23 files changed, 200 insertions, 201 deletions

diff --git a/net/bluetooth/cmtp/capi.c b/net/bluetooth/cmtp/capi.c
index be04e9fb11f6..ab166b48ce8d 100644
--- a/net/bluetooth/cmtp/capi.c
+++ b/net/bluetooth/cmtp/capi.c
@@ -196,6 +196,9 @@ static void cmtp_recv_interopmsg(struct cmtp_session *session, struct sk_buff *s
 
         switch (CAPIMSG_SUBCOMMAND(skb->data)) {
         case CAPI_CONF:
+                if (skb->len < CAPI_MSG_BASELEN + 10)
+                        break;
+
                 func = CAPIMSG_U16(skb->data, CAPI_MSG_BASELEN + 5);
                 info = CAPIMSG_U16(skb->data, CAPI_MSG_BASELEN + 8);
 
@@ -226,6 +229,9 @@ static void cmtp_recv_interopmsg(struct cmtp_session *session, struct sk_buff *s
                         break;
 
                 case CAPI_FUNCTION_GET_PROFILE:
+                        if (skb->len < CAPI_MSG_BASELEN + 11 + sizeof(capi_profile))
+                                break;
+
                         controller = CAPIMSG_U16(skb->data, CAPI_MSG_BASELEN + 11);
                         msgnum = CAPIMSG_MSGID(skb->data);
 
@@ -246,17 +252,26 @@ static void cmtp_recv_interopmsg(struct cmtp_session *session, struct sk_buff *s
                         break;
 
                 case CAPI_FUNCTION_GET_MANUFACTURER:
+                        if (skb->len < CAPI_MSG_BASELEN + 15)
+                                break;
+
                         controller = CAPIMSG_U32(skb->data, CAPI_MSG_BASELEN + 10);
 
                         if (!info && ctrl) {
+                                int len = min_t(uint, CAPI_MANUFACTURER_LEN,
+                                                skb->data[CAPI_MSG_BASELEN + 14]);
+
+                                memset(ctrl->manu, 0, CAPI_MANUFACTURER_LEN);
                                 strncpy(ctrl->manu,
-                                        skb->data + CAPI_MSG_BASELEN + 15,
-                                        skb->data[CAPI_MSG_BASELEN + 14]);
+                                        skb->data + CAPI_MSG_BASELEN + 15, len);
                         }
 
                         break;
 
                 case CAPI_FUNCTION_GET_VERSION:
+                        if (skb->len < CAPI_MSG_BASELEN + 32)
+                                break;
+
                         controller = CAPIMSG_U32(skb->data, CAPI_MSG_BASELEN + 12);
 
                         if (!info && ctrl) {
@@ -269,13 +284,18 @@ static void cmtp_recv_interopmsg(struct cmtp_session *session, struct sk_buff *s
                         break;
 
                 case CAPI_FUNCTION_GET_SERIAL_NUMBER:
+                        if (skb->len < CAPI_MSG_BASELEN + 17)
+                                break;
+
                         controller = CAPIMSG_U32(skb->data, CAPI_MSG_BASELEN + 12);
 
                         if (!info && ctrl) {
+                                int len = min_t(uint, CAPI_SERIAL_LEN,
+                                                skb->data[CAPI_MSG_BASELEN + 16]);
+
                                 memset(ctrl->serial, 0, CAPI_SERIAL_LEN);
                                 strncpy(ctrl->serial,
-                                        skb->data + CAPI_MSG_BASELEN + 17,
-                                        skb->data[CAPI_MSG_BASELEN + 16]);
+                                        skb->data + CAPI_MSG_BASELEN + 17, len);
                         }
 
                         break;
@@ -284,14 +304,18 @@ static void cmtp_recv_interopmsg(struct cmtp_session *session, struct sk_buff *s
                 break;
 
         case CAPI_IND:
+                if (skb->len < CAPI_MSG_BASELEN + 6)
+                        break;
+
                 func = CAPIMSG_U16(skb->data, CAPI_MSG_BASELEN + 3);
 
                 if (func == CAPI_FUNCTION_LOOPBACK) {
+                        int len = min_t(uint, skb->len - CAPI_MSG_BASELEN - 6,
+                                                skb->data[CAPI_MSG_BASELEN + 5]);
                         appl = CAPIMSG_APPID(skb->data);
                         msgnum = CAPIMSG_MSGID(skb->data);
                         cmtp_send_interopmsg(session, CAPI_RESP, appl, msgnum, func,
-                                                skb->data + CAPI_MSG_BASELEN + 6,
-                                                skb->data[CAPI_MSG_BASELEN + 5]);
+                                                skb->data + CAPI_MSG_BASELEN + 6, len);
                 }
 
                 break;
@@ -309,6 +333,9 @@ void cmtp_recv_capimsg(struct cmtp_session *session, struct sk_buff *skb)
 
         BT_DBG("session %p skb %p len %d", session, skb, skb->len);
 
+        if (skb->len < CAPI_MSG_BASELEN)
+                return;
+
         if (CAPIMSG_COMMAND(skb->data) == CAPI_INTEROPERABILITY) {
                 cmtp_recv_interopmsg(session, skb);
                 return;
diff --git a/net/bluetooth/hci_sysfs.c b/net/bluetooth/hci_sysfs.c
index d4c935692ccf..801d687ea4ef 100644
--- a/net/bluetooth/hci_sysfs.c
+++ b/net/bluetooth/hci_sysfs.c
@@ -242,7 +242,7 @@ static void add_conn(struct work_struct *work)
         struct hci_conn *conn = container_of(work, struct hci_conn, work);
         int i;
 
-        if (device_register(&conn->dev) < 0) {
+        if (device_add(&conn->dev) < 0) {
                 BT_ERR("Failed to register connection device");
                 return;
         }
@@ -272,6 +272,8 @@ void hci_conn_add_sysfs(struct hci_conn *conn)
 
         dev_set_drvdata(&conn->dev, conn);
 
+        device_initialize(&conn->dev);
+
         INIT_WORK(&conn->work, add_conn);
 
         schedule_work(&conn->work);
@@ -287,6 +289,9 @@ void hci_conn_del_sysfs(struct hci_conn *conn)
 {
         BT_DBG("conn %p", conn);
 
