42 files changed, 257 insertions, 197 deletions
diff --git a/net/9p/client.c b/net/9p/client.c
index 8af95b2dddd6..09d4f1e2e4a8 100644
--- a/net/9p/client.c
+++ b/net/9p/client.c
@@ -69,7 +69,7 @@ p9_client_rpc(struct p9_client *c, int8_t type, const char *fmt, ...);
 static int parse_opts(char *opts, struct p9_client *clnt)
 {
-        char *options;
+        char *options, *tmp_options;
        char *p;
        substring_t args[MAX_OPT_ARGS];
        int option;
@@ -81,12 +81,13 @@ static int parse_opts(char *opts, struct p9_client *clnt)
        if (!opts)
                return 0;
-        options = kstrdup(opts, GFP_KERNEL);
+        tmp_options = kstrdup(opts, GFP_KERNEL);
-        if (!options) {
+        if (!tmp_options) {
                P9_DPRINTK(P9_DEBUG_ERROR,
                                "failed to allocate copy of option string\n");
                return -ENOMEM;
        }
+        options = tmp_options;
        while ((p = strsep(&options, ",")) != NULL) {
                int token;
@@ -108,6 +109,13 @@ static int parse_opts(char *opts, struct p9_client *clnt)
                        break;
                case Opt_trans:
                        clnt->trans_mod = v9fs_get_trans_by_name(&args[0]);
+                        if(clnt->trans_mod == NULL) {
+                                P9_DPRINTK(P9_DEBUG_ERROR,
+                                   "Could not find request transport: %s\n",
+                                   (char *) &args[0]);
+                                ret = -EINVAL;
+                                goto free_and_return;
+                        }
                        break;
                case Opt_legacy:
                        clnt->dotu = 0;
@@ -117,7 +125,8 @@ static int parse_opts(char *opts, struct p9_client *clnt)
                }
        }
-        kfree(options);
+free_and_return:
+        kfree(tmp_options);
        return ret;
 }
@@ -667,18 +676,12 @@ struct p9_client *p9_client_create(const char *dev_name, char *options)
        clnt->trans = NULL;
        spin_lock_init(&clnt->lock);
        INIT_LIST_HEAD(&clnt->fidlist);
-        clnt->fidpool = p9_idpool_create();
-        if (IS_ERR(clnt->fidpool)) {
-                err = PTR_ERR(clnt->fidpool);
-                clnt->fidpool = NULL;
-                goto error;
-        }
        p9_tag_init(clnt);
        err = parse_opts(options, clnt);
        if (err < 0)
-                goto error;
+                goto free_client;
        if (!clnt->trans_mod)
                clnt->trans_mod = v9fs_get_default_trans();
@@ -687,7 +690,14 @@ struct p9_client *p9_client_create(const char *dev_name, char *options)
                err = -EPROTONOSUPPORT;
                P9_DPRINTK(P9_DEBUG_ERROR,
                                "No transport defined or default transport\n");
-                goto error;
+                goto free_client;
+        }
+        clnt->fidpool = p9_idpool_create();
+        if (IS_ERR(clnt->fidpool)) {
+                err = PTR_ERR(clnt->fidpool);
+                clnt->fidpool = NULL;
+                goto put_trans;
        }
        P9_DPRINTK(P9_DEBUG_MUX, "clnt %p trans %p msize %d dotu %d\n",
@@ -695,19 +705,25 @@ struct p9_client *p9_client_create(const char *dev_name, char *options)
        err = clnt->trans_mod->create(clnt, dev_name, options);
        if (err)
-                goto error;
+                goto destroy_fidpool;
        if ((clnt->msize+P9_IOHDRSZ) > clnt->trans_mod->maxsize)
                clnt->msize = clnt->trans_mod->maxsize-P9_IOHDRSZ;
        err = p9_client_version(clnt);
        if (err)
-                goto error;
+                goto close_trans;
        return clnt;
-error:
+close_trans:
-        p9_client_destroy(clnt);
+        clnt->trans_mod->close(clnt);
+destroy_fidpool:
+        p9_idpool_destroy(clnt->fidpool);
+put_trans:
+        v9fs_put_trans(clnt->trans_mod);
+free_client:
+        kfree(clnt);
        return ERR_PTR(err);
 }
 EXPORT_SYMBOL(p9_client_create);
@@ -1214,10 +1230,11 @@ static int p9_client_statsize(struct p9_wstat *wst, int optional)
 {
        int ret;
+        /* NOTE: size shouldn't include its own length */
        /* size[2] type[2] dev[4] qid[13] */
        /* mode[4] atime[4] mtime[4] length[8]*/
        /* name[s] uid[s] gid[s] muid[s] */
-        ret = 2+2+4+13+4+4+4+8+2+2+2+2;
+        ret = 2+4+13+4+4+4+8+2+2+2+2;
        if (wst->name)
                ret += strlen(wst->name);
@@ -1258,7 +1275,7 @@ int p9_client_wstat(struct p9_fid *fid, struct p9_wstat *wst)
                wst->name, wst->uid, wst->gid, wst->muid, wst->extension,
                wst->n_uid, wst->n_gid, wst->n_muid);
-        req = p9_client_rpc(clnt, P9_TWSTAT, "dwS", fid->fid, wst->size, wst);
+        req = p9_client_rpc(clnt, P9_TWSTAT, "dwS", fid->fid, wst->size+2, wst);
        if (IS_ERR(req)) {
                err = PTR_ERR(req);
                goto error;
diff --git a/net/9p/trans_fd.c b/net/9p/trans_fd.c
index be1cb909d8c0..31d0b05582a9 100644
--- a/net/9p/trans_fd.c
+++ b/net/9p/trans_fd.c
@@ -714,7 +714,7 @@ static int parse_opts(char *params, struct p9_fd_opts *opts)
        char *p;
        substring_t args[MAX_OPT_ARGS];
        int option;
-        char *options;
+        char *options, *tmp_options;
        int ret;
        opts->port = P9_PORT;
@@ -724,12 +724,13 @@ static int parse_opts(char *params, struct p9_fd_opts *opts)
        if (!params)
                return 0;
-        options = kstrdup(params, GFP_KERNEL);
+        tmp_options = kstrdup(params, GFP_KERNEL);
-        if (!options) {
+        if (!tmp_options) {
                P9_DPRINTK(P9_DEBUG_ERROR,
                                "failed to allocate copy of option string\n");
                return -ENOMEM;
        }
+        options = tmp_options;
        while ((p = strsep(&options, ",")) != NULL) {
                int token;
@@ -760,7 +761,8 @@ static int parse_opts(char *params, struct p9_fd_opts *opts)
                        continue;
                }
        }
-        kfree(options);
+        kfree(tmp_options);
        return 0;
 }
diff --git a/net/9p/trans_rdma.c b/net/9p/trans_rdma.c
index 65cb29db03f8..2c95a89c0f46 100644
--- a/net/9p/trans_rdma.c
+++ b/net/9p/trans_rdma.c
@@ -166,7 +166,7 @@ static int parse_opts(char *params, struct p9_rdma_opts *opts)
        char *p;
        substring_t args[MAX_OPT_ARGS];
        int option;
-        char *options;
+        char *options, *tmp_options;
        int ret;
        opts->port = P9_PORT;
@@ -177,12 +177,13 @@ static int parse_opts(char *params, struct p9_rdma_opts *opts)
        if (!params)
                return 0;
-        options = kstrdup(params, GFP_KERNEL);
+        tmp_options = kstrdup(params, GFP_KERNEL);
-        if (!options) {
+        if (!tmp_options) {
                P9_DPRINTK(P9_DEBUG_ERROR,
                           "failed to allocate copy of option string\n");
