18 files changed, 177 insertions, 63 deletions
diff --git a/net/bridge/br_if.c b/net/bridge/br_if.c
index 91bb895375f4..defcf6a8607c 100644
--- a/net/bridge/br_if.c
+++ b/net/bridge/br_if.c
@@ -79,7 +79,6 @@ static void destroy_nbp(struct net_bridge_port *p)
 {
        struct net_device *dev = p->dev;
-        dev->br_port = NULL;
        p->br = NULL;
        p->dev = NULL;
        dev_put(dev);
@@ -100,6 +99,7 @@ static void del_nbp(struct net_bridge_port *p)
        struct net_bridge *br = p->br;
        struct net_device *dev = p->dev;
+        dev->br_port = NULL;
        dev_set_promiscuity(dev, -1);
        spin_lock_bh(&br->lock);
diff --git a/net/bridge/netfilter/ebtables.c b/net/bridge/netfilter/ebtables.c
index c4540144f0f4..f8ffbf6e2333 100644
--- a/net/bridge/netfilter/ebtables.c
+++ b/net/bridge/netfilter/ebtables.c
@@ -26,6 +26,7 @@
 #include <linux/spinlock.h>
 #include <asm/uaccess.h>
 #include <linux/smp.h>
+#include <linux/cpumask.h>
 #include <net/sock.h>
 /* needed for logical [in,out]-dev filtering */
 #include "../br_private.h"
@@ -823,10 +824,11 @@ static int translate_table(struct ebt_replace *repl,
                /* this will get free'd in do_replace()/ebt_register_table()
                   if an error occurs */
                newinfo->chainstack = (struct ebt_chainstack **)
-                   vmalloc(num_possible_cpus() * sizeof(struct ebt_chainstack));
+                   vmalloc((highest_possible_processor_id()+1) 
+                                                * sizeof(struct ebt_chainstack));
                if (!newinfo->chainstack)
                        return -ENOMEM;
-                for (i = 0; i < num_possible_cpus(); i++) {
+                for_each_cpu(i) {
                        newinfo->chainstack[i] =
                           vmalloc(udc_cnt * sizeof(struct ebt_chainstack));
                        if (!newinfo->chainstack[i]) {
@@ -895,9 +897,12 @@ static void get_counters(struct ebt_counter *oldcounters,
        /* counters of cpu 0 */
        memcpy(counters, oldcounters,
-           sizeof(struct ebt_counter) * nentries);
+               sizeof(struct ebt_counter) * nentries);
        /* add other counters to those of cpu 0 */
-        for (cpu = 1; cpu < num_possible_cpus(); cpu++) {
+        for_each_cpu(cpu) {
+                if (cpu == 0)
+                        continue;
                counter_base = COUNTER_BASE(oldcounters, nentries, cpu);
                for (i = 0; i < nentries; i++) {
                        counters[i].pcnt += counter_base[i].pcnt;
@@ -929,7 +934,8 @@ static int do_replace(void __user *user, unsigned int len)
                BUGPRINT("Entries_size never zero\n");
                return -EINVAL;
        }
-        countersize = COUNTER_OFFSET(tmp.nentries) * num_possible_cpus();
+        countersize = COUNTER_OFFSET(tmp.nentries) * 
+                                        (highest_possible_processor_id()+1);
        newinfo = (struct ebt_table_info *)
           vmalloc(sizeof(struct ebt_table_info) + countersize);
        if (!newinfo)
@@ -1022,7 +1028,7 @@ static int do_replace(void __user *user, unsigned int len)
        vfree(table->entries);
        if (table->chainstack) {
-                for (i = 0; i < num_possible_cpus(); i++)
+                for_each_cpu(i)
                        vfree(table->chainstack[i]);
                vfree(table->chainstack);
        }
@@ -1040,7 +1046,7 @@ free_counterstmp:
        vfree(counterstmp);
        /* can be initialized in translate_table() */
