25 files changed, 248 insertions, 153 deletions

diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
index bc39e417694a..cf857c4dc7b1 100644
--- a/net/core/rtnetlink.c
+++ b/net/core/rtnetlink.c
@@ -82,6 +82,11 @@ int rtnl_trylock(void)
         return mutex_trylock(&rtnl_mutex);
 }
 
+int rtnl_is_locked(void)
+{
+        return mutex_is_locked(&rtnl_mutex);
+}
+
 static struct rtnl_link *rtnl_msg_handlers[NPROTO];
 
 static inline int rtm_msgindex(int msgtype)
@@ -1402,6 +1407,7 @@ EXPORT_SYMBOL(rtnetlink_put_metrics);
 EXPORT_SYMBOL(rtnl_lock);
 EXPORT_SYMBOL(rtnl_trylock);
 EXPORT_SYMBOL(rtnl_unlock);
+EXPORT_SYMBOL(rtnl_is_locked);
 EXPORT_SYMBOL(rtnl_unicast);
 EXPORT_SYMBOL(rtnl_notify);
 EXPORT_SYMBOL(rtnl_set_sk_err);
diff --git a/net/ipv4/fib_hash.c b/net/ipv4/fib_hash.c
index 02088deb0461..2e2fc3376ac9 100644
--- a/net/ipv4/fib_hash.c
+++ b/net/ipv4/fib_hash.c
@@ -1003,7 +1003,7 @@ static unsigned fib_flag_trans(int type, __be32 mask, struct fib_info *fi)
 static int fib_seq_show(struct seq_file *seq, void *v)
 {
         struct fib_iter_state *iter;
-        char bf[128];
+        int len;
         __be32 prefix, mask;
         unsigned flags;
         struct fib_node *f;
@@ -1025,18 +1025,19 @@ static int fib_seq_show(struct seq_file *seq, void *v)
         mask    = FZ_MASK(iter->zone);
         flags   = fib_flag_trans(fa->fa_type, mask, fi);
         if (fi)
-                snprintf(bf, sizeof(bf),
-                         "%s\t%08X\t%08X\t%04X\t%d\t%u\t%d\t%08X\t%d\t%u\t%u",
+                seq_printf(seq,
+                         "%s\t%08X\t%08X\t%04X\t%d\t%u\t%d\t%08X\t%d\t%u\t%u%n",
                          fi->fib_dev ? fi->fib_dev->name : "*", prefix,
                          fi->fib_nh->nh_gw, flags, 0, 0, fi->fib_priority,
                          mask, (fi->fib_advmss ? fi->fib_advmss + 40 : 0),
                          fi->fib_window,
-                         fi->fib_rtt >> 3);
+                         fi->fib_rtt >> 3, &len);
         else
-                snprintf(bf, sizeof(bf),
-                         "*\t%08X\t%08X\t%04X\t%d\t%u\t%d\t%08X\t%d\t%u\t%u",
-                         prefix, 0, flags, 0, 0, 0, mask, 0, 0, 0);
-        seq_printf(seq, "%-127s\n", bf);
+                seq_printf(seq,
+                         "*\t%08X\t%08X\t%04X\t%d\t%u\t%d\t%08X\t%d\t%u\t%u%n",
+                         prefix, 0, flags, 0, 0, 0, mask, 0, 0, 0, &len);
+
+        seq_printf(seq, "%*s\n", 127 - len, "");
 out:
         return 0;
 }
diff --git a/net/ipv4/fib_trie.c b/net/ipv4/fib_trie.c
index ea294fffb9ce..4b02d14e7ab9 100644
--- a/net/ipv4/fib_trie.c
+++ b/net/ipv4/fib_trie.c
@@ -2602,15 +2602,16 @@ static int fib_route_seq_show(struct seq_file *seq, void *v)
                 list_for_each_entry_rcu(fa, &li->falh, fa_list) {
                         const struct fib_info *fi = fa->fa_info;
                         unsigned flags = fib_flag_trans(fa->fa_type, mask, fi);
-                        char bf[128];
+                        int len;
 
                         if (fa->fa_type == RTN_BROADCAST
                             || fa->fa_type == RTN_MULTICAST)
                                 continue;
 
                         if (fi)
-                                snprintf(bf, sizeof(bf),
-                                         "%s\t%08X\t%08X\t%04X\t%d\t%u\t%d\t%08X\t%d\t%u\t%u",
+                                seq_printf(seq,
+                                         "%s\t%08X\t%08X\t%04X\t%d\t%u\t"
+                                         "%d\t%08X\t%d\t%u\t%u%n",
                                          fi->fib_dev ? fi->fib_dev->name : "*",
                                          prefix,
                                          fi->fib_nh->nh_gw, flags, 0, 0,
@@ -2619,14 +2620,15 @@ static int fib_route_seq_show(struct seq_file *seq, void *v)
                                          (fi->fib_advmss ?
                                           fi->fib_advmss + 40 : 0),
                                          fi->fib_window,
-                                         fi->fib_rtt >> 3);
+                                         fi->fib_rtt >> 3, &len);
                         else
-                                snprintf(bf, sizeof(bf),
-                                         "*\t%08X\t%08X\t%04X\t%d\t%u\t%d\t%08X\t%d\t%u\t%u",
+                                seq_printf(seq,
+                                         "*\t%08X\t%08X\t%04X\t%d\t%u\t"
+                                         "%d\t%08X\t%d\t%u\t%u%n",
                                          prefix, 0, flags, 0, 0, 0,
-                                         mask, 0, 0, 0);
+                                         mask, 0, 0, 0, &len);
 
-                        seq_printf(seq, "%-127s\n", bf);
+                        seq_printf(seq, "%*s\n", 127 - len, "");
                 }
         }
 
diff --git a/net/ipv4/route.c b/net/ipv4/route.c
index 780e9484c825..ce25a13f3430 100644
--- a/net/ipv4/route.c
+++ b/net/ipv4/route.c
@@ -367,10 +367,10 @@ static int rt_cache_seq_show(struct seq_file *seq, void *v)
                            "HHUptod\tSpecDst");
         else {
                 struct rtable *r = v;
-                char temp[256];
+                int len;
 
