, ppos);
        if (write && (valp[0] < 0 || valp[1] < 0 || valp[0] >= valp[1])) {
                /* Restore the correct value */
                memcpy(valp, val, sizeof(val));
diff --git a/net/netfilter/nf_conntrack_core.c b/net/netfilter/nf_conntrack_core.c
index b37109817a98..b9168c1864ca 100644
--- a/net/netfilter/nf_conntrack_core.c
+++ b/net/netfilter/nf_conntrack_core.c
@@ -14,6 +14,7 @@
 #include <linux/types.h>
 #include <linux/netfilter.h>
 #include <linux/module.h>
+#include <linux/sched.h>
 #include <linux/skbuff.h>
 #include <linux/proc_fs.h>
 #include <linux/vmalloc.h>
@@ -1245,9 +1246,9 @@ static int nf_conntrack_init_init_net(void)
         * machine has 512 buckets. >= 1GB machines have 16384 buckets. */
        if (!nf_conntrack_htable_size) {
                nf_conntrack_htable_size
-                        = (((num_physpages << PAGE_SHIFT) / 16384)
+                        = (((totalram_pages << PAGE_SHIFT) / 16384)
                           / sizeof(struct hlist_head));
-                if (num_physpages > (1024 * 1024 * 1024 / PAGE_SIZE))
+                if (totalram_pages > (1024 * 1024 * 1024 / PAGE_SIZE))
                        nf_conntrack_htable_size = 16384;
                if (nf_conntrack_htable_size < 32)
                        nf_conntrack_htable_size = 32;
@@ -1350,6 +1351,11 @@ err_stat:
        return ret;
 }
+s16 (*nf_ct_nat_offset)(const struct nf_conn *ct,
+                        enum ip_conntrack_dir dir,
+                        u32 seq);
+EXPORT_SYMBOL_GPL(nf_ct_nat_offset);
 int nf_conntrack_init(struct net *net)
 {
        int ret;
@@ -1367,6 +1373,9 @@ int nf_conntrack_init(struct net *net)
                /* For use by REJECT target */
                rcu_assign_pointer(ip_ct_attach, nf_conntrack_attach);
                rcu_assign_pointer(nf_ct_destroy, destroy_conntrack);
+                /* Howto get NAT offsets */
+                rcu_assign_pointer(nf_ct_nat_offset, NULL);
        }
        return 0;
diff --git a/net/netfilter/nf_conntrack_proto_tcp.c b/net/netfilter/nf_conntrack_proto_tcp.c
index 97a82ba75376..ba2b76937283 100644
--- a/net/netfilter/nf_conntrack_proto_tcp.c
+++ b/net/netfilter/nf_conntrack_proto_tcp.c
@@ -492,6 +492,21 @@ static void tcp_sack(const struct sk_buff *skb, unsigned int dataoff,
        }
 }
+#ifdef CONFIG_NF_NAT_NEEDED
+static inline s16 nat_offset(const struct nf_conn *ct,
+                             enum ip_conntrack_dir dir,
+                             u32 seq)
+{
+        typeof(nf_ct_nat_offset) get_offset = rcu_dereference(nf_ct_nat_offset);
+        return get_offset != NULL ? get_offset(ct, dir, seq) : 0;
+}
+#define NAT_OFFSET(pf, ct, dir, seq) \
+        (pf == NFPROTO_IPV4 ? nat_offset(ct, dir, seq) : 0)
+#else
+#define NAT_OFFSET(pf, ct, dir, seq)    0
+#endif
 static bool tcp_in_window(const struct nf_conn *ct,
                          struct ip_ct_tcp *state,
                          enum ip_conntrack_dir dir,
@@ -506,6 +521,7 @@ static bool tcp_in_window(const struct nf_conn *ct,
        struct ip_ct_tcp_state *receiver = &state->seen[!dir];
        const struct nf_conntrack_tuple *tuple = &ct->tuplehash[dir].tuple;
        __u32 seq, ack, sack, end, win, swin;
+        s16 receiver_offset;
        bool res;
        /*
@@ -519,11 +535,16 @@ static bool tcp_in_window(const struct nf_conn *ct,
        if (receiver->flags & IP_CT_TCP_FLAG_SACK_PERM)
                tcp_sack(skb, dataoff, tcph, &sack);
+        /* Take into account NAT sequence number mangling */
+        receiver_offset = NAT_OFFSET(pf, ct, !dir, ack - 1);
+        ack -= receiver_offset;
+        sack -= receiver_offset;
        pr_debug("tcp_in_window: START\n");
        pr_debug("tcp_in_window: ");
        nf_ct_dump_tuple(tuple);
-        pr_debug("seq=%u ack=%u sack=%u win=%u end=%u\n",
+        pr_debug("seq=%u ack=%u+(%d) sack=%u+(%d) win=%u end=%u\n",
-                 seq, ack, sack, win, end);
+                 seq, ack, receiver_offset, sack, receiver_offset, win, end);
        pr_debug("tcp_in_window: sender end=%u maxend=%u maxwin=%u scale=%i "
                 "receiver end=%u maxend=%u maxwin=%u scale=%i\n",
                 sender->td_end, sender->td_maxend, sender->td_maxwin,
@@ -613,8 +634,8 @@ static bool tcp_in_window(const struct nf_conn *ct,
        pr_debug("tcp_in_window: ");
        nf_ct_dump_tuple(tuple);
-        pr_debug("seq=%u ack=%u sack =%u win=%u end=%u\n",
+        pr_debug("seq=%u ack=%u+(%d) sack=%u+(%d) win=%u end=%u\n",
-                 seq, ack, sack, win, end);
+                 seq, ack, receiver_offset, sack, receiver_offset, win, end);
        pr_debug("tcp_in_window: sender end=%u maxend=%u maxwin=%u scale=%i "
                 "receiver end=%u maxend=%u maxwin=%u scale=%i\n",
                 sender->td_end, sender->td_maxend, sender->td_maxwin,
@@ -700,7 +721,7 @@ static bool tcp_in_window(const struct nf_conn *ct,
                        before(seq, sender->td_maxend + 1) ?
                        after(end, sender->td_end - receiver->td_maxwin - 1) ?
                        before(sack, receiver->td_end + 1) ?
-                        after(ack, receiver->td_end - MAXACKWINDOW(sender)) ? "BUG"
+                        after(sack, receiver->td_end - MAXACKWINDOW(sender) - 1) ? "BUG"
                        : "ACK is under the lower bound (possible overly delayed ACK)"
                        : "ACK is over the upper bound (ACKed data not seen yet)"
                        : "SEQ is under the lower bound (already ACKed data retransmitted)"
@@ -715,39 +736,6 @@ static bool tcp_in_window(const struct nf_conn *ct,
        return res;
 }
-#ifdef CONFIG_NF_NAT_NEEDED
-/* Update sender->td_end after NAT successfully mangled the packet */
-/* Caller must linearize skb at tcp header. */
-void nf_conntrack_tcp_update(const struct sk_buff *skb,
-                             unsigned int dataoff,
-                             struct nf_conn *ct, int dir,
-                             s16 offset)
-{
-        const struct tcphdr *tcph = (const void *)skb->data + dataoff;
-        const struct ip_ct_tcp_state *sender = &ct->proto.tcp.seen[dir];
-        const struct ip_ct_tcp_state *receiver = &ct->proto.tcp.seen[!dir];
-        __u32 end;
-        end = segment_seq_plus_len(ntohl(tcph->seq), skb->len, dataoff, tcph);
-        spin_lock_bh(&ct->lock);
-        /*
-         * We have to worry for the ack in the reply packet only...
-         */
-        if (ct->proto.tcp.seen[dir].td_end + offset == end)
-                ct->proto.tcp.seen[dir].td_end = end;
-        ct->proto.tcp.last_end = end;
-        spin_unlock_bh(&ct->lock);
-        pr_debug("tcp_update: sender end=%u maxend=%u maxwin=%u scale=%i "
-                 "receiver end=%u maxend=%u maxwin=%u scale=%i\n",
-                 sender->td_end, sender->td_maxend, sender->td_maxwin,
-                 sender->td_scale,
-                 receiver->td_end, receiver->td_maxend, receiver->td_maxwin,
-                 receiver->td_scale);
-}
-EXPORT_SYMBOL_GPL(nf_conntrack_tcp_update);
-#endif
 #define TH_FIN  0x01
 #define TH_SYN  0x02
 #define TH_RST  0x04
diff --git a/net/netfilter/nf_log.c b/net/netfilter/nf_log.c
index 4e620305f28c..d65d3481919c 100644
--- a/net/netfilter/nf_log.c
+++ b/net/netfilter/nf_log.c
@@ -128,9 +128,8 @@ EXPORT_SYMBOL(nf_log_packet);
 #ifdef CONFIG_PROC_FS
 static void *seq_start(struct seq_file *seq, loff_t *pos)
-        __acquires(RCU)
 {
-        rcu_read_lock();
+        mutex_lock(&nf_log_mutex);
        if (*pos >= ARRAY_SIZE(nf_loggers))
                return NULL;
@@ -149,9 +148,8 @@ static void *seq_next(struct seq_file *s, void *v, loff_t *pos)
 }
 static void seq_stop(struct seq_file *s, void *v)
-        __releases(RCU)
 {
-        rcu_read_unlock();
+        mutex_unlock(&nf_log_mutex);
 }
 static int seq_show(struct seq_file *s, void *v)
@@ -161,7 +159,7 @@ static int seq_show(struct seq_file *s, void *v)
        struct nf_logger *t;
        int ret;
-        logger = rcu_dereference(nf_loggers[*pos]);
+        logger = nf_loggers[*pos];
        if (!logger)
                ret = seq_printf(s, "%2lld NONE (", *pos);
@@ -171,22 +169,16 @@ static int seq_show(struct seq_file *s, void *v)
        if (ret < 0)
                return ret;
-        mutex_lock(&nf_log_mutex);
        list_for_each_entry(t, &nf_loggers_l[*pos], list[*pos]) {
                ret = seq_printf(s, "%s", t->name);
-                if (ret < 0) {
+                if (ret < 0)
-                        mutex_unlock(&nf_log_mutex);
                        return ret;
-                }
                if (&t->list[*pos] != nf_loggers_l[*pos].prev) {
                        ret = seq_printf(s, ",");
-                        if (ret < 0) {
+                        if (ret < 0)
-                                mutex_unlock(&nf_log_mutex);
                                return ret;
-                        }
                }
        }
-        mutex_unlock(&nf_log_mutex);
        return seq_printf(s, ")\n");
 }
@@ -226,7 +218,7 @@ static char nf_log_sysctl_fnames[NFPROTO_NUMPROTO-NFPROTO_UNSPEC][3];
 static struct ctl_table nf_log_sysctl_table[NFPROTO_NUMPROTO+1];
 static struct ctl_table_header *nf_log_dir_header;
-static int nf_log_proc_dostring(ctl_table *table, int write, struct file *filp,
+static int nf_log_proc_dostring(ctl_table *table, int write,
                         void __user *buffer, size_t *lenp, loff_t *ppos)
 {
        const struct nf_logger *logger;
@@ -260,7 +252,7 @@ static int nf_log_proc_dostring(ctl_table *table, int write, struct file *filp,
                        table->data = "NONE";
                else
                        table->data = logger->name;
-                r = proc_dostring(table, write, filp, buffer, lenp, ppos);
+                r = proc_dostring(table, write, buffer, lenp, ppos);
                mutex_unlock(&nf_log_mutex);
        }
diff --git a/net/netfilter/nf_sockopt.c b/net/netfilter/nf_sockopt.c
index 8ab829f86574..f042ae521557 100644
--- a/net/netfilter/nf_sockopt.c
+++ b/net/netfilter/nf_sockopt.c
@@ -113,7 +113,7 @@ static int nf_sockopt(struct sock *sk, u_int8_t pf, int val,
 }
 int nf_setsockopt(struct sock *sk, u_int8_t pf, int val, char __user *opt,
-                  int len)
+                  unsigned int len)
 {
        return nf_sockopt(sk, pf, val, opt, &len, 0);
 }
@@ -154,7 +154,7 @@ static int compat_nf_sockopt(struct sock *sk, u_int8_t pf, int val,
 }
 int compat_nf_setsockopt(struct sock *sk, u_int8_t pf,
-                int val, char __user *opt, int len)
+                int val, char __user *opt, unsigned int len)
 {
        return compat_nf_sockopt(sk, pf, val, opt, &len, 0);
 }
diff --git a/net/netfilter/x_tables.c b/net/netfilter/x_tables.c
index a6ac83a93348..f01955cce314 100644
--- a/net/netfilter/x_tables.c
+++ b/net/netfilter/x_tables.c
@@ -617,7 +617,7 @@ struct xt_table_info *xt_alloc_table_info(unsigned int size)
        int cpu;
        /* Pedantry: prevent them from hitting BUG() in vmalloc.c --RR */
-        if ((SMP_ALIGN(size) >> PAGE_SHIFT) + 2 > num_physpages)
+        if ((SMP_ALIGN(size) >> PAGE_SHIFT) + 2 > totalram_pages)
                return NULL;
        newinfo = kzalloc(XT_TABLE_INFO_SZ, GFP_KERNEL);
diff --git a/net/netfilter/xt_connlimit.c b/net/netfilter/xt_connlimit.c
index 680980954395..38f03f75a636 100644
--- a/net/netfilter/xt_connlimit.c
+++ b/net/netfilter/xt_connlimit.c
@@ -103,7 +103,7 @@ static int count_them(struct xt_connlimit_data *data,
                      const struct nf_conntrack_tuple *tuple,
                      const union nf_inet_addr *addr,
                      const union nf_inet_addr *mask,
-                      const struct xt_match *match)
+                      u_int8_t family)
 {
        const struct nf_conntrack_tuple_hash *found;
        struct xt_connlimit_conn *conn;
@@ -113,8 +113,7 @@ static int count_them(struct xt_connlimit_data *data,
        bool addit = true;
        int matches = 0;
+        if (family == NFPROTO_IPV6)
-        if (match->family == NFPROTO_IPV6)
                hash = &data->iphash[connlimit_iphash6(addr, mask)];
        else
                hash = &data->iphash[connlimit_iphash(addr->ip & mask->ip)];
@@ -157,8 +156,7 @@ static int count_them(struct xt_connlimit_data *data,
                        continue;
                }
-                if (same_source_net(addr, mask, &conn->tuple.src.u3,
+                if (same_source_net(addr, mask, &conn->tuple.src.u3, family))
-                    match->family))
                        /* same source network -> be counted! */
                        ++matches;
                nf_ct_put(found_ct);
@@ -207,7 +205,7 @@ connlimit_mt(const struct sk_buff *skb, const struct xt_match_param *par)
        spin_lock_bh(&info->data->lock);
        connections = count_them(info->data, tuple_ptr, &addr,
-                                 &info->mask, par->match);
+                                 &info->mask, par->family);
        spin_unlock_bh(&info->data->lock);
        if (connections < 0) {
diff --git a/net/netfilter/xt_hashlimit.c b/net/netfilter/xt_hashlimit.c
index 219dcdbe388c..dd16e404424f 100644
--- a/net/netfilter/xt_hashlimit.c
+++ b/net/netfilter/xt_hashlimit.c
@@ -194,9 +194,9 @@ static int htable_create_v0(struct xt_hashlimit_info *minfo, u_int8_t family)
        if (minfo->cfg.size)
                size = minfo->cfg.size;
        else {
-                size = ((num_physpages << PAGE_SHIFT) / 16384) /
+                size = ((totalram_pages << PAGE_SHIFT) / 16384) /
                       sizeof(struct list_head);
-                if (num_physpages > (1024 * 1024 * 1024 / PAGE_SIZE))
+                if (totalram_pages > (1024 * 1024 * 1024 / PAGE_SIZE))
                        size = 8192;
                if (size < 16)
                        size = 16;
@@ -266,9 +266,9 @@ static int htable_create(struct xt_hashlimit_mtinfo1 *minfo, u_int8_t family)
        if (minfo->cfg.size) {
                size = minfo->cfg.size;
        } else {
-                size = (num_physpages << PAGE_SHIFT) / 16384 /
+                size = (totalram_pages << PAGE_SHIFT) / 16384 /
                       sizeof(struct list_head);
-                if (num_physpages > 1024 * 1024 * 1024 / PAGE_SIZE)
+                if (totalram_pages > 1024 * 1024 * 1024 / PAGE_SIZE)
                        size = 8192;
                if (size < 16)
                        size = 16;
diff --git a/net/netfilter/xt_limit.c b/net/netfilter/xt_limit.c
index 2e8089ecd0af..2773be6a71dd 100644
--- a/net/netfilter/xt_limit.c
+++ b/net/netfilter/xt_limit.c
@@ -112,7 +112,7 @@ static bool limit_mt_check(const struct xt_mtchk_param *par)
        priv = kmalloc(sizeof(*priv), GFP_KERNEL);
        if (priv == NULL)
-                return -ENOMEM;
+                return false;
        /* For SMP, we only want to use one set of state. */
        r->master = priv;
diff --git a/net/netfilter/xt_osf.c b/net/netfilter/xt_osf.c
index 63e190504656..4d1a41bbd5d7 100644
--- a/net/netfilter/xt_osf.c
+++ b/net/netfilter/xt_osf.c
@@ -118,7 +118,7 @@ static int xt_osf_remove_callback(struct sock *ctnl, struct sk_buff *skb,
 {
        struct xt_osf_user_finger *f;
        struct xt_osf_finger *sf;
-        int err = ENOENT;
+        int err = -ENOENT;
        if (!osf_attrs[OSF_ATTR_FINGER])
                return -EINVAL;
diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c
