19 files changed, 160 insertions, 435 deletions

diff --git a/net/8021q/vlan.c b/net/8021q/vlan.c
index 2a739adaa92b..ab2225da0ee2 100644
--- a/net/8021q/vlan.c
+++ b/net/8021q/vlan.c
@@ -382,6 +382,18 @@ static void vlan_sync_address(struct net_device *dev,
         memcpy(vlan->real_dev_addr, dev->dev_addr, ETH_ALEN);
 }
 
+static void vlan_transfer_features(struct net_device *dev,
+                                   struct net_device *vlandev)
+{
+        unsigned long old_features = vlandev->features;
+
+        vlandev->features &= ~dev->vlan_features;
+        vlandev->features |= dev->features & dev->vlan_features;
+
+        if (old_features != vlandev->features)
+                netdev_features_change(vlandev);
+}
+
 static void __vlan_device_event(struct net_device *dev, unsigned long event)
 {
         switch (event) {
@@ -410,10 +422,8 @@ static int vlan_device_event(struct notifier_block *unused, unsigned long event,
         int i, flgs;
         struct net_device *vlandev;
 
-        if (is_vlan_dev(dev)) {
+        if (is_vlan_dev(dev))
                 __vlan_device_event(dev, event);
-                goto out;
-        }
 
         grp = __vlan_find_group(dev);
         if (!grp)
@@ -450,6 +460,18 @@ static int vlan_device_event(struct notifier_block *unused, unsigned long event,
                 }
                 break;
 
+        case NETDEV_FEAT_CHANGE:
+                /* Propagate device features to underlying device */
+                for (i = 0; i < VLAN_GROUP_ARRAY_LEN; i++) {
+                        vlandev = vlan_group_get_device(grp, i);
+                        if (!vlandev)
+                                continue;
+
+                        vlan_transfer_features(dev, vlandev);
+                }
+
+                break;
+
         case NETDEV_DOWN:
                 /* Put all VLANs for this dev in the down state too.  */
                 for (i = 0; i < VLAN_GROUP_ARRAY_LEN; i++) {
diff --git a/net/8021q/vlan_dev.c b/net/8021q/vlan_dev.c
index c961f0826005..5d055c242ed8 100644
--- a/net/8021q/vlan_dev.c
+++ b/net/8021q/vlan_dev.c
@@ -663,6 +663,8 @@ static int vlan_dev_init(struct net_device *dev)
                                           (1<<__LINK_STATE_DORMANT))) |
                       (1<<__LINK_STATE_PRESENT);
 
+        dev->features |= real_dev->features & real_dev->vlan_features;
+
         /* ipv6 shared card related stuff */
         dev->dev_id = real_dev->dev_id;
 
diff --git a/net/core/dev.c b/net/core/dev.c
index ce88c0d3e354..582963077877 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -3141,7 +3141,7 @@ int dev_change_flags(struct net_device *dev, unsigned flags)
          *      Load in the correct multicast list now the flags have changed.
          */
 
-        if (dev->change_rx_flags && (dev->flags ^ flags) & IFF_MULTICAST)
+        if (dev->change_rx_flags && (old_flags ^ flags) & IFF_MULTICAST)
                 dev->change_rx_flags(dev, IFF_MULTICAST);
 
         dev_set_rx_mode(dev);
diff --git a/net/core/pktgen.c b/net/core/pktgen.c
index 8dca21110493..fdf537707e51 100644
--- a/net/core/pktgen.c
+++ b/net/core/pktgen.c
@@ -390,6 +390,7 @@ struct pktgen_thread {
         int cpu;
 
         wait_queue_head_t queue;
+        struct completion start_done;
 };
 
 #define REMOVE 1
@@ -3414,6 +3415,7 @@ static int pktgen_thread_worker(void *arg)
         BUG_ON(smp_processor_id() != cpu);
 
         init_waitqueue_head(&t->queue);
+        complete(&t->start_done);
 
         pr_debug("pktgen: starting pktgen/%d:  pid=%d\n", cpu, task_pid_nr(current));
 
@@ -3615,6 +3617,7 @@ static int __init pktgen_create_thread(int cpu)
         INIT_LIST_HEAD(&t->if_list);
 
         list_add_tail(&t->th_list, &pktgen_threads);
+        init_completion(&t->start_done);
 
         p = kthread_create(pktgen_thread_worker, t, "kpktgend_%d", cpu);
         if (IS_ERR(p)) {
@@ -3639,6 +3642,7 @@ static int __init pktgen_create_thread(int cpu)
         }
 
         wake_up_process(p);
+        wait_for_completion(&t->start_done);
 
         return 0;
 }
diff --git a/net/ipv4/arp.c b/net/ipv4/arp.c
index 418862f1bf22..9b539fa9fe18 100644
--- a/net/ipv4/arp.c
+++ b/net/ipv4/arp.c
@@ -1288,7 +1288,6 @@ static void arp_format_neigh_entry(struct seq_file *seq,
                                    struct neighbour *n)
 {
         char hbuffer[HBUFFERLEN];
-        const char hexbuf[] = "0123456789ABCDEF";
         int k, j;
         char tbuf[16];
         struct net_device *dev = n->dev;
@@ -1302,8 +1301,8 @@ static void arp_format_neigh_entry(struct seq_file *seq,
         else {
 #endif
         for (k = 0, j = 0; k < HBUFFERLEN - 3 && j < dev->addr_len; j++) {
-                hbuffer[k++] = hexbuf[(n->ha[j] >> 4) & 15];
-                hbuffer[k++] = hexbuf[n->ha[j] & 15];
+                hbuffer[k++] = hex_asc_hi(n->ha[j]);
+                hbuffer[k++] = hex_asc_lo(n->ha[j]);
                 hbuffer[k++] = ':';
         }
         hbuffer[--k] = 0;
diff --git a/net/ipv4/ip_gre.c b/net/ipv4/ip_gre.c
index eede36e55702..2a61158ea722 100644
--- a/net/ipv4/ip_gre.c
+++ b/net/ipv4/ip_gre.c
@@ -313,9 +313,8 @@ static void ipgre_tunnel_uninit(struct net_device *dev)
 