+        if (!device_is_registered(&conn->dev))
+                return;
+
         INIT_WORK(&conn->work, del_conn);
 
         schedule_work(&conn->work);
diff --git a/net/bluetooth/rfcomm/sock.c b/net/bluetooth/rfcomm/sock.c
index 544d65b7baa7..cb7e855f0828 100644
--- a/net/bluetooth/rfcomm/sock.c
+++ b/net/bluetooth/rfcomm/sock.c
@@ -557,7 +557,6 @@ static int rfcomm_sock_sendmsg(struct kiocb *iocb, struct socket *sock,
         struct sock *sk = sock->sk;
         struct rfcomm_dlc *d = rfcomm_pi(sk)->dlc;
         struct sk_buff *skb;
-        int err;
         int sent = 0;
 
         if (msg->msg_flags & MSG_OOB)
@@ -572,6 +571,7 @@ static int rfcomm_sock_sendmsg(struct kiocb *iocb, struct socket *sock,
 
         while (len) {
                 size_t size = min_t(size_t, len, d->mtu);
+                int err;
                 
                 skb = sock_alloc_send_skb(sk, size + RFCOMM_SKB_RESERVE,
                                 msg->msg_flags & MSG_DONTWAIT, &err);
@@ -582,13 +582,16 @@ static int rfcomm_sock_sendmsg(struct kiocb *iocb, struct socket *sock,
                 err = memcpy_fromiovec(skb_put(skb, size), msg->msg_iov, size);
                 if (err) {
                         kfree_skb(skb);
-                        sent = err;
+                        if (sent == 0)
+                                sent = err;
                         break;
                 }
 
                 err = rfcomm_dlc_send(d, skb);
                 if (err < 0) {
                         kfree_skb(skb);
+                        if (sent == 0)
+                                sent = err;
                         break;
                 }
 
@@ -598,7 +601,7 @@ static int rfcomm_sock_sendmsg(struct kiocb *iocb, struct socket *sock,
 
         release_sock(sk);
 
-        return sent ? sent : err;
+        return sent;
 }
 
 static long rfcomm_sock_data_wait(struct sock *sk, long timeo)
diff --git a/net/bluetooth/rfcomm/tty.c b/net/bluetooth/rfcomm/tty.c
index e0e0d09023b2..eb2b52484c70 100644
--- a/net/bluetooth/rfcomm/tty.c
+++ b/net/bluetooth/rfcomm/tty.c
@@ -697,9 +697,13 @@ static int rfcomm_tty_write_room(struct tty_struct *tty)
 
         BT_DBG("tty %p", tty);
 
+        if (!dev || !dev->dlc)
+                return 0;
+
         room = rfcomm_room(dev->dlc) - atomic_read(&dev->wmem_alloc);
         if (room < 0)
                 room = 0;
+
         return room;
 }
 
@@ -915,12 +919,14 @@ static void rfcomm_tty_unthrottle(struct tty_struct *tty)
 static int rfcomm_tty_chars_in_buffer(struct tty_struct *tty)
 {
         struct rfcomm_dev *dev = (struct rfcomm_dev *) tty->driver_data;
-        struct rfcomm_dlc *dlc = dev->dlc;
 
         BT_DBG("tty %p dev %p", tty, dev);
 
-        if (!skb_queue_empty(&dlc->tx_queue))
-                return dlc->mtu;
+        if (!dev || !dev->dlc)
+                return 0;
+
+        if (!skb_queue_empty(&dev->dlc->tx_queue))
+                return dev->dlc->mtu;
 
         return 0;
 }
@@ -928,11 +934,12 @@ static int rfcomm_tty_chars_in_buffer(struct tty_struct *tty)
 static void rfcomm_tty_flush_buffer(struct tty_struct *tty)
 {
         struct rfcomm_dev *dev = (struct rfcomm_dev *) tty->driver_data;
-        if (!dev)
-                return;
 
         BT_DBG("tty %p dev %p", tty, dev);
 
+        if (!dev || !dev->dlc)
+                return;
+
         skb_queue_purge(&dev->dlc->tx_queue);
 
         if (test_bit(TTY_DO_WRITE_WAKEUP, &tty->flags) && tty->ldisc.write_wakeup)
@@ -952,11 +959,12 @@ static void rfcomm_tty_wait_until_sent(struct tty_struct *tty, int timeout)
 static void rfcomm_tty_hangup(struct tty_struct *tty)
 {
         struct rfcomm_dev *dev = (struct rfcomm_dev *) tty->driver_data;
-        if (!dev)
-                return;
 
         BT_DBG("tty %p dev %p", tty, dev);
 
+        if (!dev)
+                return;
+
         rfcomm_tty_flush_buffer(tty);
 
         if (test_bit(RFCOMM_RELEASE_ONHUP, &dev->flags))
diff --git a/net/bridge/netfilter/ebtables.c b/net/bridge/netfilter/ebtables.c
index bee558a41800..6c84ccb8c9d7 100644
--- a/net/bridge/netfilter/ebtables.c
+++ b/net/bridge/netfilter/ebtables.c
@@ -610,7 +610,7 @@ ebt_check_entry(struct ebt_entry *e, struct ebt_table_info *newinfo,
         struct ebt_entry_target *t;
         struct ebt_target *target;
         unsigned int i, j, hook = 0, hookmask = 0;
-        size_t gap = e->next_offset - e->target_offset;
+        size_t gap;
         int ret;
 
         /* don't mess with the struct ebt_entries */
@@ -660,6 +660,7 @@ ebt_check_entry(struct ebt_entry *e, struct ebt_table_info *newinfo,
         if (ret != 0)
                 goto cleanup_watchers;
         t = (struct ebt_entry_target *)(((char *)e) + e->target_offset);
+        gap = e->next_offset - e->target_offset;
         target = find_target_lock(t->u.name, &ret, &ebt_mutex);
         if (!target)
                 goto cleanup_watchers;
diff --git a/net/core/pktgen.c b/net/core/pktgen.c
index 1897a3a385d8..04d4b93c68eb 100644
--- a/net/core/pktgen.c
+++ b/net/core/pktgen.c
@@ -148,6 +148,7 @@
 #include <linux/seq_file.h>
 #include <linux/wait.h>
 #include <linux/etherdevice.h>
+#include <linux/kthread.h>
 #include <net/checksum.h>
 #include <net/ipv6.h>
 #include <net/addrconf.h>
@@ -360,8 +361,7 @@ struct pktgen_thread {
         spinlock_t if_lock;
         struct list_head if_list;       /* All device here */
         struct list_head th_list;
-        int removed;
-        char name[32];
+        struct task_struct *tsk;
         char result[512];
         u32 max_before_softirq; /* We'll call do_softirq to prevent starvation. */
 
@@ -1689,7 +1689,7 @@ static int pktgen_thread_show(struct seq_file *seq, void *v)
         BUG_ON(!t);
 
         seq_printf(seq, "Name: %s  max_before_softirq: %d\n",
-                   t->name, t->max_before_softirq);
+                   t->tsk->comm, t->max_before_softirq);
 
         seq_printf(seq, "Running: ");
 