        if (newinfo->chainstack) {
-                for (i = 0; i < num_possible_cpus(); i++)
+                for_each_cpu(i)
                        vfree(newinfo->chainstack[i]);
                vfree(newinfo->chainstack);
        }
@@ -1132,7 +1138,8 @@ int ebt_register_table(struct ebt_table *table)
                return -EINVAL;
        }
-        countersize = COUNTER_OFFSET(table->table->nentries) * num_possible_cpus();
+        countersize = COUNTER_OFFSET(table->table->nentries) *
+                                        (highest_possible_processor_id()+1);
        newinfo = (struct ebt_table_info *)
           vmalloc(sizeof(struct ebt_table_info) + countersize);
        ret = -ENOMEM;
@@ -1186,7 +1193,7 @@ free_unlock:
        up(&ebt_mutex);
 free_chainstack:
        if (newinfo->chainstack) {
-                for (i = 0; i < num_possible_cpus(); i++)
+                for_each_cpu(i)
                        vfree(newinfo->chainstack[i]);
                vfree(newinfo->chainstack);
        }
@@ -1209,7 +1216,7 @@ void ebt_unregister_table(struct ebt_table *table)
        up(&ebt_mutex);
        vfree(table->private->entries);
        if (table->private->chainstack) {
-                for (i = 0; i < num_possible_cpus(); i++)
+                for_each_cpu(i)
                        vfree(table->private->chainstack[i]);
                vfree(table->private->chainstack);
        }
diff --git a/net/dccp/ccid.h b/net/dccp/ccid.h
index 21e55142dcd3..c37eeeaf5c6e 100644
--- a/net/dccp/ccid.h
+++ b/net/dccp/ccid.h
@@ -110,14 +110,14 @@ static inline int ccid_hc_tx_init(struct ccid *ccid, struct sock *sk)
 static inline void ccid_hc_rx_exit(struct ccid *ccid, struct sock *sk)
 {
-        if (ccid->ccid_hc_rx_exit != NULL &&
+        if (ccid != NULL && ccid->ccid_hc_rx_exit != NULL &&
            dccp_sk(sk)->dccps_hc_rx_ccid_private != NULL)
                ccid->ccid_hc_rx_exit(sk);
 }
 static inline void ccid_hc_tx_exit(struct ccid *ccid, struct sock *sk)
 {
-        if (ccid->ccid_hc_tx_exit != NULL &&
+        if (ccid != NULL && ccid->ccid_hc_tx_exit != NULL &&
            dccp_sk(sk)->dccps_hc_tx_ccid_private != NULL)
                ccid->ccid_hc_tx_exit(sk);
 }
diff --git a/net/dccp/input.c b/net/dccp/input.c
index 1b6b2cb12376..3454d5941900 100644
--- a/net/dccp/input.c
+++ b/net/dccp/input.c
@@ -375,6 +375,9 @@ static int dccp_rcv_respond_partopen_state_process(struct sock *sk,
        case DCCP_PKT_RESET:
                inet_csk_clear_xmit_timer(sk, ICSK_TIME_DACK);
                break;
+        case DCCP_PKT_DATA:
+                if (sk->sk_state == DCCP_RESPOND)
+                        break;
        case DCCP_PKT_DATAACK:
        case DCCP_PKT_ACK:
                /*
@@ -393,7 +396,8 @@ static int dccp_rcv_respond_partopen_state_process(struct sock *sk,
                dccp_sk(sk)->dccps_osr = DCCP_SKB_CB(skb)->dccpd_seq;
                dccp_set_state(sk, DCCP_OPEN);
-                if (dh->dccph_type == DCCP_PKT_DATAACK) {
+                if (dh->dccph_type == DCCP_PKT_DATAACK ||
+                    dh->dccph_type == DCCP_PKT_DATA) {
                        dccp_rcv_established(sk, skb, dh, len);
                        queued = 1; /* packet was queued
                                       (by dccp_rcv_established) */
diff --git a/net/ipv4/esp4.c b/net/ipv4/esp4.c
index 1b5a09d1b90b..1b18ce66e7b7 100644
--- a/net/ipv4/esp4.c
+++ b/net/ipv4/esp4.c
@@ -5,6 +5,7 @@
 #include <net/esp.h>
 #include <asm/scatterlist.h>
 #include <linux/crypto.h>
+#include <linux/kernel.h>