 static void ipgre_err(struct sk_buff *skb, u32 info)
 {
-#ifndef I_WISH_WORLD_WERE_PERFECT
 
-/* It is not :-( All the routers (except for Linux) return only
+/* All the routers (except for Linux) return only
    8 bytes of packet payload. It means, that precise relaying of
    ICMP in the real Internet is absolutely infeasible.
 
@@ -398,149 +397,6 @@ static void ipgre_err(struct sk_buff *skb, u32 info)
 out:
         read_unlock(&ipgre_lock);
         return;
-#else
-        struct iphdr *iph = (struct iphdr*)dp;
-        struct iphdr *eiph;
-        __be16       *p = (__be16*)(dp+(iph->ihl<<2));
-        const int type = icmp_hdr(skb)->type;
-        const int code = icmp_hdr(skb)->code;
-        int rel_type = 0;
-        int rel_code = 0;
-        __be32 rel_info = 0;
-        __u32 n = 0;
-        __be16 flags;
-        int grehlen = (iph->ihl<<2) + 4;
-        struct sk_buff *skb2;
-        struct flowi fl;
-        struct rtable *rt;
-
-        if (p[1] != htons(ETH_P_IP))
-                return;
-
-        flags = p[0];
-        if (flags&(GRE_CSUM|GRE_KEY|GRE_SEQ|GRE_ROUTING|GRE_VERSION)) {
-                if (flags&(GRE_VERSION|GRE_ROUTING))
-                        return;
-                if (flags&GRE_CSUM)
-                        grehlen += 4;
-                if (flags&GRE_KEY)
-                        grehlen += 4;
-                if (flags&GRE_SEQ)
-                        grehlen += 4;
-        }
-        if (len < grehlen + sizeof(struct iphdr))
-                return;
-        eiph = (struct iphdr*)(dp + grehlen);
-
-        switch (type) {
-        default:
-                return;
-        case ICMP_PARAMETERPROB:
-                n = ntohl(icmp_hdr(skb)->un.gateway) >> 24;
-                if (n < (iph->ihl<<2))
-                        return;
-
-                /* So... This guy found something strange INSIDE encapsulated
-                   packet. Well, he is fool, but what can we do ?
-                 */
-                rel_type = ICMP_PARAMETERPROB;
-                n -= grehlen;
-                rel_info = htonl(n << 24);
-                break;
-
-        case ICMP_DEST_UNREACH:
-                switch (code) {
-                case ICMP_SR_FAILED:
-                case ICMP_PORT_UNREACH:
-                        /* Impossible event. */
-                        return;
-                case ICMP_FRAG_NEEDED:
-                        /* And it is the only really necessary thing :-) */
-                        n = ntohs(icmp_hdr(skb)->un.frag.mtu);
-                        if (n < grehlen+68)
-                                return;
-                        n -= grehlen;
-                        /* BSD 4.2 MORE DOES NOT EXIST IN NATURE. */
-                        if (n > ntohs(eiph->tot_len))
-                                return;
-                        rel_info = htonl(n);
-                        break;
-                default:
-                        /* All others are translated to HOST_UNREACH.
-                           rfc2003 contains "deep thoughts" about NET_UNREACH,
-                           I believe, it is just ether pollution. --ANK
-                         */
-                        rel_type = ICMP_DEST_UNREACH;
-                        rel_code = ICMP_HOST_UNREACH;
-                        break;
-                }
-                break;
-        case ICMP_TIME_EXCEEDED:
-                if (code != ICMP_EXC_TTL)
-                        return;
-                break;
-        }
-
-        /* Prepare fake skb to feed it to icmp_send */
-        skb2 = skb_clone(skb, GFP_ATOMIC);
-        if (skb2 == NULL)
-                return;
-        dst_release(skb2->dst);
-        skb2->dst = NULL;
-        skb_pull(skb2, skb->data - (u8*)eiph);
-        skb_reset_network_header(skb2);
-
-        /* Try to guess incoming interface */
-        memset(&fl, 0, sizeof(fl));
-        fl.fl4_dst = eiph->saddr;
-        fl.fl4_tos = RT_TOS(eiph->tos);
-        fl.proto = IPPROTO_GRE;
-        if (ip_route_output_key(dev_net(skb->dev), &rt, &fl)) {
-                kfree_skb(skb2);
-                return;
-        }
-        skb2->dev = rt->u.dst.dev;
-
-        /* route "incoming" packet */
-        if (rt->rt_flags&RTCF_LOCAL) {
-                ip_rt_put(rt);
-                rt = NULL;
-                fl.fl4_dst = eiph->daddr;
-                fl.fl4_src = eiph->saddr;
-                fl.fl4_tos = eiph->tos;
-                if (ip_route_output_key(dev_net(skb->dev), &rt, &fl) ||
-                    rt->u.dst.dev->type != ARPHRD_IPGRE) {
-                        ip_rt_put(rt);
-                        kfree_skb(skb2);
-                        return;
-                }
-        } else {
-                ip_rt_put(rt);
-                if (ip_route_input(skb2, eiph->daddr, eiph->saddr, eiph->tos, skb2->dev) ||
-                    skb2->dst->dev->type != ARPHRD_IPGRE) {
-                        kfree_skb(skb2);
-                        return;
-                }
-        }
-
-        /* change mtu on this route */
-        if (type == ICMP_DEST_UNREACH && code == ICMP_FRAG_NEEDED) {
-                if (n > dst_mtu(skb2->dst)) {
-                        kfree_skb(skb2);
-                        return;
-                }
-                skb2->dst->ops->update_pmtu(skb2->dst, n);
-        } else if (type == ICMP_TIME_EXCEEDED) {
-                struct ip_tunnel *t = netdev_priv(skb2->dev);
-                if (t->parms.iph.ttl) {
-                        rel_type = ICMP_DEST_UNREACH;
-                        rel_code = ICMP_HOST_UNREACH;
-                }
-        }
-
-        icmp_send(skb2, rel_type, rel_code, rel_info);
-        kfree_skb(skb2);
-#endif
 }
 
