58 files changed, 463 insertions, 257 deletions
diff --git a/net/8021q/vlan.c b/net/8021q/vlan.c
index dbc81b965096..b33410abfd6b 100644
--- a/net/8021q/vlan.c
+++ b/net/8021q/vlan.c
@@ -374,17 +374,35 @@ static void vlan_sync_address(struct net_device *dev,
        memcpy(vlan->real_dev_addr, dev->dev_addr, ETH_ALEN);
 }
+static void __vlan_device_event(struct net_device *dev, unsigned long event)
+{
+        switch (event) {
+        case NETDEV_CHANGENAME:
+                vlan_proc_rem_dev(dev);
+                if (vlan_proc_add_dev(dev) < 0)
+                        pr_warning("8021q: failed to change proc name for %s\n",
+                                        dev->name);
+                break;
+        }
+}
 static int vlan_device_event(struct notifier_block *unused, unsigned long event,
                             void *ptr)
 {
        struct net_device *dev = ptr;
-        struct vlan_group *grp = __vlan_find_group(dev->ifindex);
+        struct vlan_group *grp;
        int i, flgs;
        struct net_device *vlandev;
        if (dev->nd_net != &init_net)
                return NOTIFY_DONE;
+        if (is_vlan_dev(dev)) {
+                __vlan_device_event(dev, event);
+                goto out;
+        }
+        grp = __vlan_find_group(dev->ifindex);
        if (!grp)
                goto out;
diff --git a/net/8021q/vlan.h b/net/8021q/vlan.h
index 73efcc715ccb..51271aea402b 100644
--- a/net/8021q/vlan.h
+++ b/net/8021q/vlan.h
@@ -45,4 +45,9 @@ void vlan_netlink_fini(void);
 extern struct rtnl_link_ops vlan_link_ops;
+static inline int is_vlan_dev(struct net_device *dev)
+{
+        return dev->priv_flags & IFF_802_1Q_VLAN;
+}
 #endif /* !(__BEN_VLAN_802_1Q_INC__) */
diff --git a/net/8021q/vlan_dev.c b/net/8021q/vlan_dev.c
index 480ea90e7dcd..41a76a05e6fd 100644
--- a/net/8021q/vlan_dev.c
+++ b/net/8021q/vlan_dev.c
@@ -692,6 +692,20 @@ static int vlan_dev_init(struct net_device *dev)
        return 0;
 }
+static void vlan_dev_uninit(struct net_device *dev)
+{
+        struct vlan_priority_tci_mapping *pm;
+        struct vlan_dev_info *vlan = vlan_dev_info(dev);
+        int i;
+        for (i = 0; i < ARRAY_SIZE(vlan->egress_priority_map); i++) {
+                while ((pm = vlan->egress_priority_map[i]) != NULL) {
+                        vlan->egress_priority_map[i] = pm->next;
+                        kfree(pm);
+                }
+        }
+}
 void vlan_setup(struct net_device *dev)
 {
        ether_setup(dev);
@@ -701,6 +715,7 @@ void vlan_setup(struct net_device *dev)
        dev->change_mtu         = vlan_dev_change_mtu;
        dev->init               = vlan_dev_init;
+        dev->uninit             = vlan_dev_uninit;
        dev->open               = vlan_dev_open;
        dev->stop               = vlan_dev_stop;
        dev->set_mac_address    = vlan_dev_set_mac_address;
diff --git a/net/8021q/vlanproc.c b/net/8021q/vlanproc.c
index 146cfb0e9882..9671aa51af2c 100644
--- a/net/8021q/vlanproc.c
+++ b/net/8021q/vlanproc.c
@@ -210,11 +210,6 @@ int vlan_proc_rem_dev(struct net_device *vlandev)
 * The following few functions build the content of /proc/net/vlan/config
 */
-static inline int is_vlan_dev(struct net_device *dev)
-{
-        return dev->priv_flags & IFF_802_1Q_VLAN;
-}
 /* start read of /proc/net/vlan/config */
 static void *vlan_seq_start(struct seq_file *seq, loff_t *pos)
        __acquires(dev_base_lock)
diff --git a/net/atm/lec.c b/net/atm/lec.c
index a2efa7ff41f1..3235c57615e4 100644
--- a/net/atm/lec.c
+++ b/net/atm/lec.c
@@ -266,7 +266,6 @@ static int lec_start_xmit(struct sk_buff *skb, struct net_device *dev)
        char buf[300];
        int i = 0;
 #endif /* DUMP_PACKETS >0 */
-        DECLARE_MAC_BUF(mac);
        pr_debug("lec_start_xmit called\n");
        if (!priv->lecd) {
@@ -374,15 +373,19 @@ static int lec_start_xmit(struct sk_buff *skb, struct net_device *dev)
                if (entry && (entry->tx_wait.qlen < LEC_UNRES_QUE_LEN)) {
                        pr_debug("%s:lec_start_xmit: queuing packet, ",
                                dev->name);
-                        pr_debug("MAC address %s\n",
+                        pr_debug("MAC address " MAC_FMT "\n",
-                                 print_mac(mac, lec_h->h_dest));
+                                 lec_h->h_dest[0], lec_h->h_dest[1],
+                                 lec_h->h_dest[2], lec_h->h_dest[3],
+                                 lec_h->h_dest[4], lec_h->h_dest[5]);
                        skb_queue_tail(&entry->tx_wait, skb);
                } else {
                        pr_debug
                            ("%s:lec_start_xmit: tx queue full or no arp entry, dropping, ",
                             dev->name);
-                        pr_debug("MAC address %s\n",
+                        pr_debug("MAC address " MAC_FMT "\n",
-                                 print_mac(mac, lec_h->h_dest));
+                                 lec_h->h_dest[0], lec_h->h_dest[1],
+                                 lec_h->h_dest[2], lec_h->h_dest[3],
+                                 lec_h->h_dest[4], lec_h->h_dest[5]);
                        priv->stats.tx_dropped++;
                        dev_kfree_skb(skb);
                }
@@ -394,8 +397,10 @@ static int lec_start_xmit(struct sk_buff *skb, struct net_device *dev)
        while (entry && (skb2 = skb_dequeue(&entry->tx_wait))) {
                pr_debug("lec.c: emptying tx queue, ");
-                pr_debug("MAC address %s\n",
+                pr_debug("MAC address " MAC_FMT "\n",
-                         print_mac(mac, lec_h->h_dest));
+                         lec_h->h_dest[0], lec_h->h_dest[1],
+                         lec_h->h_dest[2], lec_h->h_dest[3],
+                         lec_h->h_dest[4], lec_h->h_dest[5]);
                lec_send(vcc, skb2, priv);
        }
@@ -449,7 +454,6 @@ static int lec_atm_send(struct atm_vcc *vcc, struct sk_buff *skb)
        struct lec_arp_table *entry;
        int i;
        char *tmp;              /* FIXME */
-        DECLARE_MAC_BUF(mac);
        atomic_sub(skb->truesize, &sk_atm(vcc)->sk_wmem_alloc);
        mesg = (struct atmlec_msg *)skb->data;
@@ -536,9 +540,14 @@ static int lec_atm_send(struct atm_vcc *vcc, struct sk_buff *skb)
                        struct net_bridge_fdb_entry *f;
                        pr_debug
-                            ("%s: bridge zeppelin asks about %s\n",
+                            ("%s: bridge zeppelin asks about " MAC_FMT "\n",
                             dev->name,
-                             print_mac(mac, mesg->content.proxy.mac_addr));
+                             mesg->content.proxy.mac_addr[0],
+                             mesg->content.proxy.mac_addr[1],
+                             mesg->content.proxy.mac_addr[2],
+                             mesg->content.proxy.mac_addr[3],
+                             mesg->content.proxy.mac_addr[4],
+                             mesg->content.proxy.mac_addr[5]);
                        if (br_fdb_get_hook == NULL || dev->br_port == NULL)
                                break;
diff --git a/net/bluetooth/af_bluetooth.c b/net/bluetooth/af_bluetooth.c
index 1220d8a41eb5..d366423c8392 100644
--- a/net/bluetooth/af_bluetooth.c
+++ b/net/bluetooth/af_bluetooth.c
@@ -53,6 +53,30 @@
 /* Bluetooth sockets */
 #define BT_MAX_PROTO    8
 static struct net_proto_family *bt_proto[BT_MAX_PROTO];
+static struct lock_class_key bt_slock_key[BT_MAX_PROTO];
+static struct lock_class_key bt_lock_key[BT_MAX_PROTO];
+static const char *bt_key_strings[BT_MAX_PROTO] = {
+        "sk_lock-AF_BLUETOOTH-BTPROTO_L2CAP",
+        "sk_lock-AF_BLUETOOTH-BTPROTO_HCI",
+        "sk_lock-AF_BLUETOOTH-BTPROTO_SCO",
+        "sk_lock-AF_BLUETOOTH-BTPROTO_RFCOMM",
+        "sk_lock-AF_BLUETOOTH-BTPROTO_BNEP",
+        "sk_lock-AF_BLUETOOTH-BTPROTO_CMTP",
+        "sk_lock-AF_BLUETOOTH-BTPROTO_HIDP",
+        "sk_lock-AF_BLUETOOTH-BTPROTO_AVDTP",
+};
+static const char *bt_slock_key_strings[BT_MAX_PROTO] = {
+        "slock-AF_BLUETOOTH-BTPROTO_L2CAP",
+        "slock-AF_BLUETOOTH-BTPROTO_HCI",
+        "slock-AF_BLUETOOTH-BTPROTO_SCO",
+        "slock-AF_BLUETOOTH-BTPROTO_RFCOMM",
+        "slock-AF_BLUETOOTH-BTPROTO_BNEP",
+        "slock-AF_BLUETOOTH-BTPROTO_CMTP",
+        "slock-AF_BLUETOOTH-BTPROTO_HIDP",
+        "slock-AF_BLUETOOTH-BTPROTO_AVDTP",
+};
 static DEFINE_RWLOCK(bt_proto_lock);
 int bt_sock_register(int proto, struct net_proto_family *ops)
@@ -95,6 +119,21 @@ int bt_sock_unregister(int proto)
 }
 EXPORT_SYMBOL(bt_sock_unregister);
+static void bt_reclassify_sock_lock(struct socket *sock, int proto)
+{
+        struct sock *sk = sock->sk;
+        if (!sk)
+                return;
+        BUG_ON(sock_owned_by_user(sk));
+        sock_lock_init_class_and_name(sk,
+                        bt_slock_key_strings[proto],
+                        &bt_slock_key[proto],
+                        bt_key_strings[proto],
+                        &bt_lock_key[proto]);
+}
 static int bt_sock_create(struct net *net, struct socket *sock, int proto)
 {
        int err;
@@ -117,6 +156,7 @@ static int bt_sock_create(struct net *net, struct socket *sock, int proto)
        if (bt_proto[proto] && try_module_get(bt_proto[proto]->owner)) {
                err = bt_proto[proto]->create(net, sock, proto);
+                bt_reclassify_sock_lock(sock, proto);
                module_put(bt_proto[proto]->owner);
        }
diff --git a/net/bluetooth/hci_sock.c b/net/bluetooth/hci_sock.c
index b5d4019d3572..1d36c093523b 100644
--- a/net/bluetooth/hci_sock.c
+++ b/net/bluetooth/hci_sock.c
@@ -84,7 +84,7 @@ static struct hci_sec_filter hci_sec_filter = {
 };
 static struct bt_sock_list hci_sk_list = {
-        .lock = RW_LOCK_UNLOCKED
+        .lock = __RW_LOCK_UNLOCKED(hci_sk_list.lock)
 };
 /* Send frame to RAW socket */
diff --git a/net/bluetooth/l2cap.c b/net/bluetooth/l2cap.c
index 34f8bf98bc05..2957df4b6c0b 100644
--- a/net/bluetooth/l2cap.c
+++ b/net/bluetooth/l2cap.c
@@ -62,7 +62,7 @@ static u32 l2cap_feat_mask = 0x0000;
 static const struct proto_ops l2cap_sock_ops;
 static struct bt_sock_list l2cap_sk_list = {
-        .lock = RW_LOCK_UNLOCKED
+        .lock = __RW_LOCK_UNLOCKED(l2cap_sk_list.lock)
 };
 static void __l2cap_sock_close(struct sock *sk, int reason);
diff --git a/net/bluetooth/rfcomm/core.c b/net/bluetooth/rfcomm/core.c
index 0c2c93735e93..eb62558e9b09 100644
--- a/net/bluetooth/rfcomm/core.c
+++ b/net/bluetooth/rfcomm/core.c
@@ -423,8 +423,8 @@ static int __rfcomm_dlc_close(struct rfcomm_dlc *d, int err)
                rfcomm_dlc_lock(d);
                d->state = BT_CLOSED;
-                d->state_change(d, err);
                rfcomm_dlc_unlock(d);
+                d->state_change(d, err);
                skb_queue_purge(&d->tx_queue);
                rfcomm_dlc_unlink(d);
diff --git a/net/bluetooth/rfcomm/sock.c b/net/bluetooth/rfcomm/sock.c
index c46d51035e77..af4e3934ee84 100644
--- a/net/bluetooth/rfcomm/sock.c
+++ b/net/bluetooth/rfcomm/sock.c