index c5aab6a368ce..19e98007691c 100644
--- a/net/netlink/af_netlink.c
+++ b/net/netlink/af_netlink.c
@@ -1150,7 +1150,7 @@ static void netlink_update_socket_mc(struct netlink_sock *nlk,
 }
 static int netlink_setsockopt(struct socket *sock, int level, int optname,
-                              char __user *optval, int optlen)
+                              char __user *optval, unsigned int optlen)
 {
        struct sock *sk = sock->sk;
        struct netlink_sock *nlk = nlk_sk(sk);
@@ -1609,6 +1609,16 @@ int netlink_change_ngroups(struct sock *sk, unsigned int groups)
        return err;
 }
+void __netlink_clear_multicast_users(struct sock *ksk, unsigned int group)
+{
+        struct sock *sk;
+        struct hlist_node *node;
+        struct netlink_table *tbl = &nl_table[ksk->sk_protocol];
+        sk_for_each_bound(sk, node, &tbl->mc_list)
+                netlink_update_socket_mc(nlk_sk(sk), group, 0);
+}
 /**
 * netlink_clear_multicast_users - kick off multicast listeners
 *
@@ -1619,15 +1629,8 @@ int netlink_change_ngroups(struct sock *sk, unsigned int groups)
 */
 void netlink_clear_multicast_users(struct sock *ksk, unsigned int group)
 {
-        struct sock *sk;
-        struct hlist_node *node;
-        struct netlink_table *tbl = &nl_table[ksk->sk_protocol];
        netlink_table_grab();
+        __netlink_clear_multicast_users(ksk, group);
-        sk_for_each_bound(sk, node, &tbl->mc_list)
-                netlink_update_socket_mc(nlk_sk(sk), group, 0);
        netlink_table_ungrab();
 }
@@ -1785,7 +1788,7 @@ void netlink_ack(struct sk_buff *in_skb, struct nlmsghdr *nlh, int err)
        }
        rep = __nlmsg_put(skb, NETLINK_CB(in_skb).pid, nlh->nlmsg_seq,
-                          NLMSG_ERROR, sizeof(struct nlmsgerr), 0);
+                          NLMSG_ERROR, payload, 0);
        errmsg = nlmsg_data(rep);
        errmsg->error = err;
        memcpy(&errmsg->msg, nlh, err ? nlh->nlmsg_len : sizeof(*nlh));
@@ -2091,10 +2094,10 @@ static int __init netlink_proto_init(void)
        if (!nl_table)
                goto panic;
-        if (num_physpages >= (128 * 1024))
+        if (totalram_pages >= (128 * 1024))
-                limit = num_physpages >> (21 - PAGE_SHIFT);
+                limit = totalram_pages >> (21 - PAGE_SHIFT);
        else
-                limit = num_physpages >> (23 - PAGE_SHIFT);
+                limit = totalram_pages >> (23 - PAGE_SHIFT);
        order = get_bitmask_order(limit) - 1 + PAGE_SHIFT;
        limit = (1UL << order) / sizeof(struct hlist_head);
diff --git a/net/netlink/genetlink.c b/net/netlink/genetlink.c
index 566941e03363..44ff3f3810fa 100644
--- a/net/netlink/genetlink.c
+++ b/net/netlink/genetlink.c
@@ -220,10 +220,12 @@ static void __genl_unregister_mc_group(struct genl_family *family,
        struct net *net;
        BUG_ON(grp->family != family);
+        netlink_table_grab();
        rcu_read_lock();
        for_each_net_rcu(net)
-                netlink_clear_multicast_users(net->genl_sock, grp->id);
+                __netlink_clear_multicast_users(net->genl_sock, grp->id);
        rcu_read_unlock();
+        netlink_table_ungrab();
        clear_bit(grp->id, mc_groups);
        list_del(&grp->list);
diff --git a/net/netrom/af_netrom.c b/net/netrom/af_netrom.c
index ce1a34b99c23..7a834952f67f 100644
--- a/net/netrom/af_netrom.c
+++ b/net/netrom/af_netrom.c
@@ -301,7 +301,7 @@ void nr_destroy_socket(struct sock *sk)
 */
 static int nr_setsockopt(struct socket *sock, int level, int optname,
-        char __user *optval, int optlen)
+        char __user *optval, unsigned int optlen)
 {
        struct sock *sk = sock->sk;
        struct nr_sock *nr = nr_sk(sk);
diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
index d3d52c66cdc2..f2d116a5cb35 100644
--- a/net/packet/af_packet.c
+++ b/net/packet/af_packet.c
@@ -982,10 +982,7 @@ static int tpacket_snd(struct packet_sock *po, struct msghdr *msg)
                goto out_put;
        size_max = po->tx_ring.frame_size
-                - sizeof(struct skb_shared_info)
+                - (po->tp_hdrlen - sizeof(struct sockaddr_ll));
-                - po->tp_hdrlen
-                - LL_ALLOCATED_SPACE(dev)
-                - sizeof(struct sockaddr_ll);
        if (size_max > dev->mtu + reserve)
                size_max = dev->mtu + reserve;
@@ -1701,7 +1698,7 @@ static void packet_flush_mclist(struct sock *sk)
 }
 static int
-packet_setsockopt(struct socket *sock, int level, int optname, char __user *optval, int optlen)
+packet_setsockopt(struct socket *sock, int level, int optname, char __user *optval, unsigned int optlen)
 {
        struct sock *sk = sock->sk;
        struct packet_sock *po = pkt_sk(sk);
@@ -2084,7 +2081,7 @@ static void packet_mm_close(struct vm_area_struct *vma)
                atomic_dec(&pkt_sk(sk)->mapped);
 }
-static struct vm_operations_struct packet_mmap_ops = {
+static const struct vm_operations_struct packet_mmap_ops = {
        .open   =       packet_mm_open,
        .close  =       packet_mm_close,
 };
diff --git a/net/phonet/af_phonet.c b/net/phonet/af_phonet.c
index a662e62a99cf..f60c0c2aacba 100644
--- a/net/phonet/af_phonet.c
+++ b/net/phonet/af_phonet.c
@@ -168,6 +168,12 @@ static int pn_send(struct sk_buff *skb, struct net_device *dev,
                goto drop;
        }
+        /* Broadcast sending is not implemented */
+        if (pn_addr(dst) == PNADDR_BROADCAST) {
+                err = -EOPNOTSUPP;
+                goto drop;
+        }
        skb_reset_transport_header(skb);
        WARN_ON(skb_headroom(skb) & 1); /* HW assumes word alignment */
        skb_push(skb, sizeof(struct phonethdr));
diff --git a/net/phonet/pep.c b/net/phonet/pep.c
index b8252d289cd7..5f32d217535b 100644
--- a/net/phonet/pep.c
+++ b/net/phonet/pep.c
@@ -742,7 +742,7 @@ static int pep_init(struct sock *sk)
 }
 static int pep_setsockopt(struct sock *sk, int level, int optname,
-                                char __user *optval, int optlen)
+                                char __user *optval, unsigned int optlen)
 {
        struct pep_sock *pn = pep_sk(sk);
        int val = 0, err = 0;
diff --git a/net/phonet/socket.c b/net/phonet/socket.c
index 7a4ee397d2f7..aa5b5a972bff 100644
--- a/net/phonet/socket.c
+++ b/net/phonet/socket.c
@@ -113,6 +113,8 @@ void pn_sock_unhash(struct sock *sk)
 }
 EXPORT_SYMBOL(pn_sock_unhash);
+static DEFINE_MUTEX(port_mutex);
 static int pn_socket_bind(struct socket *sock, struct sockaddr *addr, int len)
 {
        struct sock *sk = sock->sk;
@@ -140,9 +142,11 @@ static int pn_socket_bind(struct socket *sock, struct sockaddr *addr, int len)
                err = -EINVAL; /* attempt to rebind */
                goto out;
        }
+        WARN_ON(sk_hashed(sk));
+        mutex_lock(&port_mutex);
        err = sk->sk_prot->get_port(sk, pn_port(handle));
        if (err)
-                goto out;
+                goto out_port;
        /* get_port() sets the port, bind() sets the address if applicable */
        pn->sobject = pn_object(saddr, pn_port(pn->sobject));
@@ -150,6 +154,8 @@ static int pn_socket_bind(struct socket *sock, struct sockaddr *addr, int len)
        /* Enable RX on the socket */
        sk->sk_prot->hash(sk);
+out_port:
+        mutex_unlock(&port_mutex);
 out:
        release_sock(sk);
        return err;
@@ -357,8 +363,6 @@ const struct proto_ops phonet_stream_ops = {
 };
 EXPORT_SYMBOL(phonet_stream_ops);
-static DEFINE_MUTEX(port_mutex);
 /* allocate port for a socket */
 int pn_sock_get_port(struct sock *sk, unsigned short sport)
 {
@@ -370,9 +374,7 @@ int pn_sock_get_port(struct sock *sk, unsigned short sport)
        memset(&try_sa, 0, sizeof(struct sockaddr_pn));
        try_sa.spn_family = AF_PHONET;
+        WARN_ON(!mutex_is_locked(&port_mutex));
-        mutex_lock(&port_mutex);
        if (!sport) {
                /* search free port */
                int port, pmin, pmax;
@@ -401,13 +403,10 @@ int pn_sock_get_port(struct sock *sk, unsigned short sport)
                else
                        sock_put(tmpsk);
        }
-        mutex_unlock(&port_mutex);
        /* the port must be in use already */
        return -EADDRINUSE;
 found:
-        mutex_unlock(&port_mutex);
        pn->sobject = pn_object(pn_addr(pn->sobject), sport);
        return 0;
 }
diff --git a/net/phonet/sysctl.c b/net/phonet/sysctl.c
index 7b5749ee2765..2220f3322326 100644
--- a/net/phonet/sysctl.c
+++ b/net/phonet/sysctl.c
@@ -56,7 +56,7 @@ void phonet_get_local_port_range(int *min, int *max)
        } while (read_seqretry(&local_port_range_lock, seq));
 }
-static int proc_local_port_range(ctl_table *table, int write, struct file *filp,
+static int proc_local_port_range(ctl_table *table, int write,
                                void __user *buffer,
                                size_t *lenp, loff_t *ppos)
 {
@@ -70,7 +70,7 @@ static int proc_local_port_range(ctl_table *table, int write, struct file *filp,
                .extra2 = &local_port_range_max,
        };
-        ret = proc_dointvec_minmax(&tmp, write, filp, buffer, lenp, ppos);
+        ret = proc_dointvec_minmax(&tmp, write, buffer, lenp, ppos);
        if (write && ret == 0) {
                if (range[1] < range[0])
diff --git a/net/rds/af_rds.c b/net/rds/af_rds.c
index 6b58aeff4c7a..98e05382fd3c 100644
--- a/net/rds/af_rds.c
+++ b/net/rds/af_rds.c
@@ -248,7 +248,7 @@ static int rds_cong_monitor(struct rds_sock *rs, char __user *optval,
 }
 static int rds_setsockopt(struct socket *sock, int level, int optname,
-                          char __user *optval, int optlen)
+                          char __user *optval, unsigned int optlen)
 {
        struct rds_sock *rs = rds_sk_to_rs(sock->sk);
        int ret;
diff --git a/net/rfkill/core.c b/net/rfkill/core.c
index dbeaf2983822..a001f7c1f711 100644
--- a/net/rfkill/core.c
+++ b/net/rfkill/core.c
@@ -27,6 +27,7 @@
 #include <linux/list.h>
 #include <linux/mutex.h>
 #include <linux/rfkill.h>
+#include <linux/sched.h>
 #include <linux/spinlock.h>
 #include <linux/miscdevice.h>
 #include <linux/wait.h>
@@ -1188,6 +1189,7 @@ static long rfkill_fop_ioctl(struct file *file, unsigned int cmd,
 #endif
 static const struct file_operations rfkill_fops = {
+        .owner          = THIS_MODULE,
        .open           = rfkill_fop_open,
        .read           = rfkill_fop_read,
        .write          = rfkill_fop_write,
diff --git a/net/rose/af_rose.c b/net/rose/af_rose.c
index 1e166c9685aa..502cce76621d 100644
--- a/net/rose/af_rose.c
+++ b/net/rose/af_rose.c
@@ -370,7 +370,7 @@ void rose_destroy_socket(struct sock *sk)
 */
 static int rose_setsockopt(struct socket *sock, int level, int optname,
-        char __user *optval, int optlen)
+        char __user *optval, unsigned int optlen)
 {
        struct sock *sk = sock->sk;
        struct rose_sock *rose = rose_sk(sk);
diff --git a/net/rose/rose_route.c b/net/rose/rose_route.c
index 9478d9b3d977..f3e21989b88c 100644
--- a/net/rose/rose_route.c
+++ b/net/rose/rose_route.c
@@ -578,18 +578,18 @@ static int rose_clear_routes(void)
 /*
 *      Check that the device given is a valid AX.25 interface that is "up".
+ *      called whith RTNL
 */
-static struct net_device *rose_ax25_dev_get(char *devname)
+static struct net_device *rose_ax25_dev_find(char *devname)
 {
        struct net_device *dev;
-        if ((dev = dev_get_by_name(&init_net, devname)) == NULL)
+        if ((dev = __dev_get_by_name(&init_net, devname)) == NULL)
                return NULL;
        if ((dev->flags & IFF_UP) && dev->type == ARPHRD_AX25)
                return dev;
-        dev_put(dev);
        return NULL;
 }
@@ -720,27 +720,23 @@ int rose_rt_ioctl(unsigned int cmd, void __user *arg)
        case SIOCADDRT:
                if (copy_from_user(&rose_route, arg, sizeof(struct rose_route_struct)))
                        return -EFAULT;
-                if ((dev = rose_ax25_dev_get(rose_route.device)) == NULL)
+                if ((dev = rose_ax25_dev_find(rose_route.device)) == NULL)
                        return -EINVAL;
-                if (rose_dev_exists(&rose_route.address)) { /* Can't add routes to ourself */
+                if (rose_dev_exists(&rose_route.address)) /* Can't add routes to ourself */
-                        dev_put(dev);
                        return -EINVAL;
-                }
                if (rose_route.mask > 10) /* Mask can't be more than 10 digits */
                        return -EINVAL;
                if (rose_route.ndigis > AX25_MAX_DIGIS)
                        return -EINVAL;
                err = rose_add_node(&rose_route, dev);
-                dev_put(dev);
                return err;
        case SIOCDELRT:
                if (copy_from_user(&rose_route, arg, sizeof(struct rose_route_struct)))
                        return -EFAULT;
-                if ((dev = rose_ax25_dev_get(rose_route.device)) == NULL)
+                if ((dev = rose_ax25_dev_find(rose_route.device)) == NULL)
                        return -EINVAL;
                err = rose_del_node(&rose_route, dev);
-                dev_put(dev);
                return err;
        case SIOCRSCLRRT:
diff --git a/net/rxrpc/af_rxrpc.c b/net/rxrpc/af_rxrpc.c
index bfe493ebf27c..a86afceaa94f 100644
--- a/net/rxrpc/af_rxrpc.c
+++ b/net/rxrpc/af_rxrpc.c
@@ -507,7 +507,7 @@ out:
 * set RxRPC socket options
 */
 static int rxrpc_setsockopt(struct socket *sock, int level, int optname,
-                            char __user *optval, int optlen)
+                            char __user *optval, unsigned int optlen)
 {
        struct rxrpc_sock *rx = rxrpc_sk(sock->sk);
        unsigned min_sec_level;
diff --git a/net/rxrpc/ar-call.c b/net/rxrpc/ar-call.c
index d9231245a79a..bc0019f704fe 100644
--- a/net/rxrpc/ar-call.c
+++ b/net/rxrpc/ar-call.c
@@ -96,7 +96,7 @@ static struct rxrpc_call *rxrpc_alloc_call(gfp_t gfp)
 }
 /*
- * allocate a new client call and attempt to to get a connection slot for it
+ * allocate a new client call and attempt to get a connection slot for it
 */
 static struct rxrpc_call *rxrpc_alloc_client_call(
        struct rxrpc_sock *rx,
diff --git a/net/sched/act_pedit.c b/net/sched/act_pedit.c
index 96c0ed115e2a..6b0359a500e6 100644
--- a/net/sched/act_pedit.c
+++ b/net/sched/act_pedit.c
@@ -34,7 +34,7 @@ static struct tcf_hashinfo pedit_hash_info = {
 };
 static const struct nla_policy pedit_policy[TCA_PEDIT_MAX + 1] = {
-        [TCA_PEDIT_PARMS]       = { .len = sizeof(struct tcf_pedit) },
+        [TCA_PEDIT_PARMS]       = { .len = sizeof(struct tc_pedit) },
 };
 static int tcf_pedit_init(struct nlattr *nla, struct nlattr *est,
diff --git a/net/sched/cls_api.c b/net/sched/cls_api.c
index 6a536949cdc0..7cf6c0fbc7a6 100644
--- a/net/sched/cls_api.c
+++ b/net/sched/cls_api.c
@@ -350,7 +350,7 @@ static int tcf_fill_node(struct sk_buff *skb, struct tcf_proto *tp,
        tcm = NLMSG_DATA(nlh);
        tcm->tcm_family = AF_UNSPEC;
        tcm->tcm__pad1 = 0;
-        tcm->tcm__pad1 = 0;
+        tcm->tcm__pad2 = 0;
        tcm->tcm_ifindex = qdisc_dev(tp->q)->ifindex;
        tcm->tcm_parent = tp->classid;
        tcm->tcm_info = TC_H_MAKE(tp->prio, tp->protocol);
diff --git a/net/sched/sch_hfsc.c b/net/sched/sch_hfsc.c
index 375d64cb1a3d..2c5c76be18f8 100644
--- a/net/sched/sch_hfsc.c
+++ b/net/sched/sch_hfsc.c
@@ -77,7 +77,7 @@
 *   The service curve parameters are converted to the internal
 *   representation. The slope values are scaled to avoid overflow.
