25 files changed, 306 insertions, 278 deletions
diff --git a/net/ax25/ax25_subr.c b/net/ax25/ax25_subr.c
index d8f215733175..034aa10a5198 100644
--- a/net/ax25/ax25_subr.c
+++ b/net/ax25/ax25_subr.c
@@ -64,20 +64,15 @@ void ax25_frames_acked(ax25_cb *ax25, unsigned short nr)
 void ax25_requeue_frames(ax25_cb *ax25)
 {
-        struct sk_buff *skb, *skb_prev = NULL;
+        struct sk_buff *skb;
        /*
         * Requeue all the un-ack-ed frames on the output queue to be picked
         * up by ax25_kick called from the timer. This arrangement handles the
         * possibility of an empty output queue.
         */
-        while ((skb = skb_dequeue(&ax25->ack_queue)) != NULL) {
+        while ((skb = skb_dequeue_tail(&ax25->ack_queue)) != NULL)
-                if (skb_prev == NULL)
+                skb_queue_head(&ax25->write_queue, skb);
-                        skb_queue_head(&ax25->write_queue, skb);
-                else
-                        skb_append(skb_prev, skb, &ax25->write_queue);
-                skb_prev = skb;
-        }
 }
 /*
diff --git a/net/bluetooth/rfcomm/tty.c b/net/bluetooth/rfcomm/tty.c
index c3f749abb2d0..c9191871c1e0 100644
--- a/net/bluetooth/rfcomm/tty.c
+++ b/net/bluetooth/rfcomm/tty.c
@@ -566,11 +566,22 @@ static void rfcomm_dev_state_change(struct rfcomm_dlc *dlc, int err)
        if (dlc->state == BT_CLOSED) {
                if (!dev->tty) {
                        if (test_bit(RFCOMM_RELEASE_ONHUP, &dev->flags)) {
-                                if (rfcomm_dev_get(dev->id) == NULL)
+                                /* Drop DLC lock here to avoid deadlock
+                                 * 1. rfcomm_dev_get will take rfcomm_dev_lock
+                                 *    but in rfcomm_dev_add there's lock order:
+                                 *    rfcomm_dev_lock -> dlc lock
+                                 * 2. rfcomm_dev_put will deadlock if it's
+                                 *    the last reference
+                                 */
+                                rfcomm_dlc_unlock(dlc);
+                                if (rfcomm_dev_get(dev->id) == NULL) {
+                                        rfcomm_dlc_lock(dlc);
                                        return;
+                                }
                                rfcomm_dev_del(dev);
                                rfcomm_dev_put(dev);
+                                rfcomm_dlc_lock(dlc);
                        }
                } else
                        tty_hangup(dev->tty);
diff --git a/net/core/neighbour.c b/net/core/neighbour.c
index 5d9d7130bd6e..65f01f71b3f3 100644
--- a/net/core/neighbour.c
+++ b/net/core/neighbour.c
@@ -1714,7 +1714,8 @@ static int neightbl_fill_parms(struct sk_buff *skb, struct neigh_parms *parms)
        return nla_nest_end(skb, nest);
 nla_put_failure:
-        return nla_nest_cancel(skb, nest);
+        nla_nest_cancel(skb, nest);
+        return -EMSGSIZE;
 }
 static int neightbl_fill_info(struct sk_buff *skb, struct neigh_table *tbl,
@@ -2057,9 +2058,9 @@ static int neigh_fill_info(struct sk_buff *skb, struct neighbour *neigh,
                goto nla_put_failure;
        }
-        ci.ndm_used      = now - neigh->used;
+        ci.ndm_used      = jiffies_to_clock_t(now - neigh->used);
-        ci.ndm_confirmed = now - neigh->confirmed;
+        ci.ndm_confirmed = jiffies_to_clock_t(now - neigh->confirmed);
-        ci.ndm_updated   = now - neigh->updated;
+        ci.ndm_updated   = jiffies_to_clock_t(now - neigh->updated);
        ci.ndm_refcnt    = atomic_read(&neigh->refcnt) - 1;
        read_unlock_bh(&neigh->lock);
diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
index cf857c4dc7b1..a9a77216310e 100644
--- a/net/core/rtnetlink.c
+++ b/net/core/rtnetlink.c
@@ -498,7 +498,8 @@ int rtnetlink_put_metrics(struct sk_buff *skb, u32 *metrics)
        return nla_nest_end(skb, mx);
 nla_put_failure:
-        return nla_nest_cancel(skb, mx);
+        nla_nest_cancel(skb, mx);
+        return -EMSGSIZE;
 }
 int rtnl_put_cacheinfo(struct sk_buff *skb, struct dst_entry *dst, u32 id,
diff --git a/net/core/user_dma.c b/net/core/user_dma.c
index 0ad1cd57bc39..c77aff9c6eb3 100644
--- a/net/core/user_dma.c
+++ b/net/core/user_dma.c
@@ -75,7 +75,7 @@ int dma_skb_copy_datagram_iovec(struct dma_chan *chan,
                end = start + skb_shinfo(skb)->frags[i].size;
                copy = end - offset;
-                if ((copy = end - offset) > 0) {
+                if (copy > 0) {
                        skb_frag_t *frag = &skb_shinfo(skb)->frags[i];
                        struct page *page = frag->page;
diff --git a/net/ipv4/devinet.c b/net/ipv4/devinet.c
index 6848e4760f34..79a7ef6209ff 100644
--- a/net/ipv4/devinet.c
+++ b/net/ipv4/devinet.c
@@ -90,7 +90,6 @@ static const struct nla_policy ifa_ipv4_policy[IFA_MAX+1] = {
        [IFA_LOCAL]             = { .type = NLA_U32 },
        [IFA_ADDRESS]           = { .type = NLA_U32 },
        [IFA_BROADCAST]         = { .type = NLA_U32 },
-        [IFA_ANYCAST]           = { .type = NLA_U32 },
        [IFA_LABEL]             = { .type = NLA_STRING, .len = IFNAMSIZ - 1 },
 };
@@ -536,9 +535,6 @@ static struct in_ifaddr *rtm_to_ifaddr(struct net *net, struct nlmsghdr *nlh)
        if (tb[IFA_BROADCAST])
                ifa->ifa_broadcast = nla_get_be32(tb[IFA_BROADCAST]);
-        if (tb[IFA_ANYCAST])
-                ifa->ifa_anycast = nla_get_be32(tb[IFA_ANYCAST]);
        if (tb[IFA_LABEL])
                nla_strlcpy(ifa->ifa_label, tb[IFA_LABEL], IFNAMSIZ);
        else
@@ -745,7 +741,6 @@ int devinet_ioctl(struct net *net, unsigned int cmd, void __user *arg)
                                break;
                        inet_del_ifa(in_dev, ifap, 0);
                        ifa->ifa_broadcast = 0;
-                        ifa->ifa_anycast = 0;
                        ifa->ifa_scope = 0;
                }
@@ -1113,7 +1108,6 @@ static inline size_t inet_nlmsg_size(void)
               + nla_total_size(4) /* IFA_ADDRESS */
               + nla_total_size(4) /* IFA_LOCAL */
               + nla_total_size(4) /* IFA_BROADCAST */
-               + nla_total_size(4) /* IFA_ANYCAST */
               + nla_total_size(IFNAMSIZ); /* IFA_LABEL */
 }
@@ -1143,9 +1137,6 @@ static int inet_fill_ifaddr(struct sk_buff *skb, struct in_ifaddr *ifa,
        if (ifa->ifa_broadcast)
                NLA_PUT_BE32(skb, IFA_BROADCAST, ifa->ifa_broadcast);
-        if (ifa->ifa_anycast)
-                NLA_PUT_BE32(skb, IFA_ANYCAST, ifa->ifa_anycast);
        if (ifa->ifa_label[0])
                NLA_PUT_STRING(skb, IFA_LABEL, ifa->ifa_label);
diff --git a/net/ipv4/fib_frontend.c b/net/ipv4/fib_frontend.c
index 0f1557a4ac7a..0b2ac6a3d903 100644
--- a/net/ipv4/fib_frontend.c
+++ b/net/ipv4/fib_frontend.c
@@ -506,7 +506,6 @@ const struct nla_policy rtm_ipv4_policy[RTA_MAX+1] = {
        [RTA_PREFSRC]           = { .type = NLA_U32 },
        [RTA_METRICS]           = { .type = NLA_NESTED },