@@ -60,7 +60,7 @@
 static const struct proto_ops rfcomm_sock_ops;
 static struct bt_sock_list rfcomm_sk_list = {
-        .lock = RW_LOCK_UNLOCKED
+        .lock = __RW_LOCK_UNLOCKED(rfcomm_sk_list.lock)
 };
 static void rfcomm_sock_close(struct sock *sk);
diff --git a/net/bluetooth/rfcomm/tty.c b/net/bluetooth/rfcomm/tty.c
index e4c779bb8d76..c3f749abb2d0 100644
--- a/net/bluetooth/rfcomm/tty.c
+++ b/net/bluetooth/rfcomm/tty.c
@@ -570,12 +570,7 @@ static void rfcomm_dev_state_change(struct rfcomm_dlc *dlc, int err)
                                        return;
                                rfcomm_dev_del(dev);
-                                /* We have to drop DLC lock here, otherwise
-                                   rfcomm_dev_put() will dead lock if it's
-                                   the last reference. */
-                                rfcomm_dlc_unlock(dlc);
                                rfcomm_dev_put(dev);
-                                rfcomm_dlc_lock(dlc);
                        }
                } else
                        tty_hangup(dev->tty);
diff --git a/net/bluetooth/sco.c b/net/bluetooth/sco.c
index b91d3c81a73c..cd887cdca426 100644
--- a/net/bluetooth/sco.c
+++ b/net/bluetooth/sco.c
@@ -58,7 +58,7 @@
 static const struct proto_ops sco_sock_ops;
 static struct bt_sock_list sco_sk_list = {
-        .lock = RW_LOCK_UNLOCKED
+        .lock = __RW_LOCK_UNLOCKED(sco_sk_list.lock)
 };
 static void __sco_chan_add(struct sco_conn *conn, struct sock *sk, struct sock *parent);
diff --git a/net/ieee80211/ieee80211_rx.c b/net/ieee80211/ieee80211_rx.c
index 1e3f87c8c012..200ee1e63728 100644
--- a/net/ieee80211/ieee80211_rx.c
+++ b/net/ieee80211/ieee80211_rx.c
@@ -271,7 +271,6 @@ ieee80211_rx_frame_decrypt(struct ieee80211_device *ieee, struct sk_buff *skb,
 {
        struct ieee80211_hdr_3addr *hdr;
        int res, hdrlen;
-        DECLARE_MAC_BUF(mac);
        if (crypt == NULL || crypt->ops->decrypt_mpdu == NULL)
                return 0;
@@ -283,8 +282,12 @@ ieee80211_rx_frame_decrypt(struct ieee80211_device *ieee, struct sk_buff *skb,
        res = crypt->ops->decrypt_mpdu(skb, hdrlen, crypt->priv);
        atomic_dec(&crypt->refcnt);
        if (res < 0) {
-                IEEE80211_DEBUG_DROP("decryption failed (SA=%s"
+                IEEE80211_DEBUG_DROP("decryption failed (SA=" MAC_FMT
-                                     ") res=%d\n", print_mac(mac, hdr->addr2), res);
+                                     ") res=%d\n",
+                                     hdr->addr2[0], hdr->addr2[1],
+                                     hdr->addr2[2], hdr->addr2[3],
+                                     hdr->addr2[4], hdr->addr2[5],
+                                     res);
                if (res == -2)
                        IEEE80211_DEBUG_DROP("Decryption failed ICV "
                                             "mismatch (key %d)\n",
@@ -304,7 +307,6 @@ ieee80211_rx_frame_decrypt_msdu(struct ieee80211_device *ieee,
 {
        struct ieee80211_hdr_3addr *hdr;
        int res, hdrlen;
-        DECLARE_MAC_BUF(mac);
        if (crypt == NULL || crypt->ops->decrypt_msdu == NULL)
                return 0;
@@ -317,8 +319,12 @@ ieee80211_rx_frame_decrypt_msdu(struct ieee80211_device *ieee,
        atomic_dec(&crypt->refcnt);
        if (res < 0) {
                printk(KERN_DEBUG "%s: MSDU decryption/MIC verification failed"
-                       " (SA=%s keyidx=%d)\n",
+                       " (SA=" MAC_FMT " keyidx=%d)\n",
-                       ieee->dev->name, print_mac(mac, hdr->addr2), keyidx);
+                       ieee->dev->name,
+                       hdr->addr2[0], hdr->addr2[1],
+                       hdr->addr2[2], hdr->addr2[3],
+                       hdr->addr2[4], hdr->addr2[5],
+                       keyidx);
                return -1;
        }
@@ -462,8 +468,10 @@ int ieee80211_rx(struct ieee80211_device *ieee, struct sk_buff *skb,
                         * frames silently instead of filling system log with
                         * these reports. */
                        IEEE80211_DEBUG_DROP("Decryption failed (not set)"
-                                             " (SA=%s)\n",
+                                             " (SA=" MAC_FMT ")\n",
-                                             print_mac(mac, hdr->addr2));
+                                             hdr->addr2[0], hdr->addr2[1],
+                                             hdr->addr2[2], hdr->addr2[3],
+                                             hdr->addr2[4], hdr->addr2[5]);
                        ieee->ieee_stats.rx_discards_undecryptable++;
                        goto rx_dropped;
                }
@@ -474,8 +482,10 @@ int ieee80211_rx(struct ieee80211_device *ieee, struct sk_buff *skb,
                    fc & IEEE80211_FCTL_PROTECTED && ieee->host_decrypt &&
                    (keyidx = hostap_rx_frame_decrypt(ieee, skb, crypt)) < 0) {
                        printk(KERN_DEBUG "%s: failed to decrypt mgmt::auth "
-                               "from %s\n", dev->name,
+                               "from " MAC_FMT "\n", dev->name,
-                               print_mac(mac, hdr->addr2));
+                               hdr->addr2[0], hdr->addr2[1],
+                               hdr->addr2[2], hdr->addr2[3],
+                               hdr->addr2[4], hdr->addr2[5]);
                        /* TODO: could inform hostapd about this so that it
                         * could send auth failure report */
                        goto rx_dropped;
@@ -653,8 +663,11 @@ int ieee80211_rx(struct ieee80211_device *ieee, struct sk_buff *skb,
                         * configured */
                } else {
                        IEEE80211_DEBUG_DROP("encryption configured, but RX "
-                                             "frame not encrypted (SA=%s"
+                                             "frame not encrypted (SA="
-                                             ")\n", print_mac(mac, hdr->addr2));
+                                             MAC_FMT ")\n",
+                                             hdr->addr2[0], hdr->addr2[1],
+                                             hdr->addr2[2], hdr->addr2[3],
+                                             hdr->addr2[4], hdr->addr2[5]);
                        goto rx_dropped;
                }
        }
@@ -662,9 +675,11 @@ int ieee80211_rx(struct ieee80211_device *ieee, struct sk_buff *skb,
        if (crypt && !(fc & IEEE80211_FCTL_PROTECTED) && !ieee->open_wep &&
            !ieee80211_is_eapol_frame(ieee, skb)) {
                IEEE80211_DEBUG_DROP("dropped unencrypted RX data "
-                                     "frame from %s"
+                                     "frame from " MAC_FMT
                                     " (drop_unencrypted=1)\n",
-                                     print_mac(mac, hdr->addr2));
+                                     hdr->addr2[0], hdr->addr2[1],
+                                     hdr->addr2[2], hdr->addr2[3],
+                                     hdr->addr2[4], hdr->addr2[5]);
                goto rx_dropped;
        }
diff --git a/net/ipv4/esp4.c b/net/ipv4/esp4.c
index f3ceca31aa45..4e73e5708e70 100644
--- a/net/ipv4/esp4.c
+++ b/net/ipv4/esp4.c
@@ -336,7 +336,7 @@ static int esp_input(struct xfrm_state *x, struct sk_buff *skb)
        struct scatterlist *asg;
        int err = -EINVAL;
-        if (!pskb_may_pull(skb, sizeof(*esph)))
+        if (!pskb_may_pull(skb, sizeof(*esph) + crypto_aead_ivsize(aead)))
                goto out;
        if (elen <= 0)
diff --git a/net/ipv4/icmp.c b/net/ipv4/icmp.c
index a944e8053e28..40508babad8c 100644
--- a/net/ipv4/icmp.c
+++ b/net/ipv4/icmp.c
@@ -591,7 +591,7 @@ void icmp_send(struct sk_buff *skb_in, int type, int code, __be32 info)
                }
                if (xfrm_decode_session_reverse(skb_in, &fl, AF_INET))
-                        goto ende;
+                        goto relookup_failed;
                if (inet_addr_type(net, fl.fl4_src) == RTN_LOCAL)
                        err = __ip_route_output_key(net, &rt2, &fl);
@@ -601,7 +601,7 @@ void icmp_send(struct sk_buff *skb_in, int type, int code, __be32 info)
                        fl2.fl4_dst = fl.fl4_src;
                        if (ip_route_output_key(net, &rt2, &fl2))
-                                goto ende;
+                                goto relookup_failed;
                        /* Ugh! */
                        odst = skb_in->dst;
@@ -614,21 +614,23 @@ void icmp_send(struct sk_buff *skb_in, int type, int code, __be32 info)
                }
                if (err)
-                        goto ende;
+                        goto relookup_failed;
                err = xfrm_lookup((struct dst_entry **)&rt2, &fl, NULL,
                                  XFRM_LOOKUP_ICMP);
-                if (err == -ENOENT) {
+                switch (err) {
+                case 0:
+                        dst_release(&rt->u.dst);
+                        rt = rt2;
+                        break;
+                case -EPERM:
+                        goto ende;
+                default:
+relookup_failed:
                        if (!rt)
                                goto out_unlock;
-                        goto route_done;
+                        break;
                }
-                dst_release(&rt->u.dst);
-                rt = rt2;
-                if (err)
-                        goto out_unlock;
        }
 route_done:
diff --git a/net/ipv4/inet_fragment.c b/net/ipv4/inet_fragment.c
index 724d69aed031..a0a3c78cb5e0 100644
--- a/net/ipv4/inet_fragment.c
+++ b/net/ipv4/inet_fragment.c
@@ -86,7 +86,10 @@ EXPORT_SYMBOL(inet_frags_fini);
 void inet_frags_exit_net(struct netns_frags *nf, struct inet_frags *f)
 {
        nf->low_thresh = 0;
+        local_bh_disable();
        inet_frag_evictor(nf, f);
+        local_bh_enable();
 }
 EXPORT_SYMBOL(inet_frags_exit_net);
diff --git a/net/ipv4/inet_timewait_sock.c b/net/ipv4/inet_timewait_sock.c
index 876169f3a528..717c411a5c6b 100644
--- a/net/ipv4/inet_timewait_sock.c
+++ b/net/ipv4/inet_timewait_sock.c
@@ -124,6 +124,7 @@ struct inet_timewait_sock *inet_twsk_alloc(const struct sock *sk, const int stat
                tw->tw_hash         = sk->sk_hash;
                tw->tw_ipv6only     = 0;
                tw->tw_prot         = sk->sk_prot_creator;
+                tw->tw_net          = sk->sk_net;
                atomic_set(&tw->tw_refcnt, 1);
                inet_twsk_dead_node_init(tw);
                __module_get(tw->tw_prot->owner);
diff --git a/net/ipv4/ip_forward.c b/net/ipv4/ip_forward.c
index 0b3b328d82db..a4506c8cfef0 100644
--- a/net/ipv4/ip_forward.c
+++ b/net/ipv4/ip_forward.c
@@ -85,7 +85,7 @@ int ip_forward(struct sk_buff *skb)
        if (opt->is_strictroute && rt->rt_dst != rt->rt_gateway)
                goto sr_failed;
-        if (unlikely(skb->len > dst_mtu(&rt->u.dst) &&