 *   the inverse slope values as well as the y-projection of the 1st
- *   segment are kept in order to to avoid 64-bit divide operations
+ *   segment are kept in order to avoid 64-bit divide operations
 *   that are expensive on 32-bit architectures.
 */
diff --git a/net/sctp/associola.c b/net/sctp/associola.c
index 8450960df24f..7eed77a39d0d 100644
--- a/net/sctp/associola.c
+++ b/net/sctp/associola.c
@@ -1485,15 +1485,13 @@ void sctp_assoc_rwnd_decrease(struct sctp_association *asoc, unsigned len)
 * local endpoint and the remote peer.
 */
 int sctp_assoc_set_bind_addr_from_ep(struct sctp_association *asoc,
-                                     gfp_t gfp)
+                                     sctp_scope_t scope, gfp_t gfp)
 {
-        sctp_scope_t scope;
        int flags;
        /* Use scoping rules to determine the subset of addresses from
         * the endpoint.
         */
-        scope = sctp_scope(&asoc->peer.active_path->ipaddr);
        flags = (PF_INET6 == asoc->base.sk->sk_family) ? SCTP_ADDR6_ALLOWED : 0;
        if (asoc->peer.ipv4_address)
                flags |= SCTP_ADDR4_PEERSUPP;
diff --git a/net/sctp/outqueue.c b/net/sctp/outqueue.c
index c9f20e28521b..23e5e97aa617 100644
--- a/net/sctp/outqueue.c
+++ b/net/sctp/outqueue.c
@@ -423,16 +423,6 @@ void sctp_retransmit_mark(struct sctp_outq *q,
                if ((reason == SCTP_RTXR_FAST_RTX  &&
                            (chunk->fast_retransmit == SCTP_NEED_FRTX)) ||
                    (reason != SCTP_RTXR_FAST_RTX  && !chunk->tsn_gap_acked)) {
-                        /* If this chunk was sent less then 1 rto ago, do not
-                         * retransmit this chunk, but give the peer time
-                         * to acknowlege it.  Do this only when
-                         * retransmitting due to T3 timeout.
-                         */
-                        if (reason == SCTP_RTXR_T3_RTX &&
-                            time_before(jiffies, chunk->sent_at +
-                                                 transport->last_rto))
-                                continue;
                        /* RFC 2960 6.2.1 Processing a Received SACK
                         *
                         * C) Any time a DATA chunk is marked for
diff --git a/net/sctp/protocol.c b/net/sctp/protocol.c
index c557f1fb1c66..612dc878e05c 100644
--- a/net/sctp/protocol.c
+++ b/net/sctp/protocol.c
@@ -1184,10 +1184,10 @@ SCTP_STATIC __init int sctp_init(void)
        /* Size and allocate the association hash table.
         * The methodology is similar to that of the tcp hash tables.
         */
-        if (num_physpages >= (128 * 1024))
+        if (totalram_pages >= (128 * 1024))
-                goal = num_physpages >> (22 - PAGE_SHIFT);
+                goal = totalram_pages >> (22 - PAGE_SHIFT);
        else
-                goal = num_physpages >> (24 - PAGE_SHIFT);
+                goal = totalram_pages >> (24 - PAGE_SHIFT);
        for (order = 0; (1UL << order) < goal; order++)
                ;
diff --git a/net/sctp/sm_sideeffect.c b/net/sctp/sm_sideeffect.c
index 8674d4919556..efa516b47e81 100644
--- a/net/sctp/sm_sideeffect.c
+++ b/net/sctp/sm_sideeffect.c
@@ -480,7 +480,6 @@ static void sctp_do_8_2_transport_strike(struct sctp_association *asoc,
         * that indicates that we have an outstanding HB.
         */
        if (!is_hb || transport->hb_sent) {
-                transport->last_rto = transport->rto;
                transport->rto = min((transport->rto * 2), transport->asoc->rto_max);
        }
 }
diff --git a/net/sctp/sm_statefuns.c b/net/sctp/sm_statefuns.c
index c8fae1983dd1..d4df45022ffa 100644
--- a/net/sctp/sm_statefuns.c
+++ b/net/sctp/sm_statefuns.c
@@ -384,6 +384,11 @@ sctp_disposition_t sctp_sf_do_5_1B_init(const struct sctp_endpoint *ep,
        if (!new_asoc)
                goto nomem;
+        if (sctp_assoc_set_bind_addr_from_ep(new_asoc,
+                                             sctp_scope(sctp_source(chunk)),
+                                             GFP_ATOMIC) < 0)
+                goto nomem_init;
        /* The call, sctp_process_init(), can fail on memory allocation.  */
        if (!sctp_process_init(new_asoc, chunk->chunk_hdr->type,
                               sctp_source(chunk),
@@ -401,9 +406,6 @@ sctp_disposition_t sctp_sf_do_5_1B_init(const struct sctp_endpoint *ep,
                len = ntohs(err_chunk->chunk_hdr->length) -
                        sizeof(sctp_chunkhdr_t);
-        if (sctp_assoc_set_bind_addr_from_ep(new_asoc, GFP_ATOMIC) < 0)
-                goto nomem_init;
        repl = sctp_make_init_ack(new_asoc, chunk, GFP_ATOMIC, len);
        if (!repl)
                goto nomem_init;
@@ -1452,6 +1454,10 @@ static sctp_disposition_t sctp_sf_do_unexpected_init(
        if (!new_asoc)
                goto nomem;
+        if (sctp_assoc_set_bind_addr_from_ep(new_asoc,
+                                sctp_scope(sctp_source(chunk)), GFP_ATOMIC) < 0)
+                goto nomem;
        /* In the outbound INIT ACK the endpoint MUST copy its current
         * Verification Tag and Peers Verification tag into a reserved
         * place (local tie-tag and per tie-tag) within the state cookie.
@@ -1488,9 +1494,6 @@ static sctp_disposition_t sctp_sf_do_unexpected_init(
                        sizeof(sctp_chunkhdr_t);
        }
-        if (sctp_assoc_set_bind_addr_from_ep(new_asoc, GFP_ATOMIC) < 0)
-                goto nomem;
        repl = sctp_make_init_ack(new_asoc, chunk, GFP_ATOMIC, len);
        if (!repl)
                goto nomem;
diff --git a/net/sctp/socket.c b/net/sctp/socket.c
index 89af37a6c871..3a95fcb17a9e 100644
--- a/net/sctp/socket.c
+++ b/net/sctp/socket.c
@@ -1080,6 +1080,13 @@ static int __sctp_connect(struct sock* sk,
                                err = -ENOMEM;
                                goto out_free;
                        }
+                        err = sctp_assoc_set_bind_addr_from_ep(asoc, scope,
+                                                              GFP_KERNEL);
+                        if (err < 0) {
+                                goto out_free;
+                        }
                }
                /* Prime the peer's transport structures.  */
@@ -1095,11 +1102,6 @@ static int __sctp_connect(struct sock* sk,
                walk_size += af->sockaddr_len;
        }
-        err = sctp_assoc_set_bind_addr_from_ep(asoc, GFP_KERNEL);
-        if (err < 0) {
-                goto out_free;
-        }
        /* In case the user of sctp_connectx() wants an association
         * id back, assign one now.
         */
@@ -1274,22 +1276,30 @@ SCTP_STATIC int sctp_setsockopt_connectx(struct sock* sk,
 }
 /*
- * New (hopefully final) interface for the API.  The option buffer is used
+ * New (hopefully final) interface for the API.
- * both for the returned association id and the addresses.
+ * We use the sctp_getaddrs_old structure so that use-space library
+ * can avoid any unnecessary allocations.   The only defferent part
+ * is that we store the actual length of the address buffer into the
+ * addrs_num structure member.  That way we can re-use the existing
+ * code.
 */
 SCTP_STATIC int sctp_getsockopt_connectx3(struct sock* sk, int len,
                                        char __user *optval,
                                        int __user *optlen)
 {
+        struct sctp_getaddrs_old param;
        sctp_assoc_t assoc_id = 0;
        int err = 0;
-        if (len < sizeof(assoc_id))
+        if (len < sizeof(param))
                return -EINVAL;
+        if (copy_from_user(&param, optval, sizeof(param)))
+                return -EFAULT;
        err = __sctp_setsockopt_connectx(sk,
-                        (struct sockaddr __user *)(optval + sizeof(assoc_id)),
+                        (struct sockaddr __user *)param.addrs,
-                        len - sizeof(assoc_id), &assoc_id);
+                        param.addr_num, &assoc_id);
        if (err == 0 || err == -EINPROGRESS) {
                if (copy_to_user(optval, &assoc_id, sizeof(assoc_id)))
@@ -1689,6 +1699,11 @@ SCTP_STATIC int sctp_sendmsg(struct kiocb *iocb, struct sock *sk,
                        goto out_unlock;
                }
                asoc = new_asoc;
+                err = sctp_assoc_set_bind_addr_from_ep(asoc, scope, GFP_KERNEL);
+                if (err < 0) {
+                        err = -ENOMEM;
+                        goto out_free;
+                }
                /* If the SCTP_INIT ancillary data is specified, set all
                 * the association init values accordingly.
@@ -1718,11 +1733,6 @@ SCTP_STATIC int sctp_sendmsg(struct kiocb *iocb, struct sock *sk,
                        err = -ENOMEM;
                        goto out_free;
                }
-                err = sctp_assoc_set_bind_addr_from_ep(asoc, GFP_KERNEL);
-                if (err < 0) {
-                        err = -ENOMEM;
-                        goto out_free;
-                }
        }
        /* ASSERT: we have a valid association at this point.  */
@@ -2027,7 +2037,8 @@ out:
 * instead a error will be indicated to the user.
 */
 static int sctp_setsockopt_disable_fragments(struct sock *sk,
-                                            char __user *optval, int optlen)
+                                             char __user *optval,
+                                             unsigned int optlen)
 {
        int val;
@@ -2043,7 +2054,7 @@ static int sctp_setsockopt_disable_fragments(struct sock *sk,
 }
 static int sctp_setsockopt_events(struct sock *sk, char __user *optval,
-                                        int optlen)
+                                  unsigned int optlen)
 {
        if (optlen > sizeof(struct sctp_event_subscribe))
                return -EINVAL;
@@ -2064,7 +2075,7 @@ static int sctp_setsockopt_events(struct sock *sk, char __user *optval,
 * association is closed.
 */
 static int sctp_setsockopt_autoclose(struct sock *sk, char __user *optval,
-                                            int optlen)
+                                     unsigned int optlen)
 {
        struct sctp_sock *sp = sctp_sk(sk);
@@ -2318,7 +2329,8 @@ static int sctp_apply_peer_addr_params(struct sctp_paddrparams *params,
 }
 static int sctp_setsockopt_peer_addr_params(struct sock *sk,
-                                            char __user *optval, int optlen)
+                                            char __user *optval,
+                                            unsigned int optlen)
 {
        struct sctp_paddrparams  params;
        struct sctp_transport   *trans = NULL;
@@ -2430,7 +2442,7 @@ static int sctp_setsockopt_peer_addr_params(struct sock *sk,
 */
 static int sctp_setsockopt_delayed_ack(struct sock *sk,
-                                            char __user *optval, int optlen)
+                                       char __user *optval, unsigned int optlen)
 {
        struct sctp_sack_info    params;
        struct sctp_transport   *trans = NULL;
@@ -2546,7 +2558,7 @@ static int sctp_setsockopt_delayed_ack(struct sock *sk,
 * by the change).  With TCP-style sockets, this option is inherited by
 * sockets derived from a listener socket.
 */
-static int sctp_setsockopt_initmsg(struct sock *sk, char __user *optval, int optlen)
+static int sctp_setsockopt_initmsg(struct sock *sk, char __user *optval, unsigned int optlen)
 {
        struct sctp_initmsg sinit;
        struct sctp_sock *sp = sctp_sk(sk);
@@ -2583,7 +2595,8 @@ static int sctp_setsockopt_initmsg(struct sock *sk, char __user *optval, int opt
 *   to this call if the caller is using the UDP model.
 */
 static int sctp_setsockopt_default_send_param(struct sock *sk,
-                                                char __user *optval, int optlen)
+                                              char __user *optval,
+                                              unsigned int optlen)
 {
        struct sctp_sndrcvinfo info;
        struct sctp_association *asoc;
@@ -2622,7 +2635,7 @@ static int sctp_setsockopt_default_send_param(struct sock *sk,
 * association peer's addresses.
 */
 static int sctp_setsockopt_primary_addr(struct sock *sk, char __user *optval,
-                                        int optlen)
+                                        unsigned int optlen)
 {
        struct sctp_prim prim;
        struct sctp_transport *trans;
@@ -2651,7 +2664,7 @@ static int sctp_setsockopt_primary_addr(struct sock *sk, char __user *optval,
 *  integer boolean flag.
 */
 static int sctp_setsockopt_nodelay(struct sock *sk, char __user *optval,
-                                        int optlen)
+                                   unsigned int optlen)
 {
        int val;
@@ -2676,7 +2689,8 @@ static int sctp_setsockopt_nodelay(struct sock *sk, char __user *optval,
 * be changed.
 *
 */
-static int sctp_setsockopt_rtoinfo(struct sock *sk, char __user *optval, int optlen) {
+static int sctp_setsockopt_rtoinfo(struct sock *sk, char __user *optval, unsigned int optlen)
+{
        struct sctp_rtoinfo rtoinfo;
        struct sctp_association *asoc;
@@ -2728,7 +2742,7 @@ static int sctp_setsockopt_rtoinfo(struct sock *sk, char __user *optval, int opt
 * See [SCTP] for more information.
 *
 */
-static int sctp_setsockopt_associnfo(struct sock *sk, char __user *optval, int optlen)
+static int sctp_setsockopt_associnfo(struct sock *sk, char __user *optval, unsigned int optlen)
 {
        struct sctp_assocparams assocparams;
@@ -2800,7 +2814,7 @@ static int sctp_setsockopt_associnfo(struct sock *sk, char __user *optval, int o
 * addresses and a user will receive both PF_INET6 and PF_INET type
 * addresses on the socket.
 */
-static int sctp_setsockopt_mappedv4(struct sock *sk, char __user *optval, int optlen)
+static int sctp_setsockopt_mappedv4(struct sock *sk, char __user *optval, unsigned int optlen)
 {
        int val;
        struct sctp_sock *sp = sctp_sk(sk);
@@ -2844,7 +2858,7 @@ static int sctp_setsockopt_mappedv4(struct sock *sk, char __user *optval, int op
 *    changed (effecting future associations only).
 * assoc_value:  This parameter specifies the maximum size in bytes.