                return -ENOMEM;
        }
+        options = tmp_options;
        while ((p = strsep(&options, ",")) != NULL) {
                int token;
@@ -216,7 +217,7 @@ static int parse_opts(char *params, struct p9_rdma_opts *opts)
        }
        /* RQ must be at least as large as the SQ */
        opts->rq_depth = max(opts->rq_depth, opts->sq_depth);
-        kfree(options);
+        kfree(tmp_options);
        return 0;
 }
diff --git a/net/9p/trans_virtio.c b/net/9p/trans_virtio.c
index ea1e3daabefe..cb50f4ae5eef 100644
--- a/net/9p/trans_virtio.c
+++ b/net/9p/trans_virtio.c
@@ -102,7 +102,8 @@ static void p9_virtio_close(struct p9_client *client)
        struct virtio_chan *chan = client->trans;
        mutex_lock(&virtio_9p_lock);
-        chan->inuse = false;
+        if (chan)
+                chan->inuse = false;
        mutex_unlock(&virtio_9p_lock);
 }
@@ -311,6 +312,7 @@ p9_virtio_create(struct p9_client *client, const char *devname, char *args)
        }
        client->trans = (void *)chan;
+        client->status = Connected;
        chan->client = client;
        return 0;
diff --git a/net/bluetooth/hci_conn.c b/net/bluetooth/hci_conn.c
index b7c4224f4e7d..b10e3cdb08f8 100644
--- a/net/bluetooth/hci_conn.c
+++ b/net/bluetooth/hci_conn.c
@@ -377,6 +377,9 @@ struct hci_conn *hci_connect(struct hci_dev *hdev, int type, bdaddr_t *dst, __u8
        if (acl->state == BT_CONNECTED &&
                        (sco->state == BT_OPEN || sco->state == BT_CLOSED)) {
+                acl->power_save = 1;
+                hci_conn_enter_active_mode(acl);
                if (lmp_esco_capable(hdev))
                        hci_setup_sync(sco, acl->handle);
                else
diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c
index 28517bad796c..592da5c909c1 100644
--- a/net/bluetooth/hci_event.c
+++ b/net/bluetooth/hci_event.c
@@ -1699,6 +1699,7 @@ static inline void hci_sync_conn_complete_evt(struct hci_dev *hdev, struct sk_bu
                break;
        case 0x1c:      /* SCO interval rejected */
+        case 0x1a:      /* Unsupported Remote Feature */
        case 0x1f:      /* Unspecified error */
                if (conn->out && conn->attempt < 2) {
                        conn->pkt_type = (hdev->esco_type & SCO_ESCO_MASK) |
diff --git a/net/bluetooth/hidp/core.c b/net/bluetooth/hidp/core.c
index 37ba153c4cd4..280529ad9274 100644
--- a/net/bluetooth/hidp/core.c
+++ b/net/bluetooth/hidp/core.c
@@ -714,29 +714,9 @@ static void hidp_close(struct hid_device *hid)
 static int hidp_parse(struct hid_device *hid)
 {
        struct hidp_session *session = hid->driver_data;
-        struct hidp_connadd_req *req = session->req;
-        unsigned char *buf;
-        int ret;
-        buf = kmalloc(req->rd_size, GFP_KERNEL);
-        if (!buf)
-                return -ENOMEM;
-        if (copy_from_user(buf, req->rd_data, req->rd_size)) {
-                kfree(buf);
-                return -EFAULT;
-        }
-        ret = hid_parse_report(session->hid, buf, req->rd_size);
-        kfree(buf);
-        if (ret)
-                return ret;
-        session->req = NULL;
-        return 0;
+        return hid_parse_report(session->hid, session->rd_data,
+                        session->rd_size);
 }
 static int hidp_start(struct hid_device *hid)
@@ -781,12 +761,24 @@ static int hidp_setup_hid(struct hidp_session *session,
        bdaddr_t src, dst;
        int err;
+        session->rd_data = kzalloc(req->rd_size, GFP_KERNEL);
+        if (!session->rd_data)
+                return -ENOMEM;
+        if (copy_from_user(session->rd_data, req->rd_data, req->rd_size)) {
+                err = -EFAULT;
+                goto fault;
+        }
+        session->rd_size = req->rd_size;
        hid = hid_allocate_device();
-        if (IS_ERR(hid))
+        if (IS_ERR(hid)) {
-                return PTR_ERR(hid);
+                err = PTR_ERR(hid);
+                goto fault;
+        }
        session->hid = hid;
-        session->req = req;
        hid->driver_data = session;
        baswap(&src, &bt_sk(session->ctrl_sock->sk)->src);
@@ -817,6 +809,10 @@ failed:
        hid_destroy_device(hid);
        session->hid = NULL;
+fault:
+        kfree(session->rd_data);
+        session->rd_data = NULL;
        return err;
 }
@@ -911,6 +907,9 @@ unlink:
                session->hid = NULL;
        }
+        kfree(session->rd_data);
+        session->rd_data = NULL;
 purge:
        skb_queue_purge(&session->ctrl_transmit);
        skb_queue_purge(&session->intr_transmit);
diff --git a/net/bluetooth/hidp/hidp.h b/net/bluetooth/hidp/hidp.h
index faf3d74c3586..a4e215d50c10 100644
--- a/net/bluetooth/hidp/hidp.h
+++ b/net/bluetooth/hidp/hidp.h
@@ -154,7 +154,9 @@ struct hidp_session {
        struct sk_buff_head ctrl_transmit;
        struct sk_buff_head intr_transmit;
-        struct hidp_connadd_req *req;
+        /* Report descriptor */
+        __u8 *rd_data;
+        uint rd_size;
 };
 static inline void hidp_schedule(struct hidp_session *session)
diff --git a/net/bluetooth/rfcomm/core.c b/net/bluetooth/rfcomm/core.c
index fc5ee3296e22..89f4a59eb82b 100644
--- a/net/bluetooth/rfcomm/core.c
+++ b/net/bluetooth/rfcomm/core.c
@@ -252,7 +252,6 @@ static void rfcomm_session_timeout(unsigned long arg)
        BT_DBG("session %p state %ld", s, s->state);
        set_bit(RFCOMM_TIMED_OUT, &s->flags);
-        rfcomm_session_put(s);
        rfcomm_schedule(RFCOMM_SCHED_TIMEO);
 }
@@ -1151,7 +1150,11 @@ static int rfcomm_recv_ua(struct rfcomm_session *s, u8 dlci)
                        break;
                case BT_DISCONN:
-                        rfcomm_session_put(s);
+                        /* When socket is closed and we are not RFCOMM
+                         * initiator rfcomm_process_rx already calls
+                         * rfcomm_session_put() */
+                        if (s->sock->sk->sk_state != BT_CLOSED)
+                                rfcomm_session_put(s);
                        break;
                }
        }
@@ -1920,6 +1923,7 @@ static inline void rfcomm_process_sessions(void)
                if (test_and_clear_bit(RFCOMM_TIMED_OUT, &s->flags)) {
                        s->state = BT_DISCONN;
                        rfcomm_send_disc(s, 0);
+                        rfcomm_session_put(s);
                        continue;
                }
diff --git a/net/core/dev.c b/net/core/dev.c
index be9924f60ec3..ec874218b206 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -2761,7 +2761,7 @@ gro_result_t napi_frags_finish(struct napi_struct *napi, struct sk_buff *skb,
        switch (ret) {
        case GRO_NORMAL:
        case GRO_HELD:
-                skb->protocol = eth_type_trans(skb, napi->dev);
+                skb->protocol = eth_type_trans(skb, skb->dev);
                if (ret == GRO_HELD)
                        skb_gro_pull(skb, -ETH_HLEN);
diff --git a/net/core/dst.c b/net/core/dst.c
