33 files changed, 285 insertions, 213 deletions

diff --git a/net/atm/br2684.c b/net/atm/br2684.c
index 26a646d4eb32..c9230c398697 100644
--- a/net/atm/br2684.c
+++ b/net/atm/br2684.c
@@ -554,6 +554,12 @@ static const struct net_device_ops br2684_netdev_ops = {
         .ndo_validate_addr      = eth_validate_addr,
 };
 
+static const struct net_device_ops br2684_netdev_ops_routed = {
+        .ndo_start_xmit         = br2684_start_xmit,
+        .ndo_set_mac_address    = br2684_mac_addr,
+        .ndo_change_mtu         = eth_change_mtu
+};
+
 static void br2684_setup(struct net_device *netdev)
 {
         struct br2684_dev *brdev = BRPRIV(netdev);
@@ -569,11 +575,10 @@ static void br2684_setup(struct net_device *netdev)
 static void br2684_setup_routed(struct net_device *netdev)
 {
         struct br2684_dev *brdev = BRPRIV(netdev);
-        brdev->net_dev = netdev;
 
+        brdev->net_dev = netdev;
         netdev->hard_header_len = 0;
-
-        netdev->netdev_ops = &br2684_netdev_ops;
+        netdev->netdev_ops = &br2684_netdev_ops_routed;
         netdev->addr_len = 0;
         netdev->mtu = 1500;
         netdev->type = ARPHRD_PPP;
diff --git a/net/atm/lec.c b/net/atm/lec.c
index b2d644560323..42749b7b917c 100644
--- a/net/atm/lec.c
+++ b/net/atm/lec.c
@@ -62,7 +62,6 @@ static int lec_open(struct net_device *dev);
 static netdev_tx_t lec_start_xmit(struct sk_buff *skb,
                                   struct net_device *dev);
 static int lec_close(struct net_device *dev);
-static void lec_init(struct net_device *dev);
 static struct lec_arp_table *lec_arp_find(struct lec_priv *priv,
                                           const unsigned char *mac_addr);
 static int lec_arp_remove(struct lec_priv *priv,
@@ -670,13 +669,6 @@ static const struct net_device_ops lec_netdev_ops = {
         .ndo_set_multicast_list = lec_set_multicast_list,
 };
 
-
-static void lec_init(struct net_device *dev)
-{
-        dev->netdev_ops = &lec_netdev_ops;
-        printk("%s: Initialized!\n", dev->name);
-}
-
 static const unsigned char lec_ctrl_magic[] = {
         0xff,
         0x00,
@@ -893,6 +885,7 @@ static int lecd_attach(struct atm_vcc *vcc, int arg)
                         dev_lec[i] = alloc_etherdev(size);
                 if (!dev_lec[i])
                         return -ENOMEM;
+                dev_lec[i]->netdev_ops = &lec_netdev_ops;
                 snprintf(dev_lec[i]->name, IFNAMSIZ, "lec%d", i);
                 if (register_netdev(dev_lec[i])) {
                         free_netdev(dev_lec[i]);
@@ -901,7 +894,6 @@ static int lecd_attach(struct atm_vcc *vcc, int arg)
 
                 priv = netdev_priv(dev_lec[i]);
                 priv->is_trdev = is_trdev;
-                lec_init(dev_lec[i]);
         } else {
                 priv = netdev_priv(dev_lec[i]);
                 if (priv->lecd)
diff --git a/net/compat.c b/net/compat.c
index e1a56ade803b..a1fb1b079a82 100644
--- a/net/compat.c
+++ b/net/compat.c
@@ -754,26 +754,21 @@ asmlinkage long compat_sys_recvfrom(int fd, void __user *buf, size_t len,
 
 asmlinkage long compat_sys_recvmmsg(int fd, struct compat_mmsghdr __user *mmsg,
                                     unsigned vlen, unsigned int flags,
-                                    struct timespec __user *timeout)
+                                    struct compat_timespec __user *timeout)
 {
         int datagrams;
         struct timespec ktspec;
-        struct compat_timespec __user *utspec;
 
         if (timeout == NULL)
                 return __sys_recvmmsg(fd, (struct mmsghdr __user *)mmsg, vlen,
                                       flags | MSG_CMSG_COMPAT, NULL);
 
-        utspec = (struct compat_timespec __user *)timeout;
-        if (get_user(ktspec.tv_sec, &utspec->tv_sec) ||
-            get_user(ktspec.tv_nsec, &utspec->tv_nsec))
+        if (get_compat_timespec(&ktspec, timeout))
                 return -EFAULT;
 
         datagrams = __sys_recvmmsg(fd, (struct mmsghdr __user *)mmsg, vlen,
                                    flags | MSG_CMSG_COMPAT, &ktspec);
-        if (datagrams > 0 &&
-            (put_user(ktspec.tv_sec, &utspec->tv_sec) ||
-             put_user(ktspec.tv_nsec, &utspec->tv_nsec)))
+        if (datagrams > 0 && put_compat_timespec(&ktspec, timeout))
                 datagrams = -EFAULT;
 
         return datagrams;
diff --git a/net/core/dev.c b/net/core/dev.c
index c36a17aafcf3..be9924f60ec3 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -4771,21 +4771,23 @@ static void net_set_todo(struct net_device *dev)
 
 static void rollback_registered_many(struct list_head *head)
 {
-        struct net_device *dev;
+        struct net_device *dev, *tmp;
 
         BUG_ON(dev_boot_phase);
         ASSERT_RTNL();
 
-        list_for_each_entry(dev, head, unreg_list) {
+        list_for_each_entry_safe(dev, tmp, head, unreg_list) {
                 /* Some devices call without registering
-                 * for initialization unwind.
+                 * for initialization unwind. Remove those
+                 * devices and proceed with the remaining.
                  */
                 if (dev->reg_state == NETREG_UNINITIALIZED) {
                         pr_debug("unregister_netdevice: device %s/%p never "
                                  "was registered\n", dev->name, dev);
 
                         WARN_ON(1);
-                        return;
+                        list_del(&dev->unreg_list);
+                        continue;
                 }
 
                 BUG_ON(dev->reg_state != NETREG_REGISTERED);
@@ -5033,6 +5035,11 @@ int register_netdevice(struct net_device *dev)
                 rollback_registered(dev);
                 dev->reg_state = NETREG_UNREGISTERED;
         }
+        /*
+         *      Prevent userspace races by waiting until the network
+         *      device is fully setup before sending notifications.
+         */
+        rtmsg_ifinfo(RTM_NEWLINK, dev, ~0U);
 
 out:
         return ret;
@@ -5595,6 +5602,12 @@ int dev_change_net_namespace(struct net_device *dev, struct net *net, const char
         /* Notify protocols, that a new device appeared. */
         call_netdevice_notifiers(NETDEV_REGISTER, dev);
 
+        /*
+         *      Prevent userspace races by waiting until the network
+         *      device is fully setup before sending notifications.
+         */
+        rtmsg_ifinfo(RTM_NEWLINK, dev, ~0U);
+
         synchronize_net();
         err = 0;
 out:
diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
index 33148a568199..794bcb897ff0 100644
--- a/net/core/rtnetlink.c
+++ b/net/core/rtnetlink.c
@@ -1364,15 +1364,15 @@ static int rtnetlink_event(struct notifier_block *this, unsigned long event, voi
         case NETDEV_UNREGISTER:
                 rtmsg_ifinfo(RTM_DELLINK, dev, ~0U);
                 break;
-        case NETDEV_REGISTER:
-                rtmsg_ifinfo(RTM_NEWLINK, dev, ~0U);
-                break;
         case NETDEV_UP:
         case NETDEV_DOWN:
                 rtmsg_ifinfo(RTM_NEWLINK, dev, IFF_UP|IFF_RUNNING);
                 break;
+        case NETDEV_POST_INIT:
+        case NETDEV_REGISTER:
         case NETDEV_CHANGE:
         case NETDEV_GOING_DOWN:
+        case NETDEV_UNREGISTER_BATCH:
                 break;
         default:
                 rtmsg_ifinfo(RTM_NEWLINK, dev, 0);
diff --git a/net/dccp/ipv4.c b/net/dccp/ipv4.c
index efbcfdc12796..dad7bc4878e0 100644
--- a/net/dccp/ipv4.c
+++ b/net/dccp/ipv4.c
@@ -408,7 +408,7 @@ struct sock *dccp_v4_request_recv_sock(struct sock *sk, struct sk_buff *skb,
 
         dccp_sync_mss(newsk, dst_mtu(dst));
 