 static inline void ipgre_ecn_decapsulate(struct iphdr *iph, struct sk_buff *skb)
diff --git a/net/ipv4/ipip.c b/net/ipv4/ipip.c
index 26c85c23ca4f..86d8836551b9 100644
--- a/net/ipv4/ipip.c
+++ b/net/ipv4/ipip.c
@@ -278,9 +278,8 @@ static void ipip_tunnel_uninit(struct net_device *dev)
 
 static int ipip_err(struct sk_buff *skb, u32 info)
 {
-#ifndef I_WISH_WORLD_WERE_PERFECT
 
-/* It is not :-( All the routers (except for Linux) return only
+/* All the routers (except for Linux) return only
    8 bytes of packet payload. It means, that precise relaying of
    ICMP in the real Internet is absolutely infeasible.
  */
@@ -337,133 +336,6 @@ static int ipip_err(struct sk_buff *skb, u32 info)
 out:
         read_unlock(&ipip_lock);
         return err;
-#else
-        struct iphdr *iph = (struct iphdr*)dp;
-        int hlen = iph->ihl<<2;
-        struct iphdr *eiph;
-        const int type = icmp_hdr(skb)->type;
-        const int code = icmp_hdr(skb)->code;
-        int rel_type = 0;
-        int rel_code = 0;
-        __be32 rel_info = 0;
-        __u32 n = 0;
-        struct sk_buff *skb2;
-        struct flowi fl;
-        struct rtable *rt;
-
-        if (len < hlen + sizeof(struct iphdr))
-                return 0;
-        eiph = (struct iphdr*)(dp + hlen);
-
-        switch (type) {
-        default:
-                return 0;
-        case ICMP_PARAMETERPROB:
-                n = ntohl(icmp_hdr(skb)->un.gateway) >> 24;
-                if (n < hlen)
-                        return 0;
-
-                /* So... This guy found something strange INSIDE encapsulated
-                   packet. Well, he is fool, but what can we do ?
-                 */
-                rel_type = ICMP_PARAMETERPROB;
-                rel_info = htonl((n - hlen) << 24);
-                break;
-
-        case ICMP_DEST_UNREACH:
-                switch (code) {
-                case ICMP_SR_FAILED:
-                case ICMP_PORT_UNREACH:
-                        /* Impossible event. */
-                        return 0;
-                case ICMP_FRAG_NEEDED:
-                        /* And it is the only really necessary thing :-) */
-                        n = ntohs(icmp_hdr(skb)->un.frag.mtu);
-                        if (n < hlen+68)
-                                return 0;
-                        n -= hlen;
-                        /* BSD 4.2 MORE DOES NOT EXIST IN NATURE. */
-                        if (n > ntohs(eiph->tot_len))
-                                return 0;
-                        rel_info = htonl(n);
-                        break;
-                default:
-                        /* All others are translated to HOST_UNREACH.
-                           rfc2003 contains "deep thoughts" about NET_UNREACH,
-                           I believe, it is just ether pollution. --ANK
-                         */
-                        rel_type = ICMP_DEST_UNREACH;
-                        rel_code = ICMP_HOST_UNREACH;
-                        break;
-                }
-                break;
-        case ICMP_TIME_EXCEEDED:
-                if (code != ICMP_EXC_TTL)
-                        return 0;
-                break;
-        }
-
-        /* Prepare fake skb to feed it to icmp_send */
-        skb2 = skb_clone(skb, GFP_ATOMIC);
-        if (skb2 == NULL)
-                return 0;
-        dst_release(skb2->dst);
-        skb2->dst = NULL;
-        skb_pull(skb2, skb->data - (u8*)eiph);
-        skb_reset_network_header(skb2);
-
-        /* Try to guess incoming interface */
-        memset(&fl, 0, sizeof(fl));
-        fl.fl4_daddr = eiph->saddr;
-        fl.fl4_tos = RT_TOS(eiph->tos);
-        fl.proto = IPPROTO_IPIP;
-        if (ip_route_output_key(dev_net(skb->dev), &rt, &key)) {
-                kfree_skb(skb2);
-                return 0;
-        }
-        skb2->dev = rt->u.dst.dev;
-
-        /* route "incoming" packet */
-        if (rt->rt_flags&RTCF_LOCAL) {
-                ip_rt_put(rt);
-                rt = NULL;
-                fl.fl4_daddr = eiph->daddr;
-                fl.fl4_src = eiph->saddr;
-                fl.fl4_tos = eiph->tos;
-                if (ip_route_output_key(dev_net(skb->dev), &rt, &fl) ||
-                    rt->u.dst.dev->type != ARPHRD_TUNNEL) {
-                        ip_rt_put(rt);
-                        kfree_skb(skb2);
-                        return 0;
-                }
-        } else {
-                ip_rt_put(rt);
-                if (ip_route_input(skb2, eiph->daddr, eiph->saddr, eiph->tos, skb2->dev) ||
-                    skb2->dst->dev->type != ARPHRD_TUNNEL) {
-                        kfree_skb(skb2);
-                        return 0;
-                }
-        }
-
-        /* change mtu on this route */
-        if (type == ICMP_DEST_UNREACH && code == ICMP_FRAG_NEEDED) {
-                if (n > dst_mtu(skb2->dst)) {
-                        kfree_skb(skb2);
-                        return 0;
-                }
-                skb2->dst->ops->update_pmtu(skb2->dst, n);
-        } else if (type == ICMP_TIME_EXCEEDED) {
-                struct ip_tunnel *t = netdev_priv(skb2->dev);
-                if (t->parms.iph.ttl) {
-                        rel_type = ICMP_DEST_UNREACH;
-                        rel_code = ICMP_HOST_UNREACH;
-                }
-        }
-
-        icmp_send(skb2, rel_type, rel_code, rel_info);
-        kfree_skb(skb2);
-        return 0;
-#endif
 }
 