        [RTA_MULTIPATH]         = { .len = sizeof(struct rtnexthop) },
-        [RTA_PROTOINFO]         = { .type = NLA_U32 },
        [RTA_FLOW]              = { .type = NLA_U32 },
 };
diff --git a/net/ipv4/route.c b/net/ipv4/route.c
index df41026b60db..96be336064fb 100644
--- a/net/ipv4/route.c
+++ b/net/ipv4/route.c
@@ -1792,7 +1792,7 @@ static int __mkroute_input(struct sk_buff *skb,
        if (err)
                flags |= RTCF_DIRECTSRC;
-        if (out_dev == in_dev && err && !(flags & RTCF_MASQ) &&
+        if (out_dev == in_dev && err &&
            (IN_DEV_SHARED_MEDIA(out_dev) ||
             inet_addr_onlink(out_dev, saddr, FIB_RES_GW(*res))))
                flags |= RTCF_DOREDIRECT;
diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
index b54d9d37b636..54a0b7412782 100644
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -2483,6 +2483,20 @@ static inline void tcp_complete_cwr(struct sock *sk)
        tcp_ca_event(sk, CA_EVENT_COMPLETE_CWR);
 }
+static void tcp_try_keep_open(struct sock *sk)
+{
+        struct tcp_sock *tp = tcp_sk(sk);
+        int state = TCP_CA_Open;
+        if (tcp_left_out(tp) || tp->retrans_out || tp->undo_marker)
+                state = TCP_CA_Disorder;
+        if (inet_csk(sk)->icsk_ca_state != state) {
+                tcp_set_ca_state(sk, state);
+                tp->high_seq = tp->snd_nxt;
+        }
+}
 static void tcp_try_to_open(struct sock *sk, int flag)
 {
        struct tcp_sock *tp = tcp_sk(sk);
@@ -2496,15 +2510,7 @@ static void tcp_try_to_open(struct sock *sk, int flag)
                tcp_enter_cwr(sk, 1);
        if (inet_csk(sk)->icsk_ca_state != TCP_CA_CWR) {
-                int state = TCP_CA_Open;
+                tcp_try_keep_open(sk);
-                if (tcp_left_out(tp) || tp->retrans_out || tp->undo_marker)
-                        state = TCP_CA_Disorder;
-                if (inet_csk(sk)->icsk_ca_state != state) {
-                        tcp_set_ca_state(sk, state);
-                        tp->high_seq = tp->snd_nxt;
-                }
                tcp_moderate_cwnd(tp);
        } else {
                tcp_cwnd_down(sk, flag);
@@ -3310,8 +3316,11 @@ no_queue:
        return 1;
 old_ack:
-        if (TCP_SKB_CB(skb)->sacked)
+        if (TCP_SKB_CB(skb)->sacked) {
                tcp_sacktag_write_queue(sk, skb, prior_snd_una);
+                if (icsk->icsk_ca_state == TCP_CA_Open)
+                        tcp_try_keep_open(sk);
+        }
 uninteresting_ack:
        SOCK_DEBUG(sk, "Ack %u out of %u:%u\n", ack, tp->snd_una, tp->snd_nxt);
diff --git a/net/ipv6/netfilter/nf_conntrack_reasm.c b/net/ipv6/netfilter/nf_conntrack_reasm.c
index 2dccad48058c..e65e26e210ee 100644
--- a/net/ipv6/netfilter/nf_conntrack_reasm.c
+++ b/net/ipv6/netfilter/nf_conntrack_reasm.c
@@ -209,7 +209,9 @@ fq_find(__be32 id, struct in6_addr *src, struct in6_addr *dst)
        arg.dst = dst;
        hash = ip6qhashfn(id, src, dst);
+        local_bh_disable();
        q = inet_frag_find(&nf_init_frags, &nf_frags, &arg, hash);
+        local_bh_enable();
        if (q == NULL)
                goto oom;
@@ -638,10 +640,10 @@ struct sk_buff *nf_ct_frag6_gather(struct sk_buff *skb)
                goto ret_orig;
        }
-        spin_lock(&fq->q.lock);
+        spin_lock_bh(&fq->q.lock);
        if (nf_ct_frag6_queue(fq, clone, fhdr, nhoff) < 0) {
-                spin_unlock(&fq->q.lock);
+                spin_unlock_bh(&fq->q.lock);
                pr_debug("Can't insert skb to queue\n");
                fq_put(fq);
                goto ret_orig;
@@ -653,7 +655,7 @@ struct sk_buff *nf_ct_frag6_gather(struct sk_buff *skb)
                if (ret_skb == NULL)
                        pr_debug("Can't reassemble fragmented packets\n");
        }
-        spin_unlock(&fq->q.lock);
+        spin_unlock_bh(&fq->q.lock);
        fq_put(fq);
        return ret_skb;
diff --git a/net/irda/af_irda.c b/net/irda/af_irda.c
index ae54b20d0470..3eb5bcc75f99 100644
--- a/net/irda/af_irda.c
+++ b/net/irda/af_irda.c
@@ -1093,11 +1093,6 @@ static int irda_create(struct net *net, struct socket *sock, int protocol)
        init_waitqueue_head(&self->query_wait);
-        /* Initialise networking socket struct */
-        sock_init_data(sock, sk);       /* Note : set sk->sk_refcnt to 1 */
-        sk->sk_family = PF_IRDA;
-        sk->sk_protocol = protocol;
        switch (sock->type) {
        case SOCK_STREAM:
                sock->ops = &irda_stream_ops;
@@ -1124,13 +1119,20 @@ static int irda_create(struct net *net, struct socket *sock, int protocol)
                        self->max_sdu_size_rx = TTP_SAR_UNBOUND;
                        break;
                default:
+                        sk_free(sk);
                        return -ESOCKTNOSUPPORT;
                }
                break;
        default:
+                sk_free(sk);
                return -ESOCKTNOSUPPORT;
        }
+        /* Initialise networking socket struct */
+        sock_init_data(sock, sk);       /* Note : set sk->sk_refcnt to 1 */
+        sk->sk_family = PF_IRDA;
+        sk->sk_protocol = protocol;
        /* Register as a client with IrLMP */
        self->ckey = irlmp_register_client(0, NULL, NULL, NULL);
        self->mask.word = 0xffff;
diff --git a/net/netfilter/xt_connlimit.c b/net/netfilter/xt_connlimit.c
index 2e89a00df92c..70907f6baac3 100644
--- a/net/netfilter/xt_connlimit.c
+++ b/net/netfilter/xt_connlimit.c
@@ -73,7 +73,8 @@ connlimit_iphash6(const union nf_inet_addr *addr,
 static inline bool already_closed(const struct nf_conn *conn)
 {
        if (nf_ct_protonum(conn) == IPPROTO_TCP)
-                return conn->proto.tcp.state == TCP_CONNTRACK_TIME_WAIT;
+                return conn->proto.tcp.state == TCP_CONNTRACK_TIME_WAIT ||
+                       conn->proto.tcp.state == TCP_CONNTRACK_CLOSE;
        else
                return 0;
 }
diff --git a/net/netlink/attr.c b/net/netlink/attr.c
index feb326f4a752..47bbf45ae5d7 100644
--- a/net/netlink/attr.c
+++ b/net/netlink/attr.c
@@ -400,13 +400,13 @@ void __nla_put_nohdr(struct sk_buff *skb, int attrlen, const void *data)
 * @attrlen: length of attribute payload
 * @data: head of attribute payload
 *
- * Returns -1 if the tailroom of the skb is insufficient to store
+ * Returns -EMSGSIZE if the tailroom of the skb is insufficient to store
 * the attribute header and payload.
 */
 int nla_put(struct sk_buff *skb, int attrtype, int attrlen, const void *data)
 {
        if (unlikely(skb_tailroom(skb) < nla_total_size(attrlen)))
-                return -1;
+                return -EMSGSIZE;
        __nla_put(skb, attrtype, attrlen, data);
        return 0;
@@ -418,13 +418,13 @@ int nla_put(struct sk_buff *skb, int attrtype, int attrlen, const void *data)
 * @attrlen: length of attribute payload
 * @data: head of attribute payload
 *
- * Returns -1 if the tailroom of the skb is insufficient to store
+ * Returns -EMSGSIZE if the tailroom of the skb is insufficient to store
 * the attribute payload.