-                sprintf(temp, "%s\t%08lX\t%08lX\t%8X\t%d\t%u\t%d\t"
-                              "%08lX\t%d\t%u\t%u\t%02X\t%d\t%1d\t%08X",
+                seq_printf(seq, "%s\t%08lX\t%08lX\t%8X\t%d\t%u\t%d\t"
+                              "%08lX\t%d\t%u\t%u\t%02X\t%d\t%1d\t%08X%n",
                         r->u.dst.dev ? r->u.dst.dev->name : "*",
                         (unsigned long)r->rt_dst, (unsigned long)r->rt_gateway,
                         r->rt_flags, atomic_read(&r->u.dst.__refcnt),
@@ -384,8 +384,9 @@ static int rt_cache_seq_show(struct seq_file *seq, void *v)
                         r->u.dst.hh ? atomic_read(&r->u.dst.hh->hh_refcnt) : -1,
                         r->u.dst.hh ? (r->u.dst.hh->hh_output ==
                                        dev_queue_xmit) : 0,
-                        r->rt_spec_dst);
-                seq_printf(seq, "%-127s\n", temp);
+                        r->rt_spec_dst, &len);
+
+                seq_printf(seq, "%*s\n", 127 - len, "");
         }
         return 0;
 }
diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
index 776615180b93..0e9bc120707d 100644
--- a/net/ipv4/tcp_ipv4.c
+++ b/net/ipv4/tcp_ipv4.c
@@ -2255,13 +2255,13 @@ void tcp_proc_unregister(struct net *net, struct tcp_seq_afinfo *afinfo)
 }
 
 static void get_openreq4(struct sock *sk, struct request_sock *req,
-                         char *tmpbuf, int i, int uid)
+                         struct seq_file *f, int i, int uid, int *len)
 {
         const struct inet_request_sock *ireq = inet_rsk(req);
         int ttd = req->expires - jiffies;
 
-        sprintf(tmpbuf, "%4d: %08X:%04X %08X:%04X"
-                " %02X %08X:%08X %02X:%08lX %08X %5d %8d %u %d %p",
+        seq_printf(f, "%4d: %08X:%04X %08X:%04X"
+                " %02X %08X:%08X %02X:%08lX %08X %5d %8d %u %d %p%n",
                 i,
                 ireq->loc_addr,
                 ntohs(inet_sk(sk)->sport),
@@ -2276,10 +2276,11 @@ static void get_openreq4(struct sock *sk, struct request_sock *req,
                 0,  /* non standard timer */
                 0, /* open_requests have no inode */
                 atomic_read(&sk->sk_refcnt),
-                req);
+                req,
+                len);
 }
 
-static void get_tcp4_sock(struct sock *sk, char *tmpbuf, int i)
+static void get_tcp4_sock(struct sock *sk, struct seq_file *f, int i, int *len)
 {
         int timer_active;
         unsigned long timer_expires;
@@ -2305,8 +2306,8 @@ static void get_tcp4_sock(struct sock *sk, char *tmpbuf, int i)
                 timer_expires = jiffies;
         }
 
-        sprintf(tmpbuf, "%4d: %08X:%04X %08X:%04X %02X %08X:%08X %02X:%08lX "
-                        "%08X %5d %8d %lu %d %p %u %u %u %u %d",
+        seq_printf(f, "%4d: %08X:%04X %08X:%04X %02X %08X:%08X %02X:%08lX "
+                        "%08X %5d %8d %lu %d %p %u %u %u %u %d%n",
                 i, src, srcp, dest, destp, sk->sk_state,
                 tp->write_seq - tp->snd_una,
                 sk->sk_state == TCP_LISTEN ? sk->sk_ack_backlog :
@@ -2322,11 +2323,12 @@ static void get_tcp4_sock(struct sock *sk, char *tmpbuf, int i)
                 icsk->icsk_ack.ato,
                 (icsk->icsk_ack.quick << 1) | icsk->icsk_ack.pingpong,
                 tp->snd_cwnd,
-                tp->snd_ssthresh >= 0xFFFF ? -1 : tp->snd_ssthresh);
+                tp->snd_ssthresh >= 0xFFFF ? -1 : tp->snd_ssthresh,
+                len);
 }
 
 static void get_timewait4_sock(struct inet_timewait_sock *tw,
-                               char *tmpbuf, int i)
+                               struct seq_file *f, int i, int *len)
 {
         __be32 dest, src;
         __u16 destp, srcp;
@@ -2340,11 +2342,11 @@ static void get_timewait4_sock(struct inet_timewait_sock *tw,
         destp = ntohs(tw->tw_dport);
         srcp  = ntohs(tw->tw_sport);
 
-        sprintf(tmpbuf, "%4d: %08X:%04X %08X:%04X"
-                " %02X %08X:%08X %02X:%08lX %08X %5d %8d %d %d %p",
+        seq_printf(f, "%4d: %08X:%04X %08X:%04X"
+                " %02X %08X:%08X %02X:%08lX %08X %5d %8d %d %d %p%n",
                 i, src, srcp, dest, destp, tw->tw_substate, 0, 0,
                 3, jiffies_to_clock_t(ttd), 0, 0, 0, 0,
-                atomic_read(&tw->tw_refcnt), tw);
+                atomic_read(&tw->tw_refcnt), tw, len);
 }
 
 #define TMPSZ 150
@@ -2352,7 +2354,7 @@ static void get_timewait4_sock(struct inet_timewait_sock *tw,
 static int tcp4_seq_show(struct seq_file *seq, void *v)
 {
         struct tcp_iter_state* st;
-        char tmpbuf[TMPSZ + 1];
+        int len;
 
         if (v == SEQ_START_TOKEN) {
                 seq_printf(seq, "%-*s\n", TMPSZ - 1,
@@ -2366,16 +2368,16 @@ static int tcp4_seq_show(struct seq_file *seq, void *v)
         switch (st->state) {
         case TCP_SEQ_STATE_LISTENING:
         case TCP_SEQ_STATE_ESTABLISHED:
-                get_tcp4_sock(v, tmpbuf, st->num);
+                get_tcp4_sock(v, seq, st->num, &len);
                 break;
         case TCP_SEQ_STATE_OPENREQ:
-                get_openreq4(st->syn_wait_sk, v, tmpbuf, st->num, st->uid);
+                get_openreq4(st->syn_wait_sk, v, seq, st->num, st->uid, &len);
                 break;
         case TCP_SEQ_STATE_TIME_WAIT:
-                get_timewait4_sock(v, tmpbuf, st->num);
+                get_timewait4_sock(v, seq, st->num, &len);
                 break;
         }
-        seq_printf(seq, "%-*s\n", TMPSZ - 1, tmpbuf);
+        seq_printf(seq, "%*s\n", TMPSZ - 1 - len, "");
 out:
         return 0;
 }
diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
index b053ac795275..1f535e315188 100644
--- a/net/ipv4/udp.c
+++ b/net/ipv4/udp.c
@@ -1619,7 +1619,8 @@ void udp_proc_unregister(struct net *net, struct udp_seq_afinfo *afinfo)
 }
 
 /* ------------------------------------------------------------------------ */
-static void udp4_format_sock(struct sock *sp, char *tmpbuf, int bucket)
+static void udp4_format_sock(struct sock *sp, struct seq_file *f,
+                int bucket, int *len)
 {
         struct inet_sock *inet = inet_sk(sp);
         __be32 dest = inet->daddr;
@@ -1627,13 +1628,13 @@ static void udp4_format_sock(struct sock *sp, char *tmpbuf, int bucket)
         __u16 destp       = ntohs(inet->dport);
         __u16 srcp        = ntohs(inet->sport);
 