index 57bc4d5b8d08..cb1b3488b739 100644
--- a/net/core/dst.c
+++ b/net/core/dst.c
@@ -17,6 +17,7 @@
 #include <linux/string.h>
 #include <linux/types.h>
 #include <net/net_namespace.h>
+#include <linux/sched.h>
 #include <net/dst.h>
@@ -79,6 +80,7 @@ loop:
        while ((dst = next) != NULL) {
                next = dst->next;
                prefetch(&next->next);
+                cond_resched();
                if (likely(atomic_read(&dst->__refcnt))) {
                        last->next = dst;
                        last = dst;
diff --git a/net/core/ethtool.c b/net/core/ethtool.c
index d8aee584e8d1..236a9988ea91 100644
--- a/net/core/ethtool.c
+++ b/net/core/ethtool.c
@@ -927,6 +927,7 @@ int dev_ethtool(struct net *net, struct ifreq *ifr)
        case ETHTOOL_GPERMADDR:
        case ETHTOOL_GUFO:
        case ETHTOOL_GGSO:
+        case ETHTOOL_GGRO:
        case ETHTOOL_GFLAGS:
        case ETHTOOL_GPFLAGS:
        case ETHTOOL_GRXFH:
diff --git a/net/core/net-sysfs.c b/net/core/net-sysfs.c
index fbc1c7472c5e..099c753c4213 100644
--- a/net/core/net-sysfs.c
+++ b/net/core/net-sysfs.c
@@ -410,7 +410,8 @@ static ssize_t wireless_show(struct device *d, char *buf,
        const struct iw_statistics *iw;
        ssize_t ret = -EINVAL;
-        rtnl_lock();
+        if (!rtnl_trylock())
+                return restart_syscall();
        if (dev_isalive(dev)) {
                iw = get_wireless_stats(dev);
                if (iw)
diff --git a/net/core/pktgen.c b/net/core/pktgen.c
index de0c2c726420..2e692afdc55d 100644
--- a/net/core/pktgen.c
+++ b/net/core/pktgen.c
@@ -3524,6 +3524,7 @@ static int pktgen_thread_worker(void *arg)
                        wait_event_interruptible_timeout(t->queue,
                                                         t->control != 0,
                                                         HZ/10);
+                        try_to_freeze();
                        continue;
                }
diff --git a/net/dccp/ccid.c b/net/dccp/ccid.c
index 57dfb9c8c4f2..ff16e9df1969 100644
--- a/net/dccp/ccid.c
+++ b/net/dccp/ccid.c
@@ -83,7 +83,7 @@ static struct kmem_cache *ccid_kmem_cache_create(int obj_size, char *slab_name_f
        va_list args;
        va_start(args, fmt);
-        vsnprintf(slab_name_fmt, sizeof(slab_name_fmt), fmt, args);
+        vsnprintf(slab_name_fmt, CCID_SLAB_NAME_LENGTH, fmt, args);
        va_end(args);
        slab = kmem_cache_create(slab_name_fmt, sizeof(struct ccid) + obj_size, 0,
diff --git a/net/dccp/ccid.h b/net/dccp/ccid.h
index 269958bf7fe9..6df6f8ac9636 100644
--- a/net/dccp/ccid.h
+++ b/net/dccp/ccid.h
@@ -19,7 +19,9 @@
 #include <linux/list.h>
 #include <linux/module.h>
-#define CCID_MAX 255
+/* maximum value for a CCID (RFC 4340, 19.5) */
+#define CCID_MAX                255
+#define CCID_SLAB_NAME_LENGTH   32
 struct tcp_info;
@@ -49,8 +51,8 @@ struct ccid_operations {
        const char              *ccid_name;
        struct kmem_cache       *ccid_hc_rx_slab,
                                *ccid_hc_tx_slab;
-        char                    ccid_hc_rx_slab_name[32];
+        char                    ccid_hc_rx_slab_name[CCID_SLAB_NAME_LENGTH];
-        char                    ccid_hc_tx_slab_name[32];
+        char                    ccid_hc_tx_slab_name[CCID_SLAB_NAME_LENGTH];
        __u32                   ccid_hc_rx_obj_size,
                                ccid_hc_tx_obj_size;
        /* Interface Routines */
diff --git a/net/dccp/probe.c b/net/dccp/probe.c
index bace1d8cbcfd..f5b3464f1242 100644
--- a/net/dccp/probe.c
+++ b/net/dccp/probe.c
@@ -161,8 +161,8 @@ static __init int dccpprobe_init(void)
        if (!proc_net_fops_create(&init_net, procname, S_IRUSR, &dccpprobe_fops))
                goto err0;
-        ret = try_then_request_module((register_jprobe(&dccp_send_probe) == 0),
+        try_then_request_module((ret = register_jprobe(&dccp_send_probe)) == 0,
-                                        "dccp");
+                                "dccp");
        if (ret)
                goto err1;
diff --git a/net/ipv4/devinet.c b/net/ipv4/devinet.c
index 040c4f05b653..26dec2be9615 100644
--- a/net/ipv4/devinet.c
+++ b/net/ipv4/devinet.c
@@ -1317,14 +1317,19 @@ static int devinet_sysctl_forward(ctl_table *ctl, int write,
 {
        int *valp = ctl->data;
        int val = *valp;
+        loff_t pos = *ppos;
        int ret = proc_dointvec(ctl, write, buffer, lenp, ppos);
        if (write && *valp != val) {
                struct net *net = ctl->extra2;
                if (valp != &IPV4_DEVCONF_DFLT(net, FORWARDING)) {
-                        if (!rtnl_trylock())
+                        if (!rtnl_trylock()) {
+                                /* Restore the original values before restarting */
+                                *valp = val;
+                                *ppos = pos;
                                return restart_syscall();
+                        }
                        if (valp == &IPV4_DEVCONF_ALL(net, FORWARDING)) {
                                inet_forward_change(net);
                        } else if (*valp) {
diff --git a/net/ipv4/igmp.c b/net/ipv4/igmp.c
index 76c08402c933..a42f658e756a 100644
--- a/net/ipv4/igmp.c
+++ b/net/ipv4/igmp.c
@@ -946,7 +946,6 @@ int igmp_rcv(struct sk_buff *skb)
                break;
        case IGMP_HOST_MEMBERSHIP_REPORT:
        case IGMPV2_HOST_MEMBERSHIP_REPORT:
-        case IGMPV3_HOST_MEMBERSHIP_REPORT:
                /* Is it our report looped back? */
                if (skb_rtable(skb)->fl.iif == 0)
                        break;
@@ -960,6 +959,7 @@ int igmp_rcv(struct sk_buff *skb)
                in_dev_put(in_dev);
                return pim_rcv_v1(skb);
 #endif
+        case IGMPV3_HOST_MEMBERSHIP_REPORT:
        case IGMP_DVMRP:
        case IGMP_TRACE:
        case IGMP_HOST_LEAVE_MESSAGE:
diff --git a/net/ipv4/ipcomp.c b/net/ipv4/ipcomp.c
index 38fbf04150ae..544ce0876f12 100644
--- a/net/ipv4/ipcomp.c
+++ b/net/ipv4/ipcomp.c
@@ -124,16 +124,12 @@ static int ipcomp4_init_state(struct xfrm_state *x)
        if (x->props.mode == XFRM_MODE_TUNNEL) {
                err = ipcomp_tunnel_attach(x);
                if (err)
-                        goto error_tunnel;
+                        goto out;
        }
        err = 0;
 out:
        return err;
-error_tunnel:
-        ipcomp_destroy(x);
-        goto out;
 }
 static const struct xfrm_type ipcomp_type = {
diff --git a/net/ipv4/netfilter/arp_tables.c b/net/ipv4/netfilter/arp_tables.c
index 06632762ba5f..90203e1b9187 100644
--- a/net/ipv4/netfilter/arp_tables.c
+++ b/net/ipv4/netfilter/arp_tables.c
@@ -925,10 +925,10 @@ static int get_info(struct net *net, void __user *user, int *len, int compat)
        if (t && !IS_ERR(t)) {
                struct arpt_getinfo info;
                const struct xt_table_info *private = t->private;
 #ifdef CONFIG_COMPAT
+                struct xt_table_info tmp;