 */
 int nla_put_nohdr(struct sk_buff *skb, int attrlen, const void *data)
 {
        if (unlikely(skb_tailroom(skb) < NLA_ALIGN(attrlen)))
-                return -1;
+                return -EMSGSIZE;
        __nla_put_nohdr(skb, attrlen, data);
        return 0;
@@ -436,13 +436,13 @@ int nla_put_nohdr(struct sk_buff *skb, int attrlen, const void *data)
 * @attrlen: length of attribute payload
 * @data: head of attribute payload
 *
- * Returns -1 if the tailroom of the skb is insufficient to store
+ * Returns -EMSGSIZE if the tailroom of the skb is insufficient to store
 * the attribute payload.
 */
 int nla_append(struct sk_buff *skb, int attrlen, const void *data)
 {
        if (unlikely(skb_tailroom(skb) < NLA_ALIGN(attrlen)))
-                return -1;
+                return -EMSGSIZE;
        memcpy(skb_put(skb, attrlen), data, attrlen);
        return 0;
diff --git a/net/netlink/genetlink.c b/net/netlink/genetlink.c
index d16929c9b4bc..f5aa23c3e886 100644
--- a/net/netlink/genetlink.c
+++ b/net/netlink/genetlink.c
@@ -554,7 +554,8 @@ static int ctrl_fill_info(struct genl_family *family, u32 pid, u32 seq,
        return genlmsg_end(skb, hdr);
 nla_put_failure:
-        return genlmsg_cancel(skb, hdr);
+        genlmsg_cancel(skb, hdr);
+        return -EMSGSIZE;
 }
 static int ctrl_fill_mcgrp_info(struct genl_multicast_group *grp, u32 pid,
@@ -590,7 +591,8 @@ static int ctrl_fill_mcgrp_info(struct genl_multicast_group *grp, u32 pid,
        return genlmsg_end(skb, hdr);
 nla_put_failure:
-        return genlmsg_cancel(skb, hdr);
+        genlmsg_cancel(skb, hdr);
+        return -EMSGSIZE;
 }
 static int ctrl_dumpfamily(struct sk_buff *skb, struct netlink_callback *cb)
diff --git a/net/sched/sch_dsmark.c b/net/sched/sch_dsmark.c
index 0df911fd67b1..64465bacbe79 100644
--- a/net/sched/sch_dsmark.c
+++ b/net/sched/sch_dsmark.c
@@ -444,7 +444,8 @@ static int dsmark_dump_class(struct Qdisc *sch, unsigned long cl,
        return nla_nest_end(skb, opts);
 nla_put_failure:
-        return nla_nest_cancel(skb, opts);
+        nla_nest_cancel(skb, opts);
+        return -EMSGSIZE;
 }
 static int dsmark_dump(struct Qdisc *sch, struct sk_buff *skb)
@@ -466,7 +467,8 @@ static int dsmark_dump(struct Qdisc *sch, struct sk_buff *skb)
        return nla_nest_end(skb, opts);
 nla_put_failure:
-        return nla_nest_cancel(skb, opts);
+        nla_nest_cancel(skb, opts);
+        return -EMSGSIZE;
 }
 static const struct Qdisc_class_ops dsmark_class_ops = {
diff --git a/net/sched/sch_gred.c b/net/sched/sch_gred.c
index 3a9d226ff1e4..c89fba56db56 100644
--- a/net/sched/sch_gred.c
+++ b/net/sched/sch_gred.c
@@ -582,7 +582,8 @@ append_opt:
        return nla_nest_end(skb, opts);
 nla_put_failure:
-        return nla_nest_cancel(skb, opts);
+        nla_nest_cancel(skb, opts);
+        return -EMSGSIZE;
 }
 static void gred_destroy(struct Qdisc *sch)
diff --git a/net/sched/sch_hfsc.c b/net/sched/sch_hfsc.c
index 87293d0db1d7..fdfaa3fcc16d 100644
--- a/net/sched/sch_hfsc.c
+++ b/net/sched/sch_hfsc.c
@@ -1360,7 +1360,7 @@ hfsc_dump_class(struct Qdisc *sch, unsigned long arg, struct sk_buff *skb,
 nla_put_failure:
        nla_nest_cancel(skb, nest);
-        return -1;
+        return -EMSGSIZE;
 }
 static int
diff --git a/net/sched/sch_red.c b/net/sched/sch_red.c
index 3dcd493f4f4a..5c569853b9c0 100644
--- a/net/sched/sch_red.c
+++ b/net/sched/sch_red.c
@@ -281,7 +281,8 @@ static int red_dump(struct Qdisc *sch, struct sk_buff *skb)
        return nla_nest_end(skb, opts);
 nla_put_failure:
-        return nla_nest_cancel(skb, opts);
+        nla_nest_cancel(skb, opts);
+        return -EMSGSIZE;
 }
 static int red_dump_stats(struct Qdisc *sch, struct gnet_dump *d)
diff --git a/net/sunrpc/auth_generic.c b/net/sunrpc/auth_generic.c
index d927d9f57412..744b79fdcb19 100644
--- a/net/sunrpc/auth_generic.c
+++ b/net/sunrpc/auth_generic.c
@@ -17,8 +17,8 @@
 # define RPCDBG_FACILITY        RPCDBG_AUTH
 #endif
-#define RPC_ANONYMOUS_USERID    ((uid_t)-2)
+#define RPC_MACHINE_CRED_USERID         ((uid_t)0)
-#define RPC_ANONYMOUS_GROUPID   ((gid_t)-2)
+#define RPC_MACHINE_CRED_GROUPID        ((gid_t)0)
 struct generic_cred {
        struct rpc_cred gc_base;
@@ -44,8 +44,8 @@ EXPORT_SYMBOL_GPL(rpc_lookup_cred);
 struct rpc_cred *rpc_lookup_machine_cred(void)
 {
        struct auth_cred acred = {
-                .uid = RPC_ANONYMOUS_USERID,
+                .uid = RPC_MACHINE_CRED_USERID,
-                .gid = RPC_ANONYMOUS_GROUPID,
+                .gid = RPC_MACHINE_CRED_GROUPID,
                .machine_cred = 1,
        };
diff --git a/net/sunrpc/svc_xprt.c b/net/sunrpc/svc_xprt.c
index d8e8d79a8451..e46c825f4954 100644
--- a/net/sunrpc/svc_xprt.c
+++ b/net/sunrpc/svc_xprt.c
@@ -6,30 +6,9 @@
 #include <linux/sched.h>
 #include <linux/errno.h>
-#include <linux/fcntl.h>
-#include <linux/net.h>
-#include <linux/in.h>
-#include <linux/inet.h>
-#include <linux/udp.h>
-#include <linux/tcp.h>
-#include <linux/unistd.h>
-#include <linux/slab.h>
-#include <linux/netdevice.h>
-#include <linux/skbuff.h>
-#include <linux/file.h>
 #include <linux/freezer.h>
 #include <linux/kthread.h>
 #include <net/sock.h>
-#include <net/checksum.h>
-#include <net/ip.h>
-#include <net/ipv6.h>
-#include <net/tcp_states.h>
-#include <linux/uaccess.h>
-#include <asm/ioctls.h>
-#include <linux/sunrpc/types.h>
-#include <linux/sunrpc/clnt.h>
-#include <linux/sunrpc/xdr.h>
 #include <linux/sunrpc/stats.h>
 #include <linux/sunrpc/svc_xprt.h>
@@ -296,8 +275,6 @@ void svc_xprt_enqueue(struct svc_xprt *xprt)
        if (!(xprt->xpt_flags &
              ((1<<XPT_CONN)|(1<<XPT_DATA)|(1<<XPT_CLOSE)|(1<<XPT_DEFERRED))))
                return;
-        if (test_bit(XPT_DEAD, &xprt->xpt_flags))
-                return;
        cpu = get_cpu();
        pool = svc_pool_for_cpu(xprt->xpt_server, cpu);
diff --git a/net/sunrpc/svcauth_unix.c b/net/sunrpc/svcauth_unix.c
index 3f30ee6006ae..f24800f2c098 100644
--- a/net/sunrpc/svcauth_unix.c
+++ b/net/sunrpc/svcauth_unix.c
@@ -278,7 +278,7 @@ static int ip_map_show(struct seq_file *m,
                dom = im->m_client->h.name;
        if (ipv6_addr_v4mapped(&addr)) {
-                seq_printf(m, "%s" NIPQUAD_FMT "%s\n",
+                seq_printf(m, "%s " NIPQUAD_FMT " %s\n",
                        im->m_class,
                        ntohl(addr.s6_addr32[3]) >> 24 & 0xff,
                        ntohl(addr.s6_addr32[3]) >> 16 & 0xff,
@@ -286,7 +286,7 @@ static int ip_map_show(struct seq_file *m,
                        ntohl(addr.s6_addr32[3]) >>  0 & 0xff,
                        dom);
        } else {
-                seq_printf(m, "%s" NIP6_FMT "%s\n",
+                seq_printf(m, "%s " NIP6_FMT " %s\n",
                        im->m_class, NIP6(addr), dom);
        }
        return 0;
diff --git a/net/sunrpc/xprtrdma/svc_rdma_recvfrom.c b/net/sunrpc/xprtrdma/svc_rdma_recvfrom.c
index c22d6b6f2db4..06ab4841537b 100644
--- a/net/sunrpc/xprtrdma/svc_rdma_recvfrom.c
+++ b/net/sunrpc/xprtrdma/svc_rdma_recvfrom.c
@@ -260,11 +260,16 @@ static int rdma_read_max_sge(struct svcxprt_rdma *xprt, int sge_count)
 * On our side, we need to read into a pagelist. The first page immediately
 * follows the RPC header.