-        sprintf(tmpbuf, "%4d: %08X:%04X %08X:%04X"
-                " %02X %08X:%08X %02X:%08lX %08X %5d %8d %lu %d %p",
+        seq_printf(f, "%4d: %08X:%04X %08X:%04X"
+                " %02X %08X:%08X %02X:%08lX %08X %5d %8d %lu %d %p%n",
                 bucket, src, srcp, dest, destp, sp->sk_state,
                 atomic_read(&sp->sk_wmem_alloc),
                 atomic_read(&sp->sk_rmem_alloc),
                 0, 0L, 0, sock_i_uid(sp), 0, sock_i_ino(sp),
-                atomic_read(&sp->sk_refcnt), sp);
+                atomic_read(&sp->sk_refcnt), sp, len);
 }
 
 int udp4_seq_show(struct seq_file *seq, void *v)
@@ -1644,11 +1645,11 @@ int udp4_seq_show(struct seq_file *seq, void *v)
                            "rx_queue tr tm->when retrnsmt   uid  timeout "
                            "inode");
         else {
-                char tmpbuf[129];
                 struct udp_iter_state *state = seq->private;
+                int len;
 
-                udp4_format_sock(v, tmpbuf, state->bucket);
-                seq_printf(seq, "%-127s\n", tmpbuf);
+                udp4_format_sock(v, seq, state->bucket, &len);
+                seq_printf(seq, "%*s\n", 127 - len ,"");
         }
         return 0;
 }
diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
index 6b75cb6c6300..a5e5c31c23ab 100644
--- a/net/mac80211/mlme.c
+++ b/net/mac80211/mlme.c
@@ -2248,10 +2248,13 @@ static void ieee80211_rx_bss_put(struct net_device *dev,
                                  struct ieee80211_sta_bss *bss)
 {
         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
-        if (!atomic_dec_and_test(&bss->users))
+
+        local_bh_disable();
+        if (!atomic_dec_and_lock(&bss->users, &local->sta_bss_lock)) {
+                local_bh_enable();
                 return;
+        }
 
-        spin_lock_bh(&local->sta_bss_lock);
         __ieee80211_rx_bss_hash_del(dev, bss);
         list_del(&bss->list);
         spin_unlock_bh(&local->sta_bss_lock);
@@ -2709,7 +2712,26 @@ static void ieee80211_rx_bss_info(struct net_device *dev,
                         bss->wmm_ie_len = elems.wmm_param_len + 2;
                 } else
                         bss->wmm_ie_len = 0;
-        } else if (!elems.wmm_param && bss->wmm_ie) {
+        } else if (elems.wmm_info &&
+                    (!bss->wmm_ie || bss->wmm_ie_len != elems.wmm_info_len ||
+                     memcmp(bss->wmm_ie, elems.wmm_info, elems.wmm_info_len))) {
+                 /* As for certain AP's Fifth bit is not set in WMM IE in
+                  * beacon frames.So while parsing the beacon frame the
+                  * wmm_info structure is used instead of wmm_param.
+                  * wmm_info structure was never used to set bss->wmm_ie.
+                  * This code fixes this problem by copying the WME
+                  * information from wmm_info to bss->wmm_ie and enabling
+                  * n-band association.
+                  */
+                kfree(bss->wmm_ie);
+                bss->wmm_ie = kmalloc(elems.wmm_info_len + 2, GFP_ATOMIC);
+                if (bss->wmm_ie) {
+                        memcpy(bss->wmm_ie, elems.wmm_info - 2,
+                               elems.wmm_info_len + 2);
+                        bss->wmm_ie_len = elems.wmm_info_len + 2;
+                } else
+                        bss->wmm_ie_len = 0;
+        } else if (!elems.wmm_param && !elems.wmm_info && bss->wmm_ie) {
                 kfree(bss->wmm_ie);
                 bss->wmm_ie = NULL;
                 bss->wmm_ie_len = 0;
diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
index 52e4554fdde7..02f436a86061 100644
--- a/net/mac80211/rx.c
+++ b/net/mac80211/rx.c
@@ -2170,7 +2170,7 @@ void __ieee80211_rx(struct ieee80211_hw *hw, struct sk_buff *skb,
         struct ieee80211_supported_band *sband;
 
         if (status->band < 0 ||
-            status->band > IEEE80211_NUM_BANDS) {
+            status->band >= IEEE80211_NUM_BANDS) {
                 WARN_ON(1);
                 return;
         }
diff --git a/net/mac80211/wme.c b/net/mac80211/wme.c
index 4e94e4026e78..64faa3dc488f 100644
--- a/net/mac80211/wme.c
+++ b/net/mac80211/wme.c
@@ -709,7 +709,7 @@ void ieee80211_requeue(struct ieee80211_local *local, int queue)
         struct ieee80211_sched_data *q = qdisc_priv(root_qd);
         struct Qdisc *qdisc = q->queues[queue];
         struct sk_buff *skb = NULL;
-        u32 len = qdisc->q.qlen;
+        u32 len;
 
         if (!qdisc || !qdisc->dequeue)
                 return;
diff --git a/net/sctp/objcnt.c b/net/sctp/objcnt.c
index cfeb07ea1b04..f73ec0ea93ba 100644
--- a/net/sctp/objcnt.c
+++ b/net/sctp/objcnt.c
@@ -83,13 +83,12 @@ static sctp_dbg_objcnt_entry_t sctp_dbg_objcnt[] = {
  */
 static int sctp_objcnt_seq_show(struct seq_file *seq, void *v)
 {
-        int i;
-        char temp[128];
+        int i, len;
 
         i = (int)*(loff_t *)v;
-        sprintf(temp, "%s: %d", sctp_dbg_objcnt[i].label,
-                                atomic_read(sctp_dbg_objcnt[i].counter));
-        seq_printf(seq, "%-127s\n", temp);
+        seq_printf(seq, "%s: %d%n", sctp_dbg_objcnt[i].label,
+                                atomic_read(sctp_dbg_objcnt[i].counter), &len);
+        seq_printf(seq, "%*s\n", 127 - len, "");
         return 0;
 }
 
diff --git a/net/sunrpc/auth_gss/gss_generic_token.c b/net/sunrpc/auth_gss/gss_generic_token.c
index ea8c92ecdae5..d83b881685fe 100644
--- a/net/sunrpc/auth_gss/gss_generic_token.c
+++ b/net/sunrpc/auth_gss/gss_generic_token.c
@@ -148,7 +148,7 @@ int
 g_token_size(struct xdr_netobj *mech, unsigned int body_size)
 {
         /* set body_size to sequence contents size */
-        body_size += 4 + (int) mech->len;         /* NEED overflow check */
+        body_size += 2 + (int) mech->len;         /* NEED overflow check */
         return(1 + der_length_size(body_size) + body_size);
 }
 