                if (compat) {
-                        struct xt_table_info tmp;
                        ret = compat_table_info(private, &tmp);
                        xt_compat_flush_offsets(NFPROTO_ARP);
                        private = &tmp;
diff --git a/net/ipv4/netfilter/ip_tables.c b/net/ipv4/netfilter/ip_tables.c
index 572330a552ef..3ce53cf13d5a 100644
--- a/net/ipv4/netfilter/ip_tables.c
+++ b/net/ipv4/netfilter/ip_tables.c
@@ -1132,10 +1132,10 @@ static int get_info(struct net *net, void __user *user, int *len, int compat)
        if (t && !IS_ERR(t)) {
                struct ipt_getinfo info;
                const struct xt_table_info *private = t->private;
 #ifdef CONFIG_COMPAT
+                struct xt_table_info tmp;
                if (compat) {
-                        struct xt_table_info tmp;
                        ret = compat_table_info(private, &tmp);
                        xt_compat_flush_offsets(AF_INET);
                        private = &tmp;
diff --git a/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c b/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c
index d171b123a656..d1ea38a7c490 100644
--- a/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c
+++ b/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c
@@ -210,7 +210,7 @@ static ctl_table ip_ct_sysctl_table[] = {
        },
        {
                .procname       = "ip_conntrack_buckets",
-                .data           = &nf_conntrack_htable_size,
+                .data           = &init_net.ct.htable_size,
                .maxlen         = sizeof(unsigned int),
                .mode           = 0444,
                .proc_handler   = proc_dointvec,
diff --git a/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4_compat.c b/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4_compat.c
index 8668a3defda6..2fb7b76da94f 100644
--- a/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4_compat.c
+++ b/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4_compat.c
@@ -32,7 +32,7 @@ static struct hlist_nulls_node *ct_get_first(struct seq_file *seq)
        struct hlist_nulls_node *n;
        for (st->bucket = 0;
-             st->bucket < nf_conntrack_htable_size;
+             st->bucket < net->ct.htable_size;
             st->bucket++) {
                n = rcu_dereference(net->ct.hash[st->bucket].first);
                if (!is_a_nulls(n))
@@ -50,7 +50,7 @@ static struct hlist_nulls_node *ct_get_next(struct seq_file *seq,
        head = rcu_dereference(head->next);
        while (is_a_nulls(head)) {
                if (likely(get_nulls_value(head) == st->bucket)) {
-                        if (++st->bucket >= nf_conntrack_htable_size)
+                        if (++st->bucket >= net->ct.htable_size)
                                return NULL;
                }
                head = rcu_dereference(net->ct.hash[st->bucket].first);
diff --git a/net/ipv4/netfilter/nf_nat_core.c b/net/ipv4/netfilter/nf_nat_core.c
index fe1a64479dd0..26066a2327ad 100644
--- a/net/ipv4/netfilter/nf_nat_core.c
+++ b/net/ipv4/netfilter/nf_nat_core.c
@@ -35,9 +35,6 @@ static DEFINE_SPINLOCK(nf_nat_lock);
 static struct nf_conntrack_l3proto *l3proto __read_mostly;
-/* Calculated at init based on memory size */
-static unsigned int nf_nat_htable_size __read_mostly;
 #define MAX_IP_NAT_PROTO 256
 static const struct nf_nat_protocol *nf_nat_protos[MAX_IP_NAT_PROTO]
                                                __read_mostly;
@@ -72,7 +69,7 @@ EXPORT_SYMBOL_GPL(nf_nat_proto_put);
 /* We keep an extra hash for each conntrack, for fast searching. */
 static inline unsigned int
-hash_by_src(const struct nf_conntrack_tuple *tuple)
+hash_by_src(const struct net *net, const struct nf_conntrack_tuple *tuple)
 {
        unsigned int hash;
@@ -80,7 +77,7 @@ hash_by_src(const struct nf_conntrack_tuple *tuple)
        hash = jhash_3words((__force u32)tuple->src.u3.ip,
                            (__force u32)tuple->src.u.all,
                            tuple->dst.protonum, 0);
-        return ((u64)hash * nf_nat_htable_size) >> 32;
+        return ((u64)hash * net->ipv4.nat_htable_size) >> 32;
 }
 /* Is this tuple already taken? (not by us) */
@@ -147,7 +144,7 @@ find_appropriate_src(struct net *net,
                     struct nf_conntrack_tuple *result,
                     const struct nf_nat_range *range)
 {
-        unsigned int h = hash_by_src(tuple);
+        unsigned int h = hash_by_src(net, tuple);
        const struct nf_conn_nat *nat;
        const struct nf_conn *ct;
        const struct hlist_node *n;
@@ -330,7 +327,7 @@ nf_nat_setup_info(struct nf_conn *ct,
        if (have_to_hash) {
                unsigned int srchash;
-                srchash = hash_by_src(&ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple);
+                srchash = hash_by_src(net, &ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple);
                spin_lock_bh(&nf_nat_lock);
                /* nf_conntrack_alter_reply might re-allocate exntension aera */
                nat = nfct_nat(ct);
@@ -679,8 +676,10 @@ nfnetlink_parse_nat_setup(struct nf_conn *ct,
 static int __net_init nf_nat_net_init(struct net *net)
 {
-        net->ipv4.nat_bysource = nf_ct_alloc_hashtable(&nf_nat_htable_size,
+        /* Leave them the same for the moment. */
-                                                      &net->ipv4.nat_vmalloced, 0);
+        net->ipv4.nat_htable_size = net->ct.htable_size;
+        net->ipv4.nat_bysource = nf_ct_alloc_hashtable(&net->ipv4.nat_htable_size,
+                                                       &net->ipv4.nat_vmalloced, 0);
        if (!net->ipv4.nat_bysource)
                return -ENOMEM;
        return 0;
@@ -703,7 +702,7 @@ static void __net_exit nf_nat_net_exit(struct net *net)
        nf_ct_iterate_cleanup(net, &clean_nat, NULL);
        synchronize_rcu();
        nf_ct_free_hashtable(net->ipv4.nat_bysource, net->ipv4.nat_vmalloced,
-                             nf_nat_htable_size);
+                             net->ipv4.nat_htable_size);
 }
 static struct pernet_operations nf_nat_net_ops = {
@@ -724,9 +723,6 @@ static int __init nf_nat_init(void)
                return ret;
        }
-        /* Leave them the same for the moment. */
-        nf_nat_htable_size = nf_conntrack_htable_size;
        ret = register_pernet_subsys(&nf_nat_net_ops);
        if (ret < 0)
                goto cleanup_extend;
diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
index 28e029632493..3fddc69ccccc 100644
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -5783,11 +5783,9 @@ int tcp_rcv_state_process(struct sock *sk, struct sk_buff *skb,
                                /* tcp_ack considers this ACK as duplicate
                                 * and does not calculate rtt.
-                                 * Fix it at least with timestamps.
+                                 * Force it here.