 #include <linux/pfkeyv2.h>
 #include <linux/random.h>
 #include <net/icmp.h>
@@ -42,10 +43,10 @@ static int esp_output(struct xfrm_state *x, struct sk_buff *skb)
        esp = x->data;
        alen = esp->auth.icv_trunc_len;
        tfm = esp->conf.tfm;
-        blksize = (crypto_tfm_alg_blocksize(tfm) + 3) & ~3;
+        blksize = ALIGN(crypto_tfm_alg_blocksize(tfm), 4);
-        clen = (clen + 2 + blksize-1)&~(blksize-1);
+        clen = ALIGN(clen + 2, blksize);
        if (esp->conf.padlen)
-                clen = (clen + esp->conf.padlen-1)&~(esp->conf.padlen-1);
+                clen = ALIGN(clen, esp->conf.padlen);
        if ((nfrags = skb_cow_data(skb, clen-skb->len+alen, &trailer)) < 0)
                goto error;
@@ -143,7 +144,7 @@ static int esp_input(struct xfrm_state *x, struct xfrm_decap_state *decap, struc
        struct ip_esp_hdr *esph;
        struct esp_data *esp = x->data;
        struct sk_buff *trailer;
-        int blksize = crypto_tfm_alg_blocksize(esp->conf.tfm);
+        int blksize = ALIGN(crypto_tfm_alg_blocksize(esp->conf.tfm), 4);
        int alen = esp->auth.icv_trunc_len;
        int elen = skb->len - sizeof(struct ip_esp_hdr) - esp->conf.ivlen - alen;
        int nfrags;
@@ -304,16 +305,16 @@ static int esp_post_input(struct xfrm_state *x, struct xfrm_decap_state *decap,
 static u32 esp4_get_max_size(struct xfrm_state *x, int mtu)
 {
        struct esp_data *esp = x->data;
-        u32 blksize = crypto_tfm_alg_blocksize(esp->conf.tfm);
+        u32 blksize = ALIGN(crypto_tfm_alg_blocksize(esp->conf.tfm), 4);
        if (x->props.mode) {
-                mtu = (mtu + 2 + blksize-1)&~(blksize-1);
+                mtu = ALIGN(mtu + 2, blksize);
        } else {
                /* The worst case. */
-                mtu += 2 + blksize;
+                mtu = ALIGN(mtu + 2, 4) + blksize - 4;
        }
        if (esp->conf.padlen)
-                mtu = (mtu + esp->conf.padlen-1)&~(esp->conf.padlen-1);
+                mtu = ALIGN(mtu, esp->conf.padlen);
        return mtu + x->props.header_len + esp->auth.icv_trunc_len;
 }
diff --git a/net/ipv4/inet_timewait_sock.c b/net/ipv4/inet_timewait_sock.c
index f9076ef3a1a8..a010e9a68811 100644
--- a/net/ipv4/inet_timewait_sock.c
+++ b/net/ipv4/inet_timewait_sock.c
@@ -111,6 +111,7 @@ struct inet_timewait_sock *inet_twsk_alloc(const struct sock *sk, const int stat
                tw->tw_prot         = sk->sk_prot_creator;
                atomic_set(&tw->tw_refcnt, 1);
                inet_twsk_dead_node_init(tw);
+                __module_get(tw->tw_prot->owner);
        }
        return tw;
diff --git a/net/ipv4/netfilter/Kconfig b/net/ipv4/netfilter/Kconfig
index a7659728e7a0..7d917e4ce1d9 100644
--- a/net/ipv4/netfilter/Kconfig
+++ b/net/ipv4/netfilter/Kconfig
@@ -139,6 +139,7 @@ config IP_NF_AMANDA
 config IP_NF_PPTP
        tristate  'PPTP protocol support'
+        depends on IP_NF_CONNTRACK
        help
          This module adds support for PPTP (Point to Point Tunnelling
          Protocol, RFC2637) connection tracking and NAT. 
@@ -498,9 +499,14 @@ config IP_NF_TARGET_LOG
          To compile it as a module, choose M here.  If unsure, say N.
 config IP_NF_TARGET_ULOG
-        tristate "ULOG target support"
+        tristate "ULOG target support (OBSOLETE)"
        depends on IP_NF_IPTABLES
        ---help---
+          This option enables the old IPv4-only "ipt_ULOG" implementation
+          which has been obsoleted by the new "nfnetlink_log" code (see
+          CONFIG_NETFILTER_NETLINK_LOG).