@@ -161,7 +161,7 @@ void
 g_make_token_header(struct xdr_netobj *mech, int body_size, unsigned char **buf)
 {
         *(*buf)++ = 0x60;
-        der_write_length(buf, 4 + mech->len + body_size);
+        der_write_length(buf, 2 + mech->len + body_size);
         *(*buf)++ = 0x06;
         *(*buf)++ = (unsigned char) mech->len;
         TWRITE_STR(*buf, mech->data, ((int) mech->len));
diff --git a/net/sunrpc/auth_gss/gss_krb5_crypto.c b/net/sunrpc/auth_gss/gss_krb5_crypto.c
index 0dd792338fa9..1d52308ca324 100644
--- a/net/sunrpc/auth_gss/gss_krb5_crypto.c
+++ b/net/sunrpc/auth_gss/gss_krb5_crypto.c
@@ -66,8 +66,8 @@ krb5_encrypt(
                 goto out;
 
         if (crypto_blkcipher_ivsize(tfm) > 16) {
-                dprintk("RPC:       gss_k5encrypt: tfm iv size to large %d\n",
-                         crypto_blkcipher_ivsize(tfm));
+                dprintk("RPC:       gss_k5encrypt: tfm iv size too large %d\n",
+                        crypto_blkcipher_ivsize(tfm));
                 goto out;
         }
 
@@ -102,7 +102,7 @@ krb5_decrypt(
                 goto out;
 
         if (crypto_blkcipher_ivsize(tfm) > 16) {
-                dprintk("RPC:       gss_k5decrypt: tfm iv size to large %d\n",
+                dprintk("RPC:       gss_k5decrypt: tfm iv size too large %d\n",
                         crypto_blkcipher_ivsize(tfm));
                 goto out;
         }
diff --git a/net/sunrpc/auth_gss/gss_krb5_seal.c b/net/sunrpc/auth_gss/gss_krb5_seal.c
index dedcbd6108f4..5f1d36dfbcf7 100644
--- a/net/sunrpc/auth_gss/gss_krb5_seal.c
+++ b/net/sunrpc/auth_gss/gss_krb5_seal.c
@@ -87,10 +87,10 @@ gss_get_mic_kerberos(struct gss_ctx *gss_ctx, struct xdr_buf *text,
 
         now = get_seconds();
 
-        token->len = g_token_size(&ctx->mech_used, 22);
+        token->len = g_token_size(&ctx->mech_used, 24);
 
         ptr = token->data;
-        g_make_token_header(&ctx->mech_used, 22, &ptr);
+        g_make_token_header(&ctx->mech_used, 24, &ptr);
 
         *ptr++ = (unsigned char) ((KG_TOK_MIC_MSG>>8)&0xff);
         *ptr++ = (unsigned char) (KG_TOK_MIC_MSG&0xff);
@@ -109,15 +109,14 @@ gss_get_mic_kerberos(struct gss_ctx *gss_ctx, struct xdr_buf *text,
                           md5cksum.data, md5cksum.len))
                 return GSS_S_FAILURE;
 
-        memcpy(krb5_hdr + 16, md5cksum.data + md5cksum.len - KRB5_CKSUM_LENGTH,
-               KRB5_CKSUM_LENGTH);
+        memcpy(krb5_hdr + 16, md5cksum.data + md5cksum.len - 8, 8);
 
         spin_lock(&krb5_seq_lock);
         seq_send = ctx->seq_send++;
         spin_unlock(&krb5_seq_lock);
 
         if (krb5_make_seq_num(ctx->seq, ctx->initiate ? 0 : 0xff,
-                               ctx->seq_send, krb5_hdr + 16, krb5_hdr + 8))
+                              seq_send, krb5_hdr + 16, krb5_hdr + 8))
                 return GSS_S_FAILURE;
 
         return (ctx->endtime < now) ? GSS_S_CONTEXT_EXPIRED : GSS_S_COMPLETE;
diff --git a/net/sunrpc/auth_gss/gss_krb5_seqnum.c b/net/sunrpc/auth_gss/gss_krb5_seqnum.c
index 43f3421f1e6a..f160be6c1a46 100644
--- a/net/sunrpc/auth_gss/gss_krb5_seqnum.c
+++ b/net/sunrpc/auth_gss/gss_krb5_seqnum.c
@@ -43,7 +43,7 @@
 s32
 krb5_make_seq_num(struct crypto_blkcipher *key,
                 int direction,
-                s32 seqnum,
+                u32 seqnum,
                 unsigned char *cksum, unsigned char *buf)
 {
         unsigned char plain[8];
@@ -65,7 +65,7 @@ s32
 krb5_get_seq_num(struct crypto_blkcipher *key,
                unsigned char *cksum,
                unsigned char *buf,
-               int *direction, s32 * seqnum)
+               int *direction, u32 *seqnum)
 {
         s32 code;
         unsigned char plain[8];
diff --git a/net/sunrpc/auth_gss/gss_krb5_unseal.c b/net/sunrpc/auth_gss/gss_krb5_unseal.c
index e30a993466bc..d91a5d004803 100644
--- a/net/sunrpc/auth_gss/gss_krb5_unseal.c
+++ b/net/sunrpc/auth_gss/gss_krb5_unseal.c
@@ -82,7 +82,7 @@ gss_verify_mic_kerberos(struct gss_ctx *gss_ctx,
         struct xdr_netobj       md5cksum = {.len = 0, .data = cksumdata};
         s32                     now;
         int                     direction;
-        s32                     seqnum;
+        u32                     seqnum;
         unsigned char           *ptr = (unsigned char *)read_token->data;
         int                     bodysize;
 
diff --git a/net/sunrpc/auth_gss/gss_krb5_wrap.c b/net/sunrpc/auth_gss/gss_krb5_wrap.c
index 3bdc527ee64a..b00b1b426301 100644
--- a/net/sunrpc/auth_gss/gss_krb5_wrap.c
+++ b/net/sunrpc/auth_gss/gss_krb5_wrap.c
@@ -137,7 +137,7 @@ gss_wrap_kerberos(struct gss_ctx *ctx, int offset,
         BUG_ON((buf->len - offset) % blocksize);
         plainlen = blocksize + buf->len - offset;
 
-        headlen = g_token_size(&kctx->mech_used, 22 + plainlen) -
+        headlen = g_token_size(&kctx->mech_used, 24 + plainlen) -
                                                 (buf->len - offset);
 
         ptr = buf->head[0].iov_base + offset;
@@ -149,7 +149,7 @@ gss_wrap_kerberos(struct gss_ctx *ctx, int offset,
         buf->len += headlen;
         BUG_ON((buf->len - offset - headlen) % blocksize);
 
-        g_make_token_header(&kctx->mech_used, 22 + plainlen, &ptr);
+        g_make_token_header(&kctx->mech_used, 24 + plainlen, &ptr);
 