@@ -3112,7 +3112,7 @@ static void pktgen_rem_thread(struct pktgen_thread *t)
 {
         /* Remove from the thread list */
 
-        remove_proc_entry(t->name, pg_proc_dir);
+        remove_proc_entry(t->tsk->comm, pg_proc_dir);
 
         mutex_lock(&pktgen_thread_lock);
 
@@ -3260,58 +3260,40 @@ out:;
  * Main loop of the thread goes here
  */
 
-static void pktgen_thread_worker(struct pktgen_thread *t)
+static int pktgen_thread_worker(void *arg)
 {
         DEFINE_WAIT(wait);
+        struct pktgen_thread *t = arg;
         struct pktgen_dev *pkt_dev = NULL;
         int cpu = t->cpu;
-        sigset_t tmpsig;
         u32 max_before_softirq;
         u32 tx_since_softirq = 0;
 
-        daemonize("pktgen/%d", cpu);
-
-        /* Block all signals except SIGKILL, SIGSTOP and SIGTERM */
-
-        spin_lock_irq(&current->sighand->siglock);
-        tmpsig = current->blocked;
-        siginitsetinv(&current->blocked,
-                      sigmask(SIGKILL) | sigmask(SIGSTOP) | sigmask(SIGTERM));
-
-        recalc_sigpending();
-        spin_unlock_irq(&current->sighand->siglock);
-
-        /* Migrate to the right CPU */
-        set_cpus_allowed(current, cpumask_of_cpu(cpu));
-        if (smp_processor_id() != cpu)
-                BUG();
+        BUG_ON(smp_processor_id() != cpu);
 
         init_waitqueue_head(&t->queue);
 
-        t->control &= ~(T_TERMINATE);
-        t->control &= ~(T_RUN);
-        t->control &= ~(T_STOP);
-        t->control &= ~(T_REMDEVALL);
-        t->control &= ~(T_REMDEV);
-
         t->pid = current->pid;
 
         PG_DEBUG(printk("pktgen: starting pktgen/%d:  pid=%d\n", cpu, current->pid));
 
         max_before_softirq = t->max_before_softirq;
 
-        __set_current_state(TASK_INTERRUPTIBLE);
-        mb();
+        set_current_state(TASK_INTERRUPTIBLE);
 
-        while (1) {
-
-                __set_current_state(TASK_RUNNING);
+        while (!kthread_should_stop()) {
+                pkt_dev = next_to_run(t);
 
-                /*
-                 * Get next dev to xmit -- if any.
-                 */
+                if (!pkt_dev &&
+                    (t->control & (T_STOP | T_RUN | T_REMDEVALL | T_REMDEV))
+                    == 0) {
+                        prepare_to_wait(&(t->queue), &wait,
+                                        TASK_INTERRUPTIBLE);
+                        schedule_timeout(HZ / 10);
+                        finish_wait(&(t->queue), &wait);
+                }
 
-                pkt_dev = next_to_run(t);
+                __set_current_state(TASK_RUNNING);
 
                 if (pkt_dev) {
 
@@ -3329,21 +3311,8 @@ static void pktgen_thread_worker(struct pktgen_thread *t)
                                         do_softirq();
                                 tx_since_softirq = 0;
                         }
-                } else {
-                        prepare_to_wait(&(t->queue), &wait, TASK_INTERRUPTIBLE);
-                        schedule_timeout(HZ / 10);
-                        finish_wait(&(t->queue), &wait);
                 }
 
-                /*
-                 * Back from sleep, either due to the timeout or signal.
-                 * We check if we have any "posted" work for us.
-                 */
-
-                if (t->control & T_TERMINATE || signal_pending(current))
-                        /* we received a request to terminate ourself */
-                        break;
-
                 if (t->control & T_STOP) {
                         pktgen_stop(t);
                         t->control &= ~(T_STOP);
@@ -3364,20 +3333,19 @@ static void pktgen_thread_worker(struct pktgen_thread *t)
                         t->control &= ~(T_REMDEV);
                 }
 
-                if (need_resched())
-                        schedule();
+                set_current_state(TASK_INTERRUPTIBLE);
         }
 
-        PG_DEBUG(printk("pktgen: %s stopping all device\n", t->name));
+        PG_DEBUG(printk("pktgen: %s stopping all device\n", t->tsk->comm));
         pktgen_stop(t);
 
-        PG_DEBUG(printk("pktgen: %s removing all device\n", t->name));
+        PG_DEBUG(printk("pktgen: %s removing all device\n", t->tsk->comm));
         pktgen_rem_all_ifs(t);
 
-        PG_DEBUG(printk("pktgen: %s removing thread.\n", t->name));
+        PG_DEBUG(printk("pktgen: %s removing thread.\n", t->tsk->comm));
         pktgen_rem_thread(t);
 
-        t->removed = 1;
+        return 0;
 }
 
 static struct pktgen_dev *pktgen_find_dev(struct pktgen_thread *t,
@@ -3495,37 +3463,11 @@ static int pktgen_add_device(struct pktgen_thread *t, const char *ifname)
         return add_dev_to_thread(t, pkt_dev);
 }
 
-static struct pktgen_thread *__init pktgen_find_thread(const char *name)
+static int __init pktgen_create_thread(int cpu)
 {
         struct pktgen_thread *t;
-
-        mutex_lock(&pktgen_thread_lock);
-
-        list_for_each_entry(t, &pktgen_threads, th_list)
-                if (strcmp(t->name, name) == 0) {
-                        mutex_unlock(&pktgen_thread_lock);
-                        return t;
-                }
-
-        mutex_unlock(&pktgen_thread_lock);
-        return NULL;
-}
-
-static int __init pktgen_create_thread(const char *name, int cpu)
-{
-        int err;
-        struct pktgen_thread *t = NULL;
         struct proc_dir_entry *pe;
-
-        if (strlen(name) > 31) {
-                printk("pktgen: ERROR:  Thread name cannot be more than 31 characters.\n");
-                return -EINVAL;
-        }
-
-        if (pktgen_find_thread(name)) {
-                printk("pktgen: ERROR: thread: %s already exists\n", name);
-                return -EINVAL;
-        }
+        struct task_struct *p;
 
         t = kzalloc(sizeof(struct pktgen_thread), GFP_KERNEL);
         if (!t) {
@@ -3533,14 +3475,29 @@ static int __init pktgen_create_thread(const char *name, int cpu)
                 return -ENOMEM;
         }
 
-        strcpy(t->name, name);
         spin_lock_init(&t->if_lock);
         t->cpu = cpu;
 