 */
-static int sctp_setsockopt_maxseg(struct sock *sk, char __user *optval, int optlen)
+static int sctp_setsockopt_maxseg(struct sock *sk, char __user *optval, unsigned int optlen)
 {
        struct sctp_assoc_value params;
        struct sctp_association *asoc;
@@ -2899,7 +2913,7 @@ static int sctp_setsockopt_maxseg(struct sock *sk, char __user *optval, int optl
 *   set primary request:
 */
 static int sctp_setsockopt_peer_primary_addr(struct sock *sk, char __user *optval,
-                                             int optlen)
+                                             unsigned int optlen)
 {
        struct sctp_sock        *sp;
        struct sctp_endpoint    *ep;
@@ -2950,7 +2964,7 @@ static int sctp_setsockopt_peer_primary_addr(struct sock *sk, char __user *optva
 }
 static int sctp_setsockopt_adaptation_layer(struct sock *sk, char __user *optval,
-                                          int optlen)
+                                            unsigned int optlen)
 {
        struct sctp_setadaptation adaptation;
@@ -2979,7 +2993,7 @@ static int sctp_setsockopt_adaptation_layer(struct sock *sk, char __user *optval
 * saved with outbound messages.
 */
 static int sctp_setsockopt_context(struct sock *sk, char __user *optval,
-                                   int optlen)
+                                   unsigned int optlen)
 {
        struct sctp_assoc_value params;
        struct sctp_sock *sp;
@@ -3030,7 +3044,7 @@ static int sctp_setsockopt_context(struct sock *sk, char __user *optval,
 */
 static int sctp_setsockopt_fragment_interleave(struct sock *sk,
                                               char __user *optval,
-                                               int optlen)
+                                               unsigned int optlen)
 {
        int val;
@@ -3063,7 +3077,7 @@ static int sctp_setsockopt_fragment_interleave(struct sock *sk,
 */
 static int sctp_setsockopt_partial_delivery_point(struct sock *sk,
                                                  char __user *optval,
-                                                  int optlen)
+                                                  unsigned int optlen)
 {
        u32 val;
@@ -3096,7 +3110,7 @@ static int sctp_setsockopt_partial_delivery_point(struct sock *sk,
 */
 static int sctp_setsockopt_maxburst(struct sock *sk,
                                    char __user *optval,
-                                    int optlen)
+                                    unsigned int optlen)
 {
        struct sctp_assoc_value params;
        struct sctp_sock *sp;
@@ -3140,8 +3154,8 @@ static int sctp_setsockopt_maxburst(struct sock *sk,
 * will only effect future associations on the socket.
 */
 static int sctp_setsockopt_auth_chunk(struct sock *sk,
-                                    char __user *optval,
+                                      char __user *optval,
-                                    int optlen)
+                                      unsigned int optlen)
 {
        struct sctp_authchunk val;
@@ -3172,8 +3186,8 @@ static int sctp_setsockopt_auth_chunk(struct sock *sk,
 * endpoint requires the peer to use.
 */
 static int sctp_setsockopt_hmac_ident(struct sock *sk,
-                                    char __user *optval,
+                                      char __user *optval,
-                                    int optlen)
+                                      unsigned int optlen)
 {
        struct sctp_hmacalgo *hmacs;
        u32 idents;
@@ -3215,7 +3229,7 @@ out:
 */
 static int sctp_setsockopt_auth_key(struct sock *sk,
                                    char __user *optval,
-                                    int optlen)
+                                    unsigned int optlen)
 {
        struct sctp_authkey *authkey;
        struct sctp_association *asoc;
@@ -3260,8 +3274,8 @@ out:
 * the association shared key.
 */
 static int sctp_setsockopt_active_key(struct sock *sk,
-                                        char __user *optval,
+                                      char __user *optval,
-                                        int optlen)
+                                      unsigned int optlen)
 {
        struct sctp_authkeyid val;
        struct sctp_association *asoc;
@@ -3288,8 +3302,8 @@ static int sctp_setsockopt_active_key(struct sock *sk,
 * This set option will delete a shared secret key from use.
 */
 static int sctp_setsockopt_del_key(struct sock *sk,
-                                        char __user *optval,
+                                   char __user *optval,
-                                        int optlen)
+                                   unsigned int optlen)
 {
        struct sctp_authkeyid val;
        struct sctp_association *asoc;
@@ -3332,7 +3346,7 @@ static int sctp_setsockopt_del_key(struct sock *sk,
 *   optlen  - the size of the buffer.
 */
 SCTP_STATIC int sctp_setsockopt(struct sock *sk, int level, int optname,
-                                char __user *optval, int optlen)
+                                char __user *optval, unsigned int optlen)
 {
        int retval = 0;
diff --git a/net/sctp/transport.c b/net/sctp/transport.c
index c256e4839316..37a1184d789f 100644
--- a/net/sctp/transport.c
+++ b/net/sctp/transport.c
@@ -74,7 +74,7 @@ static struct sctp_transport *sctp_transport_init(struct sctp_transport *peer,
         * given destination transport address, set RTO to the protocol
         * parameter 'RTO.Initial'.
         */
-        peer->last_rto = peer->rto = msecs_to_jiffies(sctp_rto_initial);
+        peer->rto = msecs_to_jiffies(sctp_rto_initial);
        peer->rtt = 0;
        peer->rttvar = 0;
        peer->srtt = 0;
@@ -308,7 +308,8 @@ void sctp_transport_route(struct sctp_transport *transport,
                /* Initialize sk->sk_rcv_saddr, if the transport is the
                 * association's active path for getsockname().
                 */
-                if (asoc && (transport == asoc->peer.active_path))
+                if (asoc && (!asoc->peer.primary_path ||
+                                (transport == asoc->peer.active_path)))
                        opt->pf->af->to_sk_saddr(&transport->saddr,
                                                 asoc->base.sk);
        } else
@@ -385,7 +386,6 @@ void sctp_transport_update_rto(struct sctp_transport *tp, __u32 rtt)
                tp->rto = tp->asoc->rto_max;
        tp->rtt = rtt;
-        tp->last_rto = tp->rto;
        /* Reset rto_pending so that a new RTT measurement is started when a
         * new data chunk is sent.
@@ -601,7 +601,7 @@ void sctp_transport_reset(struct sctp_transport *t)
         */
        t->cwnd = min(4*asoc->pathmtu, max_t(__u32, 2*asoc->pathmtu, 4380));
        t->ssthresh = asoc->peer.i.a_rwnd;
-        t->last_rto = t->rto = asoc->rto_initial;
+        t->rto = asoc->rto_initial;
        t->rtt = 0;
        t->srtt = 0;
        t->rttvar = 0;
diff --git a/net/socket.c b/net/socket.c
index 2a022c00d85c..75655365b5fd 100644
--- a/net/socket.c
+++ b/net/socket.c
@@ -86,6 +86,7 @@
 #include <linux/audit.h>
 #include <linux/wireless.h>
 #include <linux/nsproxy.h>
+#include <linux/magic.h>
 #include <asm/uaccess.h>
 #include <asm/unistd.h>
@@ -235,8 +236,6 @@ int move_addr_to_user(struct sockaddr *kaddr, int klen, void __user *uaddr,
        return __put_user(klen, ulen);
 }
-#define SOCKFS_MAGIC 0x534F434B
 static struct kmem_cache *sock_inode_cachep __read_mostly;
 static struct inode *sock_alloc_inode(struct super_block *sb)
@@ -285,7 +284,7 @@ static int init_inodecache(void)
        return 0;
 }
-static struct super_operations sockfs_ops = {
+static const struct super_operations sockfs_ops = {
        .alloc_inode =  sock_alloc_inode,
        .destroy_inode =sock_destroy_inode,
        .statfs =       simple_statfs,
@@ -2099,12 +2098,17 @@ SYSCALL_DEFINE2(socketcall, int, call, unsigned long __user *, args)
        unsigned long a[6];
        unsigned long a0, a1;
        int err;
+        unsigned int len;
        if (call < 1 || call > SYS_ACCEPT4)
                return -EINVAL;
+        len = nargs[call];
+        if (len > sizeof(a))
+                return -EINVAL;
        /* copy_from_user should be SMP safe. */
-        if (copy_from_user(a, args, nargs[call]))
+        if (copy_from_user(a, args, len))
                return -EFAULT;
        audit_socketcall(nargs[call] / sizeof(unsigned long), a);
@@ -2387,7 +2391,7 @@ int kernel_getsockopt(struct socket *sock, int level, int optname,
 }
 int kernel_setsockopt(struct socket *sock, int level, int optname,
-                        char *optval, int optlen)
+                        char *optval, unsigned int optlen)
 {
        mm_segment_t oldfs = get_fs();
        int err;
diff --git a/net/sunrpc/addr.c b/net/sunrpc/addr.c
index 22e8fd89477f..c7450c8f0a7c 100644
--- a/net/sunrpc/addr.c
+++ b/net/sunrpc/addr.c
@@ -306,24 +306,25 @@ EXPORT_SYMBOL_GPL(rpc_sockaddr2uaddr);
 * @sap: buffer into which to plant socket address
 * @salen: size of buffer
 *
+ * @uaddr does not have to be '\0'-terminated, but strict_strtoul() and
+ * rpc_pton() require proper string termination to be successful.
+ *
 * Returns the size of the socket address if successful; otherwise
 * zero is returned.
 */
 size_t rpc_uaddr2sockaddr(const char *uaddr, const size_t uaddr_len,
                          struct sockaddr *sap, const size_t salen)
 {
-        char *c, buf[RPCBIND_MAXUADDRLEN];
+        char *c, buf[RPCBIND_MAXUADDRLEN + sizeof('\0')];
        unsigned long portlo, porthi;
        unsigned short port;
-        if (uaddr_len > sizeof(buf))
+        if (uaddr_len > RPCBIND_MAXUADDRLEN)
                return 0;
        memcpy(buf, uaddr, uaddr_len);
-        buf[uaddr_len] = '\n';
+        buf[uaddr_len] = '\0';
-        buf[uaddr_len + 1] = '\0';
        c = strrchr(buf, '.');
        if (unlikely(c == NULL))
                return 0;
@@ -332,9 +333,7 @@ size_t rpc_uaddr2sockaddr(const char *uaddr, const size_t uaddr_len,
        if (unlikely(portlo > 255))
                return 0;
-        c[0] = '\n';
+        *c = '\0';
-        c[1] = '\0';
        c = strrchr(buf, '.');
        if (unlikely(c == NULL))
                return 0;
@@ -345,8 +344,7 @@ size_t rpc_uaddr2sockaddr(const char *uaddr, const size_t uaddr_len,
        port = (unsigned short)((porthi << 8) | portlo);
-        c[0] = '\0';
+        *c = '\0';
        if (rpc_pton(buf, strlen(buf), sap, salen) == 0)
                return 0;
diff --git a/net/sunrpc/auth.c b/net/sunrpc/auth.c
index 0c431c277af5..54a4e042f104 100644
--- a/net/sunrpc/auth.c
+++ b/net/sunrpc/auth.c
@@ -385,7 +385,7 @@ rpcauth_init_cred(struct rpc_cred *cred, const struct auth_cred *acred,
 EXPORT_SYMBOL_GPL(rpcauth_init_cred);
 void
-rpcauth_generic_bind_cred(struct rpc_task *task, struct rpc_cred *cred)
+rpcauth_generic_bind_cred(struct rpc_task *task, struct rpc_cred *cred, int lookupflags)
 {
        task->tk_msg.rpc_cred = get_rpccred(cred);
        dprintk("RPC: %5u holding %s cred %p\n", task->tk_pid,
@@ -394,7 +394,7 @@ rpcauth_generic_bind_cred(struct rpc_task *task, struct rpc_cred *cred)
 EXPORT_SYMBOL_GPL(rpcauth_generic_bind_cred);
 static void
-rpcauth_bind_root_cred(struct rpc_task *task)
+rpcauth_bind_root_cred(struct rpc_task *task, int lookupflags)
 {
        struct rpc_auth *auth = task->tk_client->cl_auth;
        struct auth_cred acred = {
@@ -405,7 +405,7 @@ rpcauth_bind_root_cred(struct rpc_task *task)
        dprintk("RPC: %5u looking up %s cred\n",
                task->tk_pid, task->tk_client->cl_auth->au_ops->au_name);
-        ret = auth->au_ops->lookup_cred(auth, &acred, 0);
+        ret = auth->au_ops->lookup_cred(auth, &acred, lookupflags);
        if (!IS_ERR(ret))
                task->tk_msg.rpc_cred = ret;
        else
@@ -413,14 +413,14 @@ rpcauth_bind_root_cred(struct rpc_task *task)
 }
 static void
-rpcauth_bind_new_cred(struct rpc_task *task)
+rpcauth_bind_new_cred(struct rpc_task *task, int lookupflags)
 {
        struct rpc_auth *auth = task->tk_client->cl_auth;
        struct rpc_cred *ret;
        dprintk("RPC: %5u looking up %s cred\n",
                task->tk_pid, auth->au_ops->au_name);
-        ret = rpcauth_lookupcred(auth, 0);
+        ret = rpcauth_lookupcred(auth, lookupflags);
        if (!IS_ERR(ret))
                task->tk_msg.rpc_cred = ret;
        else
@@ -430,12 +430,16 @@ rpcauth_bind_new_cred(struct rpc_task *task)
 void
 rpcauth_bindcred(struct rpc_task *task, struct rpc_cred *cred, int flags)
 {
+        int lookupflags = 0;
+        if (flags & RPC_TASK_ASYNC)
+                lookupflags |= RPCAUTH_LOOKUP_NEW;
        if (cred != NULL)
-                cred->cr_ops->crbind(task, cred);
+                cred->cr_ops->crbind(task, cred, lookupflags);
        else if (flags & RPC_TASK_ROOTCREDS)
-                rpcauth_bind_root_cred(task);
+                rpcauth_bind_root_cred(task, lookupflags);
        else
-                rpcauth_bind_new_cred(task);
+                rpcauth_bind_new_cred(task, lookupflags);
 }
 void
diff --git a/net/sunrpc/auth_generic.c b/net/sunrpc/auth_generic.c
index 4028502f0528..bf88bf8e9365 100644
--- a/net/sunrpc/auth_generic.c
+++ b/net/sunrpc/auth_generic.c
@@ -55,13 +55,13 @@ struct rpc_cred *rpc_lookup_machine_cred(void)
 EXPORT_SYMBOL_GPL(rpc_lookup_machine_cred);
 static void
-generic_bind_cred(struct rpc_task *task, struct rpc_cred *cred)
+generic_bind_cred(struct rpc_task *task, struct rpc_cred *cred, int lookupflags)
 {
        struct rpc_auth *auth = task->tk_client->cl_auth;
        struct auth_cred *acred = &container_of(cred, struct generic_cred, gc_base)->acred;
        struct rpc_cred *ret;
-        ret = auth->au_ops->lookup_cred(auth, acred, 0);
+        ret = auth->au_ops->lookup_cred(auth, acred, lookupflags);
        if (!IS_ERR(ret))
                task->tk_msg.rpc_cred = ret;
        else
diff --git a/net/sunrpc/auth_gss/svcauth_gss.c b/net/sunrpc/auth_gss/svcauth_gss.c
index 2e6a148d277c..f6c51e562a02 100644
--- a/net/sunrpc/auth_gss/svcauth_gss.c
+++ b/net/sunrpc/auth_gss/svcauth_gss.c
@@ -1374,8 +1374,10 @@ svcauth_gss_release(struct svc_rqst *rqstp)
                if (stat)
                        goto out_err;
                break;
-        default:
+        /*
-                goto out_err;
+         * For any other gc_svc value, svcauth_gss_accept() already set
+         * the auth_error appropriately; just fall through:
+         */
        }
 out:
diff --git a/net/sunrpc/auth_null.c b/net/sunrpc/auth_null.c
index c70dd7f5258e..1db618f56ecb 100644
--- a/net/sunrpc/auth_null.c
+++ b/net/sunrpc/auth_null.c
@@ -8,7 +8,6 @@
 #include <linux/types.h>
 #include <linux/module.h>
-#include <linux/utsname.h>
 #include <linux/sunrpc/clnt.h>
 #ifdef RPC_DEBUG
diff --git a/net/sunrpc/cache.c b/net/sunrpc/cache.c
index 45cdaff9b361..d6eee291a0e2 100644
--- a/net/sunrpc/cache.c
+++ b/net/sunrpc/cache.c
@@ -103,23 +103,21 @@ struct cache_head *sunrpc_cache_lookup(struct cache_detail *detail,
 EXPORT_SYMBOL_GPL(sunrpc_cache_lookup);
-static void queue_loose(struct cache_detail *detail, struct cache_head *ch);
+static void cache_dequeue(struct cache_detail *detail, struct cache_head *ch);
-static int cache_fresh_locked(struct cache_head *head, time_t expiry)
+static void cache_fresh_locked(struct cache_head *head, time_t expiry)
 {
        head->expiry_time = expiry;
        head->last_refresh = get_seconds();
-        return !test_and_set_bit(CACHE_VALID, &head->flags);
+        set_bit(CACHE_VALID, &head->flags);
 }
 static void cache_fresh_unlocked(struct cache_head *head,
-                        struct cache_detail *detail, int new)
+                                 struct cache_detail *detail)
 {
-        if (new)
-                cache_revisit_request(head);
        if (test_and_clear_bit(CACHE_PENDING, &head->flags)) {
                cache_revisit_request(head);
-                queue_loose(detail, head);
+                cache_dequeue(detail, head);
        }
 }
@@ -132,7 +130,6 @@ struct cache_head *sunrpc_cache_update(struct cache_detail *detail,
         */
        struct cache_head **head;
        struct cache_head *tmp;
-        int is_new;
        if (!test_bit(CACHE_VALID, &old->flags)) {
                write_lock(&detail->hash_lock);
@@ -141,9 +138,9 @@ struct cache_head *sunrpc_cache_update(struct cache_detail *detail,
                                set_bit(CACHE_NEGATIVE, &old->flags);
                        else
                                detail->update(old, new);
-                        is_new = cache_fresh_locked(old, new->expiry_time);
+                        cache_fresh_locked(old, new->expiry_time);
                        write_unlock(&detail->hash_lock);
-                        cache_fresh_unlocked(old, detail, is_new);
+                        cache_fresh_unlocked(old, detail);
                        return old;
                }
                write_unlock(&detail->hash_lock);
@@ -167,11 +164,11 @@ struct cache_head *sunrpc_cache_update(struct cache_detail *detail,
        *head = tmp;
        detail->entries++;
        cache_get(tmp);
-        is_new = cache_fresh_locked(tmp, new->expiry_time);
+        cache_fresh_locked(tmp, new->expiry_time);
        cache_fresh_locked(old, 0);
        write_unlock(&detail->hash_lock);
-        cache_fresh_unlocked(tmp, detail, is_new);
+        cache_fresh_unlocked(tmp, detail);
-        cache_fresh_unlocked(old, detail, 0);
+        cache_fresh_unlocked(old, detail);
        cache_put(old, detail);
        return tmp;
 }
@@ -184,6 +181,22 @@ static int cache_make_upcall(struct cache_detail *cd, struct cache_head *h)
        return cd->cache_upcall(cd, h);
 }
+static inline int cache_is_valid(struct cache_detail *detail, struct cache_head *h)
+{
+        if (!test_bit(CACHE_VALID, &h->flags) ||
+            h->expiry_time < get_seconds())
+                return -EAGAIN;
+        else if (detail->flush_time > h->last_refresh)
+                return -EAGAIN;
+        else {
+                /* entry is valid */
+                if (test_bit(CACHE_NEGATIVE, &h->flags))
+                        return -ENOENT;
+                else
+                        return 0;
+        }
+}
 /*
 * This is the generic cache management routine for all
 * the authentication caches.