 
         *ptr++ = (unsigned char) ((KG_TOK_WRAP_MSG>>8)&0xff);
@@ -176,9 +176,7 @@ gss_wrap_kerberos(struct gss_ctx *ctx, int offset,
         if (krb5_encrypt(kctx->seq, NULL, md5cksum.data,
                           md5cksum.data, md5cksum.len))
                 return GSS_S_FAILURE;
-        memcpy(krb5_hdr + 16,
-               md5cksum.data + md5cksum.len - KRB5_CKSUM_LENGTH,
-               KRB5_CKSUM_LENGTH);
+        memcpy(krb5_hdr + 16, md5cksum.data + md5cksum.len - 8, 8);
 
         spin_lock(&krb5_seq_lock);
         seq_send = kctx->seq_send++;
diff --git a/net/sunrpc/auth_gss/gss_spkm3_seal.c b/net/sunrpc/auth_gss/gss_spkm3_seal.c
index abf17ce2e3b1..c832712f8d55 100644
--- a/net/sunrpc/auth_gss/gss_spkm3_seal.c
+++ b/net/sunrpc/auth_gss/gss_spkm3_seal.c
@@ -107,10 +107,10 @@ spkm3_make_token(struct spkm3_ctx *ctx,
                 tokenlen = 10 + ctxelen + 1 + md5elen + 1;
 
                 /* Create token header using generic routines */
-                token->len = g_token_size(&ctx->mech_used, tokenlen);
+                token->len = g_token_size(&ctx->mech_used, tokenlen + 2);
 
                 ptr = token->data;
-                g_make_token_header(&ctx->mech_used, tokenlen, &ptr);
+                g_make_token_header(&ctx->mech_used, tokenlen + 2, &ptr);
 
                 spkm3_make_mic_token(&ptr, tokenlen, &mic_hdr, &md5cksum, md5elen, md5zbit);
         } else if (toktype == SPKM_WRAP_TOK) { /* Not Supported */
diff --git a/net/sunrpc/auth_gss/svcauth_gss.c b/net/sunrpc/auth_gss/svcauth_gss.c
index 481f984e9a22..5905d56737d6 100644
--- a/net/sunrpc/auth_gss/svcauth_gss.c
+++ b/net/sunrpc/auth_gss/svcauth_gss.c
@@ -1146,7 +1146,7 @@ svcauth_gss_accept(struct svc_rqst *rqstp, __be32 *authp)
                 case RPC_GSS_SVC_INTEGRITY:
                         if (unwrap_integ_data(&rqstp->rq_arg,
                                         gc->gc_seq, rsci->mechctx))
-                                goto auth_err;
+                                goto garbage_args;
                         /* placeholders for length and seq. number: */
                         svc_putnl(resv, 0);
                         svc_putnl(resv, 0);
@@ -1154,7 +1154,7 @@ svcauth_gss_accept(struct svc_rqst *rqstp, __be32 *authp)
                 case RPC_GSS_SVC_PRIVACY:
                         if (unwrap_priv_data(rqstp, &rqstp->rq_arg,
                                         gc->gc_seq, rsci->mechctx))
-                                goto auth_err;
+                                goto garbage_args;
                         /* placeholders for length and seq. number: */
                         svc_putnl(resv, 0);
                         svc_putnl(resv, 0);
@@ -1169,6 +1169,11 @@ svcauth_gss_accept(struct svc_rqst *rqstp, __be32 *authp)
                 ret = SVC_OK;
                 goto out;
         }
+garbage_args:
+        /* Restore write pointer to its original value: */
+        xdr_ressize_check(rqstp, reject_stat);
+        ret = SVC_GARBAGE;
+        goto out;
 auth_err:
         /* Restore write pointer to its original value: */
         xdr_ressize_check(rqstp, reject_stat);
diff --git a/net/sunrpc/cache.c b/net/sunrpc/cache.c
index b5f2786251b9..d75530ff2a6d 100644
--- a/net/sunrpc/cache.c
+++ b/net/sunrpc/cache.c
@@ -571,7 +571,6 @@ static int cache_defer_req(struct cache_req *req, struct cache_head *item)
                 return -ETIMEDOUT;
 
         dreq->item = item;
-        dreq->recv_time = get_seconds();
 
         spin_lock(&cache_defer_lock);
 
diff --git a/net/sunrpc/svc.c b/net/sunrpc/svc.c
index 090af78d68b5..d74c2d269539 100644
--- a/net/sunrpc/svc.c
+++ b/net/sunrpc/svc.c
@@ -510,8 +510,7 @@ EXPORT_SYMBOL(svc_destroy);
 static int
 svc_init_buffer(struct svc_rqst *rqstp, unsigned int size)
 {
-        int pages;
-        int arghi;
+        unsigned int pages, arghi;
 
         pages = size / PAGE_SIZE + 1; /* extra page as we hold both request and reply.
                                        * We assume one is at most one page
@@ -525,7 +524,7 @@ svc_init_buffer(struct svc_rqst *rqstp, unsigned int size)
                 rqstp->rq_pages[arghi++] = p;
                 pages--;
         }
-        return ! pages;
+        return pages == 0;
 }
 
 /*
@@ -534,8 +533,9 @@ svc_init_buffer(struct svc_rqst *rqstp, unsigned int size)
 static void
 svc_release_buffer(struct svc_rqst *rqstp)
 {
-        int i;
-        for (i=0; i<ARRAY_SIZE(rqstp->rq_pages); i++)
+        unsigned int i;
+
+        for (i = 0; i < ARRAY_SIZE(rqstp->rq_pages); i++)
                 if (rqstp->rq_pages[i])
                         put_page(rqstp->rq_pages[i]);
 }
@@ -590,7 +590,7 @@ __svc_create_thread(svc_thread_fn func, struct svc_serv *serv,
         struct svc_rqst *rqstp;
         int             error = -ENOMEM;
         int             have_oldmask = 0;
-        cpumask_t       oldmask;
+        cpumask_t       uninitialized_var(oldmask);
 
         rqstp = svc_prepare_thread(serv, pool);
         if (IS_ERR(rqstp)) {
@@ -619,16 +619,6 @@ out_thread:
 }
 
 /*
- * Create a thread in the default pool.  Caller must hold BKL.
- */
-int
-svc_create_thread(svc_thread_fn func, struct svc_serv *serv)
-{
-        return __svc_create_thread(func, serv, &serv->sv_pools[0]);
-}
-EXPORT_SYMBOL(svc_create_thread);
-
-/*
  * Choose a pool in which to create a new thread, for svc_set_num_threads
  */
 static inline struct svc_pool *
@@ -921,8 +911,7 @@ svc_process(struct svc_rqst *rqstp)
         case SVC_OK:
                 break;
         case SVC_GARBAGE:
-                rpc_stat = rpc_garbage_args;
-                goto err_bad;
+                goto err_garbage;
         case SVC_SYSERR:
                 rpc_stat = rpc_system_err;
                 goto err_bad;
diff --git a/net/sunrpc/svc_xprt.c b/net/sunrpc/svc_xprt.c
index 332eb47539e1..d8e8d79a8451 100644
--- a/net/sunrpc/svc_xprt.c
+++ b/net/sunrpc/svc_xprt.c
@@ -18,6 +18,7 @@
 #include <linux/skbuff.h>
 #include <linux/file.h>
 #include <linux/freezer.h>
+#include <linux/kthread.h>
 #include <net/sock.h>
 #include <net/checksum.h>
 #include <net/ip.h>
@@ -586,8 +587,12 @@ int svc_recv(struct svc_rqst *rqstp, long timeout)
                 while (rqstp->rq_pages[i] == NULL) {
                         struct page *p = alloc_page(GFP_KERNEL);
                         if (!p) {
-                                int j = msecs_to_jiffies(500);
-                                schedule_timeout_uninterruptible(j);
+                                set_current_state(TASK_INTERRUPTIBLE);
+                                if (signalled() || kthread_should_stop()) {
+                                        set_current_state(TASK_RUNNING);
+                                        return -EINTR;
+                                }
+                                schedule_timeout(msecs_to_jiffies(500));
                         }
                         rqstp->rq_pages[i] = p;
                 }
@@ -607,7 +612,7 @@ int svc_recv(struct svc_rqst *rqstp, long timeout)
 
         try_to_freeze();
         cond_resched();
-        if (signalled())
+        if (signalled() || kthread_should_stop())
                 return -EINTR;
 
         spin_lock_bh(&pool->sp_lock);
@@ -626,6 +631,20 @@ int svc_recv(struct svc_rqst *rqstp, long timeout)
                  * to bring down the daemons ...
                  */
                 set_current_state(TASK_INTERRUPTIBLE);
+
+                /*
+                 * checking kthread_should_stop() here allows us to avoid
+                 * locking and signalling when stopping kthreads that call
+                 * svc_recv. If the thread has already been woken up, then
+                 * we can exit here without sleeping. If not, then it
+                 * it'll be woken up quickly during the schedule_timeout
+                 */
+                if (kthread_should_stop()) {
+                        set_current_state(TASK_RUNNING);
+                        spin_unlock_bh(&pool->sp_lock);
+                        return -EINTR;
+                }
+
                 add_wait_queue(&rqstp->rq_wait, &wait);
                 spin_unlock_bh(&pool->sp_lock);
 
@@ -641,7 +660,10 @@ int svc_recv(struct svc_rqst *rqstp, long timeout)
                         svc_thread_dequeue(pool, rqstp);
                         spin_unlock_bh(&pool->sp_lock);
                         dprintk("svc: server %p, no data yet\n", rqstp);
-                        return signalled()? -EINTR : -EAGAIN;
+                        if (signalled() || kthread_should_stop())
+                                return -EINTR;
+                        else
+                                return -EAGAIN;
                 }
         }
         spin_unlock_bh(&pool->sp_lock);
diff --git a/net/sunrpc/svcauth_unix.c b/net/sunrpc/svcauth_unix.c
index 3c64051e4555..3f30ee6006ae 100644
--- a/net/sunrpc/svcauth_unix.c
+++ b/net/sunrpc/svcauth_unix.c
@@ -11,7 +11,8 @@
 #include <linux/hash.h>
 #include <linux/string.h>
 #include <net/sock.h>
-
+#include <net/ipv6.h>
+#include <linux/kernel.h>
 #define RPCDBG_FACILITY RPCDBG_AUTH
 
 
@@ -85,7 +86,7 @@ static void svcauth_unix_domain_release(struct auth_domain *dom)
 struct ip_map {
         struct cache_head       h;
         char                    m_class[8]; /* e.g. "nfsd" */
-        struct in_addr          m_addr;
+        struct in6_addr         m_addr;
         struct unix_domain      *m_client;
         int                     m_add_change;
 };
@@ -113,12 +114,19 @@ static inline int hash_ip(__be32 ip)
         return (hash ^ (hash>>8)) & 0xff;
 }
 #endif
+static inline int hash_ip6(struct in6_addr ip)
+{
+        return (hash_ip(ip.s6_addr32[0]) ^
+                hash_ip(ip.s6_addr32[1]) ^
+                hash_ip(ip.s6_addr32[2]) ^
+                hash_ip(ip.s6_addr32[3]));
+}
 static int ip_map_match(struct cache_head *corig, struct cache_head *cnew)
 {
         struct ip_map *orig = container_of(corig, struct ip_map, h);
         struct ip_map *new = container_of(cnew, struct ip_map, h);
         return strcmp(orig->m_class, new->m_class) == 0
-                && orig->m_addr.s_addr == new->m_addr.s_addr;
+                && ipv6_addr_equal(&orig->m_addr, &new->m_addr);
 }
 static void ip_map_init(struct cache_head *cnew, struct cache_head *citem)
 {
@@ -126,7 +134,7 @@ static void ip_map_init(struct cache_head *cnew, struct cache_head *citem)
         struct ip_map *item = container_of(citem, struct ip_map, h);
 
         strcpy(new->m_class, item->m_class);
-        new->m_addr.s_addr = item->m_addr.s_addr;
+        ipv6_addr_copy(&new->m_addr, &item->m_addr);
 }
 static void update(struct cache_head *cnew, struct cache_head *citem)
 {
@@ -150,22 +158,24 @@ static void ip_map_request(struct cache_detail *cd,
                                   struct cache_head *h,
                                   char **bpp, int *blen)
 {
-        char text_addr[20];
+        char text_addr[40];
         struct ip_map *im = container_of(h, struct ip_map, h);
-        __be32 addr = im->m_addr.s_addr;
-
-        snprintf(text_addr, 20, "%u.%u.%u.%u",
-                 ntohl(addr) >> 24 & 0xff,
-                 ntohl(addr) >> 16 & 0xff,
-                 ntohl(addr) >>  8 & 0xff,
-                 ntohl(addr) >>  0 & 0xff);
 
+        if (ipv6_addr_v4mapped(&(im->m_addr))) {
+                snprintf(text_addr, 20, NIPQUAD_FMT,
+                                ntohl(im->m_addr.s6_addr32[3]) >> 24 & 0xff,
+                                ntohl(im->m_addr.s6_addr32[3]) >> 16 & 0xff,
+                                ntohl(im->m_addr.s6_addr32[3]) >>  8 & 0xff,
+                                ntohl(im->m_addr.s6_addr32[3]) >>  0 & 0xff);
+        } else {
+                snprintf(text_addr, 40, NIP6_FMT, NIP6(im->m_addr));
+        }
         qword_add(bpp, blen, im->m_class);
         qword_add(bpp, blen, text_addr);
         (*bpp)[-1] = '\n';
 }
 
-static struct ip_map *ip_map_lookup(char *class, struct in_addr addr);
+static struct ip_map *ip_map_lookup(char *class, struct in6_addr *addr);
 static int ip_map_update(struct ip_map *ipm, struct unix_domain *udom, time_t expiry);
 
 static int ip_map_parse(struct cache_detail *cd,
@@ -176,10 +186,10 @@ static int ip_map_parse(struct cache_detail *cd,
          * for scratch: */
         char *buf = mesg;
         int len;
-        int b1,b2,b3,b4;
+        int b1, b2, b3, b4, b5, b6, b7, b8;
         char c;
         char class[8];
-        struct in_addr addr;
+        struct in6_addr addr;
         int err;
 
         struct ip_map *ipmp;
@@ -198,7 +208,23 @@ static int ip_map_parse(struct cache_detail *cd,
         len = qword_get(&mesg, buf, mlen);
         if (len <= 0) return -EINVAL;
 
-        if (sscanf(buf, "%u.%u.%u.%u%c", &b1, &b2, &b3, &b4, &c) != 4)
+        if (sscanf(buf, NIPQUAD_FMT "%c", &b1, &b2, &b3, &b4, &c) == 4) {
+                addr.s6_addr32[0] = 0;
+                addr.s6_addr32[1] = 0;
+                addr.s6_addr32[2] = htonl(0xffff);
+                addr.s6_addr32[3] =
+                        htonl((((((b1<<8)|b2)<<8)|b3)<<8)|b4);
+       } else if (sscanf(buf, NIP6_FMT "%c",
+                        &b1, &b2, &b3, &b4, &b5, &b6, &b7, &b8, &c) == 8) {
+                addr.s6_addr16[0] = htons(b1);
+                addr.s6_addr16[1] = htons(b2);
+                addr.s6_addr16[2] = htons(b3);
+                addr.s6_addr16[3] = htons(b4);
+                addr.s6_addr16[4] = htons(b5);
+                addr.s6_addr16[5] = htons(b6);
+                addr.s6_addr16[6] = htons(b7);
+                addr.s6_addr16[7] = htons(b8);
+       } else
                 return -EINVAL;
 
         expiry = get_expiry(&mesg);
@@ -216,10 +242,7 @@ static int ip_map_parse(struct cache_detail *cd,
         } else
                 dom = NULL;
 
-        addr.s_addr =
-                htonl((((((b1<<8)|b2)<<8)|b3)<<8)|b4);
-
-        ipmp = ip_map_lookup(class,addr);
+        ipmp = ip_map_lookup(class, &addr);
         if (ipmp) {
                 err = ip_map_update(ipmp,
                              container_of(dom, struct unix_domain, h),
@@ -239,7 +262,7 @@ static int ip_map_show(struct seq_file *m,
                        struct cache_head *h)
 {
         struct ip_map *im;
-        struct in_addr addr;
+        struct in6_addr addr;
         char *dom = "-no-domain-";
 
         if (h == NULL) {
@@ -248,20 +271,24 @@ static int ip_map_show(struct seq_file *m,
         }
         im = container_of(h, struct ip_map, h);
         /* class addr domain */
-        addr = im->m_addr;
+        ipv6_addr_copy(&addr, &im->m_addr);
 
         if (test_bit(CACHE_VALID, &h->flags) &&
             !test_bit(CACHE_NEGATIVE, &h->flags))
                 dom = im->m_client->h.name;
 
-        seq_printf(m, "%s %d.%d.%d.%d %s\n",
-                   im->m_class,
-                   ntohl(addr.s_addr) >> 24 & 0xff,
-                   ntohl(addr.s_addr) >> 16 & 0xff,
-                   ntohl(addr.s_addr) >>  8 & 0xff,
-                   ntohl(addr.s_addr) >>  0 & 0xff,
-                   dom
-                   );
+        if (ipv6_addr_v4mapped(&addr)) {
+                seq_printf(m, "%s" NIPQUAD_FMT "%s\n",
+                        im->m_class,
+                        ntohl(addr.s6_addr32[3]) >> 24 & 0xff,
+                        ntohl(addr.s6_addr32[3]) >> 16 & 0xff,
+                        ntohl(addr.s6_addr32[3]) >>  8 & 0xff,
+                        ntohl(addr.s6_addr32[3]) >>  0 & 0xff,
+                        dom);
+        } else {
+                seq_printf(m, "%s" NIP6_FMT "%s\n",
+                        im->m_class, NIP6(addr), dom);
+        }
         return 0;
 }
 
@@ -281,16 +308,16 @@ struct cache_detail ip_map_cache = {
         .alloc          = ip_map_alloc,
 };
 
-static struct ip_map *ip_map_lookup(char *class, struct in_addr addr)
+static struct ip_map *ip_map_lookup(char *class, struct in6_addr *addr)
 {
         struct ip_map ip;
         struct cache_head *ch;
 
         strcpy(ip.m_class, class);
-        ip.m_addr = addr;
+        ipv6_addr_copy(&ip.m_addr, addr);
         ch = sunrpc_cache_lookup(&ip_map_cache, &ip.h,
                                  hash_str(class, IP_HASHBITS) ^
-                                 hash_ip(addr.s_addr));
+                                 hash_ip6(*addr));
 
         if (ch)
                 return container_of(ch, struct ip_map, h);
@@ -319,14 +346,14 @@ static int ip_map_update(struct ip_map *ipm, struct unix_domain *udom, time_t ex
         ch = sunrpc_cache_update(&ip_map_cache,
                                  &ip.h, &ipm->h,
                                  hash_str(ipm->m_class, IP_HASHBITS) ^
-                                 hash_ip(ipm->m_addr.s_addr));
+                                 hash_ip6(ipm->m_addr));
         if (!ch)
                 return -ENOMEM;
         cache_put(ch, &ip_map_cache);
         return 0;
 }
 
-int auth_unix_add_addr(struct in_addr addr, struct auth_domain *dom)
+int auth_unix_add_addr(struct in6_addr *addr, struct auth_domain *dom)
 {
         struct unix_domain *udom;
         struct ip_map *ipmp;
@@ -355,7 +382,7 @@ int auth_unix_forget_old(struct auth_domain *dom)
 }
 EXPORT_SYMBOL(auth_unix_forget_old);
 
-struct auth_domain *auth_unix_lookup(struct in_addr addr)
+struct auth_domain *auth_unix_lookup(struct in6_addr *addr)
 {
         struct ip_map *ipm;
         struct auth_domain *rv;
@@ -650,9 +677,24 @@ static int unix_gid_find(uid_t uid, struct group_info **gip,
 int
 svcauth_unix_set_client(struct svc_rqst *rqstp)
 {
-        struct sockaddr_in *sin = svc_addr_in(rqstp);
+        struct sockaddr_in *sin;
+        struct sockaddr_in6 *sin6, sin6_storage;
         struct ip_map *ipm;
 