                                 */
-                                if (tp->rx_opt.saw_tstamp &&
+                                tcp_ack_update_rtt(sk, 0, 0);
-                                    tp->rx_opt.rcv_tsecr && !tp->srtt)
-                                        tcp_ack_saw_tstamp(sk, 0);
                                if (tp->rx_opt.tstamp_ok)
                                        tp->advmss -= TCPOLEN_TSTAMP_ALIGNED;
diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index de7a194a64ab..143791da062c 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -502,8 +502,11 @@ static int addrconf_fixup_forwarding(struct ctl_table *table, int *p, int old)
        if (p == &net->ipv6.devconf_dflt->forwarding)
                return 0;
-        if (!rtnl_trylock())
+        if (!rtnl_trylock()) {
+                /* Restore the original values before restarting */
+                *p = old;
                return restart_syscall();
+        }
        if (p == &net->ipv6.devconf_all->forwarding) {
                __s32 newf = net->ipv6.devconf_all->forwarding;
@@ -4028,12 +4031,15 @@ int addrconf_sysctl_forward(ctl_table *ctl, int write,
 {
        int *valp = ctl->data;
        int val = *valp;
+        loff_t pos = *ppos;
        int ret;
        ret = proc_dointvec(ctl, write, buffer, lenp, ppos);
        if (write)
                ret = addrconf_fixup_forwarding(ctl, valp, val);
+        if (ret)
+                *ppos = pos;
        return ret;
 }
@@ -4075,8 +4081,11 @@ static int addrconf_disable_ipv6(struct ctl_table *table, int *p, int old)
        if (p == &net->ipv6.devconf_dflt->disable_ipv6)
                return 0;
-        if (!rtnl_trylock())
+        if (!rtnl_trylock()) {
+                /* Restore the original values before restarting */
+                *p = old;
                return restart_syscall();
+        }
        if (p == &net->ipv6.devconf_all->disable_ipv6) {
                __s32 newf = net->ipv6.devconf_all->disable_ipv6;
@@ -4095,12 +4104,15 @@ int addrconf_sysctl_disable(ctl_table *ctl, int write,
 {
        int *valp = ctl->data;
        int val = *valp;
+        loff_t pos = *ppos;
        int ret;
        ret = proc_dointvec(ctl, write, buffer, lenp, ppos);
        if (write)
                ret = addrconf_disable_ipv6(ctl, valp, val);
+        if (ret)
+                *ppos = pos;
        return ret;
 }
diff --git a/net/ipv6/ipcomp6.c b/net/ipv6/ipcomp6.c
index 2f2a5ca2c878..002e6eef9120 100644
--- a/net/ipv6/ipcomp6.c
+++ b/net/ipv6/ipcomp6.c
@@ -154,16 +154,12 @@ static int ipcomp6_init_state(struct xfrm_state *x)
        if (x->props.mode == XFRM_MODE_TUNNEL) {
                err = ipcomp6_tunnel_attach(x);
                if (err)
-                        goto error_tunnel;
+                        goto out;
        }
        err = 0;
 out:
        return err;
-error_tunnel:
-        ipcomp_destroy(x);
-        goto out;
 }
 static const struct xfrm_type ipcomp6_type =
diff --git a/net/ipv6/netfilter/ip6_tables.c b/net/ipv6/netfilter/ip6_tables.c
index 480d7f8c9802..8a7e0f52e177 100644
--- a/net/ipv6/netfilter/ip6_tables.c
+++ b/net/ipv6/netfilter/ip6_tables.c
@@ -1164,10 +1164,10 @@ static int get_info(struct net *net, void __user *user, int *len, int compat)
        if (t && !IS_ERR(t)) {
                struct ip6t_getinfo info;
                const struct xt_table_info *private = t->private;
 #ifdef CONFIG_COMPAT
+                struct xt_table_info tmp;
                if (compat) {
-                        struct xt_table_info tmp;
                        ret = compat_table_info(private, &tmp);
                        xt_compat_flush_offsets(AF_INET6);
                        private = &tmp;
diff --git a/net/irda/irnet/irnet_ppp.c b/net/irda/irnet/irnet_ppp.c
index 156020d138b5..6b3602de359a 100644
--- a/net/irda/irnet/irnet_ppp.c
+++ b/net/irda/irnet/irnet_ppp.c
@@ -698,15 +698,18 @@ dev_irnet_ioctl(
      /* Query PPP channel and unit number */
    case PPPIOCGCHAN:
+      lock_kernel();
      if(ap->ppp_open && !put_user(ppp_channel_index(&ap->chan),
                                                (int __user *)argp))
        err = 0;
+      unlock_kernel();
      break;
    case PPPIOCGUNIT:
      lock_kernel();
      if(ap->ppp_open && !put_user(ppp_unit_number(&ap->chan),
                                                (int __user *)argp))
-      err = 0;
+        err = 0;
+      unlock_kernel();
      break;
      /* All these ioctls can be passed both directly and from ppp_generic,
diff --git a/net/key/af_key.c b/net/key/af_key.c
index 76fa6fef6473..539f43bc97db 100644
--- a/net/key/af_key.c
+++ b/net/key/af_key.c
@@ -3794,9 +3794,9 @@ static struct pernet_operations pfkey_net_ops = {
 static void __exit ipsec_pfkey_exit(void)
 {
-        unregister_pernet_subsys(&pfkey_net_ops);
        xfrm_unregister_km(&pfkeyv2_mgr);
        sock_unregister(PF_KEY);
+        unregister_pernet_subsys(&pfkey_net_ops);
        proto_unregister(&key_proto);
 }
@@ -3807,21 +3807,22 @@ static int __init ipsec_pfkey_init(void)
        if (err != 0)
                goto out;
-        err = sock_register(&pfkey_family_ops);
+        err = register_pernet_subsys(&pfkey_net_ops);
        if (err != 0)
                goto out_unregister_key_proto;
+        err = sock_register(&pfkey_family_ops);
+        if (err != 0)
+                goto out_unregister_pernet;
        err = xfrm_register_km(&pfkeyv2_mgr);
        if (err != 0)
                goto out_sock_unregister;
-        err = register_pernet_subsys(&pfkey_net_ops);
-        if (err != 0)
-                goto out_xfrm_unregister_km;
 out:
        return err;
-out_xfrm_unregister_km:
-        xfrm_unregister_km(&pfkeyv2_mgr);
 out_sock_unregister:
        sock_unregister(PF_KEY);
+out_unregister_pernet:
+        unregister_pernet_subsys(&pfkey_net_ops);
 out_unregister_key_proto:
        proto_unregister(&key_proto);
        goto out;
diff --git a/net/mac80211/ibss.c b/net/mac80211/ibss.c
index 1f2db647bb5c..22f0c2aa7a89 100644
--- a/net/mac80211/ibss.c
+++ b/net/mac80211/ibss.c
@@ -647,7 +647,7 @@ static void ieee80211_rx_mgmt_probe_req(struct ieee80211_sub_if_data *sdata,
        }
        if (pos[1] != 0 &&
            (pos[1] != ifibss->ssid_len ||
-             !memcmp(pos + 2, ifibss->ssid, ifibss->ssid_len))) {
+             memcmp(pos + 2, ifibss->ssid, ifibss->ssid_len))) {
                /* Ignore ProbeReq for foreign SSID */
                return;
        }
diff --git a/net/mac80211/rate.c b/net/mac80211/rate.c
index b9007f80cb92..12a2bff7dcdb 100644
--- a/net/mac80211/rate.c
+++ b/net/mac80211/rate.c
@@ -245,6 +245,9 @@ void rate_control_get_rate(struct ieee80211_sub_if_data *sdata,
                info->control.rates[i].count = 1;
        }
+        if (sdata->local->hw.flags & IEEE80211_HW_HAS_RATE_CONTROL)
+                return;
        if (sta && sdata->force_unicast_rateidx > -1) {
                info->control.rates[0].idx = sdata->force_unicast_rateidx;
        } else {
diff --git a/net/mac80211/scan.c b/net/mac80211/scan.c
index f934c9620b73..bc17cf7d68db 100644
--- a/net/mac80211/scan.c
+++ b/net/mac80211/scan.c
@@ -439,6 +439,16 @@ static int __ieee80211_start_scan(struct ieee80211_sub_if_data *sdata,
        if (local->scan_req)
                return -EBUSY;
+        if (req != local->int_scan_req &&
+            sdata->vif.type == NL80211_IFTYPE_STATION &&
+            !list_empty(&ifmgd->work_list)) {
+                /* actually wait for the work it's doing to finish/time out */
+                set_bit(IEEE80211_STA_REQ_SCAN, &ifmgd->request);
+                local->scan_req = req;
+                local->scan_sdata = sdata;
+                return 0;
+        }
        if (local->ops->hw_scan) {
                u8 *ies;
@@ -463,14 +473,6 @@ static int __ieee80211_start_scan(struct ieee80211_sub_if_data *sdata,
        local->scan_req = req;
        local->scan_sdata = sdata;
-        if (req != local->int_scan_req &&
-            sdata->vif.type == NL80211_IFTYPE_STATION &&
-            !list_empty(&ifmgd->work_list)) {
-                /* actually wait for the work it's doing to finish/time out */
-                set_bit(IEEE80211_STA_REQ_SCAN, &ifmgd->request);
-                return 0;
-        }