 static inline void ipip_ecn_decapsulate(const struct iphdr *outer_iph,
diff --git a/net/ipv4/route.c b/net/ipv4/route.c
index 92f90ae46f4a..df41026b60db 100644
--- a/net/ipv4/route.c
+++ b/net/ipv4/route.c
@@ -160,7 +160,7 @@ static struct dst_ops ipv4_dst_ops = {
         .negative_advice =      ipv4_negative_advice,
         .link_failure =         ipv4_link_failure,
         .update_pmtu =          ip_rt_update_pmtu,
-        .local_out =            ip_local_out,
+        .local_out =            __ip_local_out,
         .entry_size =           sizeof(struct rtable),
         .entries =              ATOMIC_INIT(0),
 };
diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
index debf23581606..e399bde7813a 100644
--- a/net/ipv4/tcp_output.c
+++ b/net/ipv4/tcp_output.c
@@ -1836,7 +1836,7 @@ int tcp_retransmit_skb(struct sock *sk, struct sk_buff *skb)
 {
         struct tcp_sock *tp = tcp_sk(sk);
         struct inet_connection_sock *icsk = inet_csk(sk);
-        unsigned int cur_mss = tcp_current_mss(sk, 0);
+        unsigned int cur_mss;
         int err;
 
         /* Inconslusive MTU probe */
@@ -1858,6 +1858,11 @@ int tcp_retransmit_skb(struct sock *sk, struct sk_buff *skb)
                         return -ENOMEM;
         }
 
+        if (inet_csk(sk)->icsk_af_ops->rebuild_header(sk))
+                return -EHOSTUNREACH; /* Routing failure or similar. */
+
+        cur_mss = tcp_current_mss(sk, 0);
+
         /* If receiver has shrunk his window, and skb is out of
          * new window, do not retransmit it. The exception is the
          * case, when window is shrunk to zero. In this case
@@ -1884,9 +1889,6 @@ int tcp_retransmit_skb(struct sock *sk, struct sk_buff *skb)
             (sysctl_tcp_retrans_collapse != 0))
                 tcp_retrans_try_collapse(sk, skb, cur_mss);
 
-        if (inet_csk(sk)->icsk_af_ops->rebuild_header(sk))
-                return -EHOSTUNREACH; /* Routing failure or similar. */
-
         /* Some Solaris stacks overoptimize and ignore the FIN on a
          * retransmit when old data is attached.  So strip it off
          * since it is cheap to do so and saves bytes on the network.
diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index e591e09e5e4e..3a835578fd1c 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -1764,14 +1764,16 @@ void addrconf_prefix_rcv(struct net_device *dev, u8 *opt, int len)
          *      2) Configure prefixes with the auto flag set
          */
 
-        /* Avoid arithmetic overflow. Really, we could
-           save rt_expires in seconds, likely valid_lft,
-           but it would require division in fib gc, that it
-           not good.
-         */
-        if (valid_lft >= 0x7FFFFFFF/HZ)
+        if (valid_lft == INFINITY_LIFE_TIME)
+                rt_expires = ~0UL;
+        else if (valid_lft >= 0x7FFFFFFF/HZ) {
+                /* Avoid arithmetic overflow. Really, we could
+                 * save rt_expires in seconds, likely valid_lft,
+                 * but it would require division in fib gc, that it
+                 * not good.
+                 */
                 rt_expires = 0x7FFFFFFF - (0x7FFFFFFF % HZ);
-        else
+        } else
                 rt_expires = valid_lft * HZ;
 