 *
- * This function returns 1 to indicate success. The data is not yet in
+ * This function returns:
+ * 0 - No error and no read-list found.
+ *
+ * 1 - Successful read-list processing. The data is not yet in
 * the pagelist and therefore the RPC request must be deferred. The
 * I/O completion will enqueue the transport again and
 * svc_rdma_recvfrom will complete the request.
 *
+ * <0 - Error processing/posting read-list.
+ *
 * NOTE: The ctxt must not be touched after the last WR has been posted
 * because the I/O completion processing may occur on another
 * processor and free / modify the context. Ne touche pas!
@@ -284,7 +289,6 @@ static int rdma_read_xdr(struct svcxprt_rdma *xprt,
        u64 sgl_offset;
        struct rpcrdma_read_chunk *ch;
        struct svc_rdma_op_ctxt *ctxt = NULL;
-        struct svc_rdma_op_ctxt *head;
        struct svc_rdma_op_ctxt *tmp_sge_ctxt;
        struct svc_rdma_op_ctxt *tmp_ch_ctxt;
        struct chunk_sge *ch_sge_ary;
@@ -302,25 +306,19 @@ static int rdma_read_xdr(struct svcxprt_rdma *xprt,
        ch_sge_ary = (struct chunk_sge *)tmp_ch_ctxt->sge;
        svc_rdma_rcl_chunk_counts(ch, &ch_count, &byte_count);
+        if (ch_count > RPCSVC_MAXPAGES)
+                return -EINVAL;
        sge_count = rdma_rcl_to_sge(xprt, rqstp, hdr_ctxt, rmsgp,
                                    sge, ch_sge_ary,
                                    ch_count, byte_count);
-        head = svc_rdma_get_context(xprt);
        sgl_offset = 0;
        ch_no = 0;
        for (ch = (struct rpcrdma_read_chunk *)&rmsgp->rm_body.rm_chunks[0];
             ch->rc_discrim != 0; ch++, ch_no++) {
 next_sge:
-                if (!ctxt)
+                ctxt = svc_rdma_get_context(xprt);
-                        ctxt = head;
-                else {
-                        ctxt->next = svc_rdma_get_context(xprt);
-                        ctxt = ctxt->next;
-                }
-                ctxt->next = NULL;
                ctxt->direction = DMA_FROM_DEVICE;
-                clear_bit(RDMACTXT_F_READ_DONE, &ctxt->flags);
                clear_bit(RDMACTXT_F_LAST_CTXT, &ctxt->flags);
                /* Prepare READ WR */
@@ -347,20 +345,15 @@ next_sge:
                         * the client and the RPC needs to be enqueued.
                         */
                        set_bit(RDMACTXT_F_LAST_CTXT, &ctxt->flags);
-                        ctxt->next = hdr_ctxt;
+                        ctxt->read_hdr = hdr_ctxt;
-                        hdr_ctxt->next = head;
                }
                /* Post the read */
                err = svc_rdma_send(xprt, &read_wr);
                if (err) {
-                        printk(KERN_ERR "svcrdma: Error posting send = %d\n",
+                        printk(KERN_ERR "svcrdma: Error %d posting RDMA_READ\n",
                               err);
-                        /*
+                        set_bit(XPT_CLOSE, &xprt->sc_xprt.xpt_flags);
-                         * Break the circular list so free knows when
+                        svc_rdma_put_context(ctxt, 0);
-                         * to stop if the error happened to occur on
-                         * the last read
-                         */
-                        ctxt->next = NULL;
                        goto out;
                }
                atomic_inc(&rdma_stat_read);
@@ -371,7 +364,7 @@ next_sge:
                        goto next_sge;
                }
                sgl_offset = 0;
-                err = 0;
+                err = 1;
        }
 out:
@@ -389,25 +382,12 @@ next_sge:
        while (rqstp->rq_resused)
                rqstp->rq_respages[--rqstp->rq_resused] = NULL;
-        if (err) {
+        return err;
-                printk(KERN_ERR "svcrdma : RDMA_READ error = %d\n", err);
-                set_bit(XPT_CLOSE, &xprt->sc_xprt.xpt_flags);
-                /* Free the linked list of read contexts */
-                while (head != NULL) {
-                        ctxt = head->next;
-                        svc_rdma_put_context(head, 1);
-                        head = ctxt;
-                }
-                return 0;
-        }
-        return 1;
 }
 static int rdma_read_complete(struct svc_rqst *rqstp,
-                              struct svc_rdma_op_ctxt *data)
+                              struct svc_rdma_op_ctxt *head)
 {
-        struct svc_rdma_op_ctxt *head = data->next;
        int page_no;
        int ret;
@@ -433,21 +413,12 @@ static int rdma_read_complete(struct svc_rqst *rqstp,
        rqstp->rq_arg.len = head->arg.len;
        rqstp->rq_arg.buflen = head->arg.buflen;
+        /* Free the context */
+        svc_rdma_put_context(head, 0);
        /* XXX: What should this be? */
        rqstp->rq_prot = IPPROTO_MAX;
+        svc_xprt_copy_addrs(rqstp, rqstp->rq_xprt);
-        /*
-         * Free the contexts we used to build the RDMA_READ. We have
-         * to be careful here because the context list uses the same
-         * next pointer used to chain the contexts associated with the
-         * RDMA_READ
-         */
-        data->next = NULL;      /* terminate circular list */
-        do {
-                data = head->next;
-                svc_rdma_put_context(head, 0);
-                head = data;
-        } while (head != NULL);
        ret = rqstp->rq_arg.head[0].iov_len
                + rqstp->rq_arg.page_len
@@ -457,8 +428,6 @@ static int rdma_read_complete(struct svc_rqst *rqstp,
                ret, rqstp->rq_arg.len, rqstp->rq_arg.head[0].iov_base,
                rqstp->rq_arg.head[0].iov_len);
-        /* Indicate that we've consumed an RQ credit */
-        rqstp->rq_xprt_ctxt = rqstp->rq_xprt;
        svc_xprt_received(rqstp->rq_xprt);
        return ret;
 }
@@ -480,13 +449,6 @@ int svc_rdma_recvfrom(struct svc_rqst *rqstp)
        dprintk("svcrdma: rqstp=%p\n", rqstp);
-        /*
-         * The rq_xprt_ctxt indicates if we've consumed an RQ credit
-         * or not. It is used in the rdma xpo_release_rqst function to
-         * determine whether or not to return an RQ WQE to the RQ.