@@ -192,8 +205,10 @@ static int cache_make_upcall(struct cache_detail *cd, struct cache_head *h)
 *
 *
 * Returns 0 if the cache_head can be used, or cache_puts it and returns
- * -EAGAIN if upcall is pending,
+ * -EAGAIN if upcall is pending and request has been queued
- * -ETIMEDOUT if upcall failed and should be retried,
+ * -ETIMEDOUT if upcall failed or request could not be queue or
+ *           upcall completed but item is still invalid (implying that
+ *           the cache item has been replaced with a newer one).
 * -ENOENT if cache entry was negative
 */
 int cache_check(struct cache_detail *detail,
@@ -203,17 +218,7 @@ int cache_check(struct cache_detail *detail,
        long refresh_age, age;
        /* First decide return status as best we can */
-        if (!test_bit(CACHE_VALID, &h->flags) ||
+        rv = cache_is_valid(detail, h);
-            h->expiry_time < get_seconds())
-                rv = -EAGAIN;
-        else if (detail->flush_time > h->last_refresh)
-                rv = -EAGAIN;
-        else {
-                /* entry is valid */
-                if (test_bit(CACHE_NEGATIVE, &h->flags))
-                        rv = -ENOENT;
-                else rv = 0;
-        }
        /* now see if we want to start an upcall */
        refresh_age = (h->expiry_time - h->last_refresh);
@@ -229,10 +234,11 @@ int cache_check(struct cache_detail *detail,
                        switch (cache_make_upcall(detail, h)) {
                        case -EINVAL:
                                clear_bit(CACHE_PENDING, &h->flags);
+                                cache_revisit_request(h);
                                if (rv == -EAGAIN) {
                                        set_bit(CACHE_NEGATIVE, &h->flags);
-                                        cache_fresh_unlocked(h, detail,
+                                        cache_fresh_locked(h, get_seconds()+CACHE_NEW_EXPIRY);
-                                             cache_fresh_locked(h, get_seconds()+CACHE_NEW_EXPIRY));
+                                        cache_fresh_unlocked(h, detail);
                                        rv = -ENOENT;
                                }
                                break;
@@ -245,10 +251,14 @@ int cache_check(struct cache_detail *detail,
                }
        }
-        if (rv == -EAGAIN)
+        if (rv == -EAGAIN) {
-                if (cache_defer_req(rqstp, h) != 0)
+                if (cache_defer_req(rqstp, h) < 0) {
-                        rv = -ETIMEDOUT;
+                        /* Request is not deferred */
+                        rv = cache_is_valid(detail, h);
+                        if (rv == -EAGAIN)
+                                rv = -ETIMEDOUT;
+                }
+        }
        if (rv)
                cache_put(h, detail);
        return rv;
@@ -396,7 +406,7 @@ static int cache_clean(void)
                                )
                                continue;
                        if (test_and_clear_bit(CACHE_PENDING, &ch->flags))
-                                queue_loose(current_detail, ch);
+                                cache_dequeue(current_detail, ch);
                        if (atomic_read(&ch->ref.refcount) == 1)
                                break;
@@ -412,8 +422,10 @@ static int cache_clean(void)
                if (!ch)
                        current_index ++;
                spin_unlock(&cache_list_lock);
-                if (ch)
+                if (ch) {
+                        cache_revisit_request(ch);
                        cache_put(ch, d);
+                }
        } else
                spin_unlock(&cache_list_lock);
@@ -488,7 +500,7 @@ static int cache_defer_cnt;
 static int cache_defer_req(struct cache_req *req, struct cache_head *item)
 {
-        struct cache_deferred_req *dreq;
+        struct cache_deferred_req *dreq, *discard;
        int hash = DFR_HASH(item);
        if (cache_defer_cnt >= DFR_MAX) {
@@ -496,11 +508,11 @@ static int cache_defer_req(struct cache_req *req, struct cache_head *item)
                 * or continue and drop the oldest below
                 */
                if (net_random()&1)
-                        return -ETIMEDOUT;
+                        return -ENOMEM;
        }
        dreq = req->defer(req);
        if (dreq == NULL)
-                return -ETIMEDOUT;
+                return -ENOMEM;
        dreq->item = item;
@@ -513,23 +525,24 @@ static int cache_defer_req(struct cache_req *req, struct cache_head *item)
        list_add(&dreq->hash, &cache_defer_hash[hash]);
        /* it is in, now maybe clean up */
-        dreq = NULL;
+        discard = NULL;
        if (++cache_defer_cnt > DFR_MAX) {
-                dreq = list_entry(cache_defer_list.prev,
+                discard = list_entry(cache_defer_list.prev,
-                                  struct cache_deferred_req, recent);
+                                     struct cache_deferred_req, recent);
-                list_del(&dreq->recent);
+                list_del_init(&discard->recent);
-                list_del(&dreq->hash);
+                list_del_init(&discard->hash);
                cache_defer_cnt--;
        }
        spin_unlock(&cache_defer_lock);
-        if (dreq) {
+        if (discard)
                /* there was one too many */
-                dreq->revisit(dreq, 1);
+                discard->revisit(discard, 1);
-        }
        if (!test_bit(CACHE_PENDING, &item->flags)) {
                /* must have just been validated... */
                cache_revisit_request(item);
+                return -EAGAIN;
        }
        return 0;
 }
@@ -551,7 +564,7 @@ static void cache_revisit_request(struct cache_head *item)
                        dreq = list_entry(lp, struct cache_deferred_req, hash);
                        lp = lp->next;
                        if (dreq->item == item) {
-                                list_del(&dreq->hash);
+                                list_del_init(&dreq->hash);
                                list_move(&dreq->recent, &pending);
                                cache_defer_cnt--;
                        }
@@ -577,7 +590,7 @@ void cache_clean_deferred(void *owner)
        list_for_each_entry_safe(dreq, tmp, &cache_defer_list, recent) {
                if (dreq->owner == owner) {
-                        list_del(&dreq->hash);
+                        list_del_init(&dreq->hash);
                        list_move(&dreq->recent, &pending);
                        cache_defer_cnt--;
                }
@@ -887,7 +900,7 @@ static int cache_release(struct inode *inode, struct file *filp,
-static void queue_loose(struct cache_detail *detail, struct cache_head *ch)
+static void cache_dequeue(struct cache_detail *detail, struct cache_head *ch)
 {
        struct cache_queue *cq;
        spin_lock(&queue_lock);
diff --git a/net/sunrpc/clnt.c b/net/sunrpc/clnt.c
index fac0ca93f06b..38829e20500b 100644
--- a/net/sunrpc/clnt.c
+++ b/net/sunrpc/clnt.c
@@ -288,6 +288,7 @@ struct rpc_clnt *rpc_create(struct rpc_create_args *args)
                .srcaddr = args->saddress,
                .dstaddr = args->address,
                .addrlen = args->addrsize,
+                .bc_xprt = args->bc_xprt,
        };
        char servername[48];
@@ -639,10 +640,11 @@ EXPORT_SYMBOL_GPL(rpc_call_async);
 /**
 * rpc_run_bc_task - Allocate a new RPC task for backchannel use, then run
 * rpc_execute against it
- * @ops: RPC call ops
+ * @req: RPC request
+ * @tk_ops: RPC call ops
 */
 struct rpc_task *rpc_run_bc_task(struct rpc_rqst *req,
-                                        const struct rpc_call_ops *tk_ops)
+                                const struct rpc_call_ops *tk_ops)
 {
        struct rpc_task *task;
        struct xdr_buf *xbufp = &req->rq_snd_buf;
diff --git a/net/sunrpc/rpc_pipe.c b/net/sunrpc/rpc_pipe.c
index 7f676bdf70d3..49278f830367 100644
--- a/net/sunrpc/rpc_pipe.c
+++ b/net/sunrpc/rpc_pipe.c
@@ -860,7 +860,8 @@ static void rpc_clntdir_depopulate(struct dentry *dentry)
 /**
 * rpc_create_client_dir - Create a new rpc_client directory in rpc_pipefs
- * @path: path from the rpc_pipefs root to the new directory
+ * @dentry: dentry from the rpc_pipefs root to the new directory
+ * @name: &struct qstr for the name
 * @rpc_client: rpc client to associate with this directory
 *
 * This creates a directory at the given @path associated with
@@ -930,7 +931,7 @@ void rpc_remove_cache_dir(struct dentry *dentry)
 /*
 * populate the filesystem
 */
-static struct super_operations s_ops = {
+static const struct super_operations s_ops = {
        .alloc_inode    = rpc_alloc_inode,
        .destroy_inode  = rpc_destroy_inode,
        .statfs         = simple_statfs,
diff --git a/net/sunrpc/sched.c b/net/sunrpc/sched.c
index 8f459abe97cf..cef74ba0666c 100644
--- a/net/sunrpc/sched.c
+++ b/net/sunrpc/sched.c
@@ -21,6 +21,8 @@
 #include <linux/sunrpc/clnt.h>
+#include "sunrpc.h"
 #ifdef RPC_DEBUG
 #define RPCDBG_FACILITY         RPCDBG_SCHED
 #define RPC_TASK_MAGIC_ID       0xf00baa
@@ -711,11 +713,6 @@ static void rpc_async_schedule(struct work_struct *work)
        __rpc_execute(container_of(work, struct rpc_task, u.tk_work));
 }
-struct rpc_buffer {
-        size_t  len;
-        char    data[];
-};
 /**
 * rpc_malloc - allocate an RPC buffer
 * @task: RPC task that will use this buffer
diff --git a/net/sunrpc/sunrpc.h b/net/sunrpc/sunrpc.h
index 5d9dd742264b..90c292e2738b 100644
--- a/net/sunrpc/sunrpc.h
+++ b/net/sunrpc/sunrpc.h
@@ -27,11 +27,25 @@ SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 #ifndef _NET_SUNRPC_SUNRPC_H
 #define _NET_SUNRPC_SUNRPC_H
+#include <linux/net.h>
+/*
+ * Header for dynamically allocated rpc buffers.