-        __inet_hash_nolisten(newsk);
+        __inet_hash_nolisten(newsk, NULL);
         __inet_inherit_port(sk, newsk);
 
         return newsk;
diff --git a/net/dccp/ipv6.c b/net/dccp/ipv6.c
index 6574215a1f51..baf05cf43c28 100644
--- a/net/dccp/ipv6.c
+++ b/net/dccp/ipv6.c
@@ -46,7 +46,7 @@ static void dccp_v6_hash(struct sock *sk)
                         return;
                 }
                 local_bh_disable();
-                __inet6_hash(sk);
+                __inet6_hash(sk, NULL);
                 local_bh_enable();
         }
 }
@@ -644,7 +644,7 @@ static struct sock *dccp_v6_request_recv_sock(struct sock *sk,
         newinet->inet_daddr = newinet->inet_saddr = LOOPBACK4_IPV6;
         newinet->inet_rcv_saddr = LOOPBACK4_IPV6;
 
-        __inet6_hash(newsk);
+        __inet6_hash(newsk, NULL);
         __inet_inherit_port(sk, newsk);
 
         return newsk;
diff --git a/net/ipv4/inet_hashtables.c b/net/ipv4/inet_hashtables.c
index 21e5e32d8c60..2b79377b468d 100644
--- a/net/ipv4/inet_hashtables.c
+++ b/net/ipv4/inet_hashtables.c
@@ -351,12 +351,13 @@ static inline u32 inet_sk_port_offset(const struct sock *sk)
                                           inet->inet_dport);
 }
 
-void __inet_hash_nolisten(struct sock *sk)
+int __inet_hash_nolisten(struct sock *sk, struct inet_timewait_sock *tw)
 {
         struct inet_hashinfo *hashinfo = sk->sk_prot->h.hashinfo;
         struct hlist_nulls_head *list;
         spinlock_t *lock;
         struct inet_ehash_bucket *head;
+        int twrefcnt = 0;
 
         WARN_ON(!sk_unhashed(sk));
 
@@ -367,8 +368,13 @@ void __inet_hash_nolisten(struct sock *sk)
 
         spin_lock(lock);
         __sk_nulls_add_node_rcu(sk, list);
+        if (tw) {
+                WARN_ON(sk->sk_hash != tw->tw_hash);
+                twrefcnt = inet_twsk_unhash(tw);
+        }
         spin_unlock(lock);
         sock_prot_inuse_add(sock_net(sk), sk->sk_prot, 1);
+        return twrefcnt;
 }
 EXPORT_SYMBOL_GPL(__inet_hash_nolisten);
 
@@ -378,7 +384,7 @@ static void __inet_hash(struct sock *sk)
         struct inet_listen_hashbucket *ilb;
 
         if (sk->sk_state != TCP_LISTEN) {
-                __inet_hash_nolisten(sk);
+                __inet_hash_nolisten(sk, NULL);
                 return;
         }
 
@@ -427,7 +433,7 @@ int __inet_hash_connect(struct inet_timewait_death_row *death_row,
                 struct sock *sk, u32 port_offset,
                 int (*check_established)(struct inet_timewait_death_row *,
                         struct sock *, __u16, struct inet_timewait_sock **),
-                void (*hash)(struct sock *sk))
+                int (*hash)(struct sock *sk, struct inet_timewait_sock *twp))
 {
         struct inet_hashinfo *hinfo = death_row->hashinfo;
         const unsigned short snum = inet_sk(sk)->inet_num;
@@ -435,6 +441,7 @@ int __inet_hash_connect(struct inet_timewait_death_row *death_row,
         struct inet_bind_bucket *tb;
         int ret;
         struct net *net = sock_net(sk);
+        int twrefcnt = 1;
 
         if (!snum) {
                 int i, remaining, low, high, port;
@@ -493,13 +500,18 @@ ok:
                 inet_bind_hash(sk, tb, port);
                 if (sk_unhashed(sk)) {
                         inet_sk(sk)->inet_sport = htons(port);
-                        hash(sk);
+                        twrefcnt += hash(sk, tw);
                 }
+                if (tw)
+                        twrefcnt += inet_twsk_bind_unhash(tw, hinfo);
                 spin_unlock(&head->lock);
 
                 if (tw) {
                         inet_twsk_deschedule(tw, death_row);
-                        inet_twsk_put(tw);
+                        while (twrefcnt) {
+                                twrefcnt--;
+                                inet_twsk_put(tw);
+                        }
                 }
 
                 ret = 0;
@@ -510,7 +522,7 @@ ok:
         tb  = inet_csk(sk)->icsk_bind_hash;
         spin_lock_bh(&head->lock);
         if (sk_head(&tb->owners) == sk && !sk->sk_bind_node.next) {
-                hash(sk);
+                hash(sk, NULL);
                 spin_unlock_bh(&head->lock);
                 return 0;
         } else {
diff --git a/net/ipv4/inet_timewait_sock.c b/net/ipv4/inet_timewait_sock.c
index 0fdf45e4c90c..cc94cc2d8b2d 100644
--- a/net/ipv4/inet_timewait_sock.c
+++ b/net/ipv4/inet_timewait_sock.c
@@ -15,9 +15,13 @@
 #include <net/ip.h>
 
 
-/*
- * unhash a timewait socket from established hash
- * lock must be hold by caller
+/**
+ *      inet_twsk_unhash - unhash a timewait socket from established hash
+ *      @tw: timewait socket
+ *
+ *      unhash a timewait socket from established hash, if hashed.
+ *      ehash lock must be held by caller.
+ *      Returns 1 if caller should call inet_twsk_put() after lock release.
  */
 int inet_twsk_unhash(struct inet_timewait_sock *tw)
 {
@@ -26,6 +30,37 @@ int inet_twsk_unhash(struct inet_timewait_sock *tw)
 
         hlist_nulls_del_rcu(&tw->tw_node);
         sk_nulls_node_init(&tw->tw_node);
+        /*
+         * We cannot call inet_twsk_put() ourself under lock,
+         * caller must call it for us.
+         */
+        return 1;
+}
+
+/**
+ *      inet_twsk_bind_unhash - unhash a timewait socket from bind hash
+ *      @tw: timewait socket
+ *      @hashinfo: hashinfo pointer
+ *
+ *      unhash a timewait socket from bind hash, if hashed.
+ *      bind hash lock must be held by caller.
+ *      Returns 1 if caller should call inet_twsk_put() after lock release.
+ */
+int inet_twsk_bind_unhash(struct inet_timewait_sock *tw,
+                          struct inet_hashinfo *hashinfo)
+{
+        struct inet_bind_bucket *tb = tw->tw_tb;
+
+        if (!tb)
+                return 0;
+
+        __hlist_del(&tw->tw_bind_node);
+        tw->tw_tb = NULL;
+        inet_bind_bucket_destroy(hashinfo->bind_bucket_cachep, tb);
+        /*
+         * We cannot call inet_twsk_put() ourself under lock,
+         * caller must call it for us.
+         */
         return 1;
 }
 
@@ -34,7 +69,6 @@ static void __inet_twsk_kill(struct inet_timewait_sock *tw,
                              struct inet_hashinfo *hashinfo)
 {
         struct inet_bind_hashbucket *bhead;
-        struct inet_bind_bucket *tb;
         int refcnt;
         /* Unlink from established hashes. */
         spinlock_t *lock = inet_ehash_lockp(hashinfo, tw->tw_hash);
@@ -46,15 +80,11 @@ static void __inet_twsk_kill(struct inet_timewait_sock *tw,
         /* Disassociate with bind bucket. */
         bhead = &hashinfo->bhash[inet_bhashfn(twsk_net(tw), tw->tw_num,
                         hashinfo->bhash_size)];
+
         spin_lock(&bhead->lock);
-        tb = tw->tw_tb;
-        if (tb) {
-                __hlist_del(&tw->tw_bind_node);
-                tw->tw_tb = NULL;
-                inet_bind_bucket_destroy(hashinfo->bind_bucket_cachep, tb);
-                refcnt++;
-        }
+        refcnt += inet_twsk_bind_unhash(tw, hashinfo);
         spin_unlock(&bhead->lock);
+
 #ifdef SOCK_REFCNT_DEBUG
         if (atomic_read(&tw->tw_refcnt) != 1) {
                 printk(KERN_DEBUG "%s timewait_sock %p refcnt=%d\n",
@@ -126,7 +156,7 @@ void __inet_twsk_hashdance(struct inet_timewait_sock *tw, struct sock *sk,
 