          This option adds a `ULOG' target, which allows you to create rules in
          any iptables table. The packet is passed to a userspace logging
          daemon using netlink multicast sockets; unlike the LOG target
diff --git a/net/ipv4/netfilter/arp_tables.c b/net/ipv4/netfilter/arp_tables.c
index fa1634256680..a7969286e6e7 100644
--- a/net/ipv4/netfilter/arp_tables.c
+++ b/net/ipv4/netfilter/arp_tables.c
@@ -716,8 +716,10 @@ static int translate_table(const char *name,
        }
        /* And one copy for every other CPU */
-        for (i = 1; i < num_possible_cpus(); i++) {
+        for_each_cpu(i) {
-                memcpy(newinfo->entries + SMP_ALIGN(newinfo->size)*i,
+                if (i == 0)
+                        continue;
+                memcpy(newinfo->entries + SMP_ALIGN(newinfo->size) * i,
                       newinfo->entries,
                       SMP_ALIGN(newinfo->size));
        }
@@ -767,7 +769,7 @@ static void get_counters(const struct arpt_table_info *t,
        unsigned int cpu;
        unsigned int i;
-        for (cpu = 0; cpu < num_possible_cpus(); cpu++) {
+        for_each_cpu(cpu) {
                i = 0;
                ARPT_ENTRY_ITERATE(t->entries + TABLE_OFFSET(t, cpu),
                                   t->size,
@@ -885,7 +887,8 @@ static int do_replace(void __user *user, unsigned int len)
                return -ENOMEM;
        newinfo = vmalloc(sizeof(struct arpt_table_info)
-                          + SMP_ALIGN(tmp.size) * num_possible_cpus());
+                          + SMP_ALIGN(tmp.size) *
+                                        (highest_possible_processor_id()+1));
        if (!newinfo)
                return -ENOMEM;
@@ -1158,7 +1161,8 @@ int arpt_register_table(struct arpt_table *table,
                = { 0, 0, 0, { 0 }, { 0 }, { } };
        newinfo = vmalloc(sizeof(struct arpt_table_info)
-                          + SMP_ALIGN(repl->size) * num_possible_cpus());
+                          + SMP_ALIGN(repl->size) *
+                                        (highest_possible_processor_id()+1));
        if (!newinfo) {
                ret = -ENOMEM;
                return ret;
diff --git a/net/ipv4/netfilter/ip_conntrack_core.c b/net/ipv4/netfilter/ip_conntrack_core.c
index ea65dd3e517a..07a80b56e8dc 100644
--- a/net/ipv4/netfilter/ip_conntrack_core.c
+++ b/net/ipv4/netfilter/ip_conntrack_core.c
@@ -1119,7 +1119,7 @@ void __ip_ct_refresh_acct(struct ip_conntrack *ct,
                        unsigned long extra_jiffies,
                        int do_acct)
 {
-        int do_event = 0;
+        int event = 0;
        IP_NF_ASSERT(ct->timeout.data == (unsigned long)ct);
        IP_NF_ASSERT(skb);
@@ -1129,13 +1129,13 @@ void __ip_ct_refresh_acct(struct ip_conntrack *ct,
        /* If not in hash table, timer will not be active yet */
        if (!is_confirmed(ct)) {
                ct->timeout.expires = extra_jiffies;
-                do_event = 1;
+                event = IPCT_REFRESH;
        } else {
                /* Need del_timer for race avoidance (may already be dying). */
                if (del_timer(&ct->timeout)) {
                        ct->timeout.expires = jiffies + extra_jiffies;
                        add_timer(&ct->timeout);
-                        do_event = 1;
+                        event = IPCT_REFRESH;
                }
        }
@@ -1144,14 +1144,17 @@ void __ip_ct_refresh_acct(struct ip_conntrack *ct,
                ct->counters[CTINFO2DIR(ctinfo)].packets++;
                ct->counters[CTINFO2DIR(ctinfo)].bytes += 
                                                ntohs(skb->nh.iph->tot_len);
+                if ((ct->counters[CTINFO2DIR(ctinfo)].packets & 0x80000000)
+                    || (ct->counters[CTINFO2DIR(ctinfo)].bytes & 0x80000000))
+                        event |= IPCT_COUNTER_FILLING;
        }
 #endif
        write_unlock_bh(&ip_conntrack_lock);
        /* must be unlocked when calling event cache */
-        if (do_event)
+        if (event)
-                ip_conntrack_event_cache(IPCT_REFRESH, skb);
+                ip_conntrack_event_cache(event, skb);
 }
 #if defined(CONFIG_IP_NF_CONNTRACK_NETLINK) || \
diff --git a/net/ipv4/netfilter/ip_conntrack_netlink.c b/net/ipv4/netfilter/ip_conntrack_netlink.c
index b08a432efcf8..166e6069f121 100644
--- a/net/ipv4/netfilter/ip_conntrack_netlink.c
+++ b/net/ipv4/netfilter/ip_conntrack_netlink.c
@@ -177,11 +177,11 @@ ctnetlink_dump_counters(struct sk_buff *skb, const struct ip_conntrack *ct,
        struct nfattr *nest_count = NFA_NEST(skb, type);
        u_int64_t tmp;
-        tmp = cpu_to_be64(ct->counters[dir].packets);
+        tmp = htonl(ct->counters[dir].packets);
-        NFA_PUT(skb, CTA_COUNTERS_PACKETS, sizeof(u_int64_t), &tmp);
+        NFA_PUT(skb, CTA_COUNTERS32_PACKETS, sizeof(u_int32_t), &tmp);
-        tmp = cpu_to_be64(ct->counters[dir].bytes);
+        tmp = htonl(ct->counters[dir].bytes);
-        NFA_PUT(skb, CTA_COUNTERS_BYTES, sizeof(u_int64_t), &tmp);
+        NFA_PUT(skb, CTA_COUNTERS32_BYTES, sizeof(u_int32_t), &tmp);
        NFA_NEST_END(skb, nest_count);
@@ -833,7 +833,8 @@ out:
 static inline int
 ctnetlink_change_status(struct ip_conntrack *ct, struct nfattr *cda[])
 {
-        unsigned long d, status = *(u_int32_t *)NFA_DATA(cda[CTA_STATUS-1]);
+        unsigned long d;
+        unsigned status = ntohl(*(u_int32_t *)NFA_DATA(cda[CTA_STATUS-1]));
        d = ct->status ^ status;
        if (d & (IPS_EXPECTED|IPS_CONFIRMED|IPS_DYING))
@@ -948,6 +949,31 @@ ctnetlink_change_timeout(struct ip_conntrack *ct, struct nfattr *cda[])
        return 0;
 }
+static inline int
+ctnetlink_change_protoinfo(struct ip_conntrack *ct, struct nfattr *cda[])
+{
+        struct nfattr *tb[CTA_PROTOINFO_MAX], *attr = cda[CTA_PROTOINFO-1];
+        struct ip_conntrack_protocol *proto;
+        u_int16_t npt = ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.dst.protonum;
+        int err = 0;
+        if (nfattr_parse_nested(tb, CTA_PROTOINFO_MAX, attr) < 0)
+                goto nfattr_failure;
+        proto = ip_conntrack_proto_find_get(npt);
+        if (!proto)
+                return -EINVAL;
+        if (proto->from_nfattr)
+                err = proto->from_nfattr(tb, ct);
+        ip_conntrack_proto_put(proto); 
+        return err;
+nfattr_failure:
+        return -ENOMEM;
+}
 static int
 ctnetlink_change_conntrack(struct ip_conntrack *ct, struct nfattr *cda[])
 {
@@ -973,6 +999,12 @@ ctnetlink_change_conntrack(struct ip_conntrack *ct, struct nfattr *cda[])
                        return err;
        }
+        if (cda[CTA_PROTOINFO-1]) {
+                err = ctnetlink_change_protoinfo(ct, cda);
+                if (err < 0)
+                        return err;
+        }
        DEBUGP("all done\n");
        return 0;
 }
@@ -1002,6 +1034,12 @@ ctnetlink_create_conntrack(struct nfattr *cda[],
        if (err < 0)
                goto err;
+        if (cda[CTA_PROTOINFO-1]) {
+                err = ctnetlink_change_protoinfo(ct, cda);
+                if (err < 0)
+                        return err;
+        }
        ct->helper = ip_conntrack_helper_find_get(rtuple);
        add_timer(&ct->timeout);
diff --git a/net/ipv4/netfilter/ip_conntrack_proto_icmp.c b/net/ipv4/netfilter/ip_conntrack_proto_icmp.c
index 838d1d69b36e..98f0015dd255 100644
--- a/net/ipv4/netfilter/ip_conntrack_proto_icmp.c
+++ b/net/ipv4/netfilter/ip_conntrack_proto_icmp.c
@@ -296,8 +296,7 @@ static int icmp_nfattr_to_tuple(struct nfattr *tb[],
                                struct ip_conntrack_tuple *tuple)
 {
        if (!tb[CTA_PROTO_ICMP_TYPE-1]
-            || !tb[CTA_PROTO_ICMP_CODE-1]
+            || !tb[CTA_PROTO_ICMP_CODE-1])
-            || !tb[CTA_PROTO_ICMP_ID-1])
                return -1;
        tuple->dst.u.icmp.type = 