+        if (unlikely(skb->len > dst_mtu(&rt->u.dst) && !skb_is_gso(skb) &&
                     (ip_hdr(skb)->frag_off & htons(IP_DF))) && !skb->local_df) {
                IP_INC_STATS(IPSTATS_MIB_FRAGFAILS);
                icmp_send(skb, ICMP_DEST_UNREACH, ICMP_FRAG_NEEDED,
diff --git a/net/ipv4/ip_sockglue.c b/net/ipv4/ip_sockglue.c
index f72457b4b0a7..c2921d01e925 100644
--- a/net/ipv4/ip_sockglue.c
+++ b/net/ipv4/ip_sockglue.c
@@ -1132,7 +1132,7 @@ static int do_ip_getsockopt(struct sock *sk, int level, int optname,
        }
        release_sock(sk);
-        if (len < sizeof(int) && len > 0 && val>=0 && val<255) {
+        if (len < sizeof(int) && len > 0 && val>=0 && val<=255) {
                unsigned char ucval = (unsigned char)val;
                len = 1;
                if (put_user(len, optlen))
diff --git a/net/ipv4/netfilter/ip_queue.c b/net/ipv4/netfilter/ip_queue.c
index fe05da41d6ba..4dc162894cb2 100644
--- a/net/ipv4/netfilter/ip_queue.c
+++ b/net/ipv4/netfilter/ip_queue.c
@@ -588,11 +588,9 @@ static int __init ip_queue_init(void)
        }
 #ifdef CONFIG_PROC_FS
-        proc = create_proc_entry(IPQ_PROC_FS_NAME, 0, init_net.proc_net);
+        proc = proc_create(IPQ_PROC_FS_NAME, 0, init_net.proc_net,
-        if (proc) {
+                           &ip_queue_proc_fops);
-                proc->owner = THIS_MODULE;
+        if (!proc) {
-                proc->proc_fops = &ip_queue_proc_fops;
-        } else {
                printk(KERN_ERR "ip_queue: failed to create proc entry\n");
                goto cleanup_ipqnl;
        }
diff --git a/net/ipv4/netfilter/ipt_CLUSTERIP.c b/net/ipv4/netfilter/ipt_CLUSTERIP.c
index c6cf84c77611..52926c8e3cc1 100644
--- a/net/ipv4/netfilter/ipt_CLUSTERIP.c
+++ b/net/ipv4/netfilter/ipt_CLUSTERIP.c
@@ -167,14 +167,13 @@ clusterip_config_init(struct ipt_clusterip_tgt_info *i, __be32 ip,
                /* create proc dir entry */
                sprintf(buffer, "%u.%u.%u.%u", NIPQUAD(ip));
-                c->pde = create_proc_entry(buffer, S_IWUSR|S_IRUSR,
+                c->pde = proc_create(buffer, S_IWUSR|S_IRUSR,
-                                           clusterip_procdir);
+                                     clusterip_procdir, &clusterip_proc_fops);
                if (!c->pde) {
                        kfree(c);
                        return NULL;
                }
        }
-        c->pde->proc_fops = &clusterip_proc_fops;
        c->pde->data = c;
 #endif
diff --git a/net/ipv4/netfilter/ipt_recent.c b/net/ipv4/netfilter/ipt_recent.c
index 8e8f0425a8ed..50e06690eb5b 100644
--- a/net/ipv4/netfilter/ipt_recent.c
+++ b/net/ipv4/netfilter/ipt_recent.c
@@ -276,12 +276,11 @@ recent_mt_check(const char *tablename, const void *ip,
        for (i = 0; i < ip_list_hash_size; i++)
                INIT_LIST_HEAD(&t->iphash[i]);
 #ifdef CONFIG_PROC_FS
-        t->proc = create_proc_entry(t->name, ip_list_perms, proc_dir);
+        t->proc = proc_create(t->name, ip_list_perms, proc_dir, &recent_fops);
        if (t->proc == NULL) {
                kfree(t);
                goto out;
        }
-        t->proc->proc_fops = &recent_fops;
        t->proc->uid       = ip_list_uid;
        t->proc->gid       = ip_list_gid;
        t->proc->data      = t;
diff --git a/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4_compat.c b/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4_compat.c
index 089252e82c01..f500b0fdaef4 100644
--- a/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4_compat.c
+++ b/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4_compat.c
@@ -395,13 +395,10 @@ int __init nf_conntrack_ipv4_compat_init(void)
        if (!proc_exp)
                goto err2;
-        proc_stat = create_proc_entry("ip_conntrack", S_IRUGO, init_net.proc_net_stat);
+        proc_stat = proc_create("ip_conntrack", S_IRUGO,
+                                init_net.proc_net_stat, &ct_cpu_seq_fops);
        if (!proc_stat)
                goto err3;
-        proc_stat->proc_fops = &ct_cpu_seq_fops;
-        proc_stat->owner = THIS_MODULE;
        return 0;
 err3:
diff --git a/net/ipv4/netfilter/nf_nat_core.c b/net/ipv4/netfilter/nf_nat_core.c
index 0d5fa3a54d04..36b4e3bb056f 100644
--- a/net/ipv4/netfilter/nf_nat_core.c
+++ b/net/ipv4/netfilter/nf_nat_core.c
@@ -629,6 +629,8 @@ static int __init nf_nat_init(void)
        size_t i;
        int ret;
+        need_ipv4_conntrack();
        ret = nf_ct_extend_register(&nat_extend);
        if (ret < 0) {
                printk(KERN_ERR "nf_nat_core: Unable to register extension\n");
diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
index 7facdb0f6960..5119856017ab 100644
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -1625,13 +1625,11 @@ out:
        return flag;
 }
-/* If we receive more dupacks than we expected counting segments
+/* Limits sacked_out so that sum with lost_out isn't ever larger than
- * in assumption of absent reordering, interpret this as reordering.
+ * packets_out. Returns zero if sacked_out adjustement wasn't necessary.
- * The only another reason could be bug in receiver TCP.
 */
-static void tcp_check_reno_reordering(struct sock *sk, const int addend)
+int tcp_limit_reno_sacked(struct tcp_sock *tp)
 {
-        struct tcp_sock *tp = tcp_sk(sk);
        u32 holes;
        holes = max(tp->lost_out, 1U);
@@ -1639,8 +1637,20 @@ static void tcp_check_reno_reordering(struct sock *sk, const int addend)
        if ((tp->sacked_out + holes) > tp->packets_out) {
                tp->sacked_out = tp->packets_out - holes;
-                tcp_update_reordering(sk, tp->packets_out + addend, 0);
+                return 1;
        }
+        return 0;
+}
+/* If we receive more dupacks than we expected counting segments
+ * in assumption of absent reordering, interpret this as reordering.
+ * The only another reason could be bug in receiver TCP.
+ */
+static void tcp_check_reno_reordering(struct sock *sk, const int addend)
+{
+        struct tcp_sock *tp = tcp_sk(sk);
+        if (tcp_limit_reno_sacked(tp))
+                tcp_update_reordering(sk, tp->packets_out + addend, 0);
 }
 /* Emulate SACKs for SACKless connection: account for a new dupack. */
@@ -1681,11 +1691,16 @@ static inline void tcp_reset_reno_sack(struct tcp_sock *tp)
 int tcp_use_frto(struct sock *sk)
 {
        const struct tcp_sock *tp = tcp_sk(sk);
+        const struct inet_connection_sock *icsk = inet_csk(sk);
        struct sk_buff *skb;
        if (!sysctl_tcp_frto)
                return 0;
+        /* MTU probe and F-RTO won't really play nicely along currently */
+        if (icsk->icsk_mtup.probe_size)
+                return 0;
        if (IsSackFrto())
                return 1;
@@ -2134,11 +2149,13 @@ static void tcp_verify_retransmit_hint(struct tcp_sock *tp, struct sk_buff *skb)
 /* Mark head of queue up as lost. With RFC3517 SACK, the packets is
 * is against sacked "cnt", otherwise it's against facked "cnt"
 */
-static void tcp_mark_head_lost(struct sock *sk, int packets, int fast_rexmit)
+static void tcp_mark_head_lost(struct sock *sk, int packets)
 {
        struct tcp_sock *tp = tcp_sk(sk);
        struct sk_buff *skb;
-        int cnt;
+        int cnt, oldcnt;
+        int err;
+        unsigned int mss;
        BUG_TRAP(packets <= tp->packets_out);
        if (tp->lost_skb_hint) {
@@ -2157,13 +2174,25 @@ static void tcp_mark_head_lost(struct sock *sk, int packets, int fast_rexmit)
                tp->lost_skb_hint = skb;
                tp->lost_cnt_hint = cnt;
+                if (after(TCP_SKB_CB(skb)->end_seq, tp->high_seq))
+                        break;
+                oldcnt = cnt;
                if (tcp_is_fack(tp) || tcp_is_reno(tp) ||
                    (TCP_SKB_CB(skb)->sacked & TCPCB_SACKED_ACKED))
                        cnt += tcp_skb_pcount(skb);
-                if (((!fast_rexmit || (tp->lost_out > 0)) && (cnt > packets)) ||
+                if (cnt > packets) {
-                    after(TCP_SKB_CB(skb)->end_seq, tp->high_seq))
+                        if (tcp_is_sack(tp) || (oldcnt >= packets))
-                        break;
+                                break;
+                        mss = skb_shinfo(skb)->gso_size;
+                        err = tcp_fragment(sk, skb, (packets - oldcnt) * mss, mss);
+                        if (err < 0)
+                                break;
+                        cnt = packets;
+                }
                if (!(TCP_SKB_CB(skb)->sacked & (TCPCB_SACKED_ACKED|TCPCB_LOST))) {
                        TCP_SKB_CB(skb)->sacked |= TCPCB_LOST;
                        tp->lost_out += tcp_skb_pcount(skb);
@@ -2180,17 +2209,17 @@ static void tcp_update_scoreboard(struct sock *sk, int fast_rexmit)
        struct tcp_sock *tp = tcp_sk(sk);
        if (tcp_is_reno(tp)) {
-                tcp_mark_head_lost(sk, 1, fast_rexmit);
+                tcp_mark_head_lost(sk, 1);
        } else if (tcp_is_fack(tp)) {
                int lost = tp->fackets_out - tp->reordering;
                if (lost <= 0)
                        lost = 1;
-                tcp_mark_head_lost(sk, lost, fast_rexmit);
+                tcp_mark_head_lost(sk, lost);
        } else {
                int sacked_upto = tp->sacked_out - tp->reordering;
-                if (sacked_upto < 0)
+                if (sacked_upto < fast_rexmit)
-                        sacked_upto = 0;
+                        sacked_upto = fast_rexmit;
-                tcp_mark_head_lost(sk, sacked_upto, fast_rexmit);
+                tcp_mark_head_lost(sk, sacked_upto);
        }
        /* New heuristics: it is possible only after we switched
@@ -2524,7 +2553,7 @@ static void tcp_fastretrans_alert(struct sock *sk, int pkts_acked, int flag)
            before(tp->snd_una, tp->high_seq) &&
            icsk->icsk_ca_state != TCP_CA_Open &&
            tp->fackets_out > tp->reordering) {
-                tcp_mark_head_lost(sk, tp->fackets_out - tp->reordering, 0);
+                tcp_mark_head_lost(sk, tp->fackets_out - tp->reordering);
                NET_INC_STATS_BH(LINUX_MIB_TCPLOSS);
        }
@@ -2586,6 +2615,8 @@ static void tcp_fastretrans_alert(struct sock *sk, int pkts_acked, int flag)
        case TCP_CA_Loss:
                if (flag & FLAG_DATA_ACKED)
                        icsk->icsk_retransmits = 0;
+                if (tcp_is_reno(tp) && flag & FLAG_SND_UNA_ADVANCED)
+                        tcp_reset_reno_sack(tp);
                if (!tcp_try_undo_loss(sk)) {
                        tcp_moderate_cwnd(tp);
                        tcp_xmit_retransmit_queue(sk);
diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
index 72b9350006fe..d29ef79c00ca 100644
--- a/net/ipv4/tcp_output.c
+++ b/net/ipv4/tcp_output.c
@@ -1808,6 +1808,9 @@ void tcp_simple_retransmit(struct sock *sk)
        if (!lost)
                return;
+        if (tcp_is_reno(tp))
+                tcp_limit_reno_sacked(tp);
        tcp_verify_left_out(tp);
        /* Don't muck with the congestion window here.
diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
index 7ea1b67b6de1..1704c1474ea1 100644
--- a/net/ipv4/udp.c
+++ b/net/ipv4/udp.c
@@ -1556,14 +1556,14 @@ static void *udp_seq_start(struct seq_file *seq, loff_t *pos)
        __acquires(udp_hash_lock)
 {
        read_lock(&udp_hash_lock);
-        return *pos ? udp_get_idx(seq, *pos-1) : (void *)1;
+        return *pos ? udp_get_idx(seq, *pos-1) : SEQ_START_TOKEN;
 }
 static void *udp_seq_next(struct seq_file *seq, void *v, loff_t *pos)
 {
        struct sock *sk;
-        if (v == (void *)1)
+        if (v == SEQ_START_TOKEN)
                sk = udp_get_idx(seq, 0);
        else
                sk = udp_get_next(seq, v);
diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index 101e0e70ba27..a65935a9afd9 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -776,6 +776,7 @@ static int ipv6_create_tempaddr(struct inet6_ifaddr *ifp, struct inet6_ifaddr *i
        struct inet6_dev *idev = ifp->idev;
        struct in6_addr addr, *tmpaddr;
        unsigned long tmp_prefered_lft, tmp_valid_lft, tmp_cstamp, tmp_tstamp;
+        unsigned long regen_advance;
        int tmp_plen;
        int ret = 0;
        int max_addresses;
@@ -836,8 +837,23 @@ retry:
        tmp_tstamp = ifp->tstamp;
        spin_unlock_bh(&ifp->lock);
+        regen_advance = idev->cnf.regen_max_retry *
+                        idev->cnf.dad_transmits *
+                        idev->nd_parms->retrans_time / HZ;
        write_unlock(&idev->lock);
+        /* A temporary address is created only if this calculated Preferred
+         * Lifetime is greater than REGEN_ADVANCE time units.  In particular,
+         * an implementation must not create a temporary address with a zero
+         * Preferred Lifetime.
+         */
+        if (tmp_prefered_lft <= regen_advance) {
+                in6_ifa_put(ifp);
+                in6_dev_put(idev);
+                ret = -1;
+                goto out;
+        }
        addr_flags = IFA_F_TEMPORARY;
        /* set in addrconf_prefix_rcv() */
        if (ifp->flags & IFA_F_OPTIMISTIC)
@@ -1831,6 +1847,9 @@ ok:
                                 * lifetimes of an existing temporary address
                                 * when processing a Prefix Information Option.
                                 */
+                                if (ifp != ift->ifpub)
+                                        continue;
                                spin_lock(&ift->lock);
                                flags = ift->flags;
                                if (ift->valid_lft > valid_lft &&
@@ -2437,7 +2456,7 @@ static int addrconf_ifdown(struct net_device *dev, int how)
        ASSERT_RTNL();
-        if (dev == init_net.loopback_dev && how == 1)
+        if ((dev->flags & IFF_LOOPBACK) && how == 1)
                how = 0;
        rt6_ifdown(dev);
@@ -2450,7 +2469,7 @@ static int addrconf_ifdown(struct net_device *dev, int how)
        /* Step 1: remove reference to ipv6 device from parent device.
                   Do not dev_put!
         */
-        if (how == 1) {
+        if (how) {
                idev->dead = 1;
                /* protected by rtnl_lock */
@@ -2482,12 +2501,12 @@ static int addrconf_ifdown(struct net_device *dev, int how)
        write_lock_bh(&idev->lock);
        /* Step 3: clear flags for stateless addrconf */
-        if (how != 1)
+        if (!how)
                idev->if_flags &= ~(IF_RS_SENT|IF_RA_RCVD|IF_READY);
        /* Step 4: clear address list */
 #ifdef CONFIG_IPV6_PRIVACY
-        if (how == 1 && del_timer(&idev->regen_timer))
+        if (how && del_timer(&idev->regen_timer))
                in6_dev_put(idev);
        /* clear tempaddr list */
@@ -2524,7 +2543,7 @@ static int addrconf_ifdown(struct net_device *dev, int how)
        /* Step 5: Discard multicast list */
-        if (how == 1)
+        if (how)
                ipv6_mc_destroy_dev(idev);
        else
                ipv6_mc_down(idev);
@@ -2533,7 +2552,7 @@ static int addrconf_ifdown(struct net_device *dev, int how)
        /* Shot the device (if unregistered) */
-        if (how == 1) {
+        if (how) {
                addrconf_sysctl_unregister(idev);
                neigh_parms_release(&nd_tbl, idev->nd_parms);
                neigh_ifdown(&nd_tbl, dev);
diff --git a/net/ipv6/anycast.c b/net/ipv6/anycast.c
index 9c7f83fbc3a1..e5f56c953b58 100644
--- a/net/ipv6/anycast.c
+++ b/net/ipv6/anycast.c
@@ -334,9 +334,7 @@ int ipv6_dev_ac_inc(struct net_device *dev, struct in6_addr *addr)
        idev->ac_list = aca;
        write_unlock_bh(&idev->lock);
-        dst_hold(&rt->u.dst);
+        ip6_ins_rt(rt);
-        if (ip6_ins_rt(rt))
-                dst_release(&rt->u.dst);
        addrconf_join_solict(dev, &aca->aca_addr);
@@ -378,10 +376,7 @@ int __ipv6_dev_ac_dec(struct inet6_dev *idev, struct in6_addr *addr)
        addrconf_leave_solict(idev, &aca->aca_addr);
        dst_hold(&aca->aca_rt->u.dst);
-        if (ip6_del_rt(aca->aca_rt))
+        ip6_del_rt(aca->aca_rt);
-                dst_free(&aca->aca_rt->u.dst);
-        else
-                dst_release(&aca->aca_rt->u.dst);
        aca_put(aca);
        return 0;
diff --git a/net/ipv6/esp6.c b/net/ipv6/esp6.c
index 0ec1402320ea..c6bb4c6d24b3 100644
--- a/net/ipv6/esp6.c
+++ b/net/ipv6/esp6.c
@@ -282,7 +282,7 @@ static int esp6_input(struct xfrm_state *x, struct sk_buff *skb)
        struct scatterlist *sg;
        struct scatterlist *asg;
-        if (!pskb_may_pull(skb, sizeof(*esph))) {
+        if (!pskb_may_pull(skb, sizeof(*esph) + crypto_aead_ivsize(aead))) {
                ret = -EINVAL;
                goto out;
        }
diff --git a/net/ipv6/icmp.c b/net/ipv6/icmp.c
index 121d517bf91c..893287ecc628 100644
--- a/net/ipv6/icmp.c
+++ b/net/ipv6/icmp.c
@@ -436,24 +436,26 @@ void icmpv6_send(struct sk_buff *skb, int type, int code, __u32 info,
        }
        if (xfrm_decode_session_reverse(skb, &fl2, AF_INET6))
-                goto out;
+                goto relookup_failed;
        if (ip6_dst_lookup(sk, &dst2, &fl))
-                goto out;
+                goto relookup_failed;
        err = xfrm_lookup(&dst2, &fl, sk, XFRM_LOOKUP_ICMP);
-        if (err == -ENOENT) {
+        switch (err) {
+        case 0:
+                dst_release(dst);
+                dst = dst2;
+                break;
+        case -EPERM:
+                goto out_dst_release;
+        default:
+relookup_failed:
                if (!dst)
                        goto out;
-                goto route_done;
+                break;
        }
-        dst_release(dst);
-        dst = dst2;
-        if (err)
-                goto out;
 route_done:
        if (ipv6_addr_is_multicast(&fl.fl6_dst))
                hlimit = np->mcast_hops;
diff --git a/net/ipv6/ip6_input.c b/net/ipv6/ip6_input.c
index 178aebc0427a..98ab4f459905 100644
--- a/net/ipv6/ip6_input.c
+++ b/net/ipv6/ip6_input.c
@@ -239,8 +239,7 @@ int ip6_mc_input(struct sk_buff *skb)
        IP6_INC_STATS_BH(ip6_dst_idev(skb->dst), IPSTATS_MIB_INMCASTPKTS);
        hdr = ipv6_hdr(skb);
-        deliver = unlikely(skb->dev->flags & (IFF_PROMISC|IFF_ALLMULTI)) ||
+        deliver = ipv6_chk_mcast_addr(skb->dev, &hdr->daddr, NULL);
-            ipv6_chk_mcast_addr(skb->dev, &hdr->daddr, NULL);
        /*
         *      IPv6 multicast router mode isnt currently supported.