        if (local->ops->hw_scan)
                __set_bit(SCAN_HW_SCANNING, &local->scanning);
        else
diff --git a/net/netfilter/nf_conntrack_core.c b/net/netfilter/nf_conntrack_core.c
index 0e98c3282d42..4d79e3c1616c 100644
--- a/net/netfilter/nf_conntrack_core.c
+++ b/net/netfilter/nf_conntrack_core.c
@@ -30,6 +30,7 @@
 #include <linux/netdevice.h>
 #include <linux/socket.h>
 #include <linux/mm.h>
+#include <linux/nsproxy.h>
 #include <linux/rculist_nulls.h>
 #include <net/netfilter/nf_conntrack.h>
@@ -63,8 +64,6 @@ EXPORT_SYMBOL_GPL(nf_conntrack_max);
 struct nf_conn nf_conntrack_untracked __read_mostly;
 EXPORT_SYMBOL_GPL(nf_conntrack_untracked);
-static struct kmem_cache *nf_conntrack_cachep __read_mostly;
 static int nf_conntrack_hash_rnd_initted;
 static unsigned int nf_conntrack_hash_rnd;
@@ -86,9 +85,10 @@ static u_int32_t __hash_conntrack(const struct nf_conntrack_tuple *tuple,
        return ((u64)h * size) >> 32;
 }
-static inline u_int32_t hash_conntrack(const struct nf_conntrack_tuple *tuple)
+static inline u_int32_t hash_conntrack(const struct net *net,
+                                       const struct nf_conntrack_tuple *tuple)
 {
-        return __hash_conntrack(tuple, nf_conntrack_htable_size,
+        return __hash_conntrack(tuple, net->ct.htable_size,
                                nf_conntrack_hash_rnd);
 }
@@ -296,7 +296,7 @@ __nf_conntrack_find(struct net *net, const struct nf_conntrack_tuple *tuple)
 {
        struct nf_conntrack_tuple_hash *h;
        struct hlist_nulls_node *n;
-        unsigned int hash = hash_conntrack(tuple);
+        unsigned int hash = hash_conntrack(net, tuple);
        /* Disable BHs the entire time since we normally need to disable them
         * at least once for the stats anyway.
@@ -366,10 +366,11 @@ static void __nf_conntrack_hash_insert(struct nf_conn *ct,
 void nf_conntrack_hash_insert(struct nf_conn *ct)
 {
+        struct net *net = nf_ct_net(ct);
        unsigned int hash, repl_hash;
-        hash = hash_conntrack(&ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple);
+        hash = hash_conntrack(net, &ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple);
-        repl_hash = hash_conntrack(&ct->tuplehash[IP_CT_DIR_REPLY].tuple);
+        repl_hash = hash_conntrack(net, &ct->tuplehash[IP_CT_DIR_REPLY].tuple);
        __nf_conntrack_hash_insert(ct, hash, repl_hash);
 }
@@ -397,8 +398,8 @@ __nf_conntrack_confirm(struct sk_buff *skb)
        if (CTINFO2DIR(ctinfo) != IP_CT_DIR_ORIGINAL)
                return NF_ACCEPT;
-        hash = hash_conntrack(&ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple);
+        hash = hash_conntrack(net, &ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple);
-        repl_hash = hash_conntrack(&ct->tuplehash[IP_CT_DIR_REPLY].tuple);
+        repl_hash = hash_conntrack(net, &ct->tuplehash[IP_CT_DIR_REPLY].tuple);
        /* We're not in hash table, and we refuse to set up related
           connections for unconfirmed conns.  But packet copies and
@@ -468,7 +469,7 @@ nf_conntrack_tuple_taken(const struct nf_conntrack_tuple *tuple,
        struct net *net = nf_ct_net(ignored_conntrack);
        struct nf_conntrack_tuple_hash *h;
        struct hlist_nulls_node *n;
-        unsigned int hash = hash_conntrack(tuple);
+        unsigned int hash = hash_conntrack(net, tuple);
        /* Disable BHs the entire time since we need to disable them at
         * least once for the stats anyway.
@@ -503,7 +504,7 @@ static noinline int early_drop(struct net *net, unsigned int hash)
        int dropped = 0;
        rcu_read_lock();
-        for (i = 0; i < nf_conntrack_htable_size; i++) {
+        for (i = 0; i < net->ct.htable_size; i++) {
                hlist_nulls_for_each_entry_rcu(h, n, &net->ct.hash[hash],
                                         hnnode) {
                        tmp = nf_ct_tuplehash_to_ctrack(h);
@@ -523,7 +524,7 @@ static noinline int early_drop(struct net *net, unsigned int hash)
                if (cnt >= NF_CT_EVICTION_RANGE)
                        break;
-                hash = (hash + 1) % nf_conntrack_htable_size;
+                hash = (hash + 1) % net->ct.htable_size;
        }
        rcu_read_unlock();
@@ -557,7 +558,7 @@ struct nf_conn *nf_conntrack_alloc(struct net *net,
        if (nf_conntrack_max &&
            unlikely(atomic_read(&net->ct.count) > nf_conntrack_max)) {
-                unsigned int hash = hash_conntrack(orig);
+                unsigned int hash = hash_conntrack(net, orig);
                if (!early_drop(net, hash)) {
                        atomic_dec(&net->ct.count);
                        if (net_ratelimit())
@@ -572,7 +573,7 @@ struct nf_conn *nf_conntrack_alloc(struct net *net,
         * Do not use kmem_cache_zalloc(), as this cache uses
         * SLAB_DESTROY_BY_RCU.
         */
-        ct = kmem_cache_alloc(nf_conntrack_cachep, gfp);
+        ct = kmem_cache_alloc(net->ct.nf_conntrack_cachep, gfp);
        if (ct == NULL) {
                pr_debug("nf_conntrack_alloc: Can't alloc conntrack.\n");
                atomic_dec(&net->ct.count);
@@ -611,7 +612,7 @@ void nf_conntrack_free(struct nf_conn *ct)
        nf_ct_ext_destroy(ct);
        atomic_dec(&net->ct.count);
        nf_ct_ext_free(ct);
-        kmem_cache_free(nf_conntrack_cachep, ct);
+        kmem_cache_free(net->ct.nf_conntrack_cachep, ct);
 }
 EXPORT_SYMBOL_GPL(nf_conntrack_free);
@@ -1014,7 +1015,7 @@ get_next_corpse(struct net *net, int (*iter)(struct nf_conn *i, void *data),
        struct hlist_nulls_node *n;
        spin_lock_bh(&nf_conntrack_lock);
-        for (; *bucket < nf_conntrack_htable_size; (*bucket)++) {
+        for (; *bucket < net->ct.htable_size; (*bucket)++) {
                hlist_nulls_for_each_entry(h, n, &net->ct.hash[*bucket], hnnode) {
                        ct = nf_ct_tuplehash_to_ctrack(h);
                        if (iter(ct, data))
@@ -1113,9 +1114,12 @@ static void nf_ct_release_dying_list(struct net *net)
 static void nf_conntrack_cleanup_init_net(void)
 {
+        /* wait until all references to nf_conntrack_untracked are dropped */
+        while (atomic_read(&nf_conntrack_untracked.ct_general.use) > 1)
+                schedule();
        nf_conntrack_helper_fini();
        nf_conntrack_proto_fini();
-        kmem_cache_destroy(nf_conntrack_cachep);
 }
 static void nf_conntrack_cleanup_net(struct net *net)
@@ -1127,15 +1131,14 @@ static void nf_conntrack_cleanup_net(struct net *net)
                schedule();
                goto i_see_dead_people;
        }
-        /* wait until all references to nf_conntrack_untracked are dropped */
-        while (atomic_read(&nf_conntrack_untracked.ct_general.use) > 1)
-                schedule();
        nf_ct_free_hashtable(net->ct.hash, net->ct.hash_vmalloc,
-                             nf_conntrack_htable_size);
+                             net->ct.htable_size);
        nf_conntrack_ecache_fini(net);
        nf_conntrack_acct_fini(net);
        nf_conntrack_expect_fini(net);
+        kmem_cache_destroy(net->ct.nf_conntrack_cachep);
+        kfree(net->ct.slabname);
        free_percpu(net->ct.stat);
 }
@@ -1190,10 +1193,12 @@ int nf_conntrack_set_hashsize(const char *val, struct kernel_param *kp)
 {
        int i, bucket, vmalloced, old_vmalloced;
        unsigned int hashsize, old_size;
-        int rnd;
        struct hlist_nulls_head *hash, *old_hash;
        struct nf_conntrack_tuple_hash *h;
+        if (current->nsproxy->net_ns != &init_net)
+                return -EOPNOTSUPP;
        /* On boot, we can set this without any fancy locking. */
        if (!nf_conntrack_htable_size)
                return param_set_uint(val, kp);
@@ -1206,33 +1211,29 @@ int nf_conntrack_set_hashsize(const char *val, struct kernel_param *kp)
        if (!hash)
                return -ENOMEM;
-        /* We have to rehahs for the new table anyway, so we also can
-         * use a newrandom seed */
-        get_random_bytes(&rnd, sizeof(rnd));
        /* Lookups in the old hash might happen in parallel, which means we
         * might get false negatives during connection lookup. New connections
         * created because of a false negative won't make it into the hash
         * though since that required taking the lock.
         */
        spin_lock_bh(&nf_conntrack_lock);
-        for (i = 0; i < nf_conntrack_htable_size; i++) {
+        for (i = 0; i < init_net.ct.htable_size; i++) {
                while (!hlist_nulls_empty(&init_net.ct.hash[i])) {
                        h = hlist_nulls_entry(init_net.ct.hash[i].first,
                                        struct nf_conntrack_tuple_hash, hnnode);
                        hlist_nulls_del_rcu(&h->hnnode);
-                        bucket = __hash_conntrack(&h->tuple, hashsize, rnd);
+                        bucket = __hash_conntrack(&h->tuple, hashsize,
+                                                  nf_conntrack_hash_rnd);
                        hlist_nulls_add_head_rcu(&h->hnnode, &hash[bucket]);
                }
        }
-        old_size = nf_conntrack_htable_size;
+        old_size = init_net.ct.htable_size;
        old_vmalloced = init_net.ct.hash_vmalloc;
        old_hash = init_net.ct.hash;
-        nf_conntrack_htable_size = hashsize;
+        init_net.ct.htable_size = nf_conntrack_htable_size = hashsize;
        init_net.ct.hash_vmalloc = vmalloced;
        init_net.ct.hash = hash;
-        nf_conntrack_hash_rnd = rnd;
        spin_unlock_bh(&nf_conntrack_lock);
        nf_ct_free_hashtable(old_hash, old_vmalloced, old_size);
@@ -1271,15 +1272,6 @@ static int nf_conntrack_init_init_net(void)
               NF_CONNTRACK_VERSION, nf_conntrack_htable_size,
               nf_conntrack_max);
-        nf_conntrack_cachep = kmem_cache_create("nf_conntrack",
-                                                sizeof(struct nf_conn),
-                                                0, SLAB_DESTROY_BY_RCU, NULL);
-        if (!nf_conntrack_cachep) {
-                printk(KERN_ERR "Unable to create nf_conn slab cache\n");
-                ret = -ENOMEM;
-                goto err_cache;
-        }
        ret = nf_conntrack_proto_init();
        if (ret < 0)
                goto err_proto;
@@ -1288,13 +1280,19 @@ static int nf_conntrack_init_init_net(void)
        if (ret < 0)
                goto err_helper;
+        /* Set up fake conntrack: to never be deleted, not in any hashes */
+#ifdef CONFIG_NET_NS
+        nf_conntrack_untracked.ct_net = &init_net;
+#endif
+        atomic_set(&nf_conntrack_untracked.ct_general.use, 1);
+        /*  - and look it like as a confirmed connection */
+        set_bit(IPS_CONFIRMED_BIT, &nf_conntrack_untracked.status);
        return 0;
 err_helper:
        nf_conntrack_proto_fini();
 err_proto:
-        kmem_cache_destroy(nf_conntrack_cachep);
-err_cache:
        return ret;
 }
@@ -1316,7 +1314,24 @@ static int nf_conntrack_init_net(struct net *net)
                ret = -ENOMEM;
                goto err_stat;
        }
-        net->ct.hash = nf_ct_alloc_hashtable(&nf_conntrack_htable_size,
+        net->ct.slabname = kasprintf(GFP_KERNEL, "nf_conntrack_%p", net);
+        if (!net->ct.slabname) {
+                ret = -ENOMEM;
+                goto err_slabname;
+        }
+        net->ct.nf_conntrack_cachep = kmem_cache_create(net->ct.slabname,
+                                                        sizeof(struct nf_conn), 0,
+                                                        SLAB_DESTROY_BY_RCU, NULL);
+        if (!net->ct.nf_conntrack_cachep) {
+                printk(KERN_ERR "Unable to create nf_conn slab cache\n");
+                ret = -ENOMEM;
+                goto err_cache;
+        }
+        net->ct.htable_size = nf_conntrack_htable_size;
+        net->ct.hash = nf_ct_alloc_hashtable(&net->ct.htable_size,
                                             &net->ct.hash_vmalloc, 1);
        if (!net->ct.hash) {
                ret = -ENOMEM;
@@ -1333,15 +1348,6 @@ static int nf_conntrack_init_net(struct net *net)
        if (ret < 0)
                goto err_ecache;
-        /* Set up fake conntrack:
-            - to never be deleted, not in any hashes */
-#ifdef CONFIG_NET_NS
-        nf_conntrack_untracked.ct_net = &init_net;
-#endif
-        atomic_set(&nf_conntrack_untracked.ct_general.use, 1);
-        /*  - and look it like as a confirmed connection */
-        set_bit(IPS_CONFIRMED_BIT, &nf_conntrack_untracked.status);
        return 0;
 err_ecache:
@@ -1350,8 +1356,12 @@ err_acct:
        nf_conntrack_expect_fini(net);
 err_expect:
        nf_ct_free_hashtable(net->ct.hash, net->ct.hash_vmalloc,
-                             nf_conntrack_htable_size);
+                             net->ct.htable_size);
 err_hash:
+        kmem_cache_destroy(net->ct.nf_conntrack_cachep);
+err_cache:
+        kfree(net->ct.slabname);
+err_slabname:
        free_percpu(net->ct.stat);
 err_stat:
        return ret;
diff --git a/net/netfilter/nf_conntrack_expect.c b/net/netfilter/nf_conntrack_expect.c
index fdf5d2a1d9b4..2f25ff610982 100644
--- a/net/netfilter/nf_conntrack_expect.c
+++ b/net/netfilter/nf_conntrack_expect.c
@@ -569,7 +569,7 @@ static void exp_proc_remove(struct net *net)
 #endif /* CONFIG_PROC_FS */
 }
-module_param_named(expect_hashsize, nf_ct_expect_hsize, uint, 0600);
+module_param_named(expect_hashsize, nf_ct_expect_hsize, uint, 0400);
 int nf_conntrack_expect_init(struct net *net)
 {
@@ -577,7 +577,7 @@ int nf_conntrack_expect_init(struct net *net)
        if (net_eq(net, &init_net)) {
                if (!nf_ct_expect_hsize) {
-                        nf_ct_expect_hsize = nf_conntrack_htable_size / 256;
+                        nf_ct_expect_hsize = net->ct.htable_size / 256;
                        if (!nf_ct_expect_hsize)
                                nf_ct_expect_hsize = 1;
                }
diff --git a/net/netfilter/nf_conntrack_helper.c b/net/netfilter/nf_conntrack_helper.c
index 65c2a7bc3afc..4b1a56bd074c 100644
--- a/net/netfilter/nf_conntrack_helper.c
+++ b/net/netfilter/nf_conntrack_helper.c
@@ -192,7 +192,7 @@ static void __nf_conntrack_helper_unregister(struct nf_conntrack_helper *me,
        /* Get rid of expecteds, set helpers to NULL. */
        hlist_nulls_for_each_entry(h, nn, &net->ct.unconfirmed, hnnode)
                unhelp(h, me);
-        for (i = 0; i < nf_conntrack_htable_size; i++) {
+        for (i = 0; i < net->ct.htable_size; i++) {
                hlist_nulls_for_each_entry(h, nn, &net->ct.hash[i], hnnode)
                        unhelp(h, me);
        }
diff --git a/net/netfilter/nf_conntrack_netlink.c b/net/netfilter/nf_conntrack_netlink.c
index 42f21c01a93e..0ffe689dfe97 100644