-        pe = create_proc_entry(t->name, 0600, pg_proc_dir);
+        INIT_LIST_HEAD(&t->if_list);
+
+        list_add_tail(&t->th_list, &pktgen_threads);
+
+        p = kthread_create(pktgen_thread_worker, t, "kpktgend_%d", cpu);
+        if (IS_ERR(p)) {
+                printk("pktgen: kernel_thread() failed for cpu %d\n", t->cpu);
+                list_del(&t->th_list);
+                kfree(t);
+                return PTR_ERR(p);
+        }
+        kthread_bind(p, cpu);
+        t->tsk = p;
+
+        pe = create_proc_entry(t->tsk->comm, 0600, pg_proc_dir);
         if (!pe) {
                 printk("pktgen: cannot create %s/%s procfs entry.\n",
-                       PG_PROC_DIR, t->name);
+                       PG_PROC_DIR, t->tsk->comm);
+                kthread_stop(p);
+                list_del(&t->th_list);
                 kfree(t);
                 return -EINVAL;
         }
@@ -3548,21 +3505,7 @@ static int __init pktgen_create_thread(const char *name, int cpu)
         pe->proc_fops = &pktgen_thread_fops;
         pe->data = t;
 
-        INIT_LIST_HEAD(&t->if_list);
-
-        list_add_tail(&t->th_list, &pktgen_threads);
-
-        t->removed = 0;
-
-        err = kernel_thread((void *)pktgen_thread_worker, (void *)t,
-                          CLONE_FS | CLONE_FILES | CLONE_SIGHAND);
-        if (err < 0) {
-                printk("pktgen: kernel_thread() failed for cpu %d\n", t->cpu);
-                remove_proc_entry(t->name, pg_proc_dir);
-                list_del(&t->th_list);
-                kfree(t);
-                return err;
-        }
+        wake_up_process(p);
 
         return 0;
 }
@@ -3643,10 +3586,8 @@ static int __init pg_init(void)
 
         for_each_online_cpu(cpu) {
                 int err;
-                char buf[30];
 
-                sprintf(buf, "kpktgend_%i", cpu);
-                err = pktgen_create_thread(buf, cpu);
+                err = pktgen_create_thread(cpu);
                 if (err)
                         printk("pktgen: WARNING: Cannot create thread for cpu %d (%d)\n",
                                         cpu, err);
@@ -3674,9 +3615,8 @@ static void __exit pg_cleanup(void)
 
         list_for_each_safe(q, n, &pktgen_threads) {
                 t = list_entry(q, struct pktgen_thread, th_list);
-                t->control |= (T_TERMINATE);
-
-                wait_event_interruptible_timeout(queue, (t->removed == 1), HZ);
+                kthread_stop(t->tsk);
+                kfree(t);
         }
 
         /* Un-register us from receiving netdevice events */
diff --git a/net/ipv4/af_inet.c b/net/ipv4/af_inet.c
index 1144900d37f6..d60fd7321e63 100644
--- a/net/ipv4/af_inet.c
+++ b/net/ipv4/af_inet.c
@@ -305,7 +305,7 @@ lookup_protocol:
                 sk->sk_reuse = 1;
 
         inet = inet_sk(sk);
-        inet->is_icsk = INET_PROTOSW_ICSK & answer_flags;
+        inet->is_icsk = (INET_PROTOSW_ICSK & answer_flags) == INET_PROTOSW_ICSK;
 
         if (SOCK_RAW == sock->type) {
                 inet->num = protocol;
diff --git a/net/ipv4/devinet.c b/net/ipv4/devinet.c
index 84bed40273ad..25c8a42965df 100644
--- a/net/ipv4/devinet.c
+++ b/net/ipv4/devinet.c
@@ -165,9 +165,8 @@ struct in_device *inetdev_init(struct net_device *dev)
                               NET_IPV4_NEIGH, "ipv4", NULL, NULL);
 #endif
 
-        /* Account for reference dev->ip_ptr */
+        /* Account for reference dev->ip_ptr (below) */
         in_dev_hold(in_dev);
-        rcu_assign_pointer(dev->ip_ptr, in_dev);
 
 #ifdef CONFIG_SYSCTL
         devinet_sysctl_register(in_dev, &in_dev->cnf);
@@ -176,6 +175,8 @@ struct in_device *inetdev_init(struct net_device *dev)
         if (dev->flags & IFF_UP)
                 ip_mc_up(in_dev);
 out:
+        /* we can receive as soon as ip_ptr is set -- do this last */
+        rcu_assign_pointer(dev->ip_ptr, in_dev);
         return in_dev;
 out_kfree:
         kfree(in_dev);
diff --git a/net/ipv4/netfilter.c b/net/ipv4/netfilter.c
index a68966059b50..c47ce7076bd5 100644
--- a/net/ipv4/netfilter.c
+++ b/net/ipv4/netfilter.c
@@ -15,16 +15,19 @@ int ip_route_me_harder(struct sk_buff **pskb, unsigned addr_type)
         struct flowi fl = {};
         struct dst_entry *odst;
         unsigned int hh_len;
+        unsigned int type;
 
+        type = inet_addr_type(iph->saddr);
         if (addr_type == RTN_UNSPEC)
-                addr_type = inet_addr_type(iph->saddr);
+                addr_type = type;
 
         /* some non-standard hacks like ipt_REJECT.c:send_reset() can cause
          * packets with foreign saddr to appear on the NF_IP_LOCAL_OUT hook.
          */
         if (addr_type == RTN_LOCAL) {
                 fl.nl_u.ip4_u.daddr = iph->daddr;
-                fl.nl_u.ip4_u.saddr = iph->saddr;
+                if (type == RTN_LOCAL)
+                        fl.nl_u.ip4_u.saddr = iph->saddr;
                 fl.nl_u.ip4_u.tos = RT_TOS(iph->tos);
                 fl.oif = (*pskb)->sk ? (*pskb)->sk->sk_bound_dev_if : 0;
                 fl.mark = (*pskb)->mark;
diff --git a/net/ipv4/netfilter/Kconfig b/net/ipv4/netfilter/Kconfig
index f6026d4ac428..47bd3ad18b71 100644
--- a/net/ipv4/netfilter/Kconfig
+++ b/net/ipv4/netfilter/Kconfig
@@ -6,8 +6,8 @@ menu "IP: Netfilter Configuration"
         depends on INET && NETFILTER
 
 config NF_CONNTRACK_IPV4
-        tristate "IPv4 connection tracking support (required for NAT) (EXPERIMENTAL)"
-        depends on EXPERIMENTAL && NF_CONNTRACK
+        tristate "IPv4 connection tracking support (required for NAT)"
+        depends on NF_CONNTRACK
         ---help---
           Connection tracking keeps a record of what packets have passed
           through your machine, in order to figure out how they are related
diff --git a/net/ipv4/netfilter/ip_tables.c b/net/ipv4/netfilter/ip_tables.c
index 09696f16aa95..fc1f153c86ba 100644
--- a/net/ipv4/netfilter/ip_tables.c
+++ b/net/ipv4/netfilter/ip_tables.c
@@ -919,13 +919,13 @@ copy_entries_to_user(unsigned int total_size,
 #ifdef CONFIG_COMPAT
 struct compat_delta {
         struct compat_delta *next;
-        u_int16_t offset;
+        unsigned int offset;
         short delta;
 };
 
 static struct compat_delta *compat_offsets = NULL;
 