diff --git a/net/ipv6/netfilter/ip6_queue.c b/net/ipv6/netfilter/ip6_queue.c
index cc2f9afcf808..8d366f7f2a9a 100644
--- a/net/ipv6/netfilter/ip6_queue.c
+++ b/net/ipv6/netfilter/ip6_queue.c
@@ -591,11 +591,9 @@ static int __init ip6_queue_init(void)
        }
 #ifdef CONFIG_PROC_FS
-        proc = create_proc_entry(IPQ_PROC_FS_NAME, 0, init_net.proc_net);
+        proc = proc_create(IPQ_PROC_FS_NAME, 0, init_net.proc_net,
-        if (proc) {
+                           &ip6_queue_proc_fops);
-                proc->owner = THIS_MODULE;
+        if (!proc) {
-                proc->proc_fops = &ip6_queue_proc_fops;
-        } else {
                printk(KERN_ERR "ip6_queue: failed to create proc entry\n");
                goto cleanup_ipqnl;
        }
diff --git a/net/ipv6/netfilter/nf_conntrack_reasm.c b/net/ipv6/netfilter/nf_conntrack_reasm.c
index 2a0d698b24d5..24c0d03095bf 100644
--- a/net/ipv6/netfilter/nf_conntrack_reasm.c
+++ b/net/ipv6/netfilter/nf_conntrack_reasm.c
@@ -171,7 +171,9 @@ static __inline__ void fq_kill(struct nf_ct_frag6_queue *fq)
 static void nf_ct_frag6_evictor(void)
 {
+        local_bh_disable();
        inet_frag_evictor(&nf_init_frags, &nf_frags);
+        local_bh_enable();
 }
 static void nf_ct_frag6_expire(unsigned long data)
diff --git a/net/llc/af_llc.c b/net/llc/af_llc.c
index 46cf962f7f88..8c50eb430c19 100644
--- a/net/llc/af_llc.c
+++ b/net/llc/af_llc.c
@@ -155,6 +155,9 @@ static int llc_ui_create(struct net *net, struct socket *sock, int protocol)
        struct sock *sk;
        int rc = -ESOCKTNOSUPPORT;
+        if (!capable(CAP_NET_RAW))
+                return -EPERM;
        if (net != &init_net)
                return -EAFNOSUPPORT;
diff --git a/net/llc/llc_c_ac.c b/net/llc/llc_c_ac.c
index 860140caa6e0..71a00225bdb3 100644
--- a/net/llc/llc_c_ac.c
+++ b/net/llc/llc_c_ac.c
@@ -198,7 +198,7 @@ int llc_conn_ac_send_disc_cmd_p_set_x(struct sock *sk, struct sk_buff *skb)
 {
        int rc = -ENOBUFS;
        struct llc_sock *llc = llc_sk(sk);
-        struct sk_buff *nskb = llc_alloc_frame(sk, llc->dev);
+        struct sk_buff *nskb = llc_alloc_frame(sk, llc->dev, LLC_PDU_TYPE_U, 0);
        if (nskb) {
                struct llc_sap *sap = llc->sap;
@@ -223,7 +223,7 @@ int llc_conn_ac_send_dm_rsp_f_set_p(struct sock *sk, struct sk_buff *skb)
 {
        int rc = -ENOBUFS;
        struct llc_sock *llc = llc_sk(sk);
-        struct sk_buff *nskb = llc_alloc_frame(sk, llc->dev);
+        struct sk_buff *nskb = llc_alloc_frame(sk, llc->dev, LLC_PDU_TYPE_U, 0);
        if (nskb) {
                struct llc_sap *sap = llc->sap;
@@ -249,7 +249,7 @@ int llc_conn_ac_send_dm_rsp_f_set_1(struct sock *sk, struct sk_buff *skb)
 {
        int rc = -ENOBUFS;
        struct llc_sock *llc = llc_sk(sk);
-        struct sk_buff *nskb = llc_alloc_frame(sk, llc->dev);
+        struct sk_buff *nskb = llc_alloc_frame(sk, llc->dev, LLC_PDU_TYPE_U, 0);
        if (nskb) {
                struct llc_sap *sap = llc->sap;
@@ -282,7 +282,8 @@ int llc_conn_ac_send_frmr_rsp_f_set_x(struct sock *sk, struct sk_buff *skb)
                llc_pdu_decode_pf_bit(skb, &f_bit);
        else
                f_bit = 0;
-        nskb = llc_alloc_frame(sk, llc->dev);
+        nskb = llc_alloc_frame(sk, llc->dev, LLC_PDU_TYPE_U,
+                               sizeof(struct llc_frmr_info));
        if (nskb) {
                struct llc_sap *sap = llc->sap;
@@ -306,7 +307,8 @@ int llc_conn_ac_resend_frmr_rsp_f_set_0(struct sock *sk, struct sk_buff *skb)
 {
        int rc = -ENOBUFS;
        struct llc_sock *llc = llc_sk(sk);
-        struct sk_buff *nskb = llc_alloc_frame(sk, llc->dev);
+        struct sk_buff *nskb = llc_alloc_frame(sk, llc->dev, LLC_PDU_TYPE_U,
+                                               sizeof(struct llc_frmr_info));
        if (nskb) {
                struct llc_sap *sap = llc->sap;
@@ -336,7 +338,8 @@ int llc_conn_ac_resend_frmr_rsp_f_set_p(struct sock *sk, struct sk_buff *skb)
        struct llc_sock *llc = llc_sk(sk);
        llc_pdu_decode_pf_bit(skb, &f_bit);
-        nskb = llc_alloc_frame(sk, llc->dev);
+        nskb = llc_alloc_frame(sk, llc->dev, LLC_PDU_TYPE_U,
+                               sizeof(struct llc_frmr_info));
        if (nskb) {
                struct llc_sap *sap = llc->sap;
                struct llc_pdu_sn *pdu = llc_pdu_sn_hdr(skb);
@@ -424,7 +427,7 @@ int llc_conn_ac_resend_i_xxx_x_set_0_or_send_rr(struct sock *sk,
        struct llc_pdu_sn *pdu = llc_pdu_sn_hdr(skb);
        int rc = -ENOBUFS;
        struct llc_sock *llc = llc_sk(sk);
-        struct sk_buff *nskb = llc_alloc_frame(sk, llc->dev);
+        struct sk_buff *nskb = llc_alloc_frame(sk, llc->dev, LLC_PDU_TYPE_U, 0);
        if (nskb) {
                struct llc_sap *sap = llc->sap;
@@ -459,7 +462,7 @@ int llc_conn_ac_send_rej_cmd_p_set_1(struct sock *sk, struct sk_buff *skb)
 {
        int rc = -ENOBUFS;
        struct llc_sock *llc = llc_sk(sk);
-        struct sk_buff *nskb = llc_alloc_frame(sk, llc->dev);
+        struct sk_buff *nskb = llc_alloc_frame(sk, llc->dev, LLC_PDU_TYPE_S, 0);
        if (nskb) {
                struct llc_sap *sap = llc->sap;
@@ -483,7 +486,7 @@ int llc_conn_ac_send_rej_rsp_f_set_1(struct sock *sk, struct sk_buff *skb)
 {
        int rc = -ENOBUFS;
        struct llc_sock *llc = llc_sk(sk);
-        struct sk_buff *nskb = llc_alloc_frame(sk, llc->dev);
+        struct sk_buff *nskb = llc_alloc_frame(sk, llc->dev, LLC_PDU_TYPE_S, 0);
        if (nskb) {
                struct llc_sap *sap = llc->sap;
@@ -507,7 +510,7 @@ int llc_conn_ac_send_rej_xxx_x_set_0(struct sock *sk, struct sk_buff *skb)
 {
        int rc = -ENOBUFS;
        struct llc_sock *llc = llc_sk(sk);
-        struct sk_buff *nskb = llc_alloc_frame(sk, llc->dev);
+        struct sk_buff *nskb = llc_alloc_frame(sk, llc->dev, LLC_PDU_TYPE_S, 0);
        if (nskb) {
                struct llc_sap *sap = llc->sap;
@@ -531,7 +534,7 @@ int llc_conn_ac_send_rnr_cmd_p_set_1(struct sock *sk, struct sk_buff *skb)
 {
        int rc = -ENOBUFS;
        struct llc_sock *llc = llc_sk(sk);
-        struct sk_buff *nskb = llc_alloc_frame(sk, llc->dev);
+        struct sk_buff *nskb = llc_alloc_frame(sk, llc->dev, LLC_PDU_TYPE_S, 0);
        if (nskb) {
                struct llc_sap *sap = llc->sap;
@@ -555,7 +558,7 @@ int llc_conn_ac_send_rnr_rsp_f_set_1(struct sock *sk, struct sk_buff *skb)
 {
        int rc = -ENOBUFS;
        struct llc_sock *llc = llc_sk(sk);
-        struct sk_buff *nskb = llc_alloc_frame(sk, llc->dev);
+        struct sk_buff *nskb = llc_alloc_frame(sk, llc->dev, LLC_PDU_TYPE_S, 0);
        if (nskb) {
                struct llc_sap *sap = llc->sap;
@@ -579,7 +582,7 @@ int llc_conn_ac_send_rnr_xxx_x_set_0(struct sock *sk, struct sk_buff *skb)
 {
        int rc = -ENOBUFS;
        struct llc_sock *llc = llc_sk(sk);
-        struct sk_buff *nskb = llc_alloc_frame(sk, llc->dev);
+        struct sk_buff *nskb = llc_alloc_frame(sk, llc->dev, LLC_PDU_TYPE_S, 0);
        if (nskb) {
                struct llc_sap *sap = llc->sap;
@@ -615,7 +618,7 @@ int llc_conn_ac_opt_send_rnr_xxx_x_set_0(struct sock *sk, struct sk_buff *skb)
 {
        int rc = -ENOBUFS;
        struct llc_sock *llc = llc_sk(sk);
-        struct sk_buff *nskb = llc_alloc_frame(sk, llc->dev);
+        struct sk_buff *nskb = llc_alloc_frame(sk, llc->dev, LLC_PDU_TYPE_S, 0);
        if (nskb) {
                struct llc_sap *sap = llc->sap;
@@ -639,7 +642,7 @@ int llc_conn_ac_send_rr_cmd_p_set_1(struct sock *sk, struct sk_buff *skb)
 {
        int rc = -ENOBUFS;
        struct llc_sock *llc = llc_sk(sk);
-        struct sk_buff *nskb = llc_alloc_frame(sk, llc->dev);
+        struct sk_buff *nskb = llc_alloc_frame(sk, llc->dev, LLC_PDU_TYPE_S, 0);
        if (nskb) {
                struct llc_sap *sap = llc->sap;
@@ -663,7 +666,7 @@ int llc_conn_ac_send_rr_rsp_f_set_1(struct sock *sk, struct sk_buff *skb)
 {
        int rc = -ENOBUFS;
        struct llc_sock *llc = llc_sk(sk);
-        struct sk_buff *nskb = llc_alloc_frame(sk, llc->dev);
+        struct sk_buff *nskb = llc_alloc_frame(sk, llc->dev, LLC_PDU_TYPE_S, 0);
        if (nskb) {
                struct llc_sap *sap = llc->sap;
@@ -688,7 +691,7 @@ int llc_conn_ac_send_ack_rsp_f_set_1(struct sock *sk, struct sk_buff *skb)
 {
        int rc = -ENOBUFS;
        struct llc_sock *llc = llc_sk(sk);
-        struct sk_buff *nskb = llc_alloc_frame(sk, llc->dev);
+        struct sk_buff *nskb = llc_alloc_frame(sk, llc->dev, LLC_PDU_TYPE_S, 0);
        if (nskb) {
                struct llc_sap *sap = llc->sap;
@@ -712,7 +715,7 @@ int llc_conn_ac_send_rr_xxx_x_set_0(struct sock *sk, struct sk_buff *skb)
 {
        int rc = -ENOBUFS;
        struct llc_sock *llc = llc_sk(sk);
-        struct sk_buff *nskb = llc_alloc_frame(sk, llc->dev);
+        struct sk_buff *nskb = llc_alloc_frame(sk, llc->dev, LLC_PDU_TYPE_S, 0);
        if (nskb) {
                struct llc_sap *sap = llc->sap;
@@ -736,7 +739,7 @@ int llc_conn_ac_send_ack_xxx_x_set_0(struct sock *sk, struct sk_buff *skb)
 {
        int rc = -ENOBUFS;
        struct llc_sock *llc = llc_sk(sk);
-        struct sk_buff *nskb = llc_alloc_frame(sk, llc->dev);
+        struct sk_buff *nskb = llc_alloc_frame(sk, llc->dev, LLC_PDU_TYPE_S, 0);
        if (nskb) {
                struct llc_sap *sap = llc->sap;
@@ -770,7 +773,7 @@ int llc_conn_ac_send_sabme_cmd_p_set_x(struct sock *sk, struct sk_buff *skb)
 {
        int rc = -ENOBUFS;
        struct llc_sock *llc = llc_sk(sk);
-        struct sk_buff *nskb = llc_alloc_frame(sk, llc->dev);
+        struct sk_buff *nskb = llc_alloc_frame(sk, llc->dev, LLC_PDU_TYPE_U, 0);
        if (nskb) {
                struct llc_sap *sap = llc->sap;
@@ -799,7 +802,7 @@ int llc_conn_ac_send_ua_rsp_f_set_p(struct sock *sk, struct sk_buff *skb)
        u8 f_bit;
        int rc = -ENOBUFS;
        struct llc_sock *llc = llc_sk(sk);
-        struct sk_buff *nskb = llc_alloc_frame(sk, llc->dev);
+        struct sk_buff *nskb = llc_alloc_frame(sk, llc->dev, LLC_PDU_TYPE_U, 0);
        llc_pdu_decode_pf_bit(skb, &f_bit);
        if (nskb) {
@@ -956,7 +959,7 @@ static int llc_conn_ac_send_rr_rsp_f_set_ackpf(struct sock *sk,
 {
        int rc = -ENOBUFS;
        struct llc_sock *llc = llc_sk(sk);
-        struct sk_buff *nskb = llc_alloc_frame(sk, llc->dev);
+        struct sk_buff *nskb = llc_alloc_frame(sk, llc->dev, LLC_PDU_TYPE_S, 0);
        if (nskb) {
                struct llc_sap *sap = llc->sap;
diff --git a/net/llc/llc_core.c b/net/llc/llc_core.c
index 248b5903bb13..50d5b10e23a2 100644
--- a/net/llc/llc_core.c
+++ b/net/llc/llc_core.c
@@ -25,8 +25,6 @@
 LIST_HEAD(llc_sap_list);
 DEFINE_RWLOCK(llc_sap_list_lock);
-unsigned char llc_station_mac_sa[ETH_ALEN];
 /**
 *      llc_sap_alloc - allocates and initializes sap.