-         */
-        rqstp->rq_xprt_ctxt = NULL;
        spin_lock_bh(&rdma_xprt->sc_read_complete_lock);
        if (!list_empty(&rdma_xprt->sc_read_complete_q)) {
                ctxt = list_entry(rdma_xprt->sc_read_complete_q.next,
@@ -537,21 +499,22 @@ int svc_rdma_recvfrom(struct svc_rqst *rqstp)
        /* If the request is invalid, reply with an error */
        if (len < 0) {
                if (len == -ENOSYS)
-                        (void)svc_rdma_send_error(rdma_xprt, rmsgp, ERR_VERS);
+                        svc_rdma_send_error(rdma_xprt, rmsgp, ERR_VERS);
                goto close_out;
        }
-        /* Read read-list data. If we would need to wait, defer
+        /* Read read-list data. */
-         * it. Not that in this case, we don't return the RQ credit
+        ret = rdma_read_xdr(rdma_xprt, rmsgp, rqstp, ctxt);
-         * until after the read completes.
+        if (ret > 0) {
-         */
+                /* read-list posted, defer until data received from client. */
-        if (rdma_read_xdr(rdma_xprt, rmsgp, rqstp, ctxt)) {
                svc_xprt_received(xprt);
                return 0;
        }
+        if (ret < 0) {
-        /* Indicate we've consumed an RQ credit */
+                /* Post of read-list failed, free context. */
-        rqstp->rq_xprt_ctxt = rqstp->rq_xprt;
+                svc_rdma_put_context(ctxt, 1);
+                return 0;
+        }
        ret = rqstp->rq_arg.head[0].iov_len
                + rqstp->rq_arg.page_len
@@ -569,11 +532,8 @@ int svc_rdma_recvfrom(struct svc_rqst *rqstp)
        return ret;
 close_out:
-        if (ctxt) {
+        if (ctxt)
                svc_rdma_put_context(ctxt, 1);
-                /* Indicate we've consumed an RQ credit */
-                rqstp->rq_xprt_ctxt = rqstp->rq_xprt;
-        }
        dprintk("svcrdma: transport %p is closing\n", xprt);
        /*
         * Set the close bit and enqueue it. svc_recv will see the
diff --git a/net/sunrpc/xprtrdma/svc_rdma_sendto.c b/net/sunrpc/xprtrdma/svc_rdma_sendto.c
index 981f190c1b39..fb82b1b683f8 100644
--- a/net/sunrpc/xprtrdma/svc_rdma_sendto.c
+++ b/net/sunrpc/xprtrdma/svc_rdma_sendto.c
@@ -389,6 +389,17 @@ static int send_reply(struct svcxprt_rdma *rdma,
        int page_no;
        int ret;
+        /* Post a recv buffer to handle another request. */
+        ret = svc_rdma_post_recv(rdma);
+        if (ret) {
+                printk(KERN_INFO
+                       "svcrdma: could not post a receive buffer, err=%d."
+                       "Closing transport %p.\n", ret, rdma);
+                set_bit(XPT_CLOSE, &rdma->sc_xprt.xpt_flags);
+                svc_rdma_put_context(ctxt, 0);
+                return -ENOTCONN;
+        }
        /* Prepare the context */
        ctxt->pages[0] = page;
        ctxt->count = 1;
diff --git a/net/sunrpc/xprtrdma/svc_rdma_transport.c b/net/sunrpc/xprtrdma/svc_rdma_transport.c
index af408fc12634..e132509d1db0 100644
--- a/net/sunrpc/xprtrdma/svc_rdma_transport.c
+++ b/net/sunrpc/xprtrdma/svc_rdma_transport.c
@@ -103,8 +103,8 @@ static int rdma_bump_context_cache(struct svcxprt_rdma *xprt)
                spin_lock_bh(&xprt->sc_ctxt_lock);
                if (ctxt) {
                        at_least_one = 1;
-                        ctxt->next = xprt->sc_ctxt_head;
+                        INIT_LIST_HEAD(&ctxt->free_list);
-                        xprt->sc_ctxt_head = ctxt;
+                        list_add(&ctxt->free_list, &xprt->sc_ctxt_free);
                } else {
                        /* kmalloc failed...give up for now */
                        xprt->sc_ctxt_cnt--;
@@ -123,7 +123,7 @@ struct svc_rdma_op_ctxt *svc_rdma_get_context(struct svcxprt_rdma *xprt)
        while (1) {
                spin_lock_bh(&xprt->sc_ctxt_lock);
-                if (unlikely(xprt->sc_ctxt_head == NULL)) {
+                if (unlikely(list_empty(&xprt->sc_ctxt_free))) {
                        /* Try to bump my cache. */
                        spin_unlock_bh(&xprt->sc_ctxt_lock);
@@ -136,12 +136,15 @@ struct svc_rdma_op_ctxt *svc_rdma_get_context(struct svcxprt_rdma *xprt)
                        schedule_timeout_uninterruptible(msecs_to_jiffies(500));
                        continue;
                }
-                ctxt = xprt->sc_ctxt_head;
+                ctxt = list_entry(xprt->sc_ctxt_free.next,
-                xprt->sc_ctxt_head = ctxt->next;
+                                  struct svc_rdma_op_ctxt,
+                                  free_list);
+                list_del_init(&ctxt->free_list);
                spin_unlock_bh(&xprt->sc_ctxt_lock);
                ctxt->xprt = xprt;
                INIT_LIST_HEAD(&ctxt->dto_q);
                ctxt->count = 0;
+                atomic_inc(&xprt->sc_ctxt_used);
                break;
        }
        return ctxt;
@@ -159,14 +162,15 @@ void svc_rdma_put_context(struct svc_rdma_op_ctxt *ctxt, int free_pages)
                        put_page(ctxt->pages[i]);
        for (i = 0; i < ctxt->count; i++)
-                dma_unmap_single(xprt->sc_cm_id->device->dma_device,
+                ib_dma_unmap_single(xprt->sc_cm_id->device,
-                                 ctxt->sge[i].addr,
+                                    ctxt->sge[i].addr,
-                                 ctxt->sge[i].length,
+                                    ctxt->sge[i].length,
-                                 ctxt->direction);
+                                    ctxt->direction);
        spin_lock_bh(&xprt->sc_ctxt_lock);
-        ctxt->next = xprt->sc_ctxt_head;
+        list_add(&ctxt->free_list, &xprt->sc_ctxt_free);
-        xprt->sc_ctxt_head = ctxt;
        spin_unlock_bh(&xprt->sc_ctxt_lock);
+        atomic_dec(&xprt->sc_ctxt_used);
 }
 /* ib_cq event handler */
@@ -228,23 +232,8 @@ static void dto_tasklet_func(unsigned long data)
                list_del_init(&xprt->sc_dto_q);
                spin_unlock_irqrestore(&dto_lock, flags);
-                if (test_and_clear_bit(RDMAXPRT_RQ_PENDING, &xprt->sc_flags)) {
+                rq_cq_reap(xprt);
-                        ib_req_notify_cq(xprt->sc_rq_cq, IB_CQ_NEXT_COMP);
+                sq_cq_reap(xprt);
-                        rq_cq_reap(xprt);
-                        set_bit(XPT_DATA, &xprt->sc_xprt.xpt_flags);
-                        /*
-                         * If data arrived before established event,
-                         * don't enqueue. This defers RPC I/O until the
-                         * RDMA connection is complete.
-                         */
-                        if (!test_bit(RDMAXPRT_CONN_PENDING, &xprt->sc_flags))
-                                svc_xprt_enqueue(&xprt->sc_xprt);
-                }
-                if (test_and_clear_bit(RDMAXPRT_SQ_PENDING, &xprt->sc_flags)) {
-                        ib_req_notify_cq(xprt->sc_sq_cq, IB_CQ_NEXT_COMP);
-                        sq_cq_reap(xprt);
-                }
                svc_xprt_put(&xprt->sc_xprt);
                spin_lock_irqsave(&dto_lock, flags);
@@ -263,11 +252,15 @@ static void rq_comp_handler(struct ib_cq *cq, void *cq_context)
        struct svcxprt_rdma *xprt = cq_context;
        unsigned long flags;
+        /* Guard against unconditional flush call for destroyed QP */
+        if (atomic_read(&xprt->sc_xprt.xpt_ref.refcount)==0)
+                return;
        /*
         * Set the bit regardless of whether or not it's on the list
         * because it may be on the list already due to an SQ
         * completion.