-static int compat_add_offset(u_int16_t offset, short delta)
+static int compat_add_offset(unsigned int offset, short delta)
 {
         struct compat_delta *tmp;
 
@@ -957,7 +957,7 @@ static void compat_flush_offsets(void)
         }
 }
 
-static short compat_calc_jump(u_int16_t offset)
+static short compat_calc_jump(unsigned int offset)
 {
         struct compat_delta *tmp;
         short delta;
@@ -997,7 +997,7 @@ static int compat_calc_entry(struct ipt_entry *e, struct xt_table_info *info,
                 void *base, struct xt_table_info *newinfo)
 {
         struct ipt_entry_target *t;
-        u_int16_t entry_offset;
+        unsigned int entry_offset;
         int off, i, ret;
 
         off = 0;
@@ -1467,7 +1467,7 @@ check_compat_entry_size_and_hooks(struct ipt_entry *e,
 {
         struct ipt_entry_target *t;
         struct ipt_target *target;
-        u_int16_t entry_offset;
+        unsigned int entry_offset;
         int ret, off, h, j;
 
         duprintf("check_compat_entry_size_and_hooks %p\n", e);
diff --git a/net/ipv4/netfilter/ipt_MASQUERADE.c b/net/ipv4/netfilter/ipt_MASQUERADE.c
index 28b9233956b5..d669685afd04 100644
--- a/net/ipv4/netfilter/ipt_MASQUERADE.c
+++ b/net/ipv4/netfilter/ipt_MASQUERADE.c
@@ -127,10 +127,13 @@ masquerade_target(struct sk_buff **pskb,
 static inline int
 device_cmp(struct ip_conntrack *i, void *ifindex)
 {
+        int ret;
 #ifdef CONFIG_NF_NAT_NEEDED
         struct nf_conn_nat *nat = nfct_nat(i);
+
+        if (!nat)
+                return 0;
 #endif
-        int ret;
 
         read_lock_bh(&masq_lock);
 #ifdef CONFIG_NF_NAT_NEEDED
diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
index bf7a22412bcb..12de90a5047c 100644
--- a/net/ipv4/tcp_ipv4.c
+++ b/net/ipv4/tcp_ipv4.c
@@ -648,7 +648,7 @@ static void tcp_v4_send_ack(struct tcp_timewait_sock *twsk,
                                    TCPOLEN_TIMESTAMP);
                 rep.opt[1] = htonl(tcp_time_stamp);
                 rep.opt[2] = htonl(ts);
-                arg.iov[0].iov_len = TCPOLEN_TSTAMP_ALIGNED;
+                arg.iov[0].iov_len += TCPOLEN_TSTAMP_ALIGNED;
         }
 
         /* Swap the send and the receive. */
diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index 9b0a90643151..171e5b55d7d6 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -413,8 +413,6 @@ static struct inet6_dev * ipv6_add_dev(struct net_device *dev)
         if (netif_carrier_ok(dev))
                 ndev->if_flags |= IF_READY;
 
-        /* protected by rtnl_lock */
-        rcu_assign_pointer(dev->ip6_ptr, ndev);
 
         ipv6_mc_init_dev(ndev);
         ndev->tstamp = jiffies;
@@ -425,6 +423,8 @@ static struct inet6_dev * ipv6_add_dev(struct net_device *dev)
                               NULL);
         addrconf_sysctl_register(ndev, &ndev->cnf);
 #endif
+        /* protected by rtnl_lock */
+        rcu_assign_pointer(dev->ip6_ptr, ndev);
         return ndev;
 }
 
diff --git a/net/ipv6/af_inet6.c b/net/ipv6/af_inet6.c
index e5cd83b2205d..832a5e6e2d7e 100644
--- a/net/ipv6/af_inet6.c
+++ b/net/ipv6/af_inet6.c
@@ -171,7 +171,7 @@ lookup_protocol:
                 sk->sk_reuse = 1;
 
         inet = inet_sk(sk);
-        inet->is_icsk = INET_PROTOSW_ICSK & answer_flags;
+        inet->is_icsk = (INET_PROTOSW_ICSK & answer_flags) == INET_PROTOSW_ICSK;
 
         if (SOCK_RAW == sock->type) {
                 inet->num = protocol;
diff --git a/net/netfilter/Kconfig b/net/netfilter/Kconfig
index 1b853c34d301..cd10e44db015 100644
--- a/net/netfilter/Kconfig
+++ b/net/netfilter/Kconfig
@@ -44,8 +44,7 @@ choice
         depends on NF_CONNTRACK_ENABLED
 
 config NF_CONNTRACK_SUPPORT
-        bool "Layer 3 Independent Connection tracking (EXPERIMENTAL)"
-        depends on EXPERIMENTAL
+        bool "Layer 3 Independent Connection tracking"
         help
           Layer 3 independent connection tracking is experimental scheme
           which generalize ip_conntrack to support other layer 3 protocols.
@@ -122,7 +121,7 @@ config NF_CONNTRACK_EVENTS
 
 config NF_CT_PROTO_GRE
         tristate
-        depends on EXPERIMENTAL && NF_CONNTRACK
+        depends on NF_CONNTRACK
 
 config NF_CT_PROTO_SCTP
         tristate 'SCTP protocol connection tracking support (EXPERIMENTAL)'
@@ -136,8 +135,8 @@ config NF_CT_PROTO_SCTP
           Documentation/modules.txt.  If unsure, say `N'.
 
 config NF_CONNTRACK_AMANDA
-        tristate "Amanda backup protocol support (EXPERIMENTAL)"
-        depends on EXPERIMENTAL && NF_CONNTRACK
+        tristate "Amanda backup protocol support"
+        depends on NF_CONNTRACK
         select TEXTSEARCH
         select TEXTSEARCH_KMP
         help
@@ -151,8 +150,8 @@ config NF_CONNTRACK_AMANDA
           To compile it as a module, choose M here.  If unsure, say N.
 