         /*
@@ -1779,7 +1781,7 @@ void addrconf_prefix_rcv(struct net_device *dev, u8 *opt, int len)
          * Avoid arithmetic overflow there as well.
          * Overflow can happen only if HZ < USER_HZ.
          */
-        if (HZ < USER_HZ && rt_expires > 0x7FFFFFFF / USER_HZ)
+        if (HZ < USER_HZ && ~rt_expires && rt_expires > 0x7FFFFFFF / USER_HZ)
                 rt_expires = 0x7FFFFFFF / USER_HZ;
 
         if (pinfo->onlink) {
@@ -1788,17 +1790,28 @@ void addrconf_prefix_rcv(struct net_device *dev, u8 *opt, int len)
                                 dev->ifindex, 1);
 
                 if (rt && ((rt->rt6i_flags & (RTF_GATEWAY | RTF_DEFAULT)) == 0)) {
-                        if (rt->rt6i_flags&RTF_EXPIRES) {
-                                if (valid_lft == 0) {
-                                        ip6_del_rt(rt);
-                                        rt = NULL;
-                                } else {
-                                        rt->rt6i_expires = jiffies + rt_expires;
-                                }
+                        /* Autoconf prefix route */
+                        if (valid_lft == 0) {
+                                ip6_del_rt(rt);
+                                rt = NULL;
+                        } else if (~rt_expires) {
+                                /* not infinity */
+                                rt->rt6i_expires = jiffies + rt_expires;
+                                rt->rt6i_flags |= RTF_EXPIRES;
+                        } else {
+                                rt->rt6i_flags &= ~RTF_EXPIRES;
+                                rt->rt6i_expires = 0;
                         }
                 } else if (valid_lft) {
+                        int flags = RTF_ADDRCONF | RTF_PREFIX_RT;
+                        clock_t expires = 0;
+                        if (~rt_expires) {
+                                /* not infinity */
+                                flags |= RTF_EXPIRES;
+                                expires = jiffies_to_clock_t(rt_expires);
+                        }
                         addrconf_prefix_route(&pinfo->prefix, pinfo->prefix_len,
-                                              dev, jiffies_to_clock_t(rt_expires), RTF_ADDRCONF|RTF_EXPIRES|RTF_PREFIX_RT);
+                                              dev, expires, flags);
                 }
                 if (rt)
                         dst_release(&rt->u.dst);
@@ -2021,7 +2034,8 @@ static int inet6_addr_add(struct net *net, int ifindex, struct in6_addr *pfx,
         struct inet6_dev *idev;
         struct net_device *dev;
         int scope;
-        u32 flags = RTF_EXPIRES;
+        u32 flags;
+        clock_t expires;
 
         ASSERT_RTNL();
 
@@ -2041,8 +2055,13 @@ static int inet6_addr_add(struct net *net, int ifindex, struct in6_addr *pfx,
         if (valid_lft == INFINITY_LIFE_TIME) {
                 ifa_flags |= IFA_F_PERMANENT;
                 flags = 0;
-        } else if (valid_lft >= 0x7FFFFFFF/HZ)
-                valid_lft = 0x7FFFFFFF/HZ;
+                expires = 0;
+        } else {
+                if (valid_lft >= 0x7FFFFFFF/HZ)
+                        valid_lft = 0x7FFFFFFF/HZ;
+                flags = RTF_EXPIRES;
+                expires = jiffies_to_clock_t(valid_lft * HZ);
+        }
 
         if (prefered_lft == 0)
                 ifa_flags |= IFA_F_DEPRECATED;
@@ -2060,7 +2079,7 @@ static int inet6_addr_add(struct net *net, int ifindex, struct in6_addr *pfx,
                 spin_unlock_bh(&ifp->lock);
 
                 addrconf_prefix_route(&ifp->addr, ifp->prefix_len, dev,
-                                      jiffies_to_clock_t(valid_lft * HZ), flags);
+                                      expires, flags);
                 /*
                  * Note that section 3.1 of RFC 4429 indicates
                  * that the Optimistic flag should not be set for
@@ -3148,7 +3167,8 @@ inet6_rtm_deladdr(struct sk_buff *skb, struct nlmsghdr *nlh, void *arg)
 static int inet6_addr_modify(struct inet6_ifaddr *ifp, u8 ifa_flags,
                              u32 prefered_lft, u32 valid_lft)
 {
-        u32 flags = RTF_EXPIRES;
+        u32 flags;
+        clock_t expires;
 
         if (!valid_lft || (prefered_lft > valid_lft))
                 return -EINVAL;
@@ -3156,8 +3176,13 @@ static int inet6_addr_modify(struct inet6_ifaddr *ifp, u8 ifa_flags,
         if (valid_lft == INFINITY_LIFE_TIME) {
                 ifa_flags |= IFA_F_PERMANENT;
                 flags = 0;
-        } else if (valid_lft >= 0x7FFFFFFF/HZ)
-                valid_lft = 0x7FFFFFFF/HZ;
+                expires = 0;
+        } else {
+                if (valid_lft >= 0x7FFFFFFF/HZ)
+                        valid_lft = 0x7FFFFFFF/HZ;
+                flags = RTF_EXPIRES;
+                expires = jiffies_to_clock_t(valid_lft * HZ);
+        }
 
         if (prefered_lft == 0)
                 ifa_flags |= IFA_F_DEPRECATED;
@@ -3176,7 +3201,7 @@ static int inet6_addr_modify(struct inet6_ifaddr *ifp, u8 ifa_flags,
                 ipv6_ifa_notify(0, ifp);
 
         addrconf_prefix_route(&ifp->addr, ifp->prefix_len, ifp->idev->dev,
-                              jiffies_to_clock_t(valid_lft * HZ), flags);
+                              expires, flags);
         addrconf_verify(0);
 