diff --git a/net/ipv4/netfilter/ip_conntrack_proto_tcp.c b/net/ipv4/netfilter/ip_conntrack_proto_tcp.c
index 121760d6cc50..d6701cafbcc2 100644
--- a/net/ipv4/netfilter/ip_conntrack_proto_tcp.c
+++ b/net/ipv4/netfilter/ip_conntrack_proto_tcp.c
@@ -341,17 +341,43 @@ static int tcp_print_conntrack(struct seq_file *s,
 static int tcp_to_nfattr(struct sk_buff *skb, struct nfattr *nfa,
                         const struct ip_conntrack *ct)
 {
+        struct nfattr *nest_parms = NFA_NEST(skb, CTA_PROTOINFO_TCP);
+        
        read_lock_bh(&tcp_lock);
        NFA_PUT(skb, CTA_PROTOINFO_TCP_STATE, sizeof(u_int8_t),
                &ct->proto.tcp.state);
        read_unlock_bh(&tcp_lock);
+        NFA_NEST_END(skb, nest_parms);
        return 0;
 nfattr_failure:
        read_unlock_bh(&tcp_lock);
        return -1;
 }
+static int nfattr_to_tcp(struct nfattr *cda[], struct ip_conntrack *ct)
+{
+        struct nfattr *attr = cda[CTA_PROTOINFO_TCP-1];
+        struct nfattr *tb[CTA_PROTOINFO_TCP_MAX];
+        if (nfattr_parse_nested(tb, CTA_PROTOINFO_TCP_MAX, attr) < 0)
+                goto nfattr_failure;
+        if (!tb[CTA_PROTOINFO_TCP_STATE-1])
+                return -EINVAL;
+        write_lock_bh(&tcp_lock);
+        ct->proto.tcp.state = 
+                *(u_int8_t *)NFA_DATA(tb[CTA_PROTOINFO_TCP_STATE-1]);
+        write_unlock_bh(&tcp_lock);
+        return 0;
+nfattr_failure:
+        return -1;
+}
 #endif
 static unsigned int get_conntrack_index(const struct tcphdr *tcph)
@@ -1123,6 +1149,7 @@ struct ip_conntrack_protocol ip_conntrack_protocol_tcp =
 #if defined(CONFIG_IP_NF_CONNTRACK_NETLINK) || \
    defined(CONFIG_IP_NF_CONNTRACK_NETLINK_MODULE)
        .to_nfattr              = tcp_to_nfattr,
+        .from_nfattr            = nfattr_to_tcp,
        .tuple_to_nfattr        = ip_ct_port_tuple_to_nfattr,
        .nfattr_to_tuple        = ip_ct_port_nfattr_to_tuple,
 #endif
diff --git a/net/ipv4/netfilter/ip_tables.c b/net/ipv4/netfilter/ip_tables.c
index eef99a1b5de6..75c27e92f6ab 100644
--- a/net/ipv4/netfilter/ip_tables.c
+++ b/net/ipv4/netfilter/ip_tables.c
@@ -27,6 +27,7 @@
 #include <asm/semaphore.h>
 #include <linux/proc_fs.h>
 #include <linux/err.h>
+#include <linux/cpumask.h>
 #include <linux/netfilter_ipv4/ip_tables.h>
@@ -921,8 +922,10 @@ translate_table(const char *name,
        }
        /* And one copy for every other CPU */
-        for (i = 1; i < num_possible_cpus(); i++) {
+        for_each_cpu(i) {
-                memcpy(newinfo->entries + SMP_ALIGN(newinfo->size)*i,
+                if (i == 0)
+                        continue;
+                memcpy(newinfo->entries + SMP_ALIGN(newinfo->size) * i,
                       newinfo->entries,
                       SMP_ALIGN(newinfo->size));
        }
@@ -943,7 +946,7 @@ replace_table(struct ipt_table *table,
                struct ipt_entry *table_base;
                unsigned int i;
-                for (i = 0; i < num_possible_cpus(); i++) {
+                for_each_cpu(i) {
                        table_base =
                                (void *)newinfo->entries
                                + TABLE_OFFSET(newinfo, i);
@@ -990,7 +993,7 @@ get_counters(const struct ipt_table_info *t,
        unsigned int cpu;
        unsigned int i;
-        for (cpu = 0; cpu < num_possible_cpus(); cpu++) {
+        for_each_cpu(cpu) {
                i = 0;
                IPT_ENTRY_ITERATE(t->entries + TABLE_OFFSET(t, cpu),
                                  t->size,
@@ -1128,7 +1131,8 @@ do_replace(void __user *user, unsigned int len)
                return -ENOMEM;
        newinfo = vmalloc(sizeof(struct ipt_table_info)
-                          + SMP_ALIGN(tmp.size) * num_possible_cpus());
+                          + SMP_ALIGN(tmp.size) * 
+                                (highest_possible_processor_id()+1));
        if (!newinfo)
                return -ENOMEM;