+        switch (rqstp->rq_addr.ss_family) {
+        case AF_INET:
+                sin = svc_addr_in(rqstp);
+                sin6 = &sin6_storage;
+                ipv6_addr_set(&sin6->sin6_addr, 0, 0,
+                                htonl(0x0000FFFF), sin->sin_addr.s_addr);
+                break;
+        case AF_INET6:
+                sin6 = svc_addr_in6(rqstp);
+                break;
+        default:
+                BUG();
+        }
+
         rqstp->rq_client = NULL;
         if (rqstp->rq_proc == 0)
                 return SVC_OK;
@@ -660,7 +702,7 @@ svcauth_unix_set_client(struct svc_rqst *rqstp)
         ipm = ip_map_cached_get(rqstp);
         if (ipm == NULL)
                 ipm = ip_map_lookup(rqstp->rq_server->sv_program->pg_class,
-                                    sin->sin_addr);
+                                    &sin6->sin6_addr);
 
         if (ipm == NULL)
                 return SVC_DENIED;
diff --git a/net/sunrpc/svcsock.c b/net/sunrpc/svcsock.c
index c475977de05a..3e65719f1ef6 100644
--- a/net/sunrpc/svcsock.c
+++ b/net/sunrpc/svcsock.c
@@ -38,6 +38,7 @@
 #include <net/checksum.h>
 #include <net/ip.h>
 #include <net/ipv6.h>
+#include <net/tcp.h>
 #include <net/tcp_states.h>
 #include <asm/uaccess.h>
 #include <asm/ioctls.h>
@@ -45,6 +46,7 @@
 #include <linux/sunrpc/types.h>
 #include <linux/sunrpc/clnt.h>
 #include <linux/sunrpc/xdr.h>
+#include <linux/sunrpc/msg_prot.h>
 #include <linux/sunrpc/svcsock.h>
 #include <linux/sunrpc/stats.h>
 
@@ -822,8 +824,8 @@ static int svc_tcp_recvfrom(struct svc_rqst *rqstp)
          * the next four bytes. Otherwise try to gobble up as much as
          * possible up to the complete record length.
          */
-        if (svsk->sk_tcplen < 4) {
-                unsigned long   want = 4 - svsk->sk_tcplen;
+        if (svsk->sk_tcplen < sizeof(rpc_fraghdr)) {
+                int             want = sizeof(rpc_fraghdr) - svsk->sk_tcplen;
                 struct kvec     iov;
 
                 iov.iov_base = ((char *) &svsk->sk_reclen) + svsk->sk_tcplen;
@@ -833,32 +835,31 @@ static int svc_tcp_recvfrom(struct svc_rqst *rqstp)
                 svsk->sk_tcplen += len;
 
                 if (len < want) {
-                        dprintk("svc: short recvfrom while reading record length (%d of %lu)\n",
-                                len, want);
+                        dprintk("svc: short recvfrom while reading record "
+                                "length (%d of %d)\n", len, want);
                         svc_xprt_received(&svsk->sk_xprt);
                         return -EAGAIN; /* record header not complete */
                 }
 
                 svsk->sk_reclen = ntohl(svsk->sk_reclen);
-                if (!(svsk->sk_reclen & 0x80000000)) {
+                if (!(svsk->sk_reclen & RPC_LAST_STREAM_FRAGMENT)) {
                         /* FIXME: technically, a record can be fragmented,
                          *  and non-terminal fragments will not have the top
                          *  bit set in the fragment length header.
                          *  But apparently no known nfs clients send fragmented
                          *  records. */
                         if (net_ratelimit())
-                                printk(KERN_NOTICE "RPC: bad TCP reclen 0x%08lx"
-                                       " (non-terminal)\n",
-                                       (unsigned long) svsk->sk_reclen);
+                                printk(KERN_NOTICE "RPC: multiple fragments "
+                                        "per record not supported\n");
                         goto err_delete;
                 }
-                svsk->sk_reclen &= 0x7fffffff;
+                svsk->sk_reclen &= RPC_FRAGMENT_SIZE_MASK;
                 dprintk("svc: TCP record, %d bytes\n", svsk->sk_reclen);
                 if (svsk->sk_reclen > serv->sv_max_mesg) {
                         if (net_ratelimit())
-                                printk(KERN_NOTICE "RPC: bad TCP reclen 0x%08lx"
-                                       " (large)\n",
-                                       (unsigned long) svsk->sk_reclen);
+                                printk(KERN_NOTICE "RPC: "
+                                        "fragment too large: 0x%08lx\n",
+                                        (unsigned long)svsk->sk_reclen);
                         goto err_delete;
                 }
         }
@@ -1045,7 +1046,6 @@ void svc_cleanup_xprt_sock(void)
 static void svc_tcp_init(struct svc_sock *svsk, struct svc_serv *serv)
 {
         struct sock     *sk = svsk->sk_sk;
-        struct tcp_sock *tp = tcp_sk(sk);
 
         svc_xprt_init(&svc_tcp_class, &svsk->sk_xprt, serv);
         set_bit(XPT_CACHE_AUTH, &svsk->sk_xprt.xpt_flags);
@@ -1063,7 +1063,7 @@ static void svc_tcp_init(struct svc_sock *svsk, struct svc_serv *serv)
                 svsk->sk_reclen = 0;
                 svsk->sk_tcplen = 0;
 
-                tp->nonagle = 1;        /* disable Nagle's algorithm */
+                tcp_sk(sk)->nonagle |= TCP_NAGLE_OFF;
 
                 /* initialise setting must have enough space to
                  * receive and respond to one request.
@@ -1101,6 +1101,7 @@ void svc_sock_update_bufs(struct svc_serv *serv)
         }
         spin_unlock_bh(&serv->sv_lock);
 }
+EXPORT_SYMBOL(svc_sock_update_bufs);
 
 /*
  * Initialize socket for RPC use and create svc_sock struct
diff --git a/net/sunrpc/xprtrdma/svc_rdma_transport.c b/net/sunrpc/xprtrdma/svc_rdma_transport.c
index 16fd3f6718ff..af408fc12634 100644
--- a/net/sunrpc/xprtrdma/svc_rdma_transport.c
+++ b/net/sunrpc/xprtrdma/svc_rdma_transport.c
@@ -1036,6 +1036,8 @@ int svc_rdma_send(struct svcxprt_rdma *xprt, struct ib_send_wr *wr)
                         wait_event(xprt->sc_send_wait,
                                    atomic_read(&xprt->sc_sq_count) <
                                    xprt->sc_sq_depth);
+                        if (test_bit(XPT_CLOSE, &xprt->sc_xprt.xpt_flags))
+                                return 0;
                         continue;
                 }
                 /* Bumped used SQ WR count and post */
diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c
index 1454afcc06c4..e18cd3628db4 100644
--- a/net/unix/af_unix.c
+++ b/net/unix/af_unix.c
@@ -2197,7 +2197,11 @@ static void __exit af_unix_exit(void)
         unregister_pernet_subsys(&unix_net_ops);
 }
 
-module_init(af_unix_init);
+/* Earlier than device_initcall() so that other drivers invoking
+   request_module() don't end up in a loop when modprobe tries
+   to use a UNIX socket. But later than subsys_initcall() because
+   we depend on stuff initialised there */
+fs_initcall(af_unix_init);
 module_exit(af_unix_exit);
 
 MODULE_LICENSE("GPL");