         return 0;
@@ -4242,7 +4267,7 @@ static void addrconf_sysctl_register(struct inet6_dev *idev)
         neigh_sysctl_register(idev->dev, idev->nd_parms, NET_IPV6,
                               NET_IPV6_NEIGH, "ipv6",
                               &ndisc_ifinfo_sysctl_change,
-                              NULL);
+                              ndisc_ifinfo_sysctl_strategy);
         __addrconf_sysctl_register(dev_net(idev->dev), idev->dev->name,
                         idev->dev->ifindex, idev, &idev->cnf);
 }
diff --git a/net/ipv6/ndisc.c b/net/ipv6/ndisc.c
index a55fc05b8125..282fdb31f8ed 100644
--- a/net/ipv6/ndisc.c
+++ b/net/ipv6/ndisc.c
@@ -1727,10 +1727,10 @@ int ndisc_ifinfo_sysctl_change(struct ctl_table *ctl, int write, struct file * f
         return ret;
 }
 
-static int ndisc_ifinfo_sysctl_strategy(ctl_table *ctl, int __user *name,
-                                        int nlen, void __user *oldval,
-                                        size_t __user *oldlenp,
-                                        void __user *newval, size_t newlen)
+int ndisc_ifinfo_sysctl_strategy(ctl_table *ctl, int __user *name,
+                                 int nlen, void __user *oldval,
+                                 size_t __user *oldlenp,
+                                 void __user *newval, size_t newlen)
 {
         struct net_device *dev = ctl->extra1;
         struct inet6_dev *idev;
diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index 12bba0880345..48534c6c0735 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -109,7 +109,7 @@ static struct dst_ops ip6_dst_ops_template = {
         .negative_advice        =       ip6_negative_advice,
         .link_failure           =       ip6_link_failure,
         .update_pmtu            =       ip6_rt_update_pmtu,
-        .local_out              =       ip6_local_out,
+        .local_out              =       __ip6_local_out,
         .entry_size             =       sizeof(struct rt6_info),
         .entries                =       ATOMIC_INIT(0),
 };
@@ -475,7 +475,7 @@ int rt6_route_rcv(struct net_device *dev, u8 *opt, int len,
         lifetime = ntohl(rinfo->lifetime);
         if (lifetime == 0xffffffff) {
                 /* infinity */
-        } else if (lifetime > 0x7fffffff/HZ) {
+        } else if (lifetime > 0x7fffffff/HZ - 1) {
                 /* Avoid arithmetic overflow */
                 lifetime = 0x7fffffff/HZ - 1;
         }
@@ -1106,7 +1106,9 @@ int ip6_route_add(struct fib6_config *cfg)
         }
 
         rt->u.dst.obsolete = -1;
-        rt->rt6i_expires = jiffies + clock_t_to_jiffies(cfg->fc_expires);
+        rt->rt6i_expires = (cfg->fc_flags & RTF_EXPIRES) ?
+                                jiffies + clock_t_to_jiffies(cfg->fc_expires) :
+                                0;
 
         if (cfg->fc_protocol == RTPROT_UNSPEC)
                 cfg->fc_protocol = RTPROT_BOOT;
@@ -2200,7 +2202,9 @@ static int rt6_fill_node(struct sk_buff *skb, struct rt6_info *rt,
 
         NLA_PUT_U32(skb, RTA_PRIORITY, rt->rt6i_metric);
 
-        expires = rt->rt6i_expires ? rt->rt6i_expires - jiffies : 0;
+        expires = (rt->rt6i_flags & RTF_EXPIRES) ?
+                        rt->rt6i_expires - jiffies : 0;
+
         if (rtnl_put_cacheinfo(skb, &rt->u.dst, 0, 0, 0,
                                expires, rt->u.dst.error) < 0)
                 goto nla_put_failure;
diff --git a/net/ipv6/sit.c b/net/ipv6/sit.c
index b0ee96187633..6b8f0583b637 100644
--- a/net/ipv6/sit.c
+++ b/net/ipv6/sit.c
@@ -403,9 +403,8 @@ static void ipip6_tunnel_uninit(struct net_device *dev)
 
 static int ipip6_err(struct sk_buff *skb, u32 info)
 {
-#ifndef I_WISH_WORLD_WERE_PERFECT
 