+ */
+struct rpc_buffer {
+        size_t  len;
+        char    data[];
+};
 static inline int rpc_reply_expected(struct rpc_task *task)
 {
        return (task->tk_msg.rpc_proc != NULL) &&
                (task->tk_msg.rpc_proc->p_decode != NULL);
 }
+int svc_send_common(struct socket *sock, struct xdr_buf *xdr,
+                    struct page *headpage, unsigned long headoffset,
+                    struct page *tailpage, unsigned long tailoffset);
 #endif /* _NET_SUNRPC_SUNRPC_H */
diff --git a/net/sunrpc/svc_xprt.c b/net/sunrpc/svc_xprt.c
index 27d44332f017..df124f78ee48 100644
--- a/net/sunrpc/svc_xprt.c
+++ b/net/sunrpc/svc_xprt.c
@@ -160,6 +160,7 @@ void svc_xprt_init(struct svc_xprt_class *xcl, struct svc_xprt *xprt,
        mutex_init(&xprt->xpt_mutex);
        spin_lock_init(&xprt->xpt_lock);
        set_bit(XPT_BUSY, &xprt->xpt_flags);
+        rpc_init_wait_queue(&xprt->xpt_bc_pending, "xpt_bc_pending");
 }
 EXPORT_SYMBOL_GPL(svc_xprt_init);
@@ -710,10 +711,7 @@ int svc_recv(struct svc_rqst *rqstp, long timeout)
        spin_unlock_bh(&pool->sp_lock);
        len = 0;
-        if (test_bit(XPT_CLOSE, &xprt->xpt_flags)) {
+        if (test_bit(XPT_LISTENER, &xprt->xpt_flags)) {
-                dprintk("svc_recv: found XPT_CLOSE\n");
-                svc_delete_xprt(xprt);
-        } else if (test_bit(XPT_LISTENER, &xprt->xpt_flags)) {
                struct svc_xprt *newxpt;
                newxpt = xprt->xpt_ops->xpo_accept(xprt);
                if (newxpt) {
@@ -739,7 +737,7 @@ int svc_recv(struct svc_rqst *rqstp, long timeout)
                        svc_xprt_received(newxpt);
                }
                svc_xprt_received(xprt);
-        } else {
+        } else if (!test_bit(XPT_CLOSE, &xprt->xpt_flags)) {
                dprintk("svc: server %p, pool %u, transport %p, inuse=%d\n",
                        rqstp, pool->sp_id, xprt,
                        atomic_read(&xprt->xpt_ref.refcount));
@@ -752,6 +750,11 @@ int svc_recv(struct svc_rqst *rqstp, long timeout)
                dprintk("svc: got len=%d\n", len);
        }
+        if (test_bit(XPT_CLOSE, &xprt->xpt_flags)) {
+                dprintk("svc_recv: found XPT_CLOSE\n");
+                svc_delete_xprt(xprt);
+        }
        /* No data, incomplete (TCP) read, or accept() */
        if (len == 0 || len == -EAGAIN) {
                rqstp->rq_res.len = 0;
@@ -808,6 +811,7 @@ int svc_send(struct svc_rqst *rqstp)
        else
                len = xprt->xpt_ops->xpo_sendto(rqstp);
        mutex_unlock(&xprt->xpt_mutex);
+        rpc_wake_up(&xprt->xpt_bc_pending);
        svc_xprt_release(rqstp);
        if (len == -ECONNREFUSED || len == -ENOTCONN || len == -EAGAIN)
@@ -1166,11 +1170,6 @@ static void *svc_pool_stats_start(struct seq_file *m, loff_t *pos)
        dprintk("svc_pool_stats_start, *pidx=%u\n", pidx);
-        lock_kernel();
-        /* bump up the pseudo refcount while traversing */
-        svc_get(serv);
-        unlock_kernel();
        if (!pidx)
                return SEQ_START_TOKEN;
        return (pidx > serv->sv_nrpools ? NULL : &serv->sv_pools[pidx-1]);
@@ -1198,12 +1197,6 @@ static void *svc_pool_stats_next(struct seq_file *m, void *p, loff_t *pos)
 static void svc_pool_stats_stop(struct seq_file *m, void *p)
 {
-        struct svc_serv *serv = m->private;
-        lock_kernel();
-        /* this function really, really should have been called svc_put() */
-        svc_destroy(serv);
-        unlock_kernel();
 }
 static int svc_pool_stats_show(struct seq_file *m, void *p)
diff --git a/net/sunrpc/svcauth_unix.c b/net/sunrpc/svcauth_unix.c
index 6caffa34ac01..117f68a8aa40 100644
--- a/net/sunrpc/svcauth_unix.c
+++ b/net/sunrpc/svcauth_unix.c
@@ -668,6 +668,7 @@ static int unix_gid_find(uid_t uid, struct group_info **gip,
        case 0:
                *gip = ug->gi;
                get_group_info(*gip);
+                cache_put(&ug->h, &unix_gid_cache);
                return 0;
        default:
                return -EAGAIN;
diff --git a/net/sunrpc/svcsock.c b/net/sunrpc/svcsock.c
index 23128ee191ae..1c246a4f491e 100644
--- a/net/sunrpc/svcsock.c
+++ b/net/sunrpc/svcsock.c
@@ -49,6 +49,7 @@
 #include <linux/sunrpc/msg_prot.h>
 #include <linux/sunrpc/svcsock.h>
 #include <linux/sunrpc/stats.h>
+#include <linux/sunrpc/xprt.h>
 #define RPCDBG_FACILITY RPCDBG_SVCXPRT
@@ -110,7 +111,7 @@ static void svc_release_skb(struct svc_rqst *rqstp)
                rqstp->rq_xprt_ctxt = NULL;
                dprintk("svc: service %p, releasing skb %p\n", rqstp, skb);
-                skb_free_datagram(svsk->sk_sk, skb);
+                skb_free_datagram_locked(svsk->sk_sk, skb);
        }
 }
@@ -153,49 +154,27 @@ static void svc_set_cmsg_data(struct svc_rqst *rqstp, struct cmsghdr *cmh)
 }
 /*
- * Generic sendto routine
+ * send routine intended to be shared by the fore- and back-channel
 */
-static int svc_sendto(struct svc_rqst *rqstp, struct xdr_buf *xdr)
+int svc_send_common(struct socket *sock, struct xdr_buf *xdr,
+                    struct page *headpage, unsigned long headoffset,
+                    struct page *tailpage, unsigned long tailoffset)
 {
-        struct svc_sock *svsk =
-                container_of(rqstp->rq_xprt, struct svc_sock, sk_xprt);
-        struct socket   *sock = svsk->sk_sock;
-        int             slen;
-        union {
-                struct cmsghdr  hdr;
-                long            all[SVC_PKTINFO_SPACE / sizeof(long)];
-        } buffer;
-        struct cmsghdr *cmh = &buffer.hdr;
-        int             len = 0;
        int             result;
        int             size;
        struct page     **ppage = xdr->pages;
        size_t          base = xdr->page_base;
        unsigned int    pglen = xdr->page_len;
        unsigned int    flags = MSG_MORE;
-        RPC_IFDEBUG(char buf[RPC_MAX_ADDRBUFLEN]);
+        int             slen;
+        int             len = 0;
        slen = xdr->len;
-        if (rqstp->rq_prot == IPPROTO_UDP) {
-                struct msghdr msg = {
-                        .msg_name       = &rqstp->rq_addr,
-                        .msg_namelen    = rqstp->rq_addrlen,
-                        .msg_control    = cmh,
-                        .msg_controllen = sizeof(buffer),
-                        .msg_flags      = MSG_MORE,
-                };
-                svc_set_cmsg_data(rqstp, cmh);
-                if (sock_sendmsg(sock, &msg, 0) < 0)
-                        goto out;
-        }
        /* send head */
        if (slen == xdr->head[0].iov_len)
                flags = 0;
-        len = kernel_sendpage(sock, rqstp->rq_respages[0], 0,
+        len = kernel_sendpage(sock, headpage, headoffset,
                                  xdr->head[0].iov_len, flags);
        if (len != xdr->head[0].iov_len)
                goto out;
@@ -219,16 +198,58 @@ static int svc_sendto(struct svc_rqst *rqstp, struct xdr_buf *xdr)
                base = 0;
                ppage++;
        }
        /* send tail */
        if (xdr->tail[0].iov_len) {
-                result = kernel_sendpage(sock, rqstp->rq_respages[0],
+                result = kernel_sendpage(sock, tailpage, tailoffset,
-                                             ((unsigned long)xdr->tail[0].iov_base)
+                                   xdr->tail[0].iov_len, 0);
-                                                & (PAGE_SIZE-1),
-                                             xdr->tail[0].iov_len, 0);
                if (result > 0)
                        len += result;
        }
+out:
+        return len;
+}
+/*
+ * Generic sendto routine
+ */
+static int svc_sendto(struct svc_rqst *rqstp, struct xdr_buf *xdr)
+{
+        struct svc_sock *svsk =
+                container_of(rqstp->rq_xprt, struct svc_sock, sk_xprt);
+        struct socket   *sock = svsk->sk_sock;
+        union {
+                struct cmsghdr  hdr;
+                long            all[SVC_PKTINFO_SPACE / sizeof(long)];
+        } buffer;
+        struct cmsghdr *cmh = &buffer.hdr;
+        int             len = 0;
+        unsigned long tailoff;
+        unsigned long headoff;
+        RPC_IFDEBUG(char buf[RPC_MAX_ADDRBUFLEN]);
+        if (rqstp->rq_prot == IPPROTO_UDP) {
+                struct msghdr msg = {
+                        .msg_name       = &rqstp->rq_addr,
+                        .msg_namelen    = rqstp->rq_addrlen,
+                        .msg_control    = cmh,
+                        .msg_controllen = sizeof(buffer),
+                        .msg_flags      = MSG_MORE,
+                };
+                svc_set_cmsg_data(rqstp, cmh);
+                if (sock_sendmsg(sock, &msg, 0) < 0)
+                        goto out;
+        }
+        tailoff = ((unsigned long)xdr->tail[0].iov_base) & (PAGE_SIZE-1);
+        headoff = 0;
+        len = svc_send_common(sock, xdr, rqstp->rq_respages[0], headoff,
+                               rqstp->rq_respages[0], tailoff);
 out:
        dprintk("svc: socket %p sendto([%p %Zu... ], %d) = %d (addr %s)\n",
                svsk, xdr->head[0].iov_base, xdr->head[0].iov_len,
@@ -432,29 +453,49 @@ static void svc_tcp_write_space(struct sock *sk)
 }
 /*
+ * See net/ipv6/ip_sockglue.c : ip_cmsg_recv_pktinfo
+ */
+static int svc_udp_get_dest_address4(struct svc_rqst *rqstp,
+                                     struct cmsghdr *cmh)
+{
+        struct in_pktinfo *pki = CMSG_DATA(cmh);
+        if (cmh->cmsg_type != IP_PKTINFO)
+                return 0;
+        rqstp->rq_daddr.addr.s_addr = pki->ipi_spec_dst.s_addr;
+        return 1;
+}
+/*
+ * See net/ipv6/datagram.c : datagram_recv_ctl
+ */
+static int svc_udp_get_dest_address6(struct svc_rqst *rqstp,
+                                     struct cmsghdr *cmh)
+{
+        struct in6_pktinfo *pki = CMSG_DATA(cmh);
+        if (cmh->cmsg_type != IPV6_PKTINFO)
+                return 0;
+        ipv6_addr_copy(&rqstp->rq_daddr.addr6, &pki->ipi6_addr);
+        return 1;
+}
+/*
 * Copy the UDP datagram's destination address to the rqstp structure.
 * The 'destination' address in this case is the address to which the
 * peer sent the datagram, i.e. our local address. For multihomed
 * hosts, this can change from msg to msg. Note that only the IP
 * address changes, the port number should remain the same.
 */
-static void svc_udp_get_dest_address(struct svc_rqst *rqstp,
+static int svc_udp_get_dest_address(struct svc_rqst *rqstp,
-                                     struct cmsghdr *cmh)
+                                    struct cmsghdr *cmh)
 {
-        struct svc_sock *svsk =
+        switch (cmh->cmsg_level) {
-                container_of(rqstp->rq_xprt, struct svc_sock, sk_xprt);
+        case SOL_IP:
-        switch (svsk->sk_sk->sk_family) {
+                return svc_udp_get_dest_address4(rqstp, cmh);
-        case AF_INET: {
+        case SOL_IPV6:
-                struct in_pktinfo *pki = CMSG_DATA(cmh);
+                return svc_udp_get_dest_address6(rqstp, cmh);
-                rqstp->rq_daddr.addr.s_addr = pki->ipi_spec_dst.s_addr;
-                break;
-                }
-        case AF_INET6: {
-                struct in6_pktinfo *pki = CMSG_DATA(cmh);
-                ipv6_addr_copy(&rqstp->rq_daddr.addr6, &pki->ipi6_addr);
-                break;
-                }
        }
+        return 0;
 }
 /*
@@ -531,16 +572,15 @@ static int svc_udp_recvfrom(struct svc_rqst *rqstp)
        rqstp->rq_prot = IPPROTO_UDP;
-        if (cmh->cmsg_level != IPPROTO_IP ||
+        if (!svc_udp_get_dest_address(rqstp, cmh)) {
-            cmh->cmsg_type != IP_PKTINFO) {
                if (net_ratelimit())
-                        printk("rpcsvc: received unknown control message:"
+                        printk(KERN_WARNING
-                               "%d/%d\n",
+                                "svc: received unknown control message %d/%d; "
-                               cmh->cmsg_level, cmh->cmsg_type);
+                                "dropping RPC reply datagram\n",
-                skb_free_datagram(svsk->sk_sk, skb);
+                                        cmh->cmsg_level, cmh->cmsg_type);
+                skb_free_datagram_locked(svsk->sk_sk, skb);
                return 0;
        }
-        svc_udp_get_dest_address(rqstp, cmh);
        if (skb_is_nonlinear(skb)) {
                /* we have to copy */
@@ -548,18 +588,18 @@ static int svc_udp_recvfrom(struct svc_rqst *rqstp)
                if (csum_partial_copy_to_xdr(&rqstp->rq_arg, skb)) {
                        local_bh_enable();
                        /* checksum error */
-                        skb_free_datagram(svsk->sk_sk, skb);
+                        skb_free_datagram_locked(svsk->sk_sk, skb);
                        return 0;
                }
                local_bh_enable();
-                skb_free_datagram(svsk->sk_sk, skb);
+                skb_free_datagram_locked(svsk->sk_sk, skb);
        } else {
                /* we can use it in-place */
                rqstp->rq_arg.head[0].iov_base = skb->data +
                        sizeof(struct udphdr);
                rqstp->rq_arg.head[0].iov_len = len;
                if (skb_checksum_complete(skb)) {
-                        skb_free_datagram(svsk->sk_sk, skb);
+                        skb_free_datagram_locked(svsk->sk_sk, skb);
                        return 0;
                }
                rqstp->rq_xprt_ctxt = skb;
@@ -651,8 +691,7 @@ static struct svc_xprt_class svc_udp_class = {
 static void svc_udp_init(struct svc_sock *svsk, struct svc_serv *serv)
 {
-        int one = 1;
+        int err, level, optname, one = 1;
-        mm_segment_t oldfs;
        svc_xprt_init(&svc_udp_class, &svsk->sk_xprt, serv);
        clear_bit(XPT_CACHE_AUTH, &svsk->sk_xprt.xpt_flags);
@@ -671,12 +710,22 @@ static void svc_udp_init(struct svc_sock *svsk, struct svc_serv *serv)
        set_bit(XPT_DATA, &svsk->sk_xprt.xpt_flags);
        set_bit(XPT_CHNGBUF, &svsk->sk_xprt.xpt_flags);
-        oldfs = get_fs();
-        set_fs(KERNEL_DS);
        /* make sure we get destination address info */
-        svsk->sk_sock->ops->setsockopt(svsk->sk_sock, IPPROTO_IP, IP_PKTINFO,
+        switch (svsk->sk_sk->sk_family) {
-                                       (char __user *)&one, sizeof(one));
+        case AF_INET:
-        set_fs(oldfs);
+                level = SOL_IP;
+                optname = IP_PKTINFO;
+                break;
+        case AF_INET6:
+                level = SOL_IPV6;
+                optname = IPV6_RECVPKTINFO;
+                break;
+        default:
+                BUG();
+        }
+        err = kernel_setsockopt(svsk->sk_sock, level, optname,
+                                        (char *)&one, sizeof(one));
+        dprintk("svc: kernel_setsockopt returned %d\n", err);
 }
 /*
@@ -826,21 +875,15 @@ failed:
 }
 /*
- * Receive data from a TCP socket.
+ * Receive data.
+ * If we haven't gotten the record length yet, get the next four bytes.
+ * Otherwise try to gobble up as much as possible up to the complete
+ * record length.
 */
-static int svc_tcp_recvfrom(struct svc_rqst *rqstp)
+static int svc_tcp_recv_record(struct svc_sock *svsk, struct svc_rqst *rqstp)
 {
-        struct svc_sock *svsk =
-                container_of(rqstp->rq_xprt, struct svc_sock, sk_xprt);
        struct svc_serv *serv = svsk->sk_xprt.xpt_server;
-        int             len;
+        int len;
-        struct kvec *vec;
-        int pnum, vlen;
-        dprintk("svc: tcp_recv %p data %d conn %d close %d\n",
-                svsk, test_bit(XPT_DATA, &svsk->sk_xprt.xpt_flags),
-                test_bit(XPT_CONN, &svsk->sk_xprt.xpt_flags),
-                test_bit(XPT_CLOSE, &svsk->sk_xprt.xpt_flags));
        if (test_and_clear_bit(XPT_CHNGBUF, &svsk->sk_xprt.xpt_flags))
                /* sndbuf needs to have room for one request
@@ -861,10 +904,6 @@ static int svc_tcp_recvfrom(struct svc_rqst *rqstp)
        clear_bit(XPT_DATA, &svsk->sk_xprt.xpt_flags);
-        /* Receive data. If we haven't got the record length yet, get
-         * the next four bytes. Otherwise try to gobble up as much as
-         * possible up to the complete record length.
-         */
        if (svsk->sk_tcplen < sizeof(rpc_fraghdr)) {
                int             want = sizeof(rpc_fraghdr) - svsk->sk_tcplen;
                struct kvec     iov;
@@ -879,7 +918,7 @@ static int svc_tcp_recvfrom(struct svc_rqst *rqstp)
                        dprintk("svc: short recvfrom while reading record "
                                "length (%d of %d)\n", len, want);
                        svc_xprt_received(&svsk->sk_xprt);
-                        return -EAGAIN; /* record header not complete */
+                        goto err_again; /* record header not complete */
                }
                svsk->sk_reclen = ntohl(svsk->sk_reclen);
@@ -894,6 +933,7 @@ static int svc_tcp_recvfrom(struct svc_rqst *rqstp)
                                        "per record not supported\n");
                        goto err_delete;
                }
                svsk->sk_reclen &= RPC_FRAGMENT_SIZE_MASK;
                dprintk("svc: TCP record, %d bytes\n", svsk->sk_reclen);
                if (svsk->sk_reclen > serv->sv_max_mesg) {
@@ -914,17 +954,121 @@ static int svc_tcp_recvfrom(struct svc_rqst *rqstp)
                dprintk("svc: incomplete TCP record (%d of %d)\n",
                        len, svsk->sk_reclen);
                svc_xprt_received(&svsk->sk_xprt);
-                return -EAGAIN; /* record not complete */
+                goto err_again; /* record not complete */
        }
        len = svsk->sk_reclen;
        set_bit(XPT_DATA, &svsk->sk_xprt.xpt_flags);
+        return len;
+ error:
+        if (len == -EAGAIN) {
+                dprintk("RPC: TCP recv_record got EAGAIN\n");
+                svc_xprt_received(&svsk->sk_xprt);
+        }
+        return len;
+ err_delete:
+        set_bit(XPT_CLOSE, &svsk->sk_xprt.xpt_flags);
+ err_again:
+        return -EAGAIN;
+}
+static int svc_process_calldir(struct svc_sock *svsk, struct svc_rqst *rqstp,
+                               struct rpc_rqst **reqpp, struct kvec *vec)
+{
+        struct rpc_rqst *req = NULL;
+        u32 *p;
+        u32 xid;
+        u32 calldir;
+        int len;
+        len = svc_recvfrom(rqstp, vec, 1, 8);
+        if (len < 0)
+                goto error;
+        p = (u32 *)rqstp->rq_arg.head[0].iov_base;
+        xid = *p++;
+        calldir = *p;
+        if (calldir == 0) {
+                /* REQUEST is the most common case */
+                vec[0] = rqstp->rq_arg.head[0];
+        } else {
+                /* REPLY */
+                if (svsk->sk_bc_xprt)
+                        req = xprt_lookup_rqst(svsk->sk_bc_xprt, xid);
+                if (!req) {
+                        printk(KERN_NOTICE
+                                "%s: Got unrecognized reply: "
+                                "calldir 0x%x sk_bc_xprt %p xid %08x\n",
+                                __func__, ntohl(calldir),
+                                svsk->sk_bc_xprt, xid);
+                        vec[0] = rqstp->rq_arg.head[0];
+                        goto out;
+                }
+                memcpy(&req->rq_private_buf, &req->rq_rcv_buf,
+                       sizeof(struct xdr_buf));
+                /* copy the xid and call direction */
+                memcpy(req->rq_private_buf.head[0].iov_base,
+                       rqstp->rq_arg.head[0].iov_base, 8);
+                vec[0] = req->rq_private_buf.head[0];
+        }
+ out:
+        vec[0].iov_base += 8;
+        vec[0].iov_len -= 8;
+        len = svsk->sk_reclen - 8;
+ error:
+        *reqpp = req;
+        return len;
+}
+/*
+ * Receive data from a TCP socket.
+ */
+static int svc_tcp_recvfrom(struct svc_rqst *rqstp)
+{
+        struct svc_sock *svsk =
+                container_of(rqstp->rq_xprt, struct svc_sock, sk_xprt);
+        struct svc_serv *serv = svsk->sk_xprt.xpt_server;
+        int             len;
+        struct kvec *vec;
+        int pnum, vlen;
+        struct rpc_rqst *req = NULL;
+        dprintk("svc: tcp_recv %p data %d conn %d close %d\n",
+                svsk, test_bit(XPT_DATA, &svsk->sk_xprt.xpt_flags),
+                test_bit(XPT_CONN, &svsk->sk_xprt.xpt_flags),
+                test_bit(XPT_CLOSE, &svsk->sk_xprt.xpt_flags));
+        len = svc_tcp_recv_record(svsk, rqstp);
+        if (len < 0)
+                goto error;
        vec = rqstp->rq_vec;
        vec[0] = rqstp->rq_arg.head[0];
        vlen = PAGE_SIZE;
+        /*
+         * We have enough data for the whole tcp record. Let's try and read the
+         * first 8 bytes to get the xid and the call direction. We can use this
+         * to figure out if this is a call or a reply to a callback. If
+         * sk_reclen is < 8 (xid and calldir), then this is a malformed packet.
+         * In that case, don't bother with the calldir and just read the data.
+         * It will be rejected in svc_process.
+         */
+        if (len >= 8) {
+                len = svc_process_calldir(svsk, rqstp, &req, vec);
+                if (len < 0)
+                        goto err_again;
+                vlen -= 8;
+        }
        pnum = 1;
        while (vlen < len) {
-                vec[pnum].iov_base = page_address(rqstp->rq_pages[pnum]);
+                vec[pnum].iov_base = (req) ?
+                        page_address(req->rq_private_buf.pages[pnum - 1]) :
+                        page_address(rqstp->rq_pages[pnum]);
                vec[pnum].iov_len = PAGE_SIZE;
                pnum++;
                vlen += PAGE_SIZE;
@@ -934,8 +1078,18 @@ static int svc_tcp_recvfrom(struct svc_rqst *rqstp)
        /* Now receive data */
        len = svc_recvfrom(rqstp, vec, pnum, len);
        if (len < 0)
-                goto error;
+                goto err_again;
+        /*
+         * Account for the 8 bytes we read earlier
+         */
+        len += 8;
+        if (req) {
+                xprt_complete_rqst(req->rq_task, len);
+                len = 0;
+                goto out;
+        }
        dprintk("svc: TCP complete record (%d bytes)\n", len);
        rqstp->rq_arg.len = len;
        rqstp->rq_arg.page_base = 0;
@@ -949,6 +1103,7 @@ static int svc_tcp_recvfrom(struct svc_rqst *rqstp)
        rqstp->rq_xprt_ctxt   = NULL;
        rqstp->rq_prot        = IPPROTO_TCP;
+out:
        /* Reset TCP read info */
        svsk->sk_reclen = 0;
        svsk->sk_tcplen = 0;
@@ -960,21 +1115,19 @@ static int svc_tcp_recvfrom(struct svc_rqst *rqstp)
        return len;
- err_delete:
+err_again:
-        set_bit(XPT_CLOSE, &svsk->sk_xprt.xpt_flags);
-        return -EAGAIN;
- error:
        if (len == -EAGAIN) {
                dprintk("RPC: TCP recvfrom got EAGAIN\n");
                svc_xprt_received(&svsk->sk_xprt);
-        } else {
+                return len;
+        }
+error:
+        if (len != -EAGAIN) {
                printk(KERN_NOTICE "%s: recvfrom returned errno %d\n",
                       svsk->sk_xprt.xpt_server->sv_name, -len);
-                goto err_delete;
+                set_bit(XPT_CLOSE, &svsk->sk_xprt.xpt_flags);
        }
+        return -EAGAIN;
-        return len;
 }
 /*
diff --git a/net/sunrpc/sysctl.c b/net/sunrpc/sysctl.c
index 5231f7aaac0e..42f9748ae093 100644
--- a/net/sunrpc/sysctl.c
+++ b/net/sunrpc/sysctl.c
@@ -56,7 +56,7 @@ rpc_unregister_sysctl(void)
        }
 }
-static int proc_do_xprt(ctl_table *table, int write, struct file *file,
+static int proc_do_xprt(ctl_table *table, int write,
                        void __user *buffer, size_t *lenp, loff_t *ppos)
 {
        char tmpbuf[256];
@@ -71,7 +71,7 @@ static int proc_do_xprt(ctl_table *table, int write, struct file *file,
 }
 static int
-proc_dodebug(ctl_table *table, int write, struct file *file,
+proc_dodebug(ctl_table *table, int write,
                                void __user *buffer, size_t *lenp, loff_t *ppos)
 {
        char            tmpbuf[20], c, *s;
diff --git a/net/sunrpc/xprt.c b/net/sunrpc/xprt.c
index f412a852bc73..fd46d42afa89 100644
--- a/net/sunrpc/xprt.c
+++ b/net/sunrpc/xprt.c
@@ -832,6 +832,11 @@ static void xprt_timer(struct rpc_task *task)
        spin_unlock_bh(&xprt->transport_lock);
 }
+static inline int xprt_has_timer(struct rpc_xprt *xprt)
+{
+        return xprt->idle_timeout != 0;
+}
 /**
 * xprt_prepare_transmit - reserve the transport before sending a request
 * @task: RPC task about to send a request
@@ -1013,7 +1018,7 @@ void xprt_release(struct rpc_task *task)
        if (!list_empty(&req->rq_list))
                list_del(&req->rq_list);
        xprt->last_used = jiffies;
-        if (list_empty(&xprt->recv))
+        if (list_empty(&xprt->recv) && xprt_has_timer(xprt))
                mod_timer(&xprt->timer,
                                xprt->last_used + xprt->idle_timeout);
        spin_unlock_bh(&xprt->transport_lock);
@@ -1082,8 +1087,11 @@ found:
 #endif /* CONFIG_NFS_V4_1 */
        INIT_WORK(&xprt->task_cleanup, xprt_autoclose);
-        setup_timer(&xprt->timer, xprt_init_autodisconnect,
+        if (xprt_has_timer(xprt))
-                        (unsigned long)xprt);
+                setup_timer(&xprt->timer, xprt_init_autodisconnect,
+                            (unsigned long)xprt);
+        else
+                init_timer(&xprt->timer);
        xprt->last_used = jiffies;
        xprt->cwnd = RPC_INITCWND;
        xprt->bind_index = 0;
@@ -1102,7 +1110,6 @@ found:
        dprintk("RPC:       created transport %p with %u slots\n", xprt,
                        xprt->max_reqs);
        return xprt;
 }
diff --git a/net/sunrpc/xprtrdma/svc_rdma.c b/net/sunrpc/xprtrdma/svc_rdma.c
index 87101177825b..35fb68b9c8ec 100644
--- a/net/sunrpc/xprtrdma/svc_rdma.c
+++ b/net/sunrpc/xprtrdma/svc_rdma.c
@@ -80,7 +80,7 @@ struct kmem_cache *svc_rdma_ctxt_cachep;
 * current value.
 */
 static int read_reset_stat(ctl_table *table, int write,
-                           struct file *filp, void __user *buffer, size_t *lenp,
+                           void __user *buffer, size_t *lenp,
                           loff_t *ppos)
 {
        atomic_t *stat = (atomic_t *)table->data;
diff --git a/net/sunrpc/xprtrdma/svc_rdma_transport.c b/net/sunrpc/xprtrdma/svc_rdma_transport.c
index 5151f9f6c573..3fa5751af0ec 100644
--- a/net/sunrpc/xprtrdma/svc_rdma_transport.c
+++ b/net/sunrpc/xprtrdma/svc_rdma_transport.c
@@ -42,6 +42,7 @@
 #include <linux/sunrpc/svc_xprt.h>
 #include <linux/sunrpc/debug.h>
 #include <linux/sunrpc/rpc_rdma.h>
+#include <linux/sched.h>
 #include <linux/spinlock.h>
 #include <rdma/ib_verbs.h>
 #include <rdma/rdma_cm.h>
@@ -730,12 +731,12 @@ static struct svc_rdma_fastreg_mr *rdma_alloc_frmr(struct svcxprt_rdma *xprt)
                goto err;
        mr = ib_alloc_fast_reg_mr(xprt->sc_pd, RPCSVC_MAXPAGES);
-        if (!mr)
+        if (IS_ERR(mr))
                goto err_free_frmr;
        pl = ib_alloc_fast_reg_page_list(xprt->sc_cm_id->device,
                                         RPCSVC_MAXPAGES);
-        if (!pl)
+        if (IS_ERR(pl))
                goto err_free_mr;
        frmr->mr = mr;
diff --git a/net/sunrpc/xprtsock.c b/net/sunrpc/xprtsock.c
index 62438f3a914d..37c5475ba258 100644
--- a/net/sunrpc/xprtsock.c
+++ b/net/sunrpc/xprtsock.c
@@ -32,6 +32,7 @@
 #include <linux/tcp.h>
 #include <linux/sunrpc/clnt.h>
 #include <linux/sunrpc/sched.h>
+#include <linux/sunrpc/svcsock.h>
 #include <linux/sunrpc/xprtsock.h>
 #include <linux/file.h>
 #ifdef CONFIG_NFS_V4_1
@@ -43,6 +44,7 @@
 #include <net/udp.h>
 #include <net/tcp.h>
+#include "sunrpc.h"
 /*
 * xprtsock tunables
 */
@@ -771,6 +773,7 @@ static void xs_close(struct rpc_xprt *xprt)
        dprintk("RPC:       xs_close xprt %p\n", xprt);
        xs_reset_transport(transport);
+        xprt->reestablish_timeout = 0;
        smp_mb__before_clear_bit();
        clear_bit(XPRT_CONNECTION_ABORT, &xprt->state);
@@ -1262,6 +1265,12 @@ static void xs_tcp_data_ready(struct sock *sk, int bytes)
        if (xprt->shutdown)
                goto out;
+        /* Any data means we had a useful conversation, so
+         * the we don't need to delay the next reconnect
+         */
+        if (xprt->reestablish_timeout)
+                xprt->reestablish_timeout = 0;
        /* We use rd_desc to pass struct xprt to xs_tcp_data_recv */
        rd_desc.arg.data = xprt;
        do {
@@ -2032,6 +2041,8 @@ static void xs_connect(struct rpc_task *task)
                                   &transport->connect_worker,
                                   xprt->reestablish_timeout);
                xprt->reestablish_timeout <<= 1;
+                if (xprt->reestablish_timeout < XS_TCP_INIT_REEST_TO)
+                        xprt->reestablish_timeout = XS_TCP_INIT_REEST_TO;
                if (xprt->reestablish_timeout > XS_TCP_MAX_REEST_TO)
                        xprt->reestablish_timeout = XS_TCP_MAX_REEST_TO;
        } else {
@@ -2098,6 +2109,134 @@ static void xs_tcp_print_stats(struct rpc_xprt *xprt, struct seq_file *seq)
                        xprt->stat.bklog_u);
 }
+/*
+ * Allocate a bunch of pages for a scratch buffer for the rpc code. The reason
+ * we allocate pages instead doing a kmalloc like rpc_malloc is because we want
+ * to use the server side send routines.
+ */
+void *bc_malloc(struct rpc_task *task, size_t size)
+{
+        struct page *page;
+        struct rpc_buffer *buf;
+        BUG_ON(size > PAGE_SIZE - sizeof(struct rpc_buffer));
+        page = alloc_page(GFP_KERNEL);
+        if (!page)
+                return NULL;
+        buf = page_address(page);
+        buf->len = PAGE_SIZE;
+        return buf->data;
+}
+/*
+ * Free the space allocated in the bc_alloc routine
+ */
+void bc_free(void *buffer)
+{
+        struct rpc_buffer *buf;
+        if (!buffer)
+                return;
+        buf = container_of(buffer, struct rpc_buffer, data);
+        free_page((unsigned long)buf);
+}
+/*
+ * Use the svc_sock to send the callback. Must be called with svsk->sk_mutex
+ * held. Borrows heavily from svc_tcp_sendto and xs_tcp_send_request.