 *
@@ -37,8 +35,8 @@ static struct llc_sap *llc_sap_alloc(void)
        struct llc_sap *sap = kzalloc(sizeof(*sap), GFP_ATOMIC);
        if (sap) {
+                /* sap->laddr.mac - leave as a null, it's filled by bind */
                sap->state = LLC_SAP_STATE_ACTIVE;
-                memcpy(sap->laddr.mac, llc_station_mac_sa, ETH_ALEN);
                rwlock_init(&sap->sk_list.lock);
                atomic_set(&sap->refcnt, 1);
        }
@@ -167,10 +165,6 @@ static int __init llc_init(void)
        if (dev != NULL)
                dev = next_net_device(dev);
-        if (dev != NULL)
-                memcpy(llc_station_mac_sa, dev->dev_addr, ETH_ALEN);
-        else
-                memset(llc_station_mac_sa, 0, ETH_ALEN);
        dev_add_pack(&llc_packet_type);
        dev_add_pack(&llc_tr_packet_type);
        return 0;
@@ -185,7 +179,6 @@ static void __exit llc_exit(void)
 module_init(llc_init);
 module_exit(llc_exit);
-EXPORT_SYMBOL(llc_station_mac_sa);
 EXPORT_SYMBOL(llc_sap_list);
 EXPORT_SYMBOL(llc_sap_list_lock);
 EXPORT_SYMBOL(llc_sap_find);
diff --git a/net/llc/llc_input.c b/net/llc/llc_input.c
index c40c9b2a345a..bfd2567dd365 100644
--- a/net/llc/llc_input.c
+++ b/net/llc/llc_input.c
@@ -117,8 +117,12 @@ static inline int llc_fixup_skb(struct sk_buff *skb)
        skb_pull(skb, llc_len);
        if (skb->protocol == htons(ETH_P_802_2)) {
                __be16 pdulen = eth_hdr(skb)->h_proto;
-                u16 data_size = ntohs(pdulen) - llc_len;
+                s32 data_size = ntohs(pdulen) - llc_len;
+                if (data_size < 0 ||
+                    ((skb_tail_pointer(skb) -
+                      (u8 *)pdu) - llc_len) < data_size)
+                        return 0;
                if (unlikely(pskb_trim_rcsum(skb, data_size)))
                        return 0;
        }
diff --git a/net/llc/llc_pdu.c b/net/llc/llc_pdu.c
index fa8324396db3..2e6cb79196bb 100644
--- a/net/llc/llc_pdu.c
+++ b/net/llc/llc_pdu.c
@@ -241,7 +241,7 @@ void llc_pdu_init_as_frmr_rsp(struct sk_buff *skb, struct llc_pdu_sn *prev_pdu,
        FRMR_INFO_SET_PDU_INFO_2LONG_IND(frmr_info, vzyxw);
        FRMR_INFO_SET_PDU_INVALID_Nr_IND(frmr_info, vzyxw);
        FRMR_INFO_SET_PDU_INVALID_Ns_IND(frmr_info, vzyxw);
-        skb_put(skb, 5);
+        skb_put(skb, sizeof(struct llc_frmr_info));
 }
 /**
diff --git a/net/llc/llc_s_ac.c b/net/llc/llc_s_ac.c
index ac3d93b210d2..a94bd56bcac6 100644
--- a/net/llc/llc_s_ac.c
+++ b/net/llc/llc_s_ac.c
@@ -103,7 +103,8 @@ int llc_sap_action_send_xid_r(struct llc_sap *sap, struct sk_buff *skb)
        llc_pdu_decode_sa(skb, mac_da);
        llc_pdu_decode_da(skb, mac_sa);
        llc_pdu_decode_ssap(skb, &dsap);
-        nskb = llc_alloc_frame(NULL, skb->dev);
+        nskb = llc_alloc_frame(NULL, skb->dev, LLC_PDU_TYPE_U,
+                               sizeof(struct llc_xid_info));
        if (!nskb)
                goto out;
        llc_pdu_header_init(nskb, LLC_PDU_TYPE_U, sap->laddr.lsap, dsap,
@@ -144,11 +145,15 @@ int llc_sap_action_send_test_r(struct llc_sap *sap, struct sk_buff *skb)
        u8 mac_da[ETH_ALEN], mac_sa[ETH_ALEN], dsap;
        struct sk_buff *nskb;
        int rc = 1;
+        u32 data_size;
        llc_pdu_decode_sa(skb, mac_da);
        llc_pdu_decode_da(skb, mac_sa);
        llc_pdu_decode_ssap(skb, &dsap);
-        nskb = llc_alloc_frame(NULL, skb->dev);
+        /* The test request command is type U (llc_len = 3) */
+        data_size = ntohs(eth_hdr(skb)->h_proto) - 3;
+        nskb = llc_alloc_frame(NULL, skb->dev, LLC_PDU_TYPE_U, data_size);
        if (!nskb)
                goto out;
        llc_pdu_header_init(nskb, LLC_PDU_TYPE_U, sap->laddr.lsap, dsap,
diff --git a/net/llc/llc_sap.c b/net/llc/llc_sap.c
index 2525165e2e8f..e2ddde755019 100644
--- a/net/llc/llc_sap.c
+++ b/net/llc/llc_sap.c
@@ -24,20 +24,41 @@
 #include <net/tcp_states.h>
 #include <linux/llc.h>
+static int llc_mac_header_len(unsigned short devtype)
+{
+        switch (devtype) {
+        case ARPHRD_ETHER:
+        case ARPHRD_LOOPBACK:
+                return sizeof(struct ethhdr);
+#ifdef CONFIG_TR
+        case ARPHRD_IEEE802_TR:
+                return sizeof(struct trh_hdr);
+#endif
+        }
+        return 0;
+}
 /**
 *      llc_alloc_frame - allocates sk_buff for frame
 *      @dev: network device this skb will be sent over
+ *      @type: pdu type to allocate
+ *      @data_size: data size to allocate
 *
 *      Allocates an sk_buff for frame and initializes sk_buff fields.
 *      Returns allocated skb or %NULL when out of memory.
 */
-struct sk_buff *llc_alloc_frame(struct sock *sk, struct net_device *dev)
+struct sk_buff *llc_alloc_frame(struct sock *sk, struct net_device *dev,
+                                u8 type, u32 data_size)
 {
-        struct sk_buff *skb = alloc_skb(128, GFP_ATOMIC);
+        int hlen = type == LLC_PDU_TYPE_U ? 3 : 4;
+        struct sk_buff *skb;
+        hlen += llc_mac_header_len(dev->type);
+        skb = alloc_skb(hlen + data_size, GFP_ATOMIC);
        if (skb) {
                skb_reset_mac_header(skb);
-                skb_reserve(skb, 50);
+                skb_reserve(skb, hlen);
                skb_reset_network_header(skb);
                skb_reset_transport_header(skb);
                skb->protocol = htons(ETH_P_802_2);
diff --git a/net/llc/llc_station.c b/net/llc/llc_station.c
index 6f2ea2090322..83da13339490 100644
--- a/net/llc/llc_station.c
+++ b/net/llc/llc_station.c
@@ -253,13 +253,14 @@ static int llc_station_ac_inc_xid_r_cnt_by_1(struct sk_buff *skb)
 static int llc_station_ac_send_null_dsap_xid_c(struct sk_buff *skb)
 {
        int rc = 1;
-        struct sk_buff *nskb = llc_alloc_frame(NULL, skb->dev);
+        struct sk_buff *nskb = llc_alloc_frame(NULL, skb->dev, LLC_PDU_TYPE_U,
+                                               sizeof(struct llc_xid_info));
        if (!nskb)
                goto out;
        llc_pdu_header_init(nskb, LLC_PDU_TYPE_U, 0, 0, LLC_PDU_CMD);
        llc_pdu_init_as_xid_cmd(nskb, LLC_XID_NULL_CLASS_2, 127);
-        rc = llc_mac_hdr_init(nskb, llc_station_mac_sa, llc_station_mac_sa);
+        rc = llc_mac_hdr_init(nskb, skb->dev->dev_addr, skb->dev->dev_addr);
        if (unlikely(rc))
                goto free;
        llc_station_send_pdu(nskb);
@@ -274,7 +275,8 @@ static int llc_station_ac_send_xid_r(struct sk_buff *skb)
 {
        u8 mac_da[ETH_ALEN], dsap;
        int rc = 1;
-        struct sk_buff* nskb = llc_alloc_frame(NULL, skb->dev);
+        struct sk_buff *nskb = llc_alloc_frame(NULL, skb->dev, LLC_PDU_TYPE_U,
+                                               sizeof(struct llc_xid_info));
        if (!nskb)
                goto out;
@@ -283,7 +285,7 @@ static int llc_station_ac_send_xid_r(struct sk_buff *skb)
        llc_pdu_decode_ssap(skb, &dsap);
        llc_pdu_header_init(nskb, LLC_PDU_TYPE_U, 0, dsap, LLC_PDU_RSP);
        llc_pdu_init_as_xid_rsp(nskb, LLC_XID_NULL_CLASS_2, 127);
-        rc = llc_mac_hdr_init(nskb, llc_station_mac_sa, mac_da);
+        rc = llc_mac_hdr_init(nskb, skb->dev->dev_addr, mac_da);
        if (unlikely(rc))
                goto free;
        llc_station_send_pdu(nskb);
@@ -298,7 +300,12 @@ static int llc_station_ac_send_test_r(struct sk_buff *skb)
 {
        u8 mac_da[ETH_ALEN], dsap;
        int rc = 1;
-        struct sk_buff *nskb = llc_alloc_frame(NULL, skb->dev);
+        u32 data_size;
+        struct sk_buff *nskb;
+        /* The test request command is type U (llc_len = 3) */
+        data_size = ntohs(eth_hdr(skb)->h_proto) - 3;
+        nskb = llc_alloc_frame(NULL, skb->dev, LLC_PDU_TYPE_U, data_size);
        if (!nskb)
                goto out;
@@ -307,7 +314,7 @@ static int llc_station_ac_send_test_r(struct sk_buff *skb)
        llc_pdu_decode_ssap(skb, &dsap);
        llc_pdu_header_init(nskb, LLC_PDU_TYPE_U, 0, dsap, LLC_PDU_RSP);
        llc_pdu_init_as_test_rsp(nskb, skb);
-        rc = llc_mac_hdr_init(nskb, llc_station_mac_sa, mac_da);
+        rc = llc_mac_hdr_init(nskb, skb->dev->dev_addr, mac_da);
        if (unlikely(rc))
                goto free;
        llc_station_send_pdu(nskb);
diff --git a/net/mac80211/ieee80211.c b/net/mac80211/ieee80211.c
index 28bcdf9fc3df..8e586390a2ef 100644
--- a/net/mac80211/ieee80211.c
+++ b/net/mac80211/ieee80211.c
@@ -286,6 +286,18 @@ static int ieee80211_open(struct net_device *dev)
        if (need_hw_reconfig)
                ieee80211_hw_config(local);
+        /*
+         * ieee80211_sta_work is disabled while network interface
+         * is down. Therefore, some configuration changes may not
+         * yet be effective. Trigger execution of ieee80211_sta_work
+         * to fix this.