@@ -1458,7 +1462,8 @@ int ipt_register_table(struct ipt_table *table, const struct ipt_replace *repl)
                = { 0, 0, 0, { 0 }, { 0 }, { } };
        newinfo = vmalloc(sizeof(struct ipt_table_info)
-                          + SMP_ALIGN(repl->size) * num_possible_cpus());
+                          + SMP_ALIGN(repl->size) * 
+                                        (highest_possible_processor_id()+1));
        if (!newinfo)
                return -ENOMEM;
diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
index 8225e4257258..7114031fdc70 100644
--- a/net/ipv4/tcp_output.c
+++ b/net/ipv4/tcp_output.c
@@ -435,7 +435,16 @@ int tcp_fragment(struct sock *sk, struct sk_buff *skb, u32 len, unsigned int mss
        int nsize, old_factor;
        u16 flags;
-        BUG_ON(len >= skb->len);
+        if (unlikely(len >= skb->len)) {
+                if (net_ratelimit()) {
+                        printk(KERN_DEBUG "TCP: seg_size=%u, mss=%u, seq=%u, "
+                               "end_seq=%u, skb->len=%u.\n", len, mss_now,
+                               TCP_SKB_CB(skb)->seq, TCP_SKB_CB(skb)->end_seq,
+                               skb->len);
+                        WARN_ON(1);
+                }
+                return 0;
+        }
        nsize = skb_headlen(skb) - len;
        if (nsize < 0)
diff --git a/net/ipv6/esp6.c b/net/ipv6/esp6.c
index 9b27460f0cc7..40d9a1935ab5 100644
--- a/net/ipv6/esp6.c
+++ b/net/ipv6/esp6.c
@@ -31,6 +31,7 @@
 #include <net/esp.h>
 #include <asm/scatterlist.h>
 #include <linux/crypto.h>
+#include <linux/kernel.h>
 #include <linux/pfkeyv2.h>
 #include <linux/random.h>
 #include <net/icmp.h>
@@ -66,10 +67,10 @@ static int esp6_output(struct xfrm_state *x, struct sk_buff *skb)
        alen = esp->auth.icv_trunc_len;
        tfm = esp->conf.tfm;
-        blksize = (crypto_tfm_alg_blocksize(tfm) + 3) & ~3;
+        blksize = ALIGN(crypto_tfm_alg_blocksize(tfm), 4);
-        clen = (clen + 2 + blksize-1)&~(blksize-1);
+        clen = ALIGN(clen + 2, blksize);
        if (esp->conf.padlen)
-                clen = (clen + esp->conf.padlen-1)&~(esp->conf.padlen-1);
+                clen = ALIGN(clen, esp->conf.padlen);
        if ((nfrags = skb_cow_data(skb, clen-skb->len+alen, &trailer)) < 0) {
                goto error;
@@ -133,7 +134,7 @@ static int esp6_input(struct xfrm_state *x, struct xfrm_decap_state *decap, stru
        struct ipv6_esp_hdr *esph;
        struct esp_data *esp = x->data;
        struct sk_buff *trailer;
-        int blksize = crypto_tfm_alg_blocksize(esp->conf.tfm);
+        int blksize = ALIGN(crypto_tfm_alg_blocksize(esp->conf.tfm), 4);
        int alen = esp->auth.icv_trunc_len;
        int elen = skb->len - sizeof(struct ipv6_esp_hdr) - esp->conf.ivlen - alen;
@@ -235,16 +236,17 @@ out_nofree:
 static u32 esp6_get_max_size(struct xfrm_state *x, int mtu)
 {
        struct esp_data *esp = x->data;
-        u32 blksize = crypto_tfm_alg_blocksize(esp->conf.tfm);
+        u32 blksize = ALIGN(crypto_tfm_alg_blocksize(esp->conf.tfm), 4);
        if (x->props.mode) {
-                mtu = (mtu + 2 + blksize-1)&~(blksize-1);
+                mtu = ALIGN(mtu + 2, blksize);
        } else {
                /* The worst case. */
-                mtu += 2 + blksize;
+                u32 padsize = ((blksize - 1) & 7) + 1;
+                mtu = ALIGN(mtu + 2, padsize) + blksize - padsize;
        }
        if (esp->conf.padlen)
-                mtu = (mtu + esp->conf.padlen-1)&~(esp->conf.padlen-1);
+                mtu = ALIGN(mtu, esp->conf.padlen);
        return mtu + x->props.header_len + esp->auth.icv_full_len;
 }
diff --git a/net/ipv6/netfilter/ip6_tables.c b/net/ipv6/netfilter/ip6_tables.c
index 2da514b16d95..b03e90649eb5 100644
--- a/net/ipv6/netfilter/ip6_tables.c
+++ b/net/ipv6/netfilter/ip6_tables.c
@@ -28,6 +28,7 @@
 #include <asm/uaccess.h>
 #include <asm/semaphore.h>
 #include <linux/proc_fs.h>
+#include <linux/cpumask.h>