+ */
+static int bc_sendto(struct rpc_rqst *req)
+{
+        int len;
+        struct xdr_buf *xbufp = &req->rq_snd_buf;
+        struct rpc_xprt *xprt = req->rq_xprt;
+        struct sock_xprt *transport =
+                                container_of(xprt, struct sock_xprt, xprt);
+        struct socket *sock = transport->sock;
+        unsigned long headoff;
+        unsigned long tailoff;
+        /*
+         * Set up the rpc header and record marker stuff
+         */
+        xs_encode_tcp_record_marker(xbufp);
+        tailoff = (unsigned long)xbufp->tail[0].iov_base & ~PAGE_MASK;
+        headoff = (unsigned long)xbufp->head[0].iov_base & ~PAGE_MASK;
+        len = svc_send_common(sock, xbufp,
+                              virt_to_page(xbufp->head[0].iov_base), headoff,
+                              xbufp->tail[0].iov_base, tailoff);
+        if (len != xbufp->len) {
+                printk(KERN_NOTICE "Error sending entire callback!\n");
+                len = -EAGAIN;
+        }
+        return len;
+}
+/*
+ * The send routine. Borrows from svc_send
+ */
+static int bc_send_request(struct rpc_task *task)
+{
+        struct rpc_rqst *req = task->tk_rqstp;
+        struct svc_xprt *xprt;
+        struct svc_sock         *svsk;
+        u32                     len;
+        dprintk("sending request with xid: %08x\n", ntohl(req->rq_xid));
+        /*
+         * Get the server socket associated with this callback xprt
+         */
+        xprt = req->rq_xprt->bc_xprt;
+        svsk = container_of(xprt, struct svc_sock, sk_xprt);
+        /*
+         * Grab the mutex to serialize data as the connection is shared
+         * with the fore channel
+         */
+        if (!mutex_trylock(&xprt->xpt_mutex)) {
+                rpc_sleep_on(&xprt->xpt_bc_pending, task, NULL);
+                if (!mutex_trylock(&xprt->xpt_mutex))
+                        return -EAGAIN;
+                rpc_wake_up_queued_task(&xprt->xpt_bc_pending, task);
+        }
+        if (test_bit(XPT_DEAD, &xprt->xpt_flags))
+                len = -ENOTCONN;
+        else
+                len = bc_sendto(req);
+        mutex_unlock(&xprt->xpt_mutex);
+        if (len > 0)
+                len = 0;
+        return len;
+}
+/*
+ * The close routine. Since this is client initiated, we do nothing
+ */
+static void bc_close(struct rpc_xprt *xprt)
+{
+        return;
+}
+/*
+ * The xprt destroy routine. Again, because this connection is client
+ * initiated, we do nothing
+ */
+static void bc_destroy(struct rpc_xprt *xprt)
+{
+        return;
+}
 static struct rpc_xprt_ops xs_udp_ops = {
        .set_buffer_size        = xs_udp_set_buffer_size,
        .reserve_xprt           = xprt_reserve_xprt_cong,
@@ -2134,6 +2273,22 @@ static struct rpc_xprt_ops xs_tcp_ops = {
        .print_stats            = xs_tcp_print_stats,
 };
+/*
+ * The rpc_xprt_ops for the server backchannel
+ */
+static struct rpc_xprt_ops bc_tcp_ops = {
+        .reserve_xprt           = xprt_reserve_xprt,
+        .release_xprt           = xprt_release_xprt,
+        .buf_alloc              = bc_malloc,
+        .buf_free               = bc_free,
+        .send_request           = bc_send_request,
+        .set_retrans_timeout    = xprt_set_retrans_timeout_def,
+        .close                  = bc_close,
+        .destroy                = bc_destroy,
+        .print_stats            = xs_tcp_print_stats,
+};
 static struct rpc_xprt *xs_setup_xprt(struct xprt_create *args,
                                      unsigned int slot_table_size)
 {
@@ -2322,11 +2477,93 @@ static struct rpc_xprt *xs_setup_tcp(struct xprt_create *args)
        return ERR_PTR(-EINVAL);
 }
+/**
+ * xs_setup_bc_tcp - Set up transport to use a TCP backchannel socket
+ * @args: rpc transport creation arguments
+ *
+ */
+static struct rpc_xprt *xs_setup_bc_tcp(struct xprt_create *args)
+{
+        struct sockaddr *addr = args->dstaddr;
+        struct rpc_xprt *xprt;
+        struct sock_xprt *transport;
+        struct svc_sock *bc_sock;
+        if (!args->bc_xprt)
+                ERR_PTR(-EINVAL);
+        xprt = xs_setup_xprt(args, xprt_tcp_slot_table_entries);
+        if (IS_ERR(xprt))
+                return xprt;
+        transport = container_of(xprt, struct sock_xprt, xprt);
+        xprt->prot = IPPROTO_TCP;
+        xprt->tsh_size = sizeof(rpc_fraghdr) / sizeof(u32);
+        xprt->max_payload = RPC_MAX_FRAGMENT_SIZE;
+        xprt->timeout = &xs_tcp_default_timeout;
+        /* backchannel */
+        xprt_set_bound(xprt);
+        xprt->bind_timeout = 0;
+        xprt->connect_timeout = 0;
+        xprt->reestablish_timeout = 0;
+        xprt->idle_timeout = 0;
+        /*
+         * The backchannel uses the same socket connection as the
+         * forechannel
+         */
+        xprt->bc_xprt = args->bc_xprt;
+        bc_sock = container_of(args->bc_xprt, struct svc_sock, sk_xprt);
+        bc_sock->sk_bc_xprt = xprt;
+        transport->sock = bc_sock->sk_sock;
+        transport->inet = bc_sock->sk_sk;
+        xprt->ops = &bc_tcp_ops;
+        switch (addr->sa_family) {
+        case AF_INET:
+                xs_format_peer_addresses(xprt, "tcp",
+                                         RPCBIND_NETID_TCP);
+                break;
+        case AF_INET6:
+                xs_format_peer_addresses(xprt, "tcp",
+                                   RPCBIND_NETID_TCP6);
+                break;
+        default:
+                kfree(xprt);
+                return ERR_PTR(-EAFNOSUPPORT);
+        }
+        if (xprt_bound(xprt))
+                dprintk("RPC:       set up xprt to %s (port %s) via %s\n",
+                                xprt->address_strings[RPC_DISPLAY_ADDR],
+                                xprt->address_strings[RPC_DISPLAY_PORT],
+                                xprt->address_strings[RPC_DISPLAY_PROTO]);
+        else
+                dprintk("RPC:       set up xprt to %s (autobind) via %s\n",
+                                xprt->address_strings[RPC_DISPLAY_ADDR],
+                                xprt->address_strings[RPC_DISPLAY_PROTO]);
+        /*
+         * Since we don't want connections for the backchannel, we set
+         * the xprt status to connected
+         */
+        xprt_set_connected(xprt);
+        if (try_module_get(THIS_MODULE))
+                return xprt;
+        kfree(xprt->slot);
+        kfree(xprt);
+        return ERR_PTR(-EINVAL);
+}
 static struct xprt_class        xs_udp_transport = {
        .list           = LIST_HEAD_INIT(xs_udp_transport.list),
        .name           = "udp",
        .owner          = THIS_MODULE,
-        .ident          = IPPROTO_UDP,
+        .ident          = XPRT_TRANSPORT_UDP,
        .setup          = xs_setup_udp,
 };
@@ -2334,10 +2571,18 @@ static struct xprt_class	xs_tcp_transport = {
        .list           = LIST_HEAD_INIT(xs_tcp_transport.list),
        .name           = "tcp",
        .owner          = THIS_MODULE,
-        .ident          = IPPROTO_TCP,
+        .ident          = XPRT_TRANSPORT_TCP,
        .setup          = xs_setup_tcp,
 };
+static struct xprt_class        xs_bc_tcp_transport = {
+        .list           = LIST_HEAD_INIT(xs_bc_tcp_transport.list),
+        .name           = "tcp NFSv4.1 backchannel",
+        .owner          = THIS_MODULE,
+        .ident          = XPRT_TRANSPORT_BC_TCP,
+        .setup          = xs_setup_bc_tcp,
+};
 /**
 * init_socket_xprt - set up xprtsock's sysctls, register with RPC client
 *
@@ -2351,6 +2596,7 @@ int init_socket_xprt(void)
        xprt_register_transport(&xs_udp_transport);
        xprt_register_transport(&xs_tcp_transport);
+        xprt_register_transport(&xs_bc_tcp_transport);
        return 0;
 }
@@ -2370,6 +2616,7 @@ void cleanup_socket_xprt(void)
        xprt_unregister_transport(&xs_udp_transport);
        xprt_unregister_transport(&xs_tcp_transport);
+        xprt_unregister_transport(&xs_bc_tcp_transport);
 }
 static int param_set_uint_minmax(const char *val, struct kernel_param *kp,
diff --git a/net/tipc/socket.c b/net/tipc/socket.c
index e8254e809b79..e6d9abf7440e 100644
--- a/net/tipc/socket.c
+++ b/net/tipc/socket.c
@@ -1658,7 +1658,7 @@ restart:
 */
 static int setsockopt(struct socket *sock,
-                      int lvl, int opt, char __user *ov, int ol)
+                      int lvl, int opt, char __user *ov, unsigned int ol)
 {
        struct sock *sk = sock->sk;
        struct tipc_port *tport = tipc_sk_port(sk);
diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c
index 51ab497115eb..fc820cd75453 100644
--- a/net/unix/af_unix.c
+++ b/net/unix/af_unix.c
@@ -1074,6 +1074,8 @@ restart:
        err = -ECONNREFUSED;
        if (other->sk_state != TCP_LISTEN)
                goto out_unlock;
+        if (other->sk_shutdown & RCV_SHUTDOWN)
+                goto out_unlock;
        if (unix_recvq_full(other)) {
                err = -EAGAIN;
diff --git a/net/wireless/core.c b/net/wireless/core.c
index 45b2be3274db..a595f712b5bf 100644
--- a/net/wireless/core.c
+++ b/net/wireless/core.c
@@ -14,6 +14,7 @@
 #include <linux/device.h>
 #include <linux/etherdevice.h>
 #include <linux/rtnetlink.h>
+#include <linux/sched.h>
 #include <net/genetlink.h>
 #include <net/cfg80211.h>
 #include "nl80211.h"
diff --git a/net/wireless/core.h b/net/wireless/core.h
index 2a33d8bc886b..68b321997d4c 100644
--- a/net/wireless/core.h
+++ b/net/wireless/core.h
@@ -358,6 +358,7 @@ int cfg80211_mgd_wext_connect(struct cfg80211_registered_device *rdev,
                              struct wireless_dev *wdev);
 void cfg80211_conn_work(struct work_struct *work);
+void cfg80211_sme_failed_assoc(struct wireless_dev *wdev);
 bool cfg80211_sme_failed_reassoc(struct wireless_dev *wdev);
 /* internal helpers */
diff --git a/net/wireless/mlme.c b/net/wireless/mlme.c
index 79d2eec54cec..0a6b7a0eca6b 100644
--- a/net/wireless/mlme.c
+++ b/net/wireless/mlme.c
@@ -62,6 +62,7 @@ void cfg80211_send_rx_assoc(struct net_device *dev, const u8 *buf, size_t len)
        u8 *ie = mgmt->u.assoc_resp.variable;
        int i, ieoffs = offsetof(struct ieee80211_mgmt, u.assoc_resp.variable);
        struct cfg80211_internal_bss *bss = NULL;
+        bool need_connect_result = true;
        wdev_lock(wdev);
@@ -94,6 +95,14 @@ void cfg80211_send_rx_assoc(struct net_device *dev, const u8 *buf, size_t len)
                }
                WARN_ON(!bss);
+        } else if (wdev->conn) {
+                cfg80211_sme_failed_assoc(wdev);
+                need_connect_result = false;
+                /*
+                 * do not call connect_result() now because the
+                 * sme will schedule work that does it later.
+                 */
+                goto out;
        }
        if (!wdev->conn && wdev->sme_state == CFG80211_SME_IDLE) {
diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
index eddab097435c..ca3c92a0a14f 100644
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -4029,7 +4029,7 @@ static int nl80211_wiphy_netns(struct sk_buff *skb, struct genl_info *info)
        rdev = cfg80211_get_dev_from_info(info);
        if (IS_ERR(rdev)) {
                err = PTR_ERR(rdev);
-                goto out;
+                goto out_rtnl;
        }
        net = get_net_ns_by_pid(pid);
@@ -4049,6 +4049,7 @@ static int nl80211_wiphy_netns(struct sk_buff *skb, struct genl_info *info)
        put_net(net);
 out:
        cfg80211_unlock_rdev(rdev);
+ out_rtnl:
        rtnl_unlock();
        return err;
 }
diff --git a/net/wireless/sme.c b/net/wireless/sme.c
index 7fae7eee65de..9f0b2800a9d7 100644
--- a/net/wireless/sme.c
+++ b/net/wireless/sme.c
@@ -26,6 +26,7 @@ struct cfg80211_conn {
                CFG80211_CONN_AUTHENTICATING,
                CFG80211_CONN_ASSOCIATE_NEXT,
                CFG80211_CONN_ASSOCIATING,
+                CFG80211_CONN_DEAUTH_ASSOC_FAIL,
        } state;
        u8 bssid[ETH_ALEN], prev_bssid[ETH_ALEN];
        u8 *ie;
@@ -148,6 +149,12 @@ static int cfg80211_conn_do_work(struct wireless_dev *wdev)
                                               NULL, 0,
                                               WLAN_REASON_DEAUTH_LEAVING);
                return err;
+        case CFG80211_CONN_DEAUTH_ASSOC_FAIL:
+                __cfg80211_mlme_deauth(rdev, wdev->netdev, params->bssid,
+                                       NULL, 0,
+                                       WLAN_REASON_DEAUTH_LEAVING);
+                /* return an error so that we call __cfg80211_connect_result() */
+                return -EINVAL;
        default:
                return 0;
        }
@@ -158,6 +165,7 @@ void cfg80211_conn_work(struct work_struct *work)
        struct cfg80211_registered_device *rdev =
                container_of(work, struct cfg80211_registered_device, conn_work);
        struct wireless_dev *wdev;
+        u8 bssid_buf[ETH_ALEN], *bssid = NULL;
        rtnl_lock();
        cfg80211_lock_rdev(rdev);
@@ -173,10 +181,13 @@ void cfg80211_conn_work(struct work_struct *work)
                        wdev_unlock(wdev);
                        continue;
                }
+                if (wdev->conn->params.bssid) {
+                        memcpy(bssid_buf, wdev->conn->params.bssid, ETH_ALEN);
+                        bssid = bssid_buf;
+                }
                if (cfg80211_conn_do_work(wdev))
                        __cfg80211_connect_result(
-                                        wdev->netdev,
+                                        wdev->netdev, bssid,
-                                        wdev->conn->params.bssid,
                                        NULL, 0, NULL, 0,
                                        WLAN_STATUS_UNSPECIFIED_FAILURE,
                                        false, NULL);
@@ -337,6 +348,15 @@ bool cfg80211_sme_failed_reassoc(struct wireless_dev *wdev)
        return true;
 }
+void cfg80211_sme_failed_assoc(struct wireless_dev *wdev)
+{
+        struct wiphy *wiphy = wdev->wiphy;
+        struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
+        wdev->conn->state = CFG80211_CONN_DEAUTH_ASSOC_FAIL;
+        schedule_work(&rdev->conn_work);
+}
 void __cfg80211_connect_result(struct net_device *dev, const u8 *bssid,
                               const u8 *req_ie, size_t req_ie_len,
                               const u8 *resp_ie, size_t resp_ie_len,
@@ -762,9 +782,8 @@ int __cfg80211_connect(struct cfg80211_registered_device *rdev,
                wdev->conn->params.ssid = wdev->ssid;
                wdev->conn->params.ssid_len = connect->ssid_len;
-                /* don't care about result -- but fill bssid & channel */
+                /* see if we have the bss already */
-                if (!wdev->conn->params.bssid || !wdev->conn->params.channel)
+                bss = cfg80211_get_conn_bss(wdev);
-                        bss = cfg80211_get_conn_bss(wdev);
                wdev->sme_state = CFG80211_SME_CONNECTING;
                wdev->connect_keys = connkeys;
diff --git a/net/wireless/wext-compat.c b/net/wireless/wext-compat.c
index 429dd06a4ecc..561a45cf2a6a 100644
--- a/net/wireless/wext-compat.c
+++ b/net/wireless/wext-compat.c
@@ -834,7 +834,7 @@ int cfg80211_wext_siwtxpower(struct net_device *dev,
                return 0;
        }
-        return rdev->ops->set_tx_power(wdev->wiphy, type, dbm);;
+        return rdev->ops->set_tx_power(wdev->wiphy, type, dbm);
 }
 EXPORT_SYMBOL_GPL(cfg80211_wext_siwtxpower);
diff --git a/net/wireless/wext-sme.c b/net/wireless/wext-sme.c
index d16cd9ea4d00..5615a8802536 100644
--- a/net/wireless/wext-sme.c
+++ b/net/wireless/wext-sme.c
@@ -26,11 +26,12 @@ int cfg80211_mgd_wext_connect(struct cfg80211_registered_device *rdev,
        wdev->wext.connect.ie = wdev->wext.ie;
        wdev->wext.connect.ie_len = wdev->wext.ie_len;
-        wdev->wext.connect.privacy = wdev->wext.default_key != -1;
        if (wdev->wext.keys) {
                wdev->wext.keys->def = wdev->wext.default_key;
                wdev->wext.keys->defmgmt = wdev->wext.default_mgmt_key;
+                if (wdev->wext.default_key != -1)
+                        wdev->wext.connect.privacy = true;
        }
        if (!wdev->wext.connect.ssid_len)
@@ -229,8 +230,7 @@ int cfg80211_mgd_wext_giwessid(struct net_device *dev,
                data->flags = 1;
                data->length = wdev->wext.connect.ssid_len;
                memcpy(ssid, wdev->wext.connect.ssid, data->length);
-        } else
+        }
-                data->flags = 0;
        wdev_unlock(wdev);
        return 0;
@@ -306,8 +306,6 @@ int cfg80211_mgd_wext_giwap(struct net_device *dev,
        wdev_lock(wdev);
        if (wdev->current_bss)
                memcpy(ap_addr->sa_data, wdev->current_bss->pub.bssid, ETH_ALEN);
-        else if (wdev->wext.connect.bssid)
-                memcpy(ap_addr->sa_data, wdev->wext.connect.bssid, ETH_ALEN);
        else
                memset(ap_addr->sa_data, 0, ETH_ALEN);
        wdev_unlock(wdev);
diff --git a/net/wireless/wext.c b/net/wireless/wext.c
index 5b4a0cee4418..60fe57761ca9 100644
--- a/net/wireless/wext.c
+++ b/net/wireless/wext.c
@@ -470,7 +470,7 @@ static iw_handler get_handler(struct net_device *dev, unsigned int cmd)
 /*
 * Get statistics out of the driver
 */
-static struct iw_statistics *get_wireless_stats(struct net_device *dev)
+struct iw_statistics *get_wireless_stats(struct net_device *dev)
 {
        /* New location */
        if ((dev->wireless_handlers != NULL) &&
@@ -773,10 +773,13 @@ static int ioctl_standard_iw_point(struct iw_point *iwp, unsigned int cmd,
                        essid_compat = 1;
                else if (IW_IS_SET(cmd) && (iwp->length != 0)) {
                        char essid[IW_ESSID_MAX_SIZE + 1];
+                        unsigned int len;
+                        len = iwp->length * descr->token_size;
-                        err = copy_from_user(essid, iwp->pointer,
+                        if (len > IW_ESSID_MAX_SIZE)
-                                             iwp->length *
+                                return -EFAULT;
-                                             descr->token_size);
+                        err = copy_from_user(essid, iwp->pointer, len);
                        if (err)
                                return -EFAULT;
diff --git a/net/x25/af_x25.c b/net/x25/af_x25.c
index 5e6c072c64d3..7fa9c7ad3d3b 100644
--- a/net/x25/af_x25.c
+++ b/net/x25/af_x25.c
@@ -409,7 +409,7 @@ static void x25_destroy_socket(struct sock *sk)
 */
 static int x25_setsockopt(struct socket *sock, int level, int optname,
-                          char __user *optval, int optlen)
+                          char __user *optval, unsigned int optlen)
 {
        int opt;
        struct sock *sk = sock->sk;