-        */
+         */
        set_bit(RDMAXPRT_RQ_PENDING, &xprt->sc_flags);
        /*
@@ -290,6 +283,8 @@ static void rq_comp_handler(struct ib_cq *cq, void *cq_context)
 *
 * Take all completing WC off the CQE and enqueue the associated DTO
 * context on the dto_q for the transport.
+ *
+ * Note that caller must hold a transport reference.
 */
 static void rq_cq_reap(struct svcxprt_rdma *xprt)
 {
@@ -297,29 +292,47 @@ static void rq_cq_reap(struct svcxprt_rdma *xprt)
        struct ib_wc wc;
        struct svc_rdma_op_ctxt *ctxt = NULL;
+        if (!test_and_clear_bit(RDMAXPRT_RQ_PENDING, &xprt->sc_flags))
+                return;
+        ib_req_notify_cq(xprt->sc_rq_cq, IB_CQ_NEXT_COMP);
        atomic_inc(&rdma_stat_rq_poll);
-        spin_lock_bh(&xprt->sc_rq_dto_lock);
        while ((ret = ib_poll_cq(xprt->sc_rq_cq, 1, &wc)) > 0) {
                ctxt = (struct svc_rdma_op_ctxt *)(unsigned long)wc.wr_id;
                ctxt->wc_status = wc.status;
                ctxt->byte_len = wc.byte_len;
                if (wc.status != IB_WC_SUCCESS) {
                        /* Close the transport */
+                        dprintk("svcrdma: transport closing putting ctxt %p\n", ctxt);
                        set_bit(XPT_CLOSE, &xprt->sc_xprt.xpt_flags);
                        svc_rdma_put_context(ctxt, 1);
+                        svc_xprt_put(&xprt->sc_xprt);
                        continue;
                }
+                spin_lock_bh(&xprt->sc_rq_dto_lock);
                list_add_tail(&ctxt->dto_q, &xprt->sc_rq_dto_q);
+                spin_unlock_bh(&xprt->sc_rq_dto_lock);
+                svc_xprt_put(&xprt->sc_xprt);
        }
-        spin_unlock_bh(&xprt->sc_rq_dto_lock);
        if (ctxt)
                atomic_inc(&rdma_stat_rq_prod);
+        set_bit(XPT_DATA, &xprt->sc_xprt.xpt_flags);
+        /*
+         * If data arrived before established event,
+         * don't enqueue. This defers RPC I/O until the
+         * RDMA connection is complete.
+         */
+        if (!test_bit(RDMAXPRT_CONN_PENDING, &xprt->sc_flags))
+                svc_xprt_enqueue(&xprt->sc_xprt);
 }
 /*
 * Send Queue Completion Handler - potentially called on interrupt context.
+ *
+ * Note that caller must hold a transport reference.
 */
 static void sq_cq_reap(struct svcxprt_rdma *xprt)
 {
@@ -328,6 +341,11 @@ static void sq_cq_reap(struct svcxprt_rdma *xprt)
        struct ib_cq *cq = xprt->sc_sq_cq;
        int ret;
+        if (!test_and_clear_bit(RDMAXPRT_SQ_PENDING, &xprt->sc_flags))
+                return;
+        ib_req_notify_cq(xprt->sc_sq_cq, IB_CQ_NEXT_COMP);
        atomic_inc(&rdma_stat_sq_poll);
        while ((ret = ib_poll_cq(cq, 1, &wc)) > 0) {
                ctxt = (struct svc_rdma_op_ctxt *)(unsigned long)wc.wr_id;
@@ -349,14 +367,16 @@ static void sq_cq_reap(struct svcxprt_rdma *xprt)
                case IB_WR_RDMA_READ:
                        if (test_bit(RDMACTXT_F_LAST_CTXT, &ctxt->flags)) {
+                                struct svc_rdma_op_ctxt *read_hdr = ctxt->read_hdr;
+                                BUG_ON(!read_hdr);
                                set_bit(XPT_DATA, &xprt->sc_xprt.xpt_flags);
-                                set_bit(RDMACTXT_F_READ_DONE, &ctxt->flags);
                                spin_lock_bh(&xprt->sc_read_complete_lock);
-                                list_add_tail(&ctxt->dto_q,
+                                list_add_tail(&read_hdr->dto_q,
                                              &xprt->sc_read_complete_q);
                                spin_unlock_bh(&xprt->sc_read_complete_lock);
                                svc_xprt_enqueue(&xprt->sc_xprt);
                        }
+                        svc_rdma_put_context(ctxt, 0);
                        break;
                default:
@@ -365,6 +385,7 @@ static void sq_cq_reap(struct svcxprt_rdma *xprt)
                               wc.opcode, wc.status);
                        break;
                }
+                svc_xprt_put(&xprt->sc_xprt);
        }
        if (ctxt)
@@ -376,11 +397,15 @@ static void sq_comp_handler(struct ib_cq *cq, void *cq_context)
        struct svcxprt_rdma *xprt = cq_context;
        unsigned long flags;
+        /* Guard against unconditional flush call for destroyed QP */
+        if (atomic_read(&xprt->sc_xprt.xpt_ref.refcount)==0)
+                return;
        /*
         * Set the bit regardless of whether or not it's on the list
         * because it may be on the list already due to an RQ
         * completion.
-        */
+         */
        set_bit(RDMAXPRT_SQ_PENDING, &xprt->sc_flags);
        /*
@@ -407,28 +432,29 @@ static void create_context_cache(struct svcxprt_rdma *xprt,
        xprt->sc_ctxt_max = ctxt_max;
        xprt->sc_ctxt_bump = ctxt_bump;
        xprt->sc_ctxt_cnt = 0;
-        xprt->sc_ctxt_head = NULL;
+        atomic_set(&xprt->sc_ctxt_used, 0);
+        INIT_LIST_HEAD(&xprt->sc_ctxt_free);
        for (i = 0; i < ctxt_count; i++) {
                ctxt = kmalloc(sizeof(*ctxt), GFP_KERNEL);
                if (ctxt) {
-                        ctxt->next = xprt->sc_ctxt_head;
+                        INIT_LIST_HEAD(&ctxt->free_list);
-                        xprt->sc_ctxt_head = ctxt;
+                        list_add(&ctxt->free_list, &xprt->sc_ctxt_free);
                        xprt->sc_ctxt_cnt++;
                }
        }
 }
-static void destroy_context_cache(struct svc_rdma_op_ctxt *ctxt)
+static void destroy_context_cache(struct svcxprt_rdma *xprt)
 {
-        struct svc_rdma_op_ctxt *next;
+        while (!list_empty(&xprt->sc_ctxt_free)) {
-        if (!ctxt)
+                struct svc_rdma_op_ctxt *ctxt;
-                return;
+                ctxt = list_entry(xprt->sc_ctxt_free.next,
+                                  struct svc_rdma_op_ctxt,
-        do {
+                                  free_list);
-                next = ctxt->next;
+                list_del_init(&ctxt->free_list);
                kfree(ctxt);
-                ctxt = next;
+        }
-        } while (next);
 }
 static struct svcxprt_rdma *rdma_create_xprt(struct svc_serv *serv,
@@ -465,7 +491,7 @@ static struct svcxprt_rdma *rdma_create_xprt(struct svc_serv *serv,
                                     reqs +
                                     cma_xprt->sc_sq_depth +
                                     RPCRDMA_MAX_THREADS + 1); /* max */
-                if (!cma_xprt->sc_ctxt_head) {
+                if (list_empty(&cma_xprt->sc_ctxt_free)) {
                        kfree(cma_xprt);
                        return NULL;
                }
@@ -520,7 +546,12 @@ int svc_rdma_post_recv(struct svcxprt_rdma *xprt)
        recv_wr.num_sge = ctxt->count;
        recv_wr.wr_id = (u64)(unsigned long)ctxt;
+        svc_xprt_get(&xprt->sc_xprt);
        ret = ib_post_recv(xprt->sc_qp, &recv_wr, &bad_recv_wr);