-/* It is not :-( All the routers (except for Linux) return only
+/* All the routers (except for Linux) return only
    8 bytes of packet payload. It means, that precise relaying of
    ICMP in the real Internet is absolutely infeasible.
  */
@@ -462,92 +461,6 @@ static int ipip6_err(struct sk_buff *skb, u32 info)
 out:
         read_unlock(&ipip6_lock);
         return err;
-#else
-        struct iphdr *iph = (struct iphdr*)dp;
-        int hlen = iph->ihl<<2;
-        struct ipv6hdr *iph6;
-        const int type = icmp_hdr(skb)->type;
-        const int code = icmp_hdr(skb)->code;
-        int rel_type = 0;
-        int rel_code = 0;
-        int rel_info = 0;
-        struct sk_buff *skb2;
-        struct rt6_info *rt6i;
-
-        if (len < hlen + sizeof(struct ipv6hdr))
-                return;
-        iph6 = (struct ipv6hdr*)(dp + hlen);
-
-        switch (type) {
-        default:
-                return;
-        case ICMP_PARAMETERPROB:
-                if (icmp_hdr(skb)->un.gateway < hlen)
-                        return;
-
-                /* So... This guy found something strange INSIDE encapsulated
-                   packet. Well, he is fool, but what can we do ?
-                 */
-                rel_type = ICMPV6_PARAMPROB;
-                rel_info = icmp_hdr(skb)->un.gateway - hlen;
-                break;
-
-        case ICMP_DEST_UNREACH:
-                switch (code) {
-                case ICMP_SR_FAILED:
-                case ICMP_PORT_UNREACH:
-                        /* Impossible event. */
-                        return;
-                case ICMP_FRAG_NEEDED:
-                        /* Too complicated case ... */
-                        return;
-                default:
-                        /* All others are translated to HOST_UNREACH.
-                           rfc2003 contains "deep thoughts" about NET_UNREACH,
-                           I believe, it is just ether pollution. --ANK
-                         */
-                        rel_type = ICMPV6_DEST_UNREACH;
-                        rel_code = ICMPV6_ADDR_UNREACH;
-                        break;
-                }
-                break;
-        case ICMP_TIME_EXCEEDED:
-                if (code != ICMP_EXC_TTL)
-                        return;
-                rel_type = ICMPV6_TIME_EXCEED;
-                rel_code = ICMPV6_EXC_HOPLIMIT;
-                break;
-        }
-
-        /* Prepare fake skb to feed it to icmpv6_send */
-        skb2 = skb_clone(skb, GFP_ATOMIC);
-        if (skb2 == NULL)
-                return 0;
-        dst_release(skb2->dst);
-        skb2->dst = NULL;
-        skb_pull(skb2, skb->data - (u8*)iph6);
-        skb_reset_network_header(skb2);
-
-        /* Try to guess incoming interface */
-        rt6i = rt6_lookup(dev_net(skb->dev), &iph6->saddr, NULL, NULL, 0);
-        if (rt6i && rt6i->rt6i_dev) {
-                skb2->dev = rt6i->rt6i_dev;
-
-                rt6i = rt6_lookup(dev_net(skb->dev),
-                                &iph6->daddr, &iph6->saddr, NULL, 0);
-
-                if (rt6i && rt6i->rt6i_dev && rt6i->rt6i_dev->type == ARPHRD_SIT) {
-                        struct ip_tunnel *t = netdev_priv(rt6i->rt6i_dev);
-                        if (rel_type == ICMPV6_TIME_EXCEED && t->parms.iph.ttl) {
-                                rel_type = ICMPV6_DEST_UNREACH;
-                                rel_code = ICMPV6_ADDR_UNREACH;
-                        }
-                        icmpv6_send(skb2, rel_type, rel_code, rel_info, skb2->dev);
-                }
-        }
-        kfree_skb(skb2);
-        return 0;
-#endif
 }
 
 static inline void ipip6_ecn_decapsulate(struct iphdr *iph, struct sk_buff *skb)
diff --git a/net/key/af_key.c b/net/key/af_key.c
index 9e7236ff6bcc..9bba7ac5fee0 100644
--- a/net/key/af_key.c
+++ b/net/key/af_key.c
@@ -1251,7 +1251,7 @@ static struct xfrm_state * pfkey_msg2xfrm_state(struct sadb_msg *hdr,
                 x->sel.prefixlen_s = addr->sadb_address_prefixlen;
         }
 
-        if (x->props.mode == XFRM_MODE_TRANSPORT)
+        if (!x->sel.family)
                 x->sel.family = x->props.family;
 
         if (ext_hdrs[SADB_X_EXT_NAT_T_TYPE-1]) {
diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
index 7877d3b3f4cb..3f7f92a2f227 100644
--- a/net/mac80211/mlme.c
+++ b/net/mac80211/mlme.c
@@ -721,7 +721,17 @@ static void ieee80211_send_assoc(struct net_device *dev,
                         capab |= WLAN_CAPABILITY_PRIVACY;
                 if (bss->wmm_ie)
                         wmm = 1;
+
+                /* get all rates supported by the device and the AP as
+                 * some APs don't like getting a superset of their rates
+                 * in the association request (e.g. D-Link DAP 1353 in
+                 * b-only mode) */
+                rates_len = ieee80211_compatible_rates(bss, sband, &rates);
+
                 ieee80211_rx_bss_put(dev, bss);
+        } else {
+                rates = ~0;
+                rates_len = sband->n_bitrates;
         }
 
         mgmt = (struct ieee80211_mgmt *) skb_put(skb, 24);
@@ -752,10 +762,7 @@ static void ieee80211_send_assoc(struct net_device *dev,
         *pos++ = ifsta->ssid_len;
         memcpy(pos, ifsta->ssid, ifsta->ssid_len);
 
-        /* all supported rates should be added here but some APs
-         * (e.g. D-Link DAP 1353 in b-only mode) don't like that
-         * Therefore only add rates the AP supports */
-        rates_len = ieee80211_compatible_rates(bss, sband, &rates);
+        /* add all rates which were marked to be used above */
         supp_rates_len = rates_len;
         if (supp_rates_len > 8)
                 supp_rates_len = 8;
@@ -3434,21 +3441,17 @@ static int ieee80211_sta_config_auth(struct net_device *dev,
         struct ieee80211_sta_bss *bss, *selected = NULL;
         int top_rssi = 0, freq;
 