 #include <linux/netfilter_ipv6/ip6_tables.h>
@@ -950,8 +951,10 @@ translate_table(const char *name,
        }
        /* And one copy for every other CPU */
-        for (i = 1; i < num_possible_cpus(); i++) {
+        for_each_cpu(i) {
-                memcpy(newinfo->entries + SMP_ALIGN(newinfo->size)*i,
+                if (i == 0)
+                        continue;
+                memcpy(newinfo->entries + SMP_ALIGN(newinfo->size) * i,
                       newinfo->entries,
                       SMP_ALIGN(newinfo->size));
        }
@@ -973,6 +976,7 @@ replace_table(struct ip6t_table *table,
                unsigned int i;
                for (i = 0; i < num_possible_cpus(); i++) {
+                for_each_cpu(i) {
                        table_base =
                                (void *)newinfo->entries
                                + TABLE_OFFSET(newinfo, i);
@@ -1019,7 +1023,7 @@ get_counters(const struct ip6t_table_info *t,
        unsigned int cpu;
        unsigned int i;
-        for (cpu = 0; cpu < num_possible_cpus(); cpu++) {
+        for_each_cpu(cpu) {
                i = 0;
                IP6T_ENTRY_ITERATE(t->entries + TABLE_OFFSET(t, cpu),
                                  t->size,
@@ -1153,7 +1157,8 @@ do_replace(void __user *user, unsigned int len)
                return -ENOMEM;
        newinfo = vmalloc(sizeof(struct ip6t_table_info)
-                          + SMP_ALIGN(tmp.size) * num_possible_cpus());
+                          + SMP_ALIGN(tmp.size) *
+                                        (highest_possible_processor_id()+1));
        if (!newinfo)
                return -ENOMEM;
@@ -1467,7 +1472,8 @@ int ip6t_register_table(struct ip6t_table *table,
                = { 0, 0, 0, { 0 }, { 0 }, { } };
        newinfo = vmalloc(sizeof(struct ip6t_table_info)
-                          + SMP_ALIGN(repl->size) * num_possible_cpus());
+                          + SMP_ALIGN(repl->size) *
+                                        (highest_possible_processor_id()+1));
        if (!newinfo)
                return -ENOMEM;
diff --git a/net/netfilter/nfnetlink.c b/net/netfilter/nfnetlink.c
index 1caaca06f698..4bc27a6334c1 100644
--- a/net/netfilter/nfnetlink.c
+++ b/net/netfilter/nfnetlink.c
@@ -133,7 +133,7 @@ int nfattr_parse(struct nfattr *tb[], int maxattr, struct nfattr *nfa, int len)
        memset(tb, 0, sizeof(struct nfattr *) * maxattr);
        while (NFA_OK(nfa, len)) {
-                unsigned flavor = nfa->nfa_type;
+                unsigned flavor = NFA_TYPE(nfa);
                if (flavor && flavor <= maxattr)
                        tb[flavor-1] = nfa;
                nfa = NFA_NEXT(nfa, len);
@@ -177,7 +177,7 @@ nfnetlink_check_attributes(struct nfnetlink_subsystem *subsys,
                int attrlen = nlh->nlmsg_len - NLMSG_ALIGN(min_len);
                while (NFA_OK(attr, attrlen)) {
-                        unsigned flavor = attr->nfa_type;
+                        unsigned flavor = NFA_TYPE(attr);
                        if (flavor) {
                                if (flavor > attr_count)
                                        return -EINVAL;
diff --git a/net/sched/Kconfig b/net/sched/Kconfig
index 45d3bc0812c8..81510da31792 100644
--- a/net/sched/Kconfig
+++ b/net/sched/Kconfig
@@ -72,9 +72,11 @@ config NET_SCH_CLK_GETTIMEOFDAY
          Choose this if you need a high resolution clock source but can't use
          the CPU's cycle counter.
+# don't allow on SMP x86 because they can have unsynchronized TSCs.
+# gettimeofday is a good alternative
 config NET_SCH_CLK_CPU
        bool "CPU cycle counter"
-        depends on X86_TSC || X86_64 || ALPHA || SPARC64 || PPC64 || IA64
+        depends on ((X86_TSC || X86_64) && !SMP) || ALPHA || SPARC64 || PPC64 || IA64
        help
          Say Y here if you want to use the CPU's cycle counter as clock source.
          This is a cheap and high resolution clock source, but on some