         /*
          * Notes :
-         * - We initially set tw_refcnt to 0 in inet_twsk_alloc()
+         * - We initially set tw_refcnt to 0 in inet_twsk_alloc()
          * - We add one reference for the bhash link
          * - We add one reference for the ehash link
          * - We want this refcnt update done before allowing other
@@ -136,7 +166,6 @@ void __inet_twsk_hashdance(struct inet_timewait_sock *tw, struct sock *sk,
 
         spin_unlock(lock);
 }
-
 EXPORT_SYMBOL_GPL(__inet_twsk_hashdance);
 
 struct inet_timewait_sock *inet_twsk_alloc(const struct sock *sk, const int state)
@@ -177,7 +206,6 @@ struct inet_timewait_sock *inet_twsk_alloc(const struct sock *sk, const int stat
 
         return tw;
 }
-
 EXPORT_SYMBOL_GPL(inet_twsk_alloc);
 
 /* Returns non-zero if quota exceeded.  */
@@ -256,7 +284,6 @@ void inet_twdr_hangman(unsigned long data)
 out:
         spin_unlock(&twdr->death_lock);
 }
-
 EXPORT_SYMBOL_GPL(inet_twdr_hangman);
 
 void inet_twdr_twkill_work(struct work_struct *work)
@@ -287,7 +314,6 @@ void inet_twdr_twkill_work(struct work_struct *work)
                 spin_unlock_bh(&twdr->death_lock);
         }
 }
-
 EXPORT_SYMBOL_GPL(inet_twdr_twkill_work);
 
 /* These are always called from BH context.  See callers in
@@ -307,7 +333,6 @@ void inet_twsk_deschedule(struct inet_timewait_sock *tw,
         spin_unlock(&twdr->death_lock);
         __inet_twsk_kill(tw, twdr->hashinfo);
 }
-
 EXPORT_SYMBOL(inet_twsk_deschedule);
 
 void inet_twsk_schedule(struct inet_timewait_sock *tw,
@@ -388,7 +413,6 @@ void inet_twsk_schedule(struct inet_timewait_sock *tw,
                 mod_timer(&twdr->tw_timer, jiffies + twdr->period);
         spin_unlock(&twdr->death_lock);
 }
-
 EXPORT_SYMBOL_GPL(inet_twsk_schedule);
 
 void inet_twdr_twcal_tick(unsigned long data)
@@ -449,7 +473,6 @@ out:
 #endif
         spin_unlock(&twdr->death_lock);
 }
-
 EXPORT_SYMBOL_GPL(inet_twdr_twcal_tick);
 
 void inet_twsk_purge(struct inet_hashinfo *hashinfo,
diff --git a/net/ipv4/syncookies.c b/net/ipv4/syncookies.c
index 26399ad2a289..66fd80ef2473 100644
--- a/net/ipv4/syncookies.c
+++ b/net/ipv4/syncookies.c
@@ -277,6 +277,13 @@ struct sock *cookie_v4_check(struct sock *sk, struct sk_buff *skb,
 
         NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_SYNCOOKIESRECV);
 
+        /* check for timestamp cookie support */
+        memset(&tcp_opt, 0, sizeof(tcp_opt));
+        tcp_parse_options(skb, &tcp_opt, &hash_location, 0);
+
+        if (tcp_opt.saw_tstamp)
+                cookie_check_timestamp(&tcp_opt);
+
         ret = NULL;
         req = inet_reqsk_alloc(&tcp_request_sock_ops); /* for safety */
         if (!req)
@@ -292,6 +299,12 @@ struct sock *cookie_v4_check(struct sock *sk, struct sk_buff *skb,
         ireq->loc_addr          = ip_hdr(skb)->daddr;
         ireq->rmt_addr          = ip_hdr(skb)->saddr;
         ireq->ecn_ok            = 0;
+        ireq->snd_wscale        = tcp_opt.snd_wscale;
+        ireq->rcv_wscale        = tcp_opt.rcv_wscale;
+        ireq->sack_ok           = tcp_opt.sack_ok;
+        ireq->wscale_ok         = tcp_opt.wscale_ok;
+        ireq->tstamp_ok         = tcp_opt.saw_tstamp;
+        req->ts_recent          = tcp_opt.saw_tstamp ? tcp_opt.rcv_tsval : 0;
 
         /* We throwed the options of the initial SYN away, so we hope
          * the ACK carries the same options again (see RFC1122 4.2.3.8)
@@ -340,20 +353,6 @@ struct sock *cookie_v4_check(struct sock *sk, struct sk_buff *skb,
                 }
         }
 
-        /* check for timestamp cookie support */
-        memset(&tcp_opt, 0, sizeof(tcp_opt));
-        tcp_parse_options(skb, &tcp_opt, &hash_location, 0, &rt->u.dst);
-
-        if (tcp_opt.saw_tstamp)
-                cookie_check_timestamp(&tcp_opt);
-
-        ireq->snd_wscale        = tcp_opt.snd_wscale;
-        ireq->rcv_wscale        = tcp_opt.rcv_wscale;
-        ireq->sack_ok           = tcp_opt.sack_ok;
-        ireq->wscale_ok         = tcp_opt.wscale_ok;
-        ireq->tstamp_ok         = tcp_opt.saw_tstamp;
-        req->ts_recent          = tcp_opt.saw_tstamp ? tcp_opt.rcv_tsval : 0;
-
         /* Try to redo what tcp_v4_send_synack did. */
         req->window_clamp = tp->window_clamp ? :dst_metric(&rt->u.dst, RTAX_WINDOW);
 
diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
index c8666b70cde0..b0a26bb25e2e 100644
--- a/net/ipv4/tcp.c
+++ b/net/ipv4/tcp.c
@@ -2540,11 +2540,6 @@ static int do_tcp_getsockopt(struct sock *sk, int level,
                         ctd.tcpct_cookie_desired = cvp->cookie_desired;
                         ctd.tcpct_s_data_desired = cvp->s_data_desired;
 
-                        /* Cookie(s) saved, return as nonce */
-                        if (sizeof(ctd.tcpct_value) < cvp->cookie_pair_size) {
-                                /* impossible? */
-                                return -EINVAL;
-                        }
                         memcpy(&ctd.tcpct_value[0], &cvp->cookie_pair[0],
                                cvp->cookie_pair_size);
                         ctd.tcpct_used = cvp->cookie_pair_size;
diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
index 57ae96a04220..28e029632493 100644
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -2717,6 +2717,35 @@ static void tcp_try_undo_dsack(struct sock *sk)
         }
 }
 
+/* We can clear retrans_stamp when there are no retransmissions in the
+ * window. It would seem that it is trivially available for us in
+ * tp->retrans_out, however, that kind of assumptions doesn't consider
+ * what will happen if errors occur when sending retransmission for the
+ * second time. ...It could the that such segment has only
+ * TCPCB_EVER_RETRANS set at the present time. It seems that checking
+ * the head skb is enough except for some reneging corner cases that
+ * are not worth the effort.
+ *
+ * Main reason for all this complexity is the fact that connection dying
+ * time now depends on the validity of the retrans_stamp, in particular,
+ * that successive retransmissions of a segment must not advance
+ * retrans_stamp under any conditions.
+ */
+static int tcp_any_retrans_done(struct sock *sk)
+{
+        struct tcp_sock *tp = tcp_sk(sk);
+        struct sk_buff *skb;
+
+        if (tp->retrans_out)
+                return 1;
+
+        skb = tcp_write_queue_head(sk);
+        if (unlikely(skb && TCP_SKB_CB(skb)->sacked & TCPCB_EVER_RETRANS))
+                return 1;
+
+        return 0;
+}
+
 /* Undo during fast recovery after partial ACK. */
 
 static int tcp_try_undo_partial(struct sock *sk, int acked)
@@ -2729,7 +2758,7 @@ static int tcp_try_undo_partial(struct sock *sk, int acked)
                 /* Plain luck! Hole if filled with delayed
                  * packet, rather than with a retransmit.
                  */
-                if (tp->retrans_out == 0)
+                if (!tcp_any_retrans_done(sk))
                         tp->retrans_stamp = 0;
 
                 tcp_update_reordering(sk, tcp_fackets_out(tp) + acked, 1);
@@ -2788,7 +2817,7 @@ static void tcp_try_keep_open(struct sock *sk)
         struct tcp_sock *tp = tcp_sk(sk);
         int state = TCP_CA_Open;
 
-        if (tcp_left_out(tp) || tp->retrans_out || tp->undo_marker)
+        if (tcp_left_out(tp) || tcp_any_retrans_done(sk) || tp->undo_marker)
                 state = TCP_CA_Disorder;
 
         if (inet_csk(sk)->icsk_ca_state != state) {
@@ -2803,7 +2832,7 @@ static void tcp_try_to_open(struct sock *sk, int flag)
 
         tcp_verify_left_out(tp);
 
-        if (!tp->frto_counter && tp->retrans_out == 0)
+        if (!tp->frto_counter && !tcp_any_retrans_done(sk))
                 tp->retrans_stamp = 0;
 
         if (flag & FLAG_ECE)
@@ -3698,7 +3727,7 @@ old_ack:
  * the fast version below fails.
  */
 void tcp_parse_options(struct sk_buff *skb, struct tcp_options_received *opt_rx,
-                       u8 **hvpp, int estab,  struct dst_entry *dst)
+                       u8 **hvpp, int estab)
 {
         unsigned char *ptr;
         struct tcphdr *th = tcp_hdr(skb);
@@ -3737,8 +3766,7 @@ void tcp_parse_options(struct sk_buff *skb, struct tcp_options_received *opt_rx,
                                 break;
                         case TCPOPT_WINDOW:
                                 if (opsize == TCPOLEN_WINDOW && th->syn &&
-                                    !estab && sysctl_tcp_window_scaling &&
-                                    !dst_feature(dst, RTAX_FEATURE_NO_WSCALE)) {
+                                    !estab && sysctl_tcp_window_scaling) {
                                         __u8 snd_wscale = *(__u8 *)ptr;
                                         opt_rx->wscale_ok = 1;
                                         if (snd_wscale > 14) {
@@ -3754,8 +3782,7 @@ void tcp_parse_options(struct sk_buff *skb, struct tcp_options_received *opt_rx,
                         case TCPOPT_TIMESTAMP:
                                 if ((opsize == TCPOLEN_TIMESTAMP) &&
                                     ((estab && opt_rx->tstamp_ok) ||
-                                     (!estab && sysctl_tcp_timestamps &&
-                                      !dst_feature(dst, RTAX_FEATURE_NO_TSTAMP)))) {
+                                     (!estab && sysctl_tcp_timestamps))) {
                                         opt_rx->saw_tstamp = 1;
                                         opt_rx->rcv_tsval = get_unaligned_be32(ptr);
                                         opt_rx->rcv_tsecr = get_unaligned_be32(ptr + 4);
@@ -3763,8 +3790,7 @@ void tcp_parse_options(struct sk_buff *skb, struct tcp_options_received *opt_rx,
                                 break;
                         case TCPOPT_SACK_PERM:
                                 if (opsize == TCPOLEN_SACK_PERM && th->syn &&
-                                    !estab && sysctl_tcp_sack &&
-                                    !dst_feature(dst, RTAX_FEATURE_NO_SACK)) {
+                                    !estab && sysctl_tcp_sack) {
                                         opt_rx->sack_ok = 1;
                                         tcp_sack_reset(opt_rx);
                                 }
@@ -3849,7 +3875,7 @@ static int tcp_fast_parse_options(struct sk_buff *skb, struct tcphdr *th,
                 if (tcp_parse_aligned_timestamp(tp, th))
                         return 1;
         }
-        tcp_parse_options(skb, &tp->rx_opt, hvpp, 1, NULL);
+        tcp_parse_options(skb, &tp->rx_opt, hvpp, 1);
         return 1;
 }
 
@@ -4104,10 +4130,8 @@ static inline int tcp_sack_extend(struct tcp_sack_block *sp, u32 seq,
 static void tcp_dsack_set(struct sock *sk, u32 seq, u32 end_seq)
 {
         struct tcp_sock *tp = tcp_sk(sk);
-        struct dst_entry *dst = __sk_dst_get(sk);
 
-        if (tcp_is_sack(tp) && sysctl_tcp_dsack &&
-            !dst_feature(dst, RTAX_FEATURE_NO_DSACK)) {
+        if (tcp_is_sack(tp) && sysctl_tcp_dsack) {
                 int mib_idx;
 
                 if (before(seq, tp->rcv_nxt))
@@ -4136,15 +4160,13 @@ static void tcp_dsack_extend(struct sock *sk, u32 seq, u32 end_seq)
 static void tcp_send_dupack(struct sock *sk, struct sk_buff *skb)
 {
         struct tcp_sock *tp = tcp_sk(sk);
-        struct dst_entry *dst = __sk_dst_get(sk);
 
         if (TCP_SKB_CB(skb)->end_seq != TCP_SKB_CB(skb)->seq &&
             before(TCP_SKB_CB(skb)->seq, tp->rcv_nxt)) {
                 NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_DELAYEDACKLOST);
                 tcp_enter_quickack_mode(sk);
 
-                if (tcp_is_sack(tp) && sysctl_tcp_dsack &&
-                    !dst_feature(dst, RTAX_FEATURE_NO_DSACK)) {
+                if (tcp_is_sack(tp) && sysctl_tcp_dsack) {
                         u32 end_seq = TCP_SKB_CB(skb)->end_seq;
 
                         if (after(TCP_SKB_CB(skb)->end_seq, tp->rcv_nxt))
@@ -5399,11 +5421,10 @@ static int tcp_rcv_synsent_state_process(struct sock *sk, struct sk_buff *skb,
         u8 *hash_location;
         struct inet_connection_sock *icsk = inet_csk(sk);
         struct tcp_sock *tp = tcp_sk(sk);
-        struct dst_entry *dst = __sk_dst_get(sk);
         struct tcp_cookie_values *cvp = tp->cookie_values;
         int saved_clamp = tp->rx_opt.mss_clamp;
 
-        tcp_parse_options(skb, &tp->rx_opt, &hash_location, 0, dst);
+        tcp_parse_options(skb, &tp->rx_opt, &hash_location, 0);
 
         if (th->ack) {
                 /* rfc793:
diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
index 29002ab26e0d..65b8ebfd078a 100644
--- a/net/ipv4/tcp_ipv4.c
+++ b/net/ipv4/tcp_ipv4.c
@@ -1262,20 +1262,10 @@ int tcp_v4_conn_request(struct sock *sk, struct sk_buff *skb)
         tcp_rsk(req)->af_specific = &tcp_request_sock_ipv4_ops;
 #endif
 
-        ireq = inet_rsk(req);
-        ireq->loc_addr = daddr;
-        ireq->rmt_addr = saddr;
-        ireq->no_srccheck = inet_sk(sk)->transparent;
-        ireq->opt = tcp_v4_save_options(sk, skb);
-
-        dst = inet_csk_route_req(sk, req);
-        if(!dst)
-                goto drop_and_free;
-
         tcp_clear_options(&tmp_opt);
         tmp_opt.mss_clamp = TCP_MSS_DEFAULT;
         tmp_opt.user_mss  = tp->rx_opt.user_mss;
-        tcp_parse_options(skb, &tmp_opt, &hash_location, 0, dst);
+        tcp_parse_options(skb, &tmp_opt, &hash_location, 0);
 
         if (tmp_opt.cookie_plus > 0 &&
             tmp_opt.saw_tstamp &&
@@ -1319,8 +1309,14 @@ int tcp_v4_conn_request(struct sock *sk, struct sk_buff *skb)
         tmp_opt.tstamp_ok = tmp_opt.saw_tstamp;
         tcp_openreq_init(req, &tmp_opt, skb);
 
+        ireq = inet_rsk(req);
+        ireq->loc_addr = daddr;
+        ireq->rmt_addr = saddr;
+        ireq->no_srccheck = inet_sk(sk)->transparent;
+        ireq->opt = tcp_v4_save_options(sk, skb);
+
         if (security_inet_conn_request(sk, skb, req))
-                goto drop_and_release;
+                goto drop_and_free;
 
         if (!want_cookie)
                 TCP_ECN_create_request(req, tcp_hdr(skb));
@@ -1345,6 +1341,7 @@ int tcp_v4_conn_request(struct sock *sk, struct sk_buff *skb)
                  */
                 if (tmp_opt.saw_tstamp &&
                     tcp_death_row.sysctl_tw_recycle &&
+                    (dst = inet_csk_route_req(sk, req)) != NULL &&
                     (peer = rt_get_peer((struct rtable *)dst)) != NULL &&
                     peer->v4daddr == saddr) {
                         if ((u32)get_seconds() - peer->tcp_ts_stamp < TCP_PAWS_MSL &&
@@ -1464,7 +1461,7 @@ struct sock *tcp_v4_syn_recv_sock(struct sock *sk, struct sk_buff *skb,
         }
 #endif
 
-        __inet_hash_nolisten(newsk);
+        __inet_hash_nolisten(newsk, NULL);
         __inet_inherit_port(sk, newsk);
 
         return newsk;
diff --git a/net/ipv4/tcp_minisocks.c b/net/ipv4/tcp_minisocks.c
index 87accec8d097..f206ee5dda80 100644
--- a/net/ipv4/tcp_minisocks.c
+++ b/net/ipv4/tcp_minisocks.c
@@ -95,9 +95,9 @@ tcp_timewait_state_process(struct inet_timewait_sock *tw, struct sk_buff *skb,
         struct tcp_timewait_sock *tcptw = tcp_twsk((struct sock *)tw);
         int paws_reject = 0;
 
+        tmp_opt.saw_tstamp = 0;
         if (th->doff > (sizeof(*th) >> 2) && tcptw->tw_ts_recent_stamp) {
-                tmp_opt.tstamp_ok = 1;
-                tcp_parse_options(skb, &tmp_opt, &hash_location, 1, NULL);
+                tcp_parse_options(skb, &tmp_opt, &hash_location, 0);
 
                 if (tmp_opt.saw_tstamp) {
                         tmp_opt.ts_recent       = tcptw->tw_ts_recent;
@@ -526,9 +526,9 @@ struct sock *tcp_check_req(struct sock *sk, struct sk_buff *skb,
         __be32 flg = tcp_flag_word(th) & (TCP_FLAG_RST|TCP_FLAG_SYN|TCP_FLAG_ACK);
         int paws_reject = 0;
 
-        if ((th->doff > (sizeof(*th) >> 2)) && (req->ts_recent)) {
-                tmp_opt.tstamp_ok = 1;
-                tcp_parse_options(skb, &tmp_opt, &hash_location, 1, NULL);
+        tmp_opt.saw_tstamp = 0;
+        if (th->doff > (sizeof(struct tcphdr)>>2)) {
+                tcp_parse_options(skb, &tmp_opt, &hash_location, 0);
 
                 if (tmp_opt.saw_tstamp) {
                         tmp_opt.ts_recent = req->ts_recent;
diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
index 93316a96d820..383ce237640f 100644
--- a/net/ipv4/tcp_output.c
+++ b/net/ipv4/tcp_output.c
@@ -553,7 +553,6 @@ static unsigned tcp_syn_options(struct sock *sk, struct sk_buff *skb,
                                 struct tcp_md5sig_key **md5) {
         struct tcp_sock *tp = tcp_sk(sk);
         struct tcp_cookie_values *cvp = tp->cookie_values;
-        struct dst_entry *dst = __sk_dst_get(sk);
         unsigned remaining = MAX_TCP_OPTION_SPACE;
         u8 cookie_size = (!tp->rx_opt.cookie_out_never && cvp != NULL) ?
                          tcp_cookie_size_check(cvp->cookie_desired) :
@@ -581,22 +580,18 @@ static unsigned tcp_syn_options(struct sock *sk, struct sk_buff *skb,
         opts->mss = tcp_advertise_mss(sk);
         remaining -= TCPOLEN_MSS_ALIGNED;
 
-        if (likely(sysctl_tcp_timestamps &&
-                   !dst_feature(dst, RTAX_FEATURE_NO_TSTAMP) &&
-                   *md5 == NULL)) {
+        if (likely(sysctl_tcp_timestamps && *md5 == NULL)) {
                 opts->options |= OPTION_TS;
                 opts->tsval = TCP_SKB_CB(skb)->when;
                 opts->tsecr = tp->rx_opt.ts_recent;
                 remaining -= TCPOLEN_TSTAMP_ALIGNED;
         }
-        if (likely(sysctl_tcp_window_scaling &&
-                   !dst_feature(dst, RTAX_FEATURE_NO_WSCALE))) {
+        if (likely(sysctl_tcp_window_scaling)) {
                 opts->ws = tp->rx_opt.rcv_wscale;
                 opts->options |= OPTION_WSCALE;
                 remaining -= TCPOLEN_WSCALE_ALIGNED;
         }
-        if (likely(sysctl_tcp_sack &&
-                   !dst_feature(dst, RTAX_FEATURE_NO_SACK))) {
+        if (likely(sysctl_tcp_sack)) {
                 opts->options |= OPTION_SACK_ADVERTISE;
                 if (unlikely(!(OPTION_TS & opts->options)))
                         remaining -= TCPOLEN_SACKPERM_ALIGNED;
@@ -2527,9 +2522,7 @@ static void tcp_connect_init(struct sock *sk)
          * See tcp_input.c:tcp_rcv_state_process case TCP_SYN_SENT.
          */
         tp->tcp_header_len = sizeof(struct tcphdr) +
-                (sysctl_tcp_timestamps &&
-                (!dst_feature(dst, RTAX_FEATURE_NO_TSTAMP) ?
-                  TCPOLEN_TSTAMP_ALIGNED : 0));
+                (sysctl_tcp_timestamps ? TCPOLEN_TSTAMP_ALIGNED : 0);
 
 #ifdef CONFIG_TCP_MD5SIG
         if (tp->af_specific->md5_lookup(sk, sk) != NULL)
@@ -2555,8 +2548,7 @@ static void tcp_connect_init(struct sock *sk)
                                   tp->advmss - (tp->rx_opt.ts_recent_stamp ? tp->tcp_header_len - sizeof(struct tcphdr) : 0),
                                   &tp->rcv_wnd,
                                   &tp->window_clamp,
-                                  (sysctl_tcp_window_scaling &&
-                                   !dst_feature(dst, RTAX_FEATURE_NO_WSCALE)),
+                                  sysctl_tcp_window_scaling,
                                   &rcv_wscale);
 
         tp->rx_opt.rcv_wscale = rcv_wscale;
diff --git a/net/ipv4/tcp_timer.c b/net/ipv4/tcp_timer.c
index 8353a538cd4c..8816a20c2597 100644
--- a/net/ipv4/tcp_timer.c
+++ b/net/ipv4/tcp_timer.c
@@ -132,6 +132,35 @@ static void tcp_mtu_probing(struct inet_connection_sock *icsk, struct sock *sk)
         }
 }
 
+/* This function calculates a "timeout" which is equivalent to the timeout of a
+ * TCP connection after "boundary" unsucessful, exponentially backed-off
+ * retransmissions with an initial RTO of TCP_RTO_MIN.
+ */
+static bool retransmits_timed_out(struct sock *sk,
+                                  unsigned int boundary)
+{
+        unsigned int timeout, linear_backoff_thresh;
+        unsigned int start_ts;
+
+        if (!inet_csk(sk)->icsk_retransmits)
+                return false;
+
+        if (unlikely(!tcp_sk(sk)->retrans_stamp))
+                start_ts = TCP_SKB_CB(tcp_write_queue_head(sk))->when;
+        else
+                start_ts = tcp_sk(sk)->retrans_stamp;
+
+        linear_backoff_thresh = ilog2(TCP_RTO_MAX/TCP_RTO_MIN);
+
+        if (boundary <= linear_backoff_thresh)
+                timeout = ((2 << boundary) - 1) * TCP_RTO_MIN;
+        else
+                timeout = ((2 << linear_backoff_thresh) - 1) * TCP_RTO_MIN +
+                          (boundary - linear_backoff_thresh) * TCP_RTO_MAX;
+
+        return (tcp_time_stamp - start_ts) >= timeout;
+}
+
 /* A write timeout has occurred. Process the after effects. */
 static int tcp_write_timeout(struct sock *sk)
 {
diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
index 1f9534846ca9..f0126fdd7e04 100644
--- a/net/ipv4/udp.c
+++ b/net/ipv4/udp.c
@@ -216,9 +216,8 @@ int udp_lib_get_port(struct sock *sk, unsigned short snum,
                  * force rand to be an odd multiple of UDP_HTABLE_SIZE
                  */
                 rand = (rand | 1) * (udptable->mask + 1);
-                for (last = first + udptable->mask + 1;
-                     first != last;
-                     first++) {
+                last = first + udptable->mask + 1;
+                do {
                         hslot = udp_hashslot(udptable, net, first);
                         bitmap_zero(bitmap, PORTS_PER_CHAIN);
                         spin_lock_bh(&hslot->lock);
@@ -238,7 +237,7 @@ int udp_lib_get_port(struct sock *sk, unsigned short snum,
                                 snum += rand;
                         } while (snum != first);
                         spin_unlock_bh(&hslot->lock);
-                }
+                } while (++first != last);
                 goto fail;
         } else {
                 hslot = udp_hashslot(udptable, net, snum);
diff --git a/net/ipv6/inet6_hashtables.c b/net/ipv6/inet6_hashtables.c
index c813e294ec0c..633a6c266136 100644
--- a/net/ipv6/inet6_hashtables.c
+++ b/net/ipv6/inet6_hashtables.c
@@ -22,9 +22,10 @@
 #include <net/inet6_hashtables.h>
 #include <net/ip.h>
 