+         */
+        if(sdata->vif.type == IEEE80211_IF_TYPE_STA ||
+           sdata->vif.type == IEEE80211_IF_TYPE_IBSS) {
+                struct ieee80211_if_sta *ifsta = &sdata->u.sta;
+                queue_work(local->hw.workqueue, &ifsta->work);
+        }
        netif_start_queue(dev);
        return 0;
diff --git a/net/mac80211/ieee80211_sta.c b/net/mac80211/ieee80211_sta.c
index 9aeed5320228..c1706855460a 100644
--- a/net/mac80211/ieee80211_sta.c
+++ b/net/mac80211/ieee80211_sta.c
@@ -312,14 +312,12 @@ static void ieee80211_sta_wmm_params(struct net_device *dev,
        }
 }
+static u32 ieee80211_handle_protect_preamb(struct ieee80211_sub_if_data *sdata,
-static u32 ieee80211_handle_erp_ie(struct ieee80211_sub_if_data *sdata,
+                                           bool use_protection,
-                                   u8 erp_value)
+                                           bool use_short_preamble)
 {
        struct ieee80211_bss_conf *bss_conf = &sdata->bss_conf;
        struct ieee80211_if_sta *ifsta = &sdata->u.sta;
-        bool use_protection = (erp_value & WLAN_ERP_USE_PROTECTION) != 0;
-        bool preamble_mode = (erp_value & WLAN_ERP_BARKER_PREAMBLE) != 0;
        DECLARE_MAC_BUF(mac);
        u32 changed = 0;
@@ -335,22 +333,47 @@ static u32 ieee80211_handle_erp_ie(struct ieee80211_sub_if_data *sdata,
                changed |= BSS_CHANGED_ERP_CTS_PROT;
        }
-        if (preamble_mode != bss_conf->use_short_preamble) {
+        if (use_short_preamble != bss_conf->use_short_preamble) {
                if (net_ratelimit()) {
                        printk(KERN_DEBUG "%s: switched to %s barker preamble"
                               " (BSSID=%s)\n",
                               sdata->dev->name,
-                               (preamble_mode == WLAN_ERP_PREAMBLE_SHORT) ?
+                               use_short_preamble ? "short" : "long",
-                                        "short" : "long",
                               print_mac(mac, ifsta->bssid));
                }
-                bss_conf->use_short_preamble = preamble_mode;
+                bss_conf->use_short_preamble = use_short_preamble;
                changed |= BSS_CHANGED_ERP_PREAMBLE;
        }
        return changed;
 }
+static u32 ieee80211_handle_erp_ie(struct ieee80211_sub_if_data *sdata,
+                                   u8 erp_value)
+{
+        bool use_protection = (erp_value & WLAN_ERP_USE_PROTECTION) != 0;
+        bool use_short_preamble = (erp_value & WLAN_ERP_BARKER_PREAMBLE) == 0;
+        return ieee80211_handle_protect_preamb(sdata,
+                        use_protection, use_short_preamble);
+}
+static u32 ieee80211_handle_bss_capability(struct ieee80211_sub_if_data *sdata,
+                                           struct ieee80211_sta_bss *bss)
+{
+        u32 changed = 0;
+        if (bss->has_erp_value)
+                changed |= ieee80211_handle_erp_ie(sdata, bss->erp_value);
+        else {
+                u16 capab = bss->capability;
+                changed |= ieee80211_handle_protect_preamb(sdata, false,
+                                (capab & WLAN_CAPABILITY_SHORT_PREAMBLE) != 0);
+        }
+        return changed;
+}
 int ieee80211_ht_cap_ie_to_ht_info(struct ieee80211_ht_cap *ht_cap_ie,
                                   struct ieee80211_ht_info *ht_info)
 {
@@ -469,9 +492,7 @@ static void ieee80211_set_associated(struct net_device *dev,
                                           local->hw.conf.channel,
                                           ifsta->ssid, ifsta->ssid_len);
                if (bss) {
-                        if (bss->has_erp_value)
+                        changed |= ieee80211_handle_bss_capability(sdata, bss);
-                                changed |= ieee80211_handle_erp_ie(
-                                                sdata, bss->erp_value);
                        ieee80211_rx_bss_put(dev, bss);
                }
@@ -2117,6 +2138,11 @@ static void ieee80211_rx_mgmt_beacon(struct net_device *dev,
        if (elems.erp_info && elems.erp_info_len >= 1)
                changed |= ieee80211_handle_erp_ie(sdata, elems.erp_info[0]);
+        else {
+                u16 capab = le16_to_cpu(mgmt->u.beacon.capab_info);
+                changed |= ieee80211_handle_protect_preamb(sdata, false,
+                                (capab & WLAN_CAPABILITY_SHORT_PREAMBLE) != 0);
+        }
        if (elems.ht_cap_elem && elems.ht_info_elem &&
            elems.wmm_param && local->ops->conf_ht &&
diff --git a/net/netfilter/nf_conntrack_standalone.c b/net/netfilter/nf_conntrack_standalone.c
index e88e96af613d..8599068050ec 100644
--- a/net/netfilter/nf_conntrack_standalone.c
+++ b/net/netfilter/nf_conntrack_standalone.c
@@ -395,7 +395,7 @@ EXPORT_SYMBOL_GPL(nf_ct_log_invalid);
 static int __init nf_conntrack_standalone_init(void)
 {
 #ifdef CONFIG_PROC_FS
-        struct proc_dir_entry *proc, *proc_stat;
+        struct proc_dir_entry *proc;
 #endif
        int ret = 0;
@@ -407,12 +407,9 @@ static int __init nf_conntrack_standalone_init(void)
        proc = proc_net_fops_create(&init_net, "nf_conntrack", 0440, &ct_file_ops);
        if (!proc) goto cleanup_init;
-        proc_stat = create_proc_entry("nf_conntrack", S_IRUGO, init_net.proc_net_stat);
+        if (!proc_create("nf_conntrack", S_IRUGO,
-        if (!proc_stat)
+                         init_net.proc_net_stat, &ct_cpu_seq_fops))
                goto cleanup_proc;
-        proc_stat->proc_fops = &ct_cpu_seq_fops;
-        proc_stat->owner = THIS_MODULE;
 #endif
 #ifdef CONFIG_SYSCTL
        nf_ct_sysctl_header = register_sysctl_paths(nf_ct_path,
diff --git a/net/netfilter/nf_log.c b/net/netfilter/nf_log.c
index cec9976aecbf..bc11d7092032 100644
--- a/net/netfilter/nf_log.c
+++ b/net/netfilter/nf_log.c
@@ -168,13 +168,9 @@ static const struct file_operations nflog_file_ops = {
 int __init netfilter_log_init(void)
 {
 #ifdef CONFIG_PROC_FS
-        struct proc_dir_entry *pde;
+        if (!proc_create("nf_log", S_IRUGO,
+                         proc_net_netfilter, &nflog_file_ops))
-        pde = create_proc_entry("nf_log", S_IRUGO, proc_net_netfilter);
-        if (!pde)
                return -1;
-        pde->proc_fops = &nflog_file_ops;
 #endif
        return 0;
 }
diff --git a/net/netfilter/nf_queue.c b/net/netfilter/nf_queue.c
index ddc80ea114cd..bbd26893c0c4 100644
--- a/net/netfilter/nf_queue.c
+++ b/net/netfilter/nf_queue.c
@@ -348,12 +348,9 @@ static const struct file_operations nfqueue_file_ops = {
 int __init netfilter_queue_init(void)
 {
 #ifdef CONFIG_PROC_FS
-        struct proc_dir_entry *pde;
+        if (!proc_create("nf_queue", S_IRUGO,
+                         proc_net_netfilter, &nfqueue_file_ops))
-        pde = create_proc_entry("nf_queue", S_IRUGO, proc_net_netfilter);
-        if (!pde)
                return -1;
-        pde->proc_fops = &nfqueue_file_ops;
 #endif
        return 0;
 }
diff --git a/net/netfilter/nfnetlink_log.c b/net/netfilter/nfnetlink_log.c
index bf3f19b21fe4..b8173af8c24a 100644
--- a/net/netfilter/nfnetlink_log.c
+++ b/net/netfilter/nfnetlink_log.c
@@ -923,9 +923,6 @@ static const struct file_operations nful_file_ops = {
 static int __init nfnetlink_log_init(void)
 {
        int i, status = -ENOMEM;
-#ifdef CONFIG_PROC_FS
-        struct proc_dir_entry *proc_nful;
-#endif
        for (i = 0; i < INSTANCE_BUCKETS; i++)
                INIT_HLIST_HEAD(&instance_table[i]);
@@ -943,11 +940,9 @@ static int __init nfnetlink_log_init(void)
        }
 #ifdef CONFIG_PROC_FS
-        proc_nful = create_proc_entry("nfnetlink_log", 0440,
+        if (!proc_create("nfnetlink_log", 0440,
-                                      proc_net_netfilter);
+                         proc_net_netfilter, &nful_file_ops))
-        if (!proc_nful)
                goto cleanup_subsys;
-        proc_nful->proc_fops = &nful_file_ops;
 #endif
        return status;
diff --git a/net/netfilter/nfnetlink_queue.c b/net/netfilter/nfnetlink_queue.c
index 012cb6910820..10522c04ed24 100644
--- a/net/netfilter/nfnetlink_queue.c
+++ b/net/netfilter/nfnetlink_queue.c
@@ -896,9 +896,6 @@ static const struct file_operations nfqnl_file_ops = {
 static int __init nfnetlink_queue_init(void)
 {
        int i, status = -ENOMEM;
-#ifdef CONFIG_PROC_FS
-        struct proc_dir_entry *proc_nfqueue;
-#endif
        for (i = 0; i < INSTANCE_BUCKETS; i++)
                INIT_HLIST_HEAD(&instance_table[i]);
@@ -911,11 +908,9 @@ static int __init nfnetlink_queue_init(void)
        }
 #ifdef CONFIG_PROC_FS
-        proc_nfqueue = create_proc_entry("nfnetlink_queue", 0440,
+        if (!proc_create("nfnetlink_queue", 0440,
-                                         proc_net_netfilter);
+                         proc_net_netfilter, &nfqnl_file_ops))
-        if (!proc_nfqueue)
                goto cleanup_subsys;
-        proc_nfqueue->proc_fops = &nfqnl_file_ops;
 #endif
        register_netdevice_notifier(&nfqnl_dev_notifier);
diff --git a/net/netfilter/xt_hashlimit.c b/net/netfilter/xt_hashlimit.c
index 5418ce59ac3a..40d344b21453 100644
--- a/net/netfilter/xt_hashlimit.c
+++ b/net/netfilter/xt_hashlimit.c
@@ -237,14 +237,14 @@ static int htable_create_v0(struct xt_hashlimit_info *minfo, int family)
        hinfo->family = family;
        hinfo->rnd_initialized = 0;
        spin_lock_init(&hinfo->lock);
-        hinfo->pde = create_proc_entry(minfo->name, 0,
+        hinfo->pde = proc_create(minfo->name, 0,
-                                       family == AF_INET ? hashlimit_procdir4 :
+                                 family == AF_INET ? hashlimit_procdir4 :
-                                                           hashlimit_procdir6);
+                                                     hashlimit_procdir6,
+                                 &dl_file_ops);
        if (!hinfo->pde) {
                vfree(hinfo);
                return -1;
        }
-        hinfo->pde->proc_fops = &dl_file_ops;
        hinfo->pde->data = hinfo;
        setup_timer(&hinfo->timer, htable_gc, (unsigned long )hinfo);
@@ -301,14 +301,14 @@ static int htable_create(struct xt_hashlimit_mtinfo1 *minfo,
        hinfo->rnd_initialized = 0;
        spin_lock_init(&hinfo->lock);
-        hinfo->pde = create_proc_entry(minfo->name, 0,
+        hinfo->pde = proc_create(minfo->name, 0,
-                                       family == AF_INET ? hashlimit_procdir4 :
+                                 family == AF_INET ? hashlimit_procdir4 :
-                                                           hashlimit_procdir6);
+                                                     hashlimit_procdir6,
+                                 &dl_file_ops);
        if (hinfo->pde == NULL) {
                vfree(hinfo);
                return -1;
        }
-        hinfo->pde->proc_fops = &dl_file_ops;
        hinfo->pde->data = hinfo;
        setup_timer(&hinfo->timer, htable_gc, (unsigned long)hinfo);
@@ -466,38 +466,25 @@ static inline void rateinfo_recalc(struct dsthash_ent *dh, unsigned long now)
 static inline __be32 maskl(__be32 a, unsigned int l)
 {
-        return htonl(ntohl(a) & ~(~(u_int32_t)0 >> l));
+        return l ? htonl(ntohl(a) & ~0 << (32 - l)) : 0;
 }
 #if defined(CONFIG_IP6_NF_IPTABLES) || defined(CONFIG_IP6_NF_IPTABLES_MODULE)
 static void hashlimit_ipv6_mask(__be32 *i, unsigned int p)
 {
        switch (p) {
-        case 0:
+        case 0 ... 31:
-                i[0] = i[1] = 0;
-                i[2] = i[3] = 0;
-                break;
-        case 1 ... 31:
                i[0] = maskl(i[0], p);
                i[1] = i[2] = i[3] = 0;
                break;
-        case 32:
+        case 32 ... 63:
-                i[1] = i[2] = i[3] = 0;
-                break;
-        case 33 ... 63:
                i[1] = maskl(i[1], p - 32);
                i[2] = i[3] = 0;
                break;
-        case 64:
+        case 64 ... 95:
-                i[2] = i[3] = 0;
-                break;
-        case 65 ... 95:
                i[2] = maskl(i[2], p - 64);
                i[3] = 0;
-        case 96:
+        case 96 ... 127:
-                i[3] = 0;
-                break;
-        case 97 ... 127:
                i[3] = maskl(i[3], p - 96);
                break;
        case 128:
diff --git a/net/rose/af_rose.c b/net/rose/af_rose.c
index 4a31a81059ab..063cbc5c26b1 100644
--- a/net/rose/af_rose.c
+++ b/net/rose/af_rose.c
@@ -598,17 +598,24 @@ static int rose_release(struct socket *sock)
        if (sk == NULL) return 0;
+        sock_hold(sk);
+        sock_orphan(sk);
+        lock_sock(sk);
        rose = rose_sk(sk);
        switch (rose->state) {
        case ROSE_STATE_0:
+                release_sock(sk);
                rose_disconnect(sk, 0, -1, -1);
+                lock_sock(sk);
                rose_destroy_socket(sk);
                break;
        case ROSE_STATE_2:
                rose->neighbour->use--;
+                release_sock(sk);
                rose_disconnect(sk, 0, -1, -1);
+                lock_sock(sk);
                rose_destroy_socket(sk);
                break;
@@ -633,6 +640,8 @@ static int rose_release(struct socket *sock)
        }
        sock->sk = NULL;
+        release_sock(sk);
+        sock_put(sk);
        return 0;
 }
diff --git a/net/rxrpc/ar-internal.h b/net/rxrpc/ar-internal.h
index 1aaa2e804b0d..53fe94c9d36b 100644
--- a/net/rxrpc/ar-internal.h
+++ b/net/rxrpc/ar-internal.h
@@ -23,7 +23,7 @@
 struct rxrpc_crypt {
        union {
                u8      x[FCRYPT_BSIZE];
-                u32     n[2];
+                __be32  n[2];
        };
 } __attribute__((aligned(8)));
@@ -611,7 +611,7 @@ extern struct rxrpc_transport *rxrpc_find_transport(struct rxrpc_local *,
 extern unsigned rxrpc_debug;
 #define dbgprintk(FMT,...) \
-        printk("[%x%-6.6s] "FMT"\n", smp_processor_id(), current->comm ,##__VA_ARGS__)
+        printk("[%-6.6s] "FMT"\n", current->comm ,##__VA_ARGS__)
 /* make sure we maintain the format strings, even when debugging is disabled */
 static inline __attribute__((format(printf,1,2)))
diff --git a/net/rxrpc/rxkad.c b/net/rxrpc/rxkad.c
index f48434adb7c2..d1c296f2d617 100644
--- a/net/rxrpc/rxkad.c
+++ b/net/rxrpc/rxkad.c
@@ -261,6 +261,7 @@ static int rxkad_secure_packet(const struct rxrpc_call *call,
                __be32 x[2];
        } tmpbuf __attribute__((aligned(8))); /* must all be in same page */
        __be32 x;
+        u32 y;
        int ret;
        sp = rxrpc_skb(skb);
@@ -292,11 +293,11 @@ static int rxkad_secure_packet(const struct rxrpc_call *call,
        sg_init_one(&sg[1], &tmpbuf, sizeof(tmpbuf));
        crypto_blkcipher_encrypt_iv(&desc, &sg[0], &sg[1], sizeof(tmpbuf));
-        x = ntohl(tmpbuf.x[1]);
+        y = ntohl(tmpbuf.x[1]);
-        x = (x >> 16) & 0xffff;
+        y = (y >> 16) & 0xffff;
-        if (x == 0)
+        if (y == 0)
-                x = 1; /* zero checksums are not permitted */
+                y = 1; /* zero checksums are not permitted */
-        sp->hdr.cksum = htons(x);
+        sp->hdr.cksum = htons(y);
        switch (call->conn->security_level) {
        case RXRPC_SECURITY_PLAIN:
@@ -314,7 +315,7 @@ static int rxkad_secure_packet(const struct rxrpc_call *call,
                break;
        }
-        _leave(" = %d [set %hx]", ret, x);
+        _leave(" = %d [set %hx]", ret, y);
        return ret;
 }
@@ -492,6 +493,7 @@ static int rxkad_verify_packet(const struct rxrpc_call *call,
                __be32 x[2];
        } tmpbuf __attribute__((aligned(8))); /* must all be in same page */
        __be32 x;
+        u16 y;
        __be16 cksum;
        int ret;
@@ -526,12 +528,12 @@ static int rxkad_verify_packet(const struct rxrpc_call *call,
        sg_init_one(&sg[1], &tmpbuf, sizeof(tmpbuf));
        crypto_blkcipher_encrypt_iv(&desc, &sg[0], &sg[1], sizeof(tmpbuf));
-        x = ntohl(tmpbuf.x[1]);
+        y = ntohl(tmpbuf.x[1]);
-        x = (x >> 16) & 0xffff;
+        y = (y >> 16) & 0xffff;
-        if (x == 0)
+        if (y == 0)
-                x = 1; /* zero checksums are not permitted */
+                y = 1; /* zero checksums are not permitted */
-        cksum = htons(x);
+        cksum = htons(y);
        if (sp->hdr.cksum != cksum) {
                *_abort_code = RXKADSEALEDINCON;
                _leave(" = -EPROTO [csum failed]");
@@ -1001,7 +1003,8 @@ static int rxkad_verify_response(struct rxrpc_connection *conn,
        struct rxrpc_crypt session_key;
        time_t expiry;
        void *ticket;
-        u32 abort_code, version, kvno, ticket_len, csum, level;
+        u32 abort_code, version, kvno, ticket_len, level;
+        __be32 csum;
        int ret;
        _enter("{%d,%x}", conn->debug_id, key_serial(conn->server_key));
diff --git a/net/sched/sch_generic.c b/net/sched/sch_generic.c
index 10b5c0887fff..b741618e4d54 100644
--- a/net/sched/sch_generic.c
+++ b/net/sched/sch_generic.c
@@ -184,10 +184,22 @@ static inline int qdisc_restart(struct net_device *dev)
 void __qdisc_run(struct net_device *dev)
 {
-        do {
+        unsigned long start_time = jiffies;
-                if (!qdisc_restart(dev))
+        while (qdisc_restart(dev)) {
+                if (netif_queue_stopped(dev))
+                        break;
+                /*
+                 * Postpone processing if
+                 * 1. another process needs the CPU;
+                 * 2. we've been doing it for too long.
+                 */
+                if (need_resched() || jiffies != start_time) {
+                        netif_schedule(dev);
                        break;
-        } while (!netif_queue_stopped(dev));
+                }
+        }
        clear_bit(__LINK_STATE_QDISC_RUNNING, &dev->state);
 }
diff --git a/net/sunrpc/clnt.c b/net/sunrpc/clnt.c
index 8c6a7f1a25e9..8834d68972cb 100644
--- a/net/sunrpc/clnt.c
+++ b/net/sunrpc/clnt.c
@@ -261,10 +261,6 @@ struct rpc_clnt *rpc_create(struct rpc_create_args *args)
        };
        char servername[48];
-        xprt = xprt_create_transport(&xprtargs);
-        if (IS_ERR(xprt))
-                return (struct rpc_clnt *)xprt;
        /*
         * If the caller chooses not to specify a hostname, whip
         * up a string representation of the passed-in address.
diff --git a/net/sunrpc/xdr.c b/net/sunrpc/xdr.c
index 995c3fdc16c2..79a55d56cc98 100644
--- a/net/sunrpc/xdr.c
+++ b/net/sunrpc/xdr.c
@@ -244,7 +244,7 @@ _copy_to_pages(struct page **pages, size_t pgbase, const char *p, size_t len)
        pgto = pages + (pgbase >> PAGE_CACHE_SHIFT);
        pgbase &= ~PAGE_CACHE_MASK;
-        do {
+        for (;;) {
                copy = PAGE_CACHE_SIZE - pgbase;
                if (copy > len)
                        copy = len;
@@ -253,6 +253,10 @@ _copy_to_pages(struct page **pages, size_t pgbase, const char *p, size_t len)
                memcpy(vto + pgbase, p, copy);
                kunmap_atomic(vto, KM_USER0);
+                len -= copy;
+                if (len == 0)
+                        break;
                pgbase += copy;
                if (pgbase == PAGE_CACHE_SIZE) {
                        flush_dcache_page(*pgto);
@@ -260,8 +264,7 @@ _copy_to_pages(struct page **pages, size_t pgbase, const char *p, size_t len)
                        pgto++;
                }
                p += copy;
+        }
-        } while ((len -= copy) != 0);
        flush_dcache_page(*pgto);
 }
diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
index e3a214f63f91..f68a5c8f2147 100644
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -945,7 +945,7 @@ static int nl80211_new_station(struct sk_buff *skb, struct genl_info *info)
                nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
        params.listen_interval =
                nla_get_u16(info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL]);
-        params.listen_interval = nla_get_u16(info->attrs[NL80211_ATTR_STA_AID]);
+        params.aid = nla_get_u16(info->attrs[NL80211_ATTR_STA_AID]);
        if (parse_station_flags(info->attrs[NL80211_ATTR_STA_FLAGS],
                                &params.station_flags))
diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c
index 5d96f2728dc6..019d21de19b3 100644
--- a/net/xfrm/xfrm_user.c
+++ b/net/xfrm/xfrm_user.c
@@ -288,7 +288,7 @@ static void copy_from_user_state(struct xfrm_state *x, struct xfrm_usersa_info *
        memcpy(&x->props.saddr, &p->saddr, sizeof(x->props.saddr));
        x->props.flags = p->flags;
-        if (x->props.mode == XFRM_MODE_TRANSPORT)
+        if (!x->sel.family)
                x->sel.family = p->family;
 }