 config NF_CONNTRACK_FTP
-        tristate "FTP protocol support (EXPERIMENTAL)"
-        depends on EXPERIMENTAL && NF_CONNTRACK
+        tristate "FTP protocol support"
+        depends on NF_CONNTRACK
         help
           Tracking FTP connections is problematic: special helpers are
           required for tracking them, and doing masquerading and other forms
@@ -184,8 +183,8 @@ config NF_CONNTRACK_H323
           To compile it as a module, choose M here.  If unsure, say N.
 
 config NF_CONNTRACK_IRC
-        tristate "IRC protocol support (EXPERIMENTAL)"
-        depends on EXPERIMENTAL && NF_CONNTRACK
+        tristate "IRC protocol support"
+        depends on NF_CONNTRACK
         help
           There is a commonly-used extension to IRC called
           Direct Client-to-Client Protocol (DCC).  This enables users to send
@@ -218,8 +217,8 @@ config NF_CONNTRACK_NETBIOS_NS
           To compile it as a module, choose M here.  If unsure, say N.
 
 config NF_CONNTRACK_PPTP
-        tristate "PPtP protocol support (EXPERIMENTAL)"
-        depends on EXPERIMENTAL && NF_CONNTRACK
+        tristate "PPtP protocol support"
+        depends on NF_CONNTRACK
         select NF_CT_PROTO_GRE
         help
           This module adds support for PPTP (Point to Point Tunnelling
@@ -249,8 +248,8 @@ config NF_CONNTRACK_SIP
           To compile it as a module, choose M here.  If unsure, say N.
 
 config NF_CONNTRACK_TFTP
-        tristate "TFTP protocol support (EXPERIMENTAL)"
-        depends on EXPERIMENTAL && NF_CONNTRACK
+        tristate "TFTP protocol support"
+        depends on NF_CONNTRACK
         help
           TFTP connection tracking helper, this is required depending
           on how restrictive your ruleset is.
diff --git a/net/netfilter/nf_conntrack_netbios_ns.c b/net/netfilter/nf_conntrack_netbios_ns.c
index a5b234e444dc..2a48efdf0d67 100644
--- a/net/netfilter/nf_conntrack_netbios_ns.c
+++ b/net/netfilter/nf_conntrack_netbios_ns.c
@@ -89,6 +89,7 @@ static int help(struct sk_buff **pskb, unsigned int protoff,
 
         exp->expectfn             = NULL;
         exp->flags                = NF_CT_EXPECT_PERMANENT;
+        exp->helper               = NULL;
 
         nf_conntrack_expect_related(exp);
         nf_conntrack_expect_put(exp);
diff --git a/net/netfilter/xt_hashlimit.c b/net/netfilter/xt_hashlimit.c
index a5a6e192ac2d..f28bf69d3d42 100644
--- a/net/netfilter/xt_hashlimit.c
+++ b/net/netfilter/xt_hashlimit.c
@@ -745,7 +745,7 @@ static int __init xt_hashlimit_init(void)
         }
         hashlimit_procdir6 = proc_mkdir("ip6t_hashlimit", proc_net);
         if (!hashlimit_procdir6) {
-                printk(KERN_ERR "xt_hashlimit: tnable to create proc dir "
+                printk(KERN_ERR "xt_hashlimit: unable to create proc dir "
                                 "entry\n");
                 goto err4;
         }
diff --git a/net/netlabel/netlabel_cipso_v4.c b/net/netlabel/netlabel_cipso_v4.c
index 4afc75f9e377..73e0ff469bff 100644
--- a/net/netlabel/netlabel_cipso_v4.c
+++ b/net/netlabel/netlabel_cipso_v4.c
@@ -130,12 +130,12 @@ static int netlbl_cipsov4_add_common(struct genl_info *info,
 
         nla_for_each_nested(nla, info->attrs[NLBL_CIPSOV4_A_TAGLST], nla_rem)
                 if (nla->nla_type == NLBL_CIPSOV4_A_TAG) {
-                        if (iter > CIPSO_V4_TAG_MAXCNT)
+                        if (iter >= CIPSO_V4_TAG_MAXCNT)
                                 return -EINVAL;
                         doi_def->tags[iter++] = nla_get_u8(nla);
                 }
-        if (iter < CIPSO_V4_TAG_MAXCNT)
-                doi_def->tags[iter] = CIPSO_V4_TAG_INVALID;
+        while (iter < CIPSO_V4_TAG_MAXCNT)
+                doi_def->tags[iter++] = CIPSO_V4_TAG_INVALID;
 
         return 0;
 }
diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c
index 276131fe56dd..383dd4e82ee1 100644
--- a/net/netlink/af_netlink.c
+++ b/net/netlink/af_netlink.c
@@ -472,8 +472,7 @@ static int netlink_release(struct socket *sock)
                                 NETLINK_URELEASE, &n);
         }       
 
-        if (nlk->module)
-                module_put(nlk->module);
+        module_put(nlk->module);
 
         netlink_table_grab();
         if (nlk->flags & NETLINK_KERNEL_SOCKET) {
diff --git a/net/x25/af_x25.c b/net/x25/af_x25.c
index 52a2726d327f..b5c80b189902 100644
--- a/net/x25/af_x25.c
+++ b/net/x25/af_x25.c
@@ -484,8 +484,6 @@ out:
         return sk;
 }
 
-void x25_init_timers(struct sock *sk);
-
 static int x25_create(struct socket *sock, int protocol)
 {
         struct sock *sk;
diff --git a/net/x25/x25_facilities.c b/net/x25/x25_facilities.c
index 9f42b9c9de37..27f5cc7966f6 100644
--- a/net/x25/x25_facilities.c
+++ b/net/x25/x25_facilities.c
@@ -254,7 +254,7 @@ int x25_negotiate_facilities(struct sk_buff *skb, struct sock *sk,
          *      They want reverse charging, we won't accept it.
          */
         if ((theirs.reverse & 0x01 ) && (ours->reverse & 0x01)) {
-                SOCK_DEBUG(sk, "X.25: rejecting reverse charging request");
+                SOCK_DEBUG(sk, "X.25: rejecting reverse charging request\n");
                 return -1;
         }
 
@@ -262,29 +262,29 @@ int x25_negotiate_facilities(struct sk_buff *skb, struct sock *sk,
 
         if (theirs.throughput) {
                 if (theirs.throughput < ours->throughput) {
-                        SOCK_DEBUG(sk, "X.25: throughput negotiated down");
+                        SOCK_DEBUG(sk, "X.25: throughput negotiated down\n");
                         new->throughput = theirs.throughput;
                 }
         }
 
         if (theirs.pacsize_in && theirs.pacsize_out) {
                 if (theirs.pacsize_in < ours->pacsize_in) {
-                        SOCK_DEBUG(sk, "X.25: packet size inwards negotiated down");
+                        SOCK_DEBUG(sk, "X.25: packet size inwards negotiated down\n");
                         new->pacsize_in = theirs.pacsize_in;
                 }
                 if (theirs.pacsize_out < ours->pacsize_out) {
-                        SOCK_DEBUG(sk, "X.25: packet size outwards negotiated down");
+                        SOCK_DEBUG(sk, "X.25: packet size outwards negotiated down\n");
                         new->pacsize_out = theirs.pacsize_out;
                 }
         }
 
         if (theirs.winsize_in && theirs.winsize_out) {
                 if (theirs.winsize_in < ours->winsize_in) {
-                        SOCK_DEBUG(sk, "X.25: window size inwards negotiated down");
+                        SOCK_DEBUG(sk, "X.25: window size inwards negotiated down\n");
                         new->winsize_in = theirs.winsize_in;
                 }
                 if (theirs.winsize_out < ours->winsize_out) {
-                        SOCK_DEBUG(sk, "X.25: window size outwards negotiated down");
+                        SOCK_DEBUG(sk, "X.25: window size outwards negotiated down\n");
                         new->winsize_out = theirs.winsize_out;
                 }
         }
diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c
index e5372b11fc8f..82f36d396fca 100644
--- a/net/xfrm/xfrm_user.c
+++ b/net/xfrm/xfrm_user.c
@@ -434,18 +434,19 @@ error_no_put:
         return NULL;
 }
 
-static int xfrm_add_sa(struct sk_buff *skb, struct nlmsghdr *nlh, void **xfrma)
+static int xfrm_add_sa(struct sk_buff *skb, struct nlmsghdr *nlh,
+                struct rtattr **xfrma)
 {
         struct xfrm_usersa_info *p = NLMSG_DATA(nlh);
         struct xfrm_state *x;
         int err;
         struct km_event c;
 
-        err = verify_newsa_info(p, (struct rtattr **)xfrma);
+        err = verify_newsa_info(p, xfrma);
         if (err)
                 return err;
 
-        x = xfrm_state_construct(p, (struct rtattr **)xfrma, &err);
+        x = xfrm_state_construct(p, xfrma, &err);
         if (!x)
                 return err;
 
@@ -507,14 +508,15 @@ static struct xfrm_state *xfrm_user_state_lookup(struct xfrm_usersa_id *p,
         return x;
 }
 
-static int xfrm_del_sa(struct sk_buff *skb, struct nlmsghdr *nlh, void **xfrma)
+static int xfrm_del_sa(struct sk_buff *skb, struct nlmsghdr *nlh,
+                struct rtattr **xfrma)
 {
         struct xfrm_state *x;
         int err = -ESRCH;
         struct km_event c;
         struct xfrm_usersa_id *p = NLMSG_DATA(nlh);
 
-        x = xfrm_user_state_lookup(p, (struct rtattr **)xfrma, &err);
+        x = xfrm_user_state_lookup(p, xfrma, &err);
         if (x == NULL)
                 return err;
 
@@ -672,14 +674,15 @@ static struct sk_buff *xfrm_state_netlink(struct sk_buff *in_skb,
         return skb;
 }
 
-static int xfrm_get_sa(struct sk_buff *skb, struct nlmsghdr *nlh, void **xfrma)
+static int xfrm_get_sa(struct sk_buff *skb, struct nlmsghdr *nlh,
+                struct rtattr **xfrma)
 {
         struct xfrm_usersa_id *p = NLMSG_DATA(nlh);
         struct xfrm_state *x;
         struct sk_buff *resp_skb;
         int err = -ESRCH;
 
-        x = xfrm_user_state_lookup(p, (struct rtattr **)xfrma, &err);
+        x = xfrm_user_state_lookup(p, xfrma, &err);
         if (x == NULL)
                 goto out_noput;
 
@@ -718,7 +721,8 @@ static int verify_userspi_info(struct xfrm_userspi_info *p)
         return 0;
 }
 
-static int xfrm_alloc_userspi(struct sk_buff *skb, struct nlmsghdr *nlh, void **xfrma)
+static int xfrm_alloc_userspi(struct sk_buff *skb, struct nlmsghdr *nlh,
+                struct rtattr **xfrma)
 {
         struct xfrm_state *x;
         struct xfrm_userspi_info *p;
@@ -1013,7 +1017,8 @@ static struct xfrm_policy *xfrm_policy_construct(struct xfrm_userpolicy_info *p,
         return NULL;
 }
 
-static int xfrm_add_policy(struct sk_buff *skb, struct nlmsghdr *nlh, void **xfrma)
+static int xfrm_add_policy(struct sk_buff *skb, struct nlmsghdr *nlh,
+                struct rtattr **xfrma)
 {
         struct xfrm_userpolicy_info *p = NLMSG_DATA(nlh);
         struct xfrm_policy *xp;
@@ -1024,11 +1029,11 @@ static int xfrm_add_policy(struct sk_buff *skb, struct nlmsghdr *nlh, void **xfr
         err = verify_newpolicy_info(p);
         if (err)
                 return err;
-        err = verify_sec_ctx_len((struct rtattr **)xfrma);
+        err = verify_sec_ctx_len(xfrma);
         if (err)
                 return err;
 
-        xp = xfrm_policy_construct(p, (struct rtattr **)xfrma, &err);
+        xp = xfrm_policy_construct(p, xfrma, &err);
         if (!xp)
                 return err;
 
@@ -1227,7 +1232,8 @@ static struct sk_buff *xfrm_policy_netlink(struct sk_buff *in_skb,
         return skb;
 }
 
-static int xfrm_get_policy(struct sk_buff *skb, struct nlmsghdr *nlh, void **xfrma)
+static int xfrm_get_policy(struct sk_buff *skb, struct nlmsghdr *nlh,
+                struct rtattr **xfrma)
 {
         struct xfrm_policy *xp;
         struct xfrm_userpolicy_id *p;
@@ -1239,7 +1245,7 @@ static int xfrm_get_policy(struct sk_buff *skb, struct nlmsghdr *nlh, void **xfr
         p = NLMSG_DATA(nlh);
         delete = nlh->nlmsg_type == XFRM_MSG_DELPOLICY;
 
-        err = copy_from_user_policy_type(&type, (struct rtattr **)xfrma);
+        err = copy_from_user_policy_type(&type, xfrma);
         if (err)
                 return err;
 
@@ -1250,11 +1256,10 @@ static int xfrm_get_policy(struct sk_buff *skb, struct nlmsghdr *nlh, void **xfr
         if (p->index)
                 xp = xfrm_policy_byid(type, p->dir, p->index, delete);
         else {
-                struct rtattr **rtattrs = (struct rtattr **)xfrma;
-                struct rtattr *rt = rtattrs[XFRMA_SEC_CTX-1];
+                struct rtattr *rt = xfrma[XFRMA_SEC_CTX-1];
                 struct xfrm_policy tmp;
 
-                err = verify_sec_ctx_len(rtattrs);
+                err = verify_sec_ctx_len(xfrma);
                 if (err)
                         return err;
 
@@ -1302,7 +1307,8 @@ out:
         return err;
 }
 
-static int xfrm_flush_sa(struct sk_buff *skb, struct nlmsghdr *nlh, void **xfrma)
+static int xfrm_flush_sa(struct sk_buff *skb, struct nlmsghdr *nlh,
+                struct rtattr **xfrma)
 {
         struct km_event c;
         struct xfrm_usersa_flush *p = NLMSG_DATA(nlh);
@@ -1367,7 +1373,8 @@ nlmsg_failure:
         return -1;
 }
 
-static int xfrm_get_ae(struct sk_buff *skb, struct nlmsghdr *nlh, void **xfrma)
+static int xfrm_get_ae(struct sk_buff *skb, struct nlmsghdr *nlh,
+                struct rtattr **xfrma)
 {
         struct xfrm_state *x;
         struct sk_buff *r_skb;
@@ -1415,7 +1422,8 @@ static int xfrm_get_ae(struct sk_buff *skb, struct nlmsghdr *nlh, void **xfrma)
         return err;
 }
 
-static int xfrm_new_ae(struct sk_buff *skb, struct nlmsghdr *nlh, void **xfrma)
+static int xfrm_new_ae(struct sk_buff *skb, struct nlmsghdr *nlh,
+                struct rtattr **xfrma)
 {
         struct xfrm_state *x;
         struct km_event c;
@@ -1439,7 +1447,7 @@ static int xfrm_new_ae(struct sk_buff *skb, struct nlmsghdr *nlh, void **xfrma)
                 goto out;
 
         spin_lock_bh(&x->lock);
-        err = xfrm_update_ae_params(x,(struct rtattr **)xfrma);
+        err = xfrm_update_ae_params(x, xfrma);
         spin_unlock_bh(&x->lock);
         if (err < 0)
                 goto out;
@@ -1455,14 +1463,15 @@ out:
         return err;
 }
 
-static int xfrm_flush_policy(struct sk_buff *skb, struct nlmsghdr *nlh, void **xfrma)
+static int xfrm_flush_policy(struct sk_buff *skb, struct nlmsghdr *nlh,
+                struct rtattr **xfrma)
 {
         struct km_event c;
         u8 type = XFRM_POLICY_TYPE_MAIN;
         int err;
         struct xfrm_audit audit_info;
 
-        err = copy_from_user_policy_type(&type, (struct rtattr **)xfrma);
+        err = copy_from_user_policy_type(&type, xfrma);
         if (err)
                 return err;
 
@@ -1477,7 +1486,8 @@ static int xfrm_flush_policy(struct sk_buff *skb, struct nlmsghdr *nlh, void **x
         return 0;
 }
 
-static int xfrm_add_pol_expire(struct sk_buff *skb, struct nlmsghdr *nlh, void **xfrma)
+static int xfrm_add_pol_expire(struct sk_buff *skb, struct nlmsghdr *nlh,
+                struct rtattr **xfrma)
 {
         struct xfrm_policy *xp;
         struct xfrm_user_polexpire *up = NLMSG_DATA(nlh);
@@ -1485,18 +1495,17 @@ static int xfrm_add_pol_expire(struct sk_buff *skb, struct nlmsghdr *nlh, void *
         u8 type = XFRM_POLICY_TYPE_MAIN;
         int err = -ENOENT;
 
-        err = copy_from_user_policy_type(&type, (struct rtattr **)xfrma);
+        err = copy_from_user_policy_type(&type, xfrma);
         if (err)
                 return err;
 
         if (p->index)
                 xp = xfrm_policy_byid(type, p->dir, p->index, 0);
         else {
-                struct rtattr **rtattrs = (struct rtattr **)xfrma;
-                struct rtattr *rt = rtattrs[XFRMA_SEC_CTX-1];
+                struct rtattr *rt = xfrma[XFRMA_SEC_CTX-1];
                 struct xfrm_policy tmp;
 
-                err = verify_sec_ctx_len(rtattrs);
+                err = verify_sec_ctx_len(xfrma);
                 if (err)
                         return err;
 
@@ -1537,7 +1546,8 @@ out:
         return err;
 }
 
-static int xfrm_add_sa_expire(struct sk_buff *skb, struct nlmsghdr *nlh, void **xfrma)
+static int xfrm_add_sa_expire(struct sk_buff *skb, struct nlmsghdr *nlh,
+                struct rtattr **xfrma)
 {
         struct xfrm_state *x;
         int err;
@@ -1568,7 +1578,8 @@ out:
         return err;
 }
 
-static int xfrm_add_acquire(struct sk_buff *skb, struct nlmsghdr *nlh, void **xfrma)
+static int xfrm_add_acquire(struct sk_buff *skb, struct nlmsghdr *nlh,
+                struct rtattr **xfrma)
 {
         struct xfrm_policy *xp;
         struct xfrm_user_tmpl *ut;
@@ -1647,7 +1658,7 @@ static const int xfrm_msg_min[XFRM_NR_MSGTYPES] = {
 #undef XMSGSIZE
 
 static struct xfrm_link {
-        int (*doit)(struct sk_buff *, struct nlmsghdr *, void **);
+        int (*doit)(struct sk_buff *, struct nlmsghdr *, struct rtattr **);
         int (*dump)(struct sk_buff *, struct netlink_callback *);
 } xfrm_dispatch[XFRM_NR_MSGTYPES] = {
         [XFRM_MSG_NEWSA       - XFRM_MSG_BASE] = { .doit = xfrm_add_sa        },
@@ -1735,7 +1746,7 @@ static int xfrm_user_rcv_msg(struct sk_buff *skb, struct nlmsghdr *nlh, int *err
 
         if (link->doit == NULL)
                 goto err_einval;
-        *errp = link->doit(skb, nlh, (void **) &xfrma);
+        *errp = link->doit(skb, nlh, xfrma);
 
         return *errp;