-void __inet6_hash(struct sock *sk)
+int __inet6_hash(struct sock *sk, struct inet_timewait_sock *tw)
 {
         struct inet_hashinfo *hashinfo = sk->sk_prot->h.hashinfo;
+        int twrefcnt = 0;
 
         WARN_ON(!sk_unhashed(sk));
 
@@ -45,10 +46,15 @@ void __inet6_hash(struct sock *sk)
                 lock = inet_ehash_lockp(hashinfo, hash);
                 spin_lock(lock);
                 __sk_nulls_add_node_rcu(sk, list);
+                if (tw) {
+                        WARN_ON(sk->sk_hash != tw->tw_hash);
+                        twrefcnt = inet_twsk_unhash(tw);
+                }
                 spin_unlock(lock);
         }
 
         sock_prot_inuse_add(sock_net(sk), sk->sk_prot, 1);
+        return twrefcnt;
 }
 EXPORT_SYMBOL(__inet6_hash);
 
diff --git a/net/ipv6/syncookies.c b/net/ipv6/syncookies.c
index 5b9af508b8f2..7208a06576c6 100644
--- a/net/ipv6/syncookies.c
+++ b/net/ipv6/syncookies.c
@@ -185,6 +185,13 @@ struct sock *cookie_v6_check(struct sock *sk, struct sk_buff *skb)
 
         NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_SYNCOOKIESRECV);
 
+        /* check for timestamp cookie support */
+        memset(&tcp_opt, 0, sizeof(tcp_opt));
+        tcp_parse_options(skb, &tcp_opt, &hash_location, 0);
+
+        if (tcp_opt.saw_tstamp)
+                cookie_check_timestamp(&tcp_opt);
+
         ret = NULL;
         req = inet6_reqsk_alloc(&tcp6_request_sock_ops);
         if (!req)
@@ -218,6 +225,12 @@ struct sock *cookie_v6_check(struct sock *sk, struct sk_buff *skb)
         req->expires = 0UL;
         req->retrans = 0;
         ireq->ecn_ok            = 0;
+        ireq->snd_wscale        = tcp_opt.snd_wscale;
+        ireq->rcv_wscale        = tcp_opt.rcv_wscale;
+        ireq->sack_ok           = tcp_opt.sack_ok;
+        ireq->wscale_ok         = tcp_opt.wscale_ok;
+        ireq->tstamp_ok         = tcp_opt.saw_tstamp;
+        req->ts_recent          = tcp_opt.saw_tstamp ? tcp_opt.rcv_tsval : 0;
         treq->rcv_isn = ntohl(th->seq) - 1;
         treq->snt_isn = cookie;
 
@@ -253,21 +266,6 @@ struct sock *cookie_v6_check(struct sock *sk, struct sk_buff *skb)
                         goto out_free;
         }
 
-        /* check for timestamp cookie support */
-        memset(&tcp_opt, 0, sizeof(tcp_opt));
-        tcp_parse_options(skb, &tcp_opt, &hash_location, 0, dst);
-
-        if (tcp_opt.saw_tstamp)
-                cookie_check_timestamp(&tcp_opt);
-
-        req->ts_recent          = tcp_opt.saw_tstamp ? tcp_opt.rcv_tsval : 0;
-
-        ireq->snd_wscale        = tcp_opt.snd_wscale;
-        ireq->rcv_wscale        = tcp_opt.rcv_wscale;
-        ireq->sack_ok           = tcp_opt.sack_ok;
-        ireq->wscale_ok         = tcp_opt.wscale_ok;
-        ireq->tstamp_ok         = tcp_opt.saw_tstamp;
-
         req->window_clamp = tp->window_clamp ? :dst_metric(dst, RTAX_WINDOW);
         tcp_select_initial_window(tcp_full_space(sk), req->mss,
                                   &req->rcv_wnd, &req->window_clamp,
diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
index aadd7cef73b3..febfd595a40d 100644
--- a/net/ipv6/tcp_ipv6.c
+++ b/net/ipv6/tcp_ipv6.c
@@ -96,7 +96,7 @@ static void tcp_v6_hash(struct sock *sk)
                         return;
                 }
                 local_bh_disable();
-                __inet6_hash(sk);
+                __inet6_hash(sk, NULL);
                 local_bh_enable();
         }
 }
@@ -1169,7 +1169,6 @@ static int tcp_v6_conn_request(struct sock *sk, struct sk_buff *skb)
         struct inet6_request_sock *treq;
         struct ipv6_pinfo *np = inet6_sk(sk);
         struct tcp_sock *tp = tcp_sk(sk);
-        struct dst_entry *dst = __sk_dst_get(sk);
         __u32 isn = TCP_SKB_CB(skb)->when;
 #ifdef CONFIG_SYN_COOKIES
         int want_cookie = 0;
@@ -1208,7 +1207,7 @@ static int tcp_v6_conn_request(struct sock *sk, struct sk_buff *skb)
         tcp_clear_options(&tmp_opt);
         tmp_opt.mss_clamp = IPV6_MIN_MTU - sizeof(struct tcphdr) - sizeof(struct ipv6hdr);
         tmp_opt.user_mss = tp->rx_opt.user_mss;
-        tcp_parse_options(skb, &tmp_opt, &hash_location, 0, dst);
+        tcp_parse_options(skb, &tmp_opt, &hash_location, 0);
 
         if (tmp_opt.cookie_plus > 0 &&
             tmp_opt.saw_tstamp &&
@@ -1496,7 +1495,7 @@ static struct sock * tcp_v6_syn_recv_sock(struct sock *sk, struct sk_buff *skb,
         }
 #endif
 
-        __inet6_hash(newsk);
+        __inet6_hash(newsk, NULL);
         __inet_inherit_port(sk, newsk);
 
         return newsk;
diff --git a/net/key/af_key.c b/net/key/af_key.c
index 84209fbbeb17..76fa6fef6473 100644
--- a/net/key/af_key.c
+++ b/net/key/af_key.c
@@ -1193,6 +1193,7 @@ static struct xfrm_state * pfkey_msg2xfrm_state(struct net *net,
                         x->aalg->alg_key_len = key->sadb_key_bits;
                         memcpy(x->aalg->alg_key, key+1, keysize);
                 }
+                x->aalg->alg_trunc_len = a->uinfo.auth.icv_truncbits;
                 x->props.aalgo = sa->sadb_sa_auth;
                 /* x->algo.flags = sa->sadb_sa_flags; */
         }
diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c
index 93ee1fd5c08d..6dc3579c0ac5 100644
--- a/net/mac80211/cfg.c
+++ b/net/mac80211/cfg.c
@@ -354,7 +354,8 @@ static void sta_set_sinfo(struct sta_info *sta, struct station_info *sinfo)
         sinfo->rx_packets = sta->rx_packets;
         sinfo->tx_packets = sta->tx_packets;
 
-        if (sta->local->hw.flags & IEEE80211_HW_SIGNAL_DBM) {
+        if ((sta->local->hw.flags & IEEE80211_HW_SIGNAL_DBM) ||
+            (sta->local->hw.flags & IEEE80211_HW_SIGNAL_UNSPEC)) {
                 sinfo->filled |= STATION_INFO_SIGNAL;
                 sinfo->signal = (s8)sta->last_signal;
         }
diff --git a/net/mac80211/ieee80211_i.h b/net/mac80211/ieee80211_i.h
index 419f186cfcf0..91dc8636d644 100644
--- a/net/mac80211/ieee80211_i.h
+++ b/net/mac80211/ieee80211_i.h
@@ -746,6 +746,7 @@ struct ieee80211_local {
         unsigned int wmm_acm; /* bit field of ACM bits (BIT(802.1D tag)) */
 
         bool pspolling;
+        bool scan_ps_enabled;
         /*
          * PS can only be enabled when we have exactly one managed
          * interface (and monitors) in PS, this then points there.
diff --git a/net/mac80211/mesh.c b/net/mac80211/mesh.c
index c0fe46493f71..6a4331429598 100644
--- a/net/mac80211/mesh.c
+++ b/net/mac80211/mesh.c
@@ -427,7 +427,7 @@ int ieee80211_new_mesh_header(struct ieee80211s_hdr *meshhdr,
                 char *addr5, char *addr6)
 {
         int aelen = 0;
-        memset(meshhdr, 0, sizeof(meshhdr));
+        memset(meshhdr, 0, sizeof(*meshhdr));
         meshhdr->ttl = sdata->u.mesh.mshcfg.dot11MeshTTL;
         put_unaligned(cpu_to_le32(sdata->u.mesh.mesh_seqnum), &meshhdr->seqnum);
         sdata->u.mesh.mesh_seqnum++;
diff --git a/net/mac80211/mesh.h b/net/mac80211/mesh.h
index 31e102541869..85562c59d7d6 100644
--- a/net/mac80211/mesh.h
+++ b/net/mac80211/mesh.h
@@ -188,8 +188,9 @@ struct mesh_rmc {
  */
 #define MESH_PREQ_MIN_INT       10
 #define MESH_DIAM_TRAVERSAL_TIME 50
-/* Paths will be refreshed if they are closer than PATH_REFRESH_TIME to their
- * expiration
+/* A path will be refreshed if it is used PATH_REFRESH_TIME milliseconds before
+ * timing out.  This way it will remain ACTIVE and no data frames will be
+ * unnecesarily held in the pending queue.
  */
 #define MESH_PATH_REFRESH_TIME                  1000
 #define MESH_MIN_DISCOVERY_TIMEOUT (2 * MESH_DIAM_TRAVERSAL_TIME)
diff --git a/net/mac80211/mesh_hwmp.c b/net/mac80211/mesh_hwmp.c
index 833b2f3670c5..d28acb6b1f81 100644
--- a/net/mac80211/mesh_hwmp.c
+++ b/net/mac80211/mesh_hwmp.c
@@ -937,7 +937,7 @@ int mesh_nexthop_lookup(struct sk_buff *skb,
 
         if (mpath->flags & MESH_PATH_ACTIVE) {
                 if (time_after(jiffies,
-                               mpath->exp_time +
+                               mpath->exp_time -
                                msecs_to_jiffies(sdata->u.mesh.mshcfg.path_refresh_time)) &&
                     !memcmp(sdata->dev->dev_addr, hdr->addr4, ETH_ALEN) &&
                     !(mpath->flags & MESH_PATH_RESOLVING) &&
diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
index 6dc7b5ad9a41..d8d50fb5e823 100644
--- a/net/mac80211/mlme.c
+++ b/net/mac80211/mlme.c
@@ -1083,8 +1083,6 @@ static void ieee80211_set_disassoc(struct ieee80211_sub_if_data *sdata,
 
         ieee80211_set_wmm_default(sdata);
 
-        ieee80211_recalc_idle(local);
-
         /* channel(_type) changes are handled by ieee80211_hw_config */
         local->oper_channel_type = NL80211_CHAN_NO_HT;
 
@@ -1370,6 +1368,7 @@ ieee80211_rx_mgmt_deauth(struct ieee80211_sub_if_data *sdata,
 
         if (!wk) {
                 ieee80211_set_disassoc(sdata, true);
+                ieee80211_recalc_idle(sdata->local);
         } else {
                 list_del(&wk->list);
                 kfree(wk);
@@ -1403,6 +1402,7 @@ ieee80211_rx_mgmt_disassoc(struct ieee80211_sub_if_data *sdata,
                         sdata->dev->name, mgmt->sa, reason_code);
 
         ieee80211_set_disassoc(sdata, false);
+        ieee80211_recalc_idle(sdata->local);
         return RX_MGMT_CFG80211_DISASSOC;
 }
 
@@ -2117,6 +2117,7 @@ static void ieee80211_sta_work(struct work_struct *work)
                                 " after %dms, disconnecting.\n",
                                 bssid, (1000 * IEEE80211_PROBE_WAIT)/HZ);
                         ieee80211_set_disassoc(sdata, true);
+                        ieee80211_recalc_idle(local);
                         mutex_unlock(&ifmgd->mtx);
                         /*
                          * must be outside lock due to cfg80211,
@@ -2560,6 +2561,8 @@ int ieee80211_mgd_deauth(struct ieee80211_sub_if_data *sdata,
                         IEEE80211_STYPE_DEAUTH, req->reason_code,
                         cookie);
 
+        ieee80211_recalc_idle(sdata->local);
+
         return 0;
 }
 
@@ -2592,5 +2595,8 @@ int ieee80211_mgd_disassoc(struct ieee80211_sub_if_data *sdata,
         ieee80211_send_deauth_disassoc(sdata, req->bss->bssid,
                         IEEE80211_STYPE_DISASSOC, req->reason_code,
                         cookie);
+
+        ieee80211_recalc_idle(sdata->local);
+
         return 0;
 }
diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
index f237df408378..9f2807aeaf52 100644
--- a/net/mac80211/rx.c
+++ b/net/mac80211/rx.c
@@ -1712,7 +1712,6 @@ ieee80211_rx_h_mesh_fwding(struct ieee80211_rx_data *rx)
                         mpp_path_add(proxied_addr, mpp_addr, sdata);
                 } else {
                         spin_lock_bh(&mppath->state_lock);
-                        mppath->exp_time = jiffies;
                         if (compare_ether_addr(mppath->mpp, mpp_addr) != 0)
                                 memcpy(mppath->mpp, mpp_addr, ETH_ALEN);
                         spin_unlock_bh(&mppath->state_lock);
diff --git a/net/mac80211/scan.c b/net/mac80211/scan.c
index 4cf387c944bf..f1a4c7160300 100644
--- a/net/mac80211/scan.c
+++ b/net/mac80211/scan.c
@@ -227,7 +227,8 @@ static bool ieee80211_prep_hw_scan(struct ieee80211_local *local)
 static void ieee80211_scan_ps_enable(struct ieee80211_sub_if_data *sdata)
 {
         struct ieee80211_local *local = sdata->local;
-        bool ps = false;
+
+        local->scan_ps_enabled = false;
 
         /* FIXME: what to do when local->pspolling is true? */
 
@@ -235,12 +236,13 @@ static void ieee80211_scan_ps_enable(struct ieee80211_sub_if_data *sdata)
         cancel_work_sync(&local->dynamic_ps_enable_work);
 
         if (local->hw.conf.flags & IEEE80211_CONF_PS) {
-                ps = true;
+                local->scan_ps_enabled = true;
                 local->hw.conf.flags &= ~IEEE80211_CONF_PS;
                 ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_PS);
         }
 
-        if (!ps || !(local->hw.flags & IEEE80211_HW_PS_NULLFUNC_STACK))
+        if (!(local->scan_ps_enabled) ||
+            !(local->hw.flags & IEEE80211_HW_PS_NULLFUNC_STACK))
                 /*
                  * If power save was enabled, no need to send a nullfunc
                  * frame because AP knows that we are sleeping. But if the
@@ -261,7 +263,7 @@ static void ieee80211_scan_ps_disable(struct ieee80211_sub_if_data *sdata)
 
         if (!local->ps_sdata)
                 ieee80211_send_nullfunc(local, sdata, 0);
-        else {
+        else if (local->scan_ps_enabled) {
                 /*
                  * In !IEEE80211_HW_PS_NULLFUNC_STACK case the hardware
                  * will send a nullfunc frame with the powersave bit set
@@ -277,6 +279,16 @@ static void ieee80211_scan_ps_disable(struct ieee80211_sub_if_data *sdata)
                  */
                 local->hw.conf.flags |= IEEE80211_CONF_PS;
                 ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_PS);
+        } else if (local->hw.conf.dynamic_ps_timeout > 0) {
+                /*
+                 * If IEEE80211_CONF_PS was not set and the dynamic_ps_timer
+                 * had been running before leaving the operating channel,
+                 * restart the timer now and send a nullfunc frame to inform
+                 * the AP that we are awake.
+                 */
+                ieee80211_send_nullfunc(local, sdata, 0);
+                mod_timer(&local->dynamic_ps_timer, jiffies +
+                          msecs_to_jiffies(local->hw.conf.dynamic_ps_timeout));
         }
 }
 
diff --git a/net/mac80211/util.c b/net/mac80211/util.c
index d09f78bb2442..78a6e924c7e1 100644
--- a/net/mac80211/util.c
+++ b/net/mac80211/util.c
@@ -579,7 +579,7 @@ u32 ieee802_11_parse_elems_crc(u8 *start, size_t len,
                 if (elen > left)
                         break;
 
-                if (calc_crc && id < 64 && (filter & BIT(id)))
+                if (calc_crc && id < 64 && (filter & (1ULL << id)))
                         crc = crc32_be(crc, pos - 2, elen + 2);
 
                 switch (id) {
diff --git a/net/rfkill/core.c b/net/rfkill/core.c
index 448e5a0fcc2e..c218e07e5caf 100644
--- a/net/rfkill/core.c
+++ b/net/rfkill/core.c
@@ -579,6 +579,8 @@ static ssize_t rfkill_name_show(struct device *dev,
 
 static const char *rfkill_get_type_str(enum rfkill_type type)
 {
+        BUILD_BUG_ON(NUM_RFKILL_TYPES != RFKILL_TYPE_FM + 1);
+
         switch (type) {
         case RFKILL_TYPE_WLAN:
                 return "wlan";
@@ -597,8 +599,6 @@ static const char *rfkill_get_type_str(enum rfkill_type type)
         default:
                 BUG();
         }
-
-        BUILD_BUG_ON(NUM_RFKILL_TYPES != RFKILL_TYPE_FM + 1);
 }
 
 static ssize_t rfkill_type_show(struct device *dev,
diff --git a/net/wireless/reg.c b/net/wireless/reg.c
index c01470e7de15..baa898add287 100644
--- a/net/wireless/reg.c
+++ b/net/wireless/reg.c
@@ -141,62 +141,35 @@ static const struct ieee80211_regdomain us_regdom = {
         .reg_rules = {
                 /* IEEE 802.11b/g, channels 1..11 */
                 REG_RULE(2412-10, 2462+10, 40, 6, 27, 0),
-                /* IEEE 802.11a, channel 36 */
-                REG_RULE(5180-10, 5180+10, 40, 6, 23, 0),
-                /* IEEE 802.11a, channel 40 */
-                REG_RULE(5200-10, 5200+10, 40, 6, 23, 0),
-                /* IEEE 802.11a, channel 44 */
-                REG_RULE(5220-10, 5220+10, 40, 6, 23, 0),
+                /* IEEE 802.11a, channel 36..48 */
+                REG_RULE(5180-10, 5240+10, 40, 6, 17, 0),
                 /* IEEE 802.11a, channels 48..64 */
-                REG_RULE(5240-10, 5320+10, 40, 6, 23, 0),
+                REG_RULE(5260-10, 5320+10, 40, 6, 20, NL80211_RRF_DFS),
+                /* IEEE 802.11a, channels 100..124 */
+                REG_RULE(5500-10, 5590+10, 40, 6, 20, NL80211_RRF_DFS),
+                /* IEEE 802.11a, channels 132..144 */
+                REG_RULE(5660-10, 5700+10, 40, 6, 20, NL80211_RRF_DFS),
                 /* IEEE 802.11a, channels 149..165, outdoor */
                 REG_RULE(5745-10, 5825+10, 40, 6, 30, 0),
         }
 };
 
 static const struct ieee80211_regdomain jp_regdom = {
-        .n_reg_rules = 3,
+        .n_reg_rules = 6,
         .alpha2 =  "JP",
         .reg_rules = {
-                /* IEEE 802.11b/g, channels 1..14 */
-                REG_RULE(2412-10, 2484+10, 40, 6, 20, 0),
-                /* IEEE 802.11a, channels 34..48 */
-                REG_RULE(5170-10, 5240+10, 40, 6, 20,
-                        NL80211_RRF_PASSIVE_SCAN),
+                /* IEEE 802.11b/g, channels 1..11 */
+                REG_RULE(2412-10, 2462+10, 40, 6, 20, 0),
+                /* IEEE 802.11b/g, channels 12..13 */
+                REG_RULE(2467-10, 2472+10, 20, 6, 20, 0),
+                /* IEEE 802.11b/g, channel 14 */
+                REG_RULE(2484-10, 2484+10, 20, 6, 20, NL80211_RRF_NO_OFDM),
+                /* IEEE 802.11a, channels 36..48 */
+                REG_RULE(5180-10, 5240+10, 40, 6, 20, 0),
                 /* IEEE 802.11a, channels 52..64 */
-                REG_RULE(5260-10, 5320+10, 40, 6, 20,
-                        NL80211_RRF_NO_IBSS |
-                        NL80211_RRF_DFS),
-        }
-};
-
-static const struct ieee80211_regdomain eu_regdom = {
-        .n_reg_rules = 6,
-        /*
-         * This alpha2 is bogus, we leave it here just for stupid
-         * backward compatibility
-         */
-        .alpha2 =  "EU",
-        .reg_rules = {
-                /* IEEE 802.11b/g, channels 1..13 */
-                REG_RULE(2412-10, 2472+10, 40, 6, 20, 0),
-                /* IEEE 802.11a, channel 36 */
-                REG_RULE(5180-10, 5180+10, 40, 6, 23,
-                        NL80211_RRF_PASSIVE_SCAN),
-                /* IEEE 802.11a, channel 40 */
-                REG_RULE(5200-10, 5200+10, 40, 6, 23,
-                        NL80211_RRF_PASSIVE_SCAN),
-                /* IEEE 802.11a, channel 44 */
-                REG_RULE(5220-10, 5220+10, 40, 6, 23,
-                        NL80211_RRF_PASSIVE_SCAN),
-                /* IEEE 802.11a, channels 48..64 */
-                REG_RULE(5240-10, 5320+10, 40, 6, 20,
-                        NL80211_RRF_NO_IBSS |
-                        NL80211_RRF_DFS),
-                /* IEEE 802.11a, channels 100..140 */
-                REG_RULE(5500-10, 5700+10, 40, 6, 30,
-                        NL80211_RRF_NO_IBSS |
-                        NL80211_RRF_DFS),
+                REG_RULE(5260-10, 5320+10, 40, 6, 20, NL80211_RRF_DFS),
+                /* IEEE 802.11a, channels 100..144 */
+                REG_RULE(5500-10, 5700+10, 40, 6, 23, NL80211_RRF_DFS),
         }
 };
 
@@ -206,15 +179,17 @@ static const struct ieee80211_regdomain *static_regdom(char *alpha2)
                 return &us_regdom;
         if (alpha2[0] == 'J' && alpha2[1] == 'P')
                 return &jp_regdom;
+        /* Use world roaming rules for "EU", since it was a pseudo
+           domain anyway... */
         if (alpha2[0] == 'E' && alpha2[1] == 'U')
-                return &eu_regdom;
-        /* Default, as per the old rules */
-        return &us_regdom;
+                return &world_regdom;
+        /* Default, world roaming rules */
+        return &world_regdom;
 }
 
 static bool is_old_static_regdom(const struct ieee80211_regdomain *rd)
 {
-        if (rd == &us_regdom || rd == &jp_regdom || rd == &eu_regdom)
+        if (rd == &us_regdom || rd == &jp_regdom || rd == &world_regdom)
                 return true;
         return false;
 }
diff --git a/net/wireless/wext-compat.c b/net/wireless/wext-compat.c
index 584eb4826e02..54face3d4424 100644
--- a/net/wireless/wext-compat.c
+++ b/net/wireless/wext-compat.c
@@ -479,6 +479,7 @@ static int __cfg80211_set_encryption(struct cfg80211_registered_device *rdev,
                         }
                         err = rdev->ops->del_key(&rdev->wiphy, dev, idx, addr);
                 }
+                wdev->wext.connect.privacy = false;
                 /*
                  * Applications using wireless extensions expect to be
                  * able to delete keys that don't exist, so allow that.