+        if (ret) {
+                svc_xprt_put(&xprt->sc_xprt);
+                svc_rdma_put_context(ctxt, 1);
+        }
        return ret;
 }
@@ -539,6 +570,7 @@ static void handle_connect_req(struct rdma_cm_id *new_cma_id)
 {
        struct svcxprt_rdma *listen_xprt = new_cma_id->context;
        struct svcxprt_rdma *newxprt;
+        struct sockaddr *sa;
        /* Create a new transport */
        newxprt = rdma_create_xprt(listen_xprt->sc_xprt.xpt_server, 0);
@@ -551,6 +583,12 @@ static void handle_connect_req(struct rdma_cm_id *new_cma_id)
        dprintk("svcrdma: Creating newxprt=%p, cm_id=%p, listenxprt=%p\n",
                newxprt, newxprt->sc_cm_id, listen_xprt);
+        /* Set the local and remote addresses in the transport */
+        sa = (struct sockaddr *)&newxprt->sc_cm_id->route.addr.dst_addr;
+        svc_xprt_set_remote(&newxprt->sc_xprt, sa, svc_addr_len(sa));
+        sa = (struct sockaddr *)&newxprt->sc_cm_id->route.addr.src_addr;
+        svc_xprt_set_local(&newxprt->sc_xprt, sa, svc_addr_len(sa));
        /*
         * Enqueue the new transport on the accept queue of the listening
         * transport
@@ -627,6 +665,7 @@ static int rdma_cma_handler(struct rdma_cm_id *cma_id,
                if (xprt) {
                        set_bit(XPT_CLOSE, &xprt->xpt_flags);
                        svc_xprt_enqueue(xprt);
+                        svc_xprt_put(xprt);
                }
                break;
        case RDMA_CM_EVENT_DEVICE_REMOVAL:
@@ -661,31 +700,27 @@ static struct svc_xprt *svc_rdma_create(struct svc_serv *serv,
        cma_xprt = rdma_create_xprt(serv, 1);
        if (!cma_xprt)
-                return ERR_PTR(ENOMEM);
+                return ERR_PTR(-ENOMEM);
        xprt = &cma_xprt->sc_xprt;
        listen_id = rdma_create_id(rdma_listen_handler, cma_xprt, RDMA_PS_TCP);
        if (IS_ERR(listen_id)) {
-                svc_xprt_put(&cma_xprt->sc_xprt);
+                ret = PTR_ERR(listen_id);
-                dprintk("svcrdma: rdma_create_id failed = %ld\n",
+                dprintk("svcrdma: rdma_create_id failed = %d\n", ret);
-                        PTR_ERR(listen_id));
+                goto err0;
-                return (void *)listen_id;
        }
        ret = rdma_bind_addr(listen_id, sa);
        if (ret) {
-                rdma_destroy_id(listen_id);
-                svc_xprt_put(&cma_xprt->sc_xprt);
                dprintk("svcrdma: rdma_bind_addr failed = %d\n", ret);
-                return ERR_PTR(ret);
+                goto err1;
        }
        cma_xprt->sc_cm_id = listen_id;
        ret = rdma_listen(listen_id, RPCRDMA_LISTEN_BACKLOG);
        if (ret) {
-                rdma_destroy_id(listen_id);
-                svc_xprt_put(&cma_xprt->sc_xprt);
                dprintk("svcrdma: rdma_listen failed = %d\n", ret);
-                return ERR_PTR(ret);
+                goto err1;
        }
        /*
@@ -696,6 +731,12 @@ static struct svc_xprt *svc_rdma_create(struct svc_serv *serv,
        svc_xprt_set_local(&cma_xprt->sc_xprt, sa, salen);
        return &cma_xprt->sc_xprt;
+ err1:
+        rdma_destroy_id(listen_id);
+ err0:
+        kfree(cma_xprt);
+        return ERR_PTR(ret);
 }
 /*
@@ -716,7 +757,6 @@ static struct svc_xprt *svc_rdma_accept(struct svc_xprt *xprt)
        struct rdma_conn_param conn_param;
        struct ib_qp_init_attr qp_attr;
        struct ib_device_attr devattr;
-        struct sockaddr *sa;
        int ret;
        int i;
@@ -826,7 +866,6 @@ static struct svc_xprt *svc_rdma_accept(struct svc_xprt *xprt)
                newxprt->sc_sq_depth = qp_attr.cap.max_send_wr;
                newxprt->sc_max_requests = qp_attr.cap.max_recv_wr;
        }
-        svc_xprt_get(&newxprt->sc_xprt);
        newxprt->sc_qp = newxprt->sc_cm_id->qp;
        /* Register all of physical memory */
@@ -850,6 +889,13 @@ static struct svc_xprt *svc_rdma_accept(struct svc_xprt *xprt)
        /* Swap out the handler */
        newxprt->sc_cm_id->event_handler = rdma_cma_handler;
+        /*
+         * Arm the CQs for the SQ and RQ before accepting so we can't
+         * miss the first message
+         */
+        ib_req_notify_cq(newxprt->sc_sq_cq, IB_CQ_NEXT_COMP);
+        ib_req_notify_cq(newxprt->sc_rq_cq, IB_CQ_NEXT_COMP);
        /* Accept Connection */
        set_bit(RDMAXPRT_CONN_PENDING, &newxprt->sc_flags);
        memset(&conn_param, 0, sizeof conn_param);
@@ -886,58 +932,26 @@ static struct svc_xprt *svc_rdma_accept(struct svc_xprt *xprt)
                newxprt->sc_max_requests,
                newxprt->sc_ord);
-        /* Set the local and remote addresses in the transport */
-        sa = (struct sockaddr *)&newxprt->sc_cm_id->route.addr.dst_addr;
-        svc_xprt_set_remote(&newxprt->sc_xprt, sa, svc_addr_len(sa));
-        sa = (struct sockaddr *)&newxprt->sc_cm_id->route.addr.src_addr;
-        svc_xprt_set_local(&newxprt->sc_xprt, sa, svc_addr_len(sa));
-        ib_req_notify_cq(newxprt->sc_sq_cq, IB_CQ_NEXT_COMP);
-        ib_req_notify_cq(newxprt->sc_rq_cq, IB_CQ_NEXT_COMP);
        return &newxprt->sc_xprt;
 errout:
        dprintk("svcrdma: failure accepting new connection rc=%d.\n", ret);
        /* Take a reference in case the DTO handler runs */
        svc_xprt_get(&newxprt->sc_xprt);
-        if (newxprt->sc_qp && !IS_ERR(newxprt->sc_qp)) {
+        if (newxprt->sc_qp && !IS_ERR(newxprt->sc_qp))
                ib_destroy_qp(newxprt->sc_qp);
-                svc_xprt_put(&newxprt->sc_xprt);
-        }
        rdma_destroy_id(newxprt->sc_cm_id);
        /* This call to put will destroy the transport */
        svc_xprt_put(&newxprt->sc_xprt);
        return NULL;
 }
-/*
- * Post an RQ WQE to the RQ when the rqst is being released. This
- * effectively returns an RQ credit to the client. The rq_xprt_ctxt
- * will be null if the request is deferred due to an RDMA_READ or the
- * transport had no data ready (EAGAIN). Note that an RPC deferred in
- * svc_process will still return the credit, this is because the data
- * is copied and no longer consume a WQE/WC.
- */
 static void svc_rdma_release_rqst(struct svc_rqst *rqstp)
 {
-        int err;
-        struct svcxprt_rdma *rdma =
-                container_of(rqstp->rq_xprt, struct svcxprt_rdma, sc_xprt);
-        if (rqstp->rq_xprt_ctxt) {
-                BUG_ON(rqstp->rq_xprt_ctxt != rdma);
-                err = svc_rdma_post_recv(rdma);
-                if (err)
-                        dprintk("svcrdma: failed to post an RQ WQE error=%d\n",
-                                err);
-        }
-        rqstp->rq_xprt_ctxt = NULL;
 }
 /*
- * When connected, an svc_xprt has at least three references:
+ * When connected, an svc_xprt has at least two references:
- *
- * - A reference held by the QP. We still hold that here because this
- *   code deletes the QP and puts the reference.
 *
 * - A reference held by the cm_id between the ESTABLISHED and
 *   DISCONNECTED events. If the remote peer disconnected first, this
@@ -946,7 +960,7 @@ static void svc_rdma_release_rqst(struct svc_rqst *rqstp)
 * - A reference held by the svc_recv code that called this function
 *   as part of close processing.
 *
- * At a minimum two references should still be held.
+ * At a minimum one references should still be held.
 */
 static void svc_rdma_detach(struct svc_xprt *xprt)
 {
@@ -956,23 +970,53 @@ static void svc_rdma_detach(struct svc_xprt *xprt)
        /* Disconnect and flush posted WQE */
        rdma_disconnect(rdma->sc_cm_id);
-        /* Destroy the QP if present (not a listener) */
-        if (rdma->sc_qp && !IS_ERR(rdma->sc_qp)) {
-                ib_destroy_qp(rdma->sc_qp);
-                svc_xprt_put(xprt);
-        }
-        /* Destroy the CM ID */
-        rdma_destroy_id(rdma->sc_cm_id);
 }
-static void svc_rdma_free(struct svc_xprt *xprt)
+static void __svc_rdma_free(struct work_struct *work)
 {
-        struct svcxprt_rdma *rdma = (struct svcxprt_rdma *)xprt;
+        struct svcxprt_rdma *rdma =
+                container_of(work, struct svcxprt_rdma, sc_work);
        dprintk("svcrdma: svc_rdma_free(%p)\n", rdma);
        /* We should only be called from kref_put */
-        BUG_ON(atomic_read(&xprt->xpt_ref.refcount) != 0);
+        BUG_ON(atomic_read(&rdma->sc_xprt.xpt_ref.refcount) != 0);
+        /*
+         * Destroy queued, but not processed read completions. Note
+         * that this cleanup has to be done before destroying the
+         * cm_id because the device ptr is needed to unmap the dma in
+         * svc_rdma_put_context.
+         */
+        spin_lock_bh(&rdma->sc_read_complete_lock);
+        while (!list_empty(&rdma->sc_read_complete_q)) {
+                struct svc_rdma_op_ctxt *ctxt;
+                ctxt = list_entry(rdma->sc_read_complete_q.next,
+                                  struct svc_rdma_op_ctxt,
+                                  dto_q);
+                list_del_init(&ctxt->dto_q);
+                svc_rdma_put_context(ctxt, 1);
+        }
+        spin_unlock_bh(&rdma->sc_read_complete_lock);
+        /* Destroy queued, but not processed recv completions */
+        spin_lock_bh(&rdma->sc_rq_dto_lock);
+        while (!list_empty(&rdma->sc_rq_dto_q)) {
+                struct svc_rdma_op_ctxt *ctxt;
+                ctxt = list_entry(rdma->sc_rq_dto_q.next,
+                                  struct svc_rdma_op_ctxt,
+                                  dto_q);
+                list_del_init(&ctxt->dto_q);
+                svc_rdma_put_context(ctxt, 1);
+        }
+        spin_unlock_bh(&rdma->sc_rq_dto_lock);
+        /* Warn if we leaked a resource or under-referenced */
+        WARN_ON(atomic_read(&rdma->sc_ctxt_used) != 0);
+        /* Destroy the QP if present (not a listener) */
+        if (rdma->sc_qp && !IS_ERR(rdma->sc_qp))
+                ib_destroy_qp(rdma->sc_qp);
        if (rdma->sc_sq_cq && !IS_ERR(rdma->sc_sq_cq))
                ib_destroy_cq(rdma->sc_sq_cq);
@@ -985,10 +1029,21 @@ static void svc_rdma_free(struct svc_xprt *xprt)
        if (rdma->sc_pd && !IS_ERR(rdma->sc_pd))
                ib_dealloc_pd(rdma->sc_pd);
-        destroy_context_cache(rdma->sc_ctxt_head);
+        /* Destroy the CM ID */
+        rdma_destroy_id(rdma->sc_cm_id);
+        destroy_context_cache(rdma);
        kfree(rdma);
 }
+static void svc_rdma_free(struct svc_xprt *xprt)
+{
+        struct svcxprt_rdma *rdma =
+                container_of(xprt, struct svcxprt_rdma, sc_xprt);
+        INIT_WORK(&rdma->sc_work, __svc_rdma_free);
+        schedule_work(&rdma->sc_work);
+}
 static int svc_rdma_has_wspace(struct svc_xprt *xprt)
 {
        struct svcxprt_rdma *rdma =
@@ -1018,7 +1073,7 @@ int svc_rdma_send(struct svcxprt_rdma *xprt, struct ib_send_wr *wr)
        int ret;
        if (test_bit(XPT_CLOSE, &xprt->sc_xprt.xpt_flags))
-                return 0;
+                return -ENOTCONN;
        BUG_ON(wr->send_flags != IB_SEND_SIGNALED);
        BUG_ON(((struct svc_rdma_op_ctxt *)(unsigned long)wr->wr_id)->wr_op !=
@@ -1029,7 +1084,8 @@ int svc_rdma_send(struct svcxprt_rdma *xprt, struct ib_send_wr *wr)
                if (xprt->sc_sq_depth == atomic_read(&xprt->sc_sq_count)) {
                        spin_unlock_bh(&xprt->sc_lock);
                        atomic_inc(&rdma_stat_sq_starve);
-                        /* See if we can reap some SQ WR */
+                        /* See if we can opportunistically reap SQ WR to make room */
                        sq_cq_reap(xprt);
                        /* Wait until SQ WR available if SQ still full */
@@ -1041,22 +1097,25 @@ int svc_rdma_send(struct svcxprt_rdma *xprt, struct ib_send_wr *wr)
                        continue;
                }
                /* Bumped used SQ WR count and post */
+                svc_xprt_get(&xprt->sc_xprt);
                ret = ib_post_send(xprt->sc_qp, wr, &bad_wr);
                if (!ret)
                        atomic_inc(&xprt->sc_sq_count);
-                else
+                else {
+                        svc_xprt_put(&xprt->sc_xprt);
                        dprintk("svcrdma: failed to post SQ WR rc=%d, "
                               "sc_sq_count=%d, sc_sq_depth=%d\n",
                               ret, atomic_read(&xprt->sc_sq_count),
                               xprt->sc_sq_depth);
+                }
                spin_unlock_bh(&xprt->sc_lock);
                break;
        }
        return ret;
 }
-int svc_rdma_send_error(struct svcxprt_rdma *xprt, struct rpcrdma_msg *rmsgp,
+void svc_rdma_send_error(struct svcxprt_rdma *xprt, struct rpcrdma_msg *rmsgp,
-                        enum rpcrdma_errcode err)
+                         enum rpcrdma_errcode err)
 {
        struct ib_send_wr err_wr;
        struct ib_sge sge;
@@ -1094,9 +1153,8 @@ int svc_rdma_send_error(struct svcxprt_rdma *xprt, struct rpcrdma_msg *rmsgp,
        /* Post It */
        ret = svc_rdma_send(xprt, &err_wr);
        if (ret) {
-                dprintk("svcrdma: Error posting send = %d\n", ret);
+                dprintk("svcrdma: Error %d posting send for protocol error\n",
+                        ret);
                svc_rdma_put_context(ctxt, 1);
        }
-        return ret;
 }
diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
index 2bdd4dddc0e1..fb75f265b39c 100644
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -187,7 +187,8 @@ static int nl80211_send_wiphy(struct sk_buff *msg, u32 pid, u32 seq, int flags,
        return genlmsg_end(msg, hdr);
 nla_put_failure:
-        return genlmsg_cancel(msg, hdr);
+        genlmsg_cancel(msg, hdr);
+        return -EMSGSIZE;
 }
 static int nl80211_dump_wiphy(struct sk_buff *skb, struct netlink_callback *cb)
@@ -273,7 +274,8 @@ static int nl80211_send_iface(struct sk_buff *msg, u32 pid, u32 seq, int flags,
        return genlmsg_end(msg, hdr);
 nla_put_failure:
-        return genlmsg_cancel(msg, hdr);
+        genlmsg_cancel(msg, hdr);
+        return -EMSGSIZE;
 }
 static int nl80211_dump_interface(struct sk_buff *skb, struct netlink_callback *cb)
@@ -928,7 +930,8 @@ static int nl80211_send_station(struct sk_buff *msg, u32 