-        if (!(ifsta->flags & (IEEE80211_STA_AUTO_SSID_SEL |
-            IEEE80211_STA_AUTO_BSSID_SEL | IEEE80211_STA_AUTO_CHANNEL_SEL))) {
-                ifsta->state = IEEE80211_AUTHENTICATE;
-                ieee80211_sta_reset_auth(dev, ifsta);
-                return 0;
-        }
-
         spin_lock_bh(&local->sta_bss_lock);
         freq = local->oper_channel->center_freq;
         list_for_each_entry(bss, &local->sta_bss_list, list) {
                 if (!(bss->capability & WLAN_CAPABILITY_ESS))
                         continue;
 
-                if (!!(bss->capability & WLAN_CAPABILITY_PRIVACY) ^
-                    !!sdata->default_key)
+                if ((ifsta->flags & (IEEE80211_STA_AUTO_SSID_SEL |
+                        IEEE80211_STA_AUTO_BSSID_SEL |
+                        IEEE80211_STA_AUTO_CHANNEL_SEL)) &&
+                    (!!(bss->capability & WLAN_CAPABILITY_PRIVACY) ^
+                     !!sdata->default_key))
                         continue;
 
                 if (!(ifsta->flags & IEEE80211_STA_AUTO_CHANNEL_SEL) &&
diff --git a/net/mac80211/util.c b/net/mac80211/util.c
index 24a465c4df09..131e9e6c8a32 100644
--- a/net/mac80211/util.c
+++ b/net/mac80211/util.c
@@ -389,6 +389,41 @@ void ieee80211_iterate_active_interfaces(
         struct ieee80211_local *local = hw_to_local(hw);
         struct ieee80211_sub_if_data *sdata;
 
+        rtnl_lock();
+
+        list_for_each_entry(sdata, &local->interfaces, list) {
+                switch (sdata->vif.type) {
+                case IEEE80211_IF_TYPE_INVALID:
+                case IEEE80211_IF_TYPE_MNTR:
+                case IEEE80211_IF_TYPE_VLAN:
+                        continue;
+                case IEEE80211_IF_TYPE_AP:
+                case IEEE80211_IF_TYPE_STA:
+                case IEEE80211_IF_TYPE_IBSS:
+                case IEEE80211_IF_TYPE_WDS:
+                case IEEE80211_IF_TYPE_MESH_POINT:
+                        break;
+                }
+                if (sdata->dev == local->mdev)
+                        continue;
+                if (netif_running(sdata->dev))
+                        iterator(data, sdata->dev->dev_addr,
+                                 &sdata->vif);
+        }
+
+        rtnl_unlock();
+}
+EXPORT_SYMBOL_GPL(ieee80211_iterate_active_interfaces);
+
+void ieee80211_iterate_active_interfaces_atomic(
+        struct ieee80211_hw *hw,
+        void (*iterator)(void *data, u8 *mac,
+                         struct ieee80211_vif *vif),
+        void *data)
+{
+        struct ieee80211_local *local = hw_to_local(hw);
+        struct ieee80211_sub_if_data *sdata;
+
         rcu_read_lock();
 
         list_for_each_entry_rcu(sdata, &local->interfaces, list) {
@@ -413,4 +448,4 @@ void ieee80211_iterate_active_interfaces(
 
         rcu_read_unlock();
 }
-EXPORT_SYMBOL_GPL(ieee80211_iterate_active_interfaces);
+EXPORT_SYMBOL_GPL(ieee80211_iterate_active_interfaces_atomic);
diff --git a/net/mac80211/wext.c b/net/mac80211/wext.c
index 6a342a9a40cd..c2e2378af082 100644
--- a/net/mac80211/wext.c
+++ b/net/mac80211/wext.c
@@ -221,7 +221,6 @@ static int ieee80211_ioctl_giwrange(struct net_device *dev,
         range->num_frequency = c;
 
         IW_EVENT_CAPA_SET_KERNEL(range->event_capa);
-        IW_EVENT_CAPA_SET(range->event_capa, SIOCGIWTHRSPY);
         IW_EVENT_CAPA_SET(range->event_capa, SIOCGIWAP);
         IW_EVENT_CAPA_SET(range->event_capa, SIOCGIWSCAN);
 
diff --git a/net/sched/cls_api.c b/net/sched/cls_api.c
index 1086df7478bc..9360fc81e8c7 100644
--- a/net/sched/cls_api.c
+++ b/net/sched/cls_api.c
@@ -220,7 +220,7 @@ replay:
                 tp = kzalloc(sizeof(*tp), GFP_KERNEL);
                 if (tp == NULL)
                         goto errout;
-                err = -EINVAL;
+                err = -ENOENT;
                 tp_ops = tcf_proto_lookup_ops(tca[TCA_KIND]);
                 if (tp_ops == NULL) {
 #ifdef CONFIG_KMOD
diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c
index a1b0fbe3ea35..b976d9ed10e4 100644
--- a/net/xfrm/xfrm_user.c
+++ b/net/xfrm/xfrm_user.c
@@ -50,19 +50,8 @@ static int verify_one_alg(struct nlattr **attrs, enum xfrm_attr_type_t type)
 
         switch (type) {
         case XFRMA_ALG_AUTH:
-                if (!algp->alg_key_len &&
-                    strcmp(algp->alg_name, "digest_null") != 0)
-                        return -EINVAL;
-                break;
-
         case XFRMA_ALG_CRYPT:
-                if (!algp->alg_key_len &&
-                    strcmp(algp->alg_name, "cipher_null") != 0)
-                        return -EINVAL;
-                break;
-
         case XFRMA_ALG_COMP:
-                /* Zero length keys are legal.  */
                 break;
 
         default: