16 files changed, 224 insertions, 142 deletions

diff --git a/net/9p/client.c b/net/9p/client.c
index 2ffe40cf2f01..10e320307ec0 100644
--- a/net/9p/client.c
+++ b/net/9p/client.c
@@ -75,7 +75,6 @@ static int parse_opts(char *opts, struct p9_client *clnt)
         int option;
         int ret = 0;
 
-        clnt->trans_mod = v9fs_default_trans();
         clnt->dotu = 1;
         clnt->msize = 8192;
 
@@ -108,7 +107,7 @@ static int parse_opts(char *opts, struct p9_client *clnt)
                         clnt->msize = option;
                         break;
                 case Opt_trans:
-                        clnt->trans_mod = v9fs_match_trans(&args[0]);
+                        clnt->trans_mod = v9fs_get_trans_by_name(&args[0]);
                         break;
                 case Opt_legacy:
                         clnt->dotu = 0;
@@ -117,6 +116,10 @@ static int parse_opts(char *opts, struct p9_client *clnt)
                         continue;
                 }
         }
+
+        if (!clnt->trans_mod)
+                clnt->trans_mod = v9fs_get_default_trans();
+
         kfree(options);
         return ret;
 }
@@ -150,6 +153,7 @@ struct p9_client *p9_client_create(const char *dev_name, char *options)
         if (!clnt)
                 return ERR_PTR(-ENOMEM);
 
+        clnt->trans_mod = NULL;
         clnt->trans = NULL;
         spin_lock_init(&clnt->lock);
         INIT_LIST_HEAD(&clnt->fidlist);
@@ -235,6 +239,8 @@ void p9_client_destroy(struct p9_client *clnt)
                 clnt->trans = NULL;
         }
 
+        v9fs_put_trans(clnt->trans_mod);
+
         list_for_each_entry_safe(fid, fidptr, &clnt->fidlist, flist)
                 p9_fid_destroy(fid);
 
diff --git a/net/9p/conv.c b/net/9p/conv.c
index 44547201f5bc..5ad3a3bd73b2 100644
--- a/net/9p/conv.c
+++ b/net/9p/conv.c
@@ -451,8 +451,10 @@ p9_put_data(struct cbuf *bufp, const char *data, int count,
                    unsigned char **pdata)
 {
         *pdata = buf_alloc(bufp, count);
+        if (*pdata == NULL)
+                return -ENOMEM;
         memmove(*pdata, data, count);
-        return count;
+        return 0;
 }
 
 static int
@@ -460,6 +462,8 @@ p9_put_user_data(struct cbuf *bufp, const char __user *data, int count,
                    unsigned char **pdata)
 {
         *pdata = buf_alloc(bufp, count);
+        if (*pdata == NULL)
+                return -ENOMEM;
         return copy_from_user(*pdata, data, count);
 }
 
diff --git a/net/9p/mod.c b/net/9p/mod.c
index bdee1fb7cc62..1084feb24cb0 100644
--- a/net/9p/mod.c
+++ b/net/9p/mod.c
@@ -31,6 +31,7 @@
 #include <linux/parser.h>
 #include <net/9p/transport.h>
 #include <linux/list.h>
+#include <linux/spinlock.h>
 
 #ifdef CONFIG_NET_9P_DEBUG
 unsigned int p9_debug_level = 0;        /* feature-rific global debug level  */
@@ -44,8 +45,8 @@ MODULE_PARM_DESC(debug, "9P debugging level");
  *
  */
 
+static DEFINE_SPINLOCK(v9fs_trans_lock);
 static LIST_HEAD(v9fs_trans_list);
-static struct p9_trans_module *v9fs_default_transport;
 
 /**
  * v9fs_register_trans - register a new transport with 9p
@@ -54,48 +55,87 @@ static struct p9_trans_module *v9fs_default_transport;
  */
 void v9fs_register_trans(struct p9_trans_module *m)
 {
+        spin_lock(&v9fs_trans_lock);
         list_add_tail(&m->list, &v9fs_trans_list);
-        if (m->def)
-                v9fs_default_transport = m;
+        spin_unlock(&v9fs_trans_lock);
 }
 EXPORT_SYMBOL(v9fs_register_trans);
 
 /**
- * v9fs_match_trans - match transport versus registered transports
+ * v9fs_unregister_trans - unregister a 9p transport
+ * @m: the transport to remove
+ *
+ */
+void v9fs_unregister_trans(struct p9_trans_module *m)
+{
+        spin_lock(&v9fs_trans_lock);
+        list_del_init(&m->list);
+        spin_unlock(&v9fs_trans_lock);
+}
+EXPORT_SYMBOL(v9fs_unregister_trans);
+
+/**
+ * v9fs_get_trans_by_name - get transport with the matching name
  * @name: string identifying transport
  *
  */
-struct p9_trans_module *v9fs_match_trans(const substring_t *name)
+struct p9_trans_module *v9fs_get_trans_by_name(const substring_t *name)
 {
-        struct list_head *p;
-        struct p9_trans_module *t = NULL;
-
-        list_for_each(p, &v9fs_trans_list) {
-                t = list_entry(p, struct p9_trans_module, list);
-                if (strncmp(t->name, name->from, name->to-name->from) == 0)
-                        return t;
-        }
-        return NULL;
+        struct p9_trans_module *t, *found = NULL;
+
+        spin_lock(&v9fs_trans_lock);
+
+        list_for_each_entry(t, &v9fs_trans_list, list)
+                if (strncmp(t->name, name->from, name->to-name->from) == 0 &&
+                    try_module_get(t->owner)) {
+                        found = t;
+                        break;
+                }
+
+        spin_unlock(&v9fs_trans_lock);
+        return found;
 }
-EXPORT_SYMBOL(v9fs_match_trans);
+EXPORT_SYMBOL(v9fs_get_trans_by_name);
 
 /**
- * v9fs_default_trans - returns pointer to default transport
+ * v9fs_get_default_trans - get the default transport
  *
  */
 
-struct p9_trans_module *v9fs_default_trans(void)
+struct p9_trans_module *v9fs_get_default_trans(void)
 {
-        if (v9fs_default_transport)
-                return v9fs_default_transport;
-        else if (!list_empty(&v9fs_trans_list))
-                return list_first_entry(&v9fs_trans_list,
-                                        struct p9_trans_module, list);
-        else
-                return NULL;
+        struct p9_trans_module *t, *found = NULL;
+
+        spin_lock(&v9fs_trans_lock);
+
+        list_for_each_entry(t, &v9fs_trans_list, list)
+                if (t->def && try_module_get(t->owner)) {
+                        found = t;
+                        break;
+                }
+
+        if (!found)
+                list_for_each_entry(t, &v9fs_trans_list, list)
+                        if (try_module_get(t->owner)) {
+                                found = t;
+                                break;
+                        }
+
+        spin_unlock(&v9fs_trans_lock);
+        return found;
 }
-EXPORT_SYMBOL(v9fs_default_trans);
+EXPORT_SYMBOL(v9fs_get_default_trans);
 
+/**
+ * v9fs_put_trans - put trans
+ * @m: transport to put
+ *
+ */
+void v9fs_put_trans(struct p9_trans_module *m)
+{
+        if (m)
+                module_put(m->owner);
+}
 
 /**
  * v9fs_init - Initialize module
@@ -120,6 +160,8 @@ static int __init init_p9(void)
 static void __exit exit_p9(void)
 {
         printk(KERN_INFO "Unloading 9P2000 support\n");
+
+        p9_trans_fd_exit();
 }
 
 module_init(init_p9)
diff --git a/net/9p/trans_fd.c b/net/9p/trans_fd.c
index cdf137af7adc..d652baf5ff91 100644
--- a/net/9p/trans_fd.c
+++ b/net/9p/trans_fd.c
@@ -151,7 +151,6 @@ struct p9_mux_poll_task {
  * @trans: reference to transport instance for this connection
  * @tagpool: id accounting for transactions
  * @err: error state
- * @equeue: event wait_q (?)
  * @req_list: accounting for requests which have been sent
  * @unsent_req_list: accounting for requests that haven't been sent
  * @rcall: current response &p9_fcall structure
@@ -178,7 +177,6 @@ struct p9_conn {
         struct p9_trans *trans;
         struct p9_idpool *tagpool;
         int err;
-        wait_queue_head_t equeue;
         struct list_head req_list;
         struct list_head unsent_req_list;
         struct p9_fcall *rcall;
@@ -240,22 +238,6 @@ static int p9_conn_rpcnb(struct p9_conn *m, struct p9_fcall *tc,
 
 static void p9_conn_cancel(struct p9_conn *m, int err);
 
-static int p9_mux_global_init(void)
-{
-        int i;
-
-        for (i = 0; i < ARRAY_SIZE(p9_mux_poll_tasks); i++)
-                p9_mux_poll_tasks[i].task = NULL;
-
-        p9_mux_wq = create_workqueue("v9fs");
-        if (!p9_mux_wq) {
-                printk(KERN_WARNING "v9fs: mux: creating workqueue failed\n");
-                return -ENOMEM;
-        }
-
-        return 0;
-}
-
 static u16 p9_mux_get_tag(struct p9_conn *m)
 {
         int tag;
@@ -409,11 +391,11 @@ static void p9_mux_poll_stop(struct p9_conn *m)
 static struct p9_conn *p9_conn_create(struct p9_trans *trans)
 {
         int i, n;
-        struct p9_conn *m, *mtmp;
+        struct p9_conn *m;
 
         P9_DPRINTK(P9_DEBUG_MUX, "transport %p msize %d\n", trans,
                                                                 trans->msize);
-        m = kmalloc(sizeof(struct p9_conn), GFP_KERNEL);
+        m = kzalloc(sizeof(struct p9_conn), GFP_KERNEL);
         if (!m)
                 return ERR_PTR(-ENOMEM);
 
@@ -424,25 +406,14 @@ static struct p9_conn *p9_conn_create(struct p9_trans *trans)
         m->trans = trans;
         m->tagpool = p9_idpool_create();
         if (IS_ERR(m->tagpool)) {
-                mtmp = ERR_PTR(-ENOMEM);
                 kfree(m);
-                return mtmp;
+                return ERR_PTR(-ENOMEM);
         }
 
-        m->err = 0;
-        init_waitqueue_head(&m->equeue);
         INIT_LIST_HEAD(&m->req_list);
         INIT_LIST_HEAD(&m->unsent_req_list);
-        m->rcall = NULL;
-        m->rpos = 0;
-        m->rbuf = NULL;
-        m->wpos = m->wsize = 0;
-        m->wbuf = NULL;
         INIT_WORK(&m->rq, p9_read_work);
         INIT_WORK(&m->wq, p9_write_work);
-        m->wsched = 0;
-        memset(&m->poll_waddr, 0, sizeof(m->poll_waddr));
-        m->poll_task = NULL;
         n = p9_mux_poll_start(m);
         if (n) {
                 kfree(m);
@@ -463,10 +434,8 @@ static struct p9_conn *p9_conn_create(struct p9_trans *trans)
         for (i = 0; i < ARRAY_SIZE(m->poll_waddr); i++) {
                 if (IS_ERR(m->poll_waddr[i])) {
                         p9_mux_poll_stop(m);
-                        mtmp = (void *)m->poll_waddr;   /* the error code */
                         kfree(m);
-                        m = mtmp;
-                        break;
+                        return (void *)m->poll_waddr;   /* the error code */
                 }
         }
 
@@ -483,18 +452,13 @@ static void p9_conn_destroy(struct p9_conn *m)
 {
         P9_DPRINTK(P9_DEBUG_MUX, "mux %p prev %p next %p\n", m,
                 m->mux_list.prev, m->mux_list.next);
-        p9_conn_cancel(m, -ECONNRESET);
-
-        if (!list_empty(&m->req_list)) {
-                /* wait until all processes waiting on this session exit */
-                P9_DPRINTK(P9_DEBUG_MUX,
-                        "mux %p waiting for empty request queue\n", m);
-                wait_event_timeout(m->equeue, (list_empty(&m->req_list)), 5000);
-                P9_DPRINTK(P9_DEBUG_MUX, "mux %p request queue empty: %d\n", m,
-                        list_empty(&m->req_list));
-        }
 
         p9_mux_poll_stop(m);
+        cancel_work_sync(&m->rq);
+        cancel_work_sync(&m->wq);
+
+        p9_conn_cancel(m, -ECONNRESET);
+
         m->trans = NULL;
         p9_idpool_destroy(m->tagpool);
         kfree(m);
@@ -840,8 +804,6 @@ static void p9_read_work(struct work_struct *work)
                                         (*req->cb) (req, req->cba);
                                 else
                                         kfree(req->rcall);
-
-                                wake_up(&m->equeue);
                         }
                 } else {
                         if (err >= 0 && rcall->id != P9_RFLUSH)
@@ -908,8 +870,10 @@ static struct p9_req *p9_send_request(struct p9_conn *m,
         else
                 n = p9_mux_get_tag(m);
 
-        if (n < 0)
+        if (n < 0) {
+                kfree(req);
                 return ERR_PTR(-ENOMEM);
+        }
 
         p9_set_tag(tc, n);
 
@@ -984,8 +948,6 @@ static void p9_mux_flush_cb(struct p9_req *freq, void *a)
                         (*req->cb) (req, req->cba);
                 else
                         kfree(req->rcall);
-
-                wake_up(&m->equeue);
         }
 
         kfree(freq->tcall);
@@ -1191,8 +1153,6 @@ void p9_conn_cancel(struct p9_conn *m, int err)
                 else
                         kfree(req->rcall);
         }
-
-        wake_up(&m->equeue);
 }
 
 /**
@@ -1370,7 +1330,6 @@ p9_fd_poll(struct p9_trans *trans, struct poll_table_struct *pt)
 {
         int ret, n;
         struct p9_trans_fd *ts = NULL;
-        mm_segment_t oldfs;
 
         if (trans && trans->status == Connected)
                 ts = trans->priv;
@@ -1384,24 +1343,17 @@ p9_fd_poll(struct p9_trans *trans, struct poll_table_struct *pt)
         if (!ts->wr->f_op || !ts->wr->f_op->poll)
                 return -EIO;
 
-        oldfs = get_fs();
-        set_fs(get_ds());
-
         ret = ts->rd->f_op->poll(ts->rd, pt);
         if (ret < 0)
-                goto end;
+                return ret;
 
         if (ts->rd != ts->wr) {
                 n = ts->wr->f_op->poll(ts->wr, pt);
-                if (n < 0) {
-                        ret = n;
-                        goto end;
-                }
+                if (n < 0)
+                        return n;
                 ret = (ret & ~POLLOUT) | (n & ~POLLIN);
         }
 
-end:
-        set_fs(oldfs);
         return ret;
 }
 
@@ -1629,6 +1581,7 @@ static struct p9_trans_module p9_tcp_trans = {
         .maxsize = MAX_SOCK_BUF,
         .def = 1,
         .create = p9_trans_create_tcp,
+        .owner = THIS_MODULE,
 };
 
 static struct p9_trans_module p9_unix_trans = {
@@ -1636,6 +1589,7 @@ static struct p9_trans_module p9_unix_trans = {
         .maxsize = MAX_SOCK_BUF,
         .def = 0,
         .create = p9_trans_create_unix,
+        .owner = THIS_MODULE,
 };
 
 static struct p9_trans_module p9_fd_trans = {
@@ -1643,14 +1597,20 @@ static struct p9_trans_module p9_fd_trans = {
         .maxsize = MAX_SOCK_BUF,
         .def = 0,
         .create = p9_trans_create_fd,
+        .owner = THIS_MODULE,
 };
 
 int p9_trans_fd_init(void)
 {
-        int ret = p9_mux_global_init();
-        if (ret) {
-                printk(KERN_WARNING "9p: starting mux failed\n");
-                return ret;
+        int i;
+
+        for (i = 0; i < ARRAY_SIZE(p9_mux_poll_tasks); i++)
+                p9_mux_poll_tasks[i].task = NULL;
+
+        p9_mux_wq = create_workqueue("v9fs");
+        if (!p9_mux_wq) {
+                printk(KERN_WARNING "v9fs: mux: creating workqueue failed\n");
+                return -ENOMEM;
         }
 
         v9fs_register_trans(&p9_tcp_trans);
@@ -1659,4 +1619,12 @@ int p9_trans_fd_init(void)
 
         return 0;
 }
-EXPORT_SYMBOL(p9_trans_fd_init);
+
+void p9_trans_fd_exit(void)
+{
+        v9fs_unregister_trans(&p9_tcp_trans);
+        v9fs_unregister_trans(&p9_unix_trans);
+        v9fs_unregister_trans(&p9_fd_trans);
+
+        destroy_workqueue(p9_mux_wq);
+}
diff --git a/net/9p/trans_virtio.c b/net/9p/trans_virtio.c
index 42adc052b149..94912e077a55 100644
--- a/net/9p/trans_virtio.c
+++ b/net/9p/trans_virtio.c
@@ -528,6 +528,7 @@ static struct p9_trans_module p9_virtio_trans = {
         .create = p9_virtio_create,
         .maxsize = PAGE_SIZE*16,
         .def = 0,
+        .owner = THIS_MODULE,
 };
 
 /* The standard init function */
@@ -545,6 +546,7 @@ static int __init p9_virtio_init(void)
 static void __exit p9_virtio_cleanup(void)
 {
         unregister_virtio_driver(&p9_virtio_drv);
+        v9fs_unregister_trans(&p9_virtio_trans);
 }
 
 module_init(p9_virtio_init);
diff --git a/net/core/dev.c b/net/core/dev.c
index e719ed29310f..e8eb2b478344 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -122,6 +122,7 @@
 #include <linux/if_arp.h>
 #include <linux/if_vlan.h>
 #include <linux/ip.h>
+#include <net/ip.h>
 #include <linux/ipv6.h>
 #include <linux/in.h>
 #include <linux/jhash.h>
@@ -1667,7 +1668,7 @@ static u16 simple_tx_hash(struct net_device *dev, struct sk_buff *skb)
 {
         u32 addr1, addr2, ports;
         u32 hash, ihl;
-        u8 ip_proto;
+        u8 ip_proto = 0;
 
         if (unlikely(!simple_tx_hashrnd_initialized)) {
                 get_random_bytes(&simple_tx_hashrnd, 4);
@@ -1676,7 +1677,8 @@ static u16 simple_tx_hash(struct net_device *dev, struct sk_buff *skb)
 
         switch (skb->protocol) {
         case __constant_htons(ETH_P_IP):
-                ip_proto = ip_hdr(skb)->protocol;
+                if (!(ip_hdr(skb)->frag_off & htons(IP_MF | IP_OFFSET)))
+                        ip_proto = ip_hdr(skb)->protocol;
                 addr1 = ip_hdr(skb)->saddr;
                 addr2 = ip_hdr(skb)->daddr;
                 ihl = ip_hdr(skb)->ihl;
diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
index 1b4fee20fc93..011478e46c40 100644
--- a/net/ipv4/tcp_ipv4.c
+++ b/net/ipv4/tcp_ipv4.c
@@ -618,7 +618,7 @@ static void tcp_v4_send_ack(struct sk_buff *skb, u32 seq, u32 ack,
                         ];
         } rep;
         struct ip_reply_arg arg;
-        struct net *net = dev_net(skb->dev);
+        struct net *net = dev_net(skb->dst->dev);
 
         memset(&rep.th, 0, sizeof(struct tcphdr));
         memset(&arg, 0, sizeof(arg));
diff --git a/net/ipv6/netfilter/ip6t_hbh.c b/net/ipv6/netfilter/ip6t_hbh.c
index 62e39ace0588..26654b26d7fa 100644
--- a/net/ipv6/netfilter/ip6t_hbh.c
+++ b/net/ipv6/netfilter/ip6t_hbh.c
@@ -97,8 +97,6 @@ hbh_mt6(const struct sk_buff *skb, const struct net_device *in,
         hdrlen -= 2;
         if (!(optinfo->flags & IP6T_OPTS_OPTS)) {
                 return ret;
-        } else if (optinfo->flags & IP6T_OPTS_NSTRICT) {
-                pr_debug("Not strict - not implemented");
         } else {
                 pr_debug("Strict ");
                 pr_debug("#%d ", optinfo->optsnr);
@@ -177,6 +175,12 @@ hbh_mt6_check(const char *tablename, const void *entry,
                 pr_debug("ip6t_opts: unknown flags %X\n", optsinfo->invflags);
                 return false;
         }
+
+        if (optsinfo->flags & IP6T_OPTS_NSTRICT) {
+                pr_debug("ip6t_opts: Not strict - not implemented");
+                return false;
+        }
+
         return true;
 }
 
diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index 9af6115f0f50..63442a1e741c 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -2688,6 +2688,8 @@ int __init ip6_route_init(void)
         if (ret)
                 goto out_kmem_cache;
 
+        ip6_dst_blackhole_ops.kmem_cachep = ip6_dst_ops_template.kmem_cachep;
+
         /* Registering of the loopback is done before this portion of code,
          * the loopback reference in rt6_info will not be taken, do it
          * manually for init_net */
diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
index b585c850a89a..10e22fd48222 100644
--- a/net/ipv6/tcp_ipv6.c
+++ b/net/ipv6/tcp_ipv6.c
@@ -1050,7 +1050,7 @@ static void tcp_v6_send_ack(struct sk_buff *skb, u32 seq, u32 ack, u32 win, u32
         struct tcphdr *th = tcp_hdr(skb), *t1;
         struct sk_buff *buff;
         struct flowi fl;
-        struct net *net = dev_net(skb->dev);
+        struct net *net = dev_net(skb->dst->dev);
         struct sock *ctl_sk = net->ipv6.tcp_sk;
         unsigned int tot_len = sizeof(struct tcphdr);
         __be32 *topt;
diff --git a/net/iucv/iucv.c b/net/iucv/iucv.c
index 705959b31e24..d7b54b5bfa69 100644
--- a/net/iucv/iucv.c
+++ b/net/iucv/iucv.c
@@ -524,7 +524,6 @@ static int iucv_enable(void)
         get_online_cpus();
         for_each_online_cpu(cpu)
                 smp_call_function_single(cpu, iucv_declare_cpu, NULL, 1);
-        preempt_enable();
         if (cpus_empty(iucv_buffer_cpumask))
                 /* No cpu could declare an iucv buffer. */
                 goto out_path;
@@ -547,7 +546,9 @@ out:
  */
 static void iucv_disable(void)
 {
+        get_online_cpus();
         on_each_cpu(iucv_retrieve_cpu, NULL, 1);
+        put_online_cpus();
         kfree(iucv_path_table);
 }
 
diff --git a/net/key/af_key.c b/net/key/af_key.c
index d628df97e02e..b7f5a1c353ee 100644
--- a/net/key/af_key.c
+++ b/net/key/af_key.c
@@ -73,22 +73,18 @@ static int pfkey_can_dump(struct sock *sk)
         return 0;
 }
 
-static int pfkey_do_dump(struct pfkey_sock *pfk)
+static void pfkey_terminate_dump(struct pfkey_sock *pfk)
 {
-        int rc;
-
-        rc = pfk->dump.dump(pfk);
-        if (rc == -ENOBUFS)
-                return 0;
-
-        pfk->dump.done(pfk);
-        pfk->dump.dump = NULL;
-        pfk->dump.done = NULL;
-        return rc;
+        if (pfk->dump.dump) {
+                pfk->dump.done(pfk);
+                pfk->dump.dump = NULL;
+                pfk->dump.done = NULL;
+        }
 }
 
 static void pfkey_sock_destruct(struct sock *sk)
 {
+        pfkey_terminate_dump(pfkey_sk(sk));
         skb_queue_purge(&sk->sk_receive_queue);
 
         if (!sock_flag(sk, SOCK_DEAD)) {
@@ -310,6 +306,18 @@ static int pfkey_broadcast(struct sk_buff *skb, gfp_t allocation,
         return err;
 }
 
+static int pfkey_do_dump(struct pfkey_sock *pfk)
+{
+        int rc;
+
+        rc = pfk->dump.dump(pfk);
+        if (rc == -ENOBUFS)
+                return 0;
+
+        pfkey_terminate_dump(pfk);
+        return rc;
+}
+
 static inline void pfkey_hdr_dup(struct sadb_msg *new, struct sadb_msg *orig)
 {
         *new = *orig;
diff --git a/net/sctp/sm_make_chunk.c b/net/sctp/sm_make_chunk.c
index b599cbba4fbe..d68869f966c3 100644
--- a/net/sctp/sm_make_chunk.c
+++ b/net/sctp/sm_make_chunk.c
@@ -1012,6 +1012,29 @@ end:
         return retval;
 }
 
+struct sctp_chunk *sctp_make_violation_paramlen(
+        const struct sctp_association *asoc,
+        const struct sctp_chunk *chunk,
+        struct sctp_paramhdr *param)
+{
+        struct sctp_chunk *retval;
+        static const char error[] = "The following parameter had invalid length:";
+        size_t payload_len = sizeof(error) + sizeof(sctp_errhdr_t) +
+                                sizeof(sctp_paramhdr_t);
+
+        retval = sctp_make_abort(asoc, chunk, payload_len);
+        if (!retval)
+                goto nodata;
+
+        sctp_init_cause(retval, SCTP_ERROR_PROTO_VIOLATION,
+                        sizeof(error) + sizeof(sctp_paramhdr_t));
+        sctp_addto_chunk(retval, sizeof(error), error);
+        sctp_addto_param(retval, sizeof(sctp_paramhdr_t), param);
+
+nodata:
+        return retval;
+}
+
 /* Make a HEARTBEAT chunk.  */
 struct sctp_chunk *sctp_make_heartbeat(const struct sctp_association *asoc,
                                   const struct sctp_transport *transport,
@@ -1782,11 +1805,6 @@ static int sctp_process_inv_paramlength(const struct sctp_association *asoc,
                                         const struct sctp_chunk *chunk,
                                         struct sctp_chunk **errp)
 {
-        static const char error[] = "The following parameter had invalid length:";
-        size_t          payload_len = WORD_ROUND(sizeof(error)) +
-                                                sizeof(sctp_paramhdr_t);
-
-
         /* This is a fatal error.  Any accumulated non-fatal errors are
          * not reported.
          */
@@ -1794,14 +1812,7 @@ static int sctp_process_inv_paramlength(const struct sctp_association *asoc,
                 sctp_chunk_free(*errp);
 
         /* Create an error chunk and fill it in with our payload. */
-        *errp = sctp_make_op_error_space(asoc, chunk, payload_len);
-
-        if (*errp) {
-                sctp_init_cause(*errp, SCTP_ERROR_PROTO_VIOLATION,
-                                sizeof(error) + sizeof(sctp_paramhdr_t));
-                sctp_addto_chunk(*errp, sizeof(error), error);
-                sctp_addto_param(*errp, sizeof(sctp_paramhdr_t), param);
-        }
+        *errp = sctp_make_violation_paramlen(asoc, chunk, param);
 
         return 0;
 }
diff --git a/net/sctp/sm_statefuns.c b/net/sctp/sm_statefuns.c
index 8848d329aa2c..7c622af2ce55 100644
--- a/net/sctp/sm_statefuns.c
+++ b/net/sctp/sm_statefuns.c
@@ -119,7 +119,7 @@ static sctp_disposition_t sctp_sf_violation_paramlen(
                                      const struct sctp_endpoint *ep,
                                      const struct sctp_association *asoc,
                                      const sctp_subtype_t type,
-                                     void *arg,
+                                     void *arg, void *ext,
                                      sctp_cmd_seq_t *commands);
 
 static sctp_disposition_t sctp_sf_violation_ctsn(
@@ -3425,7 +3425,7 @@ sctp_disposition_t sctp_sf_do_asconf(const struct sctp_endpoint *ep,
         addr_param = (union sctp_addr_param *)hdr->params;
         length = ntohs(addr_param->p.length);
         if (length < sizeof(sctp_paramhdr_t))
-                return sctp_sf_violation_paramlen(ep, asoc, type,
+                return sctp_sf_violation_paramlen(ep, asoc, type, arg,
                            (void *)addr_param, commands);
 
         /* Verify the ASCONF chunk before processing it. */
@@ -3433,8 +3433,8 @@ sctp_disposition_t sctp_sf_do_asconf(const struct sctp_endpoint *ep,
                             (sctp_paramhdr_t *)((void *)addr_param + length),
                             (void *)chunk->chunk_end,
                             &err_param))
-                return sctp_sf_violation_paramlen(ep, asoc, type,
-                                                  (void *)&err_param, commands);
+                return sctp_sf_violation_paramlen(ep, asoc, type, arg,
+                                                  (void *)err_param, commands);
 
         /* ADDIP 5.2 E1) Compare the value of the serial number to the value
          * the endpoint stored in a new association variable
@@ -3542,8 +3542,8 @@ sctp_disposition_t sctp_sf_do_asconf_ack(const struct sctp_endpoint *ep,
             (sctp_paramhdr_t *)addip_hdr->params,
             (void *)asconf_ack->chunk_end,
             &err_param))
-                return sctp_sf_violation_paramlen(ep, asoc, type,
-                           (void *)&err_param, commands);
+                return sctp_sf_violation_paramlen(ep, asoc, type, arg,
+                           (void *)err_param, commands);
 
         if (last_asconf) {
                 addip_hdr = (sctp_addiphdr_t *)last_asconf->subh.addip_hdr;
@@ -4240,12 +4240,38 @@ static sctp_disposition_t sctp_sf_violation_paramlen(
                                      const struct sctp_endpoint *ep,
                                      const struct sctp_association *asoc,
                                      const sctp_subtype_t type,
-                                     void *arg,
-                                     sctp_cmd_seq_t *commands) {
-        static const char err_str[] = "The following parameter had invalid length:";
+                                     void *arg, void *ext,
+                                     sctp_cmd_seq_t *commands)
+{
+        struct sctp_chunk *chunk =  arg;
+        struct sctp_paramhdr *param = ext;
+        struct sctp_chunk *abort = NULL;
 
-        return sctp_sf_abort_violation(ep, asoc, arg, commands, err_str,
-                                        sizeof(err_str));
+        if (sctp_auth_recv_cid(SCTP_CID_ABORT, asoc))
+                goto discard;
+
+        /* Make the abort chunk. */
+        abort = sctp_make_violation_paramlen(asoc, chunk, param);
+        if (!abort)
+                goto nomem;
+
+        sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(abort));
+        SCTP_INC_STATS(SCTP_MIB_OUTCTRLCHUNKS);
+
+        sctp_add_cmd_sf(commands, SCTP_CMD_SET_SK_ERR,
+                        SCTP_ERROR(ECONNABORTED));
+        sctp_add_cmd_sf(commands, SCTP_CMD_ASSOC_FAILED,
+                        SCTP_PERR(SCTP_ERROR_PROTO_VIOLATION));
+        SCTP_DEC_STATS(SCTP_MIB_CURRESTAB);
+
+discard:
+        sctp_sf_pdiscard(ep, asoc, SCTP_ST_CHUNK(0), arg, commands);
+
+        SCTP_INC_STATS(SCTP_MIB_ABORTEDS);
+
+        return SCTP_DISPOSITION_ABORT;
+nomem:
+        return SCTP_DISPOSITION_NOMEM;
 }
 
 /* Handle a protocol violation when the peer trying to advance the
diff --git a/net/socket.c b/net/socket.c
index 8ef8ba81b9e2..3e8d4e35c08f 100644
--- a/net/socket.c
+++ b/net/socket.c
@@ -1511,6 +1511,7 @@ out_fd:
         goto out_put;
 }
 
+#if 0
 #ifdef HAVE_SET_RESTORE_SIGMASK
 asmlinkage long sys_paccept(int fd, struct sockaddr __user *upeer_sockaddr,
                             int __user *upeer_addrlen,
@@ -1564,6 +1565,7 @@ asmlinkage long sys_paccept(int fd, struct sockaddr __user *upeer_sockaddr,
         return do_accept(fd, upeer_sockaddr, upeer_addrlen, flags);
 }
 #endif
+#endif
 
 asmlinkage long sys_accept(int fd, struct sockaddr __user *upeer_sockaddr,
                            int __user *upeer_addrlen)
diff --git a/net/xfrm/xfrm_output.c b/net/xfrm/xfrm_output.c
index ac25b4c0e982..dc50f1e71f76 100644
--- a/net/xfrm/xfrm_output.c
+++ b/net/xfrm/xfrm_output.c
@@ -27,10 +27,14 @@ static int xfrm_state_check_space(struct xfrm_state *x, struct sk_buff *skb)
                 - skb_headroom(skb);
         int ntail = dst->dev->needed_tailroom - skb_tailroom(skb);
 
-        if (nhead > 0 || ntail > 0)
-                return pskb_expand_head(skb, nhead, ntail, GFP_ATOMIC);
-
-        return 0;
+        if (nhead <= 0) {
+                if (ntail <= 0)
+                        return 0;
+                nhead = 0;
+        } else if (ntail < 0)
+                ntail = 0;
+
+        return pskb_expand_head(skb, nhead, ntail, GFP_ATOMIC);
 }
 
 static int xfrm_output_one(struct sk_buff *skb, int err)