--- a/net/netfilter/nf_conntrack_netlink.c
+++ b/net/netfilter/nf_conntrack_netlink.c
@@ -594,7 +594,7 @@ ctnetlink_dump_table(struct sk_buff *skb, struct netlink_callback *cb)
        rcu_read_lock();
        last = (struct nf_conn *)cb->args[1];
-        for (; cb->args[0] < nf_conntrack_htable_size; cb->args[0]++) {
+        for (; cb->args[0] < init_net.ct.htable_size; cb->args[0]++) {
 restart:
                hlist_nulls_for_each_entry_rcu(h, n, &init_net.ct.hash[cb->args[0]],
                                         hnnode) {
diff --git a/net/netfilter/nf_conntrack_standalone.c b/net/netfilter/nf_conntrack_standalone.c
index 028aba667ef7..e310f1561bb2 100644
--- a/net/netfilter/nf_conntrack_standalone.c
+++ b/net/netfilter/nf_conntrack_standalone.c
@@ -51,7 +51,7 @@ static struct hlist_nulls_node *ct_get_first(struct seq_file *seq)
        struct hlist_nulls_node *n;
        for (st->bucket = 0;
-             st->bucket < nf_conntrack_htable_size;
+             st->bucket < net->ct.htable_size;
             st->bucket++) {
                n = rcu_dereference(net->ct.hash[st->bucket].first);
                if (!is_a_nulls(n))
@@ -69,7 +69,7 @@ static struct hlist_nulls_node *ct_get_next(struct seq_file *seq,
        head = rcu_dereference(head->next);
        while (is_a_nulls(head)) {
                if (likely(get_nulls_value(head) == st->bucket)) {
-                        if (++st->bucket >= nf_conntrack_htable_size)
+                        if (++st->bucket >= net->ct.htable_size)
                                return NULL;
                }
                head = rcu_dereference(net->ct.hash[st->bucket].first);
@@ -355,7 +355,7 @@ static ctl_table nf_ct_sysctl_table[] = {
        },
        {
                .procname       = "nf_conntrack_buckets",
-                .data           = &nf_conntrack_htable_size,
+                .data           = &init_net.ct.htable_size,
                .maxlen         = sizeof(unsigned int),
                .mode           = 0444,
                .proc_handler   = proc_dointvec,
@@ -421,6 +421,7 @@ static int nf_conntrack_standalone_init_sysctl(struct net *net)
                goto out_kmemdup;
        table[1].data = &net->ct.count;
+        table[2].data = &net->ct.htable_size;
        table[3].data = &net->ct.sysctl_checksum;
        table[4].data = &net->ct.sysctl_log_invalid;
diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c
index a4957bf2ca60..4c5972ba8c78 100644
--- a/net/netlink/af_netlink.c
+++ b/net/netlink/af_netlink.c
@@ -455,9 +455,14 @@ static int netlink_create(struct net *net, struct socket *sock, int protocol,
        if (nl_table[protocol].registered &&
            try_module_get(nl_table[protocol].module))
                module = nl_table[protocol].module;
+        else
+                err = -EPROTONOSUPPORT;
        cb_mutex = nl_table[protocol].cb_mutex;
        netlink_unlock_table();
+        if (err < 0)
+                goto out;
        err = __netlink_create(net, sock, cb_mutex, protocol);
        if (err < 0)
                goto out_module;
diff --git a/net/sched/Kconfig b/net/sched/Kconfig
index 929218a47620..21f9c7678aa3 100644
--- a/net/sched/Kconfig
+++ b/net/sched/Kconfig
@@ -433,7 +433,7 @@ config NET_ACT_POLICE
          module.
          To compile this code as a module, choose M here: the
-          module will be called police.
+          module will be called act_police.
 config NET_ACT_GACT
        tristate "Generic actions"
@@ -443,7 +443,7 @@ config NET_ACT_GACT
          accepting packets.
          To compile this code as a module, choose M here: the
-          module will be called gact.
+          module will be called act_gact.
 config GACT_PROB
        bool "Probability support"
@@ -459,7 +459,7 @@ config NET_ACT_MIRRED
          other devices.
          To compile this code as a module, choose M here: the
-          module will be called mirred.
+          module will be called act_mirred.
 config NET_ACT_IPT
        tristate "IPtables targets"
@@ -469,7 +469,7 @@ config NET_ACT_IPT
          classification.
          To compile this code as a module, choose M here: the
-          module will be called ipt.
+          module will be called act_ipt.
 config NET_ACT_NAT
        tristate "Stateless NAT"
@@ -479,7 +479,7 @@ config NET_ACT_NAT
          netfilter for NAT unless you know what you are doing.
          To compile this code as a module, choose M here: the
-          module will be called nat.
+          module will be called act_nat.
 config NET_ACT_PEDIT
        tristate "Packet Editing"
@@ -488,7 +488,7 @@ config NET_ACT_PEDIT
          Say Y here if you want to mangle the content of packets.
          To compile this code as a module, choose M here: the
-          module will be called pedit.
+          module will be called act_pedit.
 config NET_ACT_SIMP
        tristate "Simple Example (Debug)"
@@ -502,7 +502,7 @@ config NET_ACT_SIMP
          If unsure, say N.
          To compile this code as a module, choose M here: the
-          module will be called simple.
+          module will be called act_simple.
 config NET_ACT_SKBEDIT
        tristate "SKB Editing"
@@ -513,7 +513,7 @@ config NET_ACT_SKBEDIT
          If unsure, say N.
          To compile this code as a module, choose M here: the
-          module will be called skbedit.
+          module will be called act_skbedit.
 config NET_CLS_IND
        bool "Incoming device classification"
diff --git a/net/xfrm/xfrm_state.c b/net/xfrm/xfrm_state.c
index b36cc344474b..f445ea1c5f52 100644
--- a/net/xfrm/xfrm_state.c
+++ b/net/xfrm/xfrm_state.c
@@ -1102,7 +1102,7 @@ static struct xfrm_state *xfrm_state_clone(struct xfrm_state *orig, int *errp)
        int err = -ENOMEM;
        struct xfrm_state *x = xfrm_state_alloc(net);
        if (!x)
-                goto error;
+                goto out;
        memcpy(&x->id, &orig->id, sizeof(x->id));
        memcpy(&x->sel, &orig->sel, sizeof(x->sel));
@@ -1160,16 +1160,10 @@ static struct xfrm_state *xfrm_state_clone(struct xfrm_state *orig, int *errp)
        return x;
 error:
+        xfrm_state_put(x);
+out:
        if (errp)
                *errp = err;
-        if (x) {
-                kfree(x->aalg);
-                kfree(x->ealg);
-                kfree(x->calg);
-                kfree(x->encap);
-                kfree(x->coaddr);
-        }
-        kfree(x);
        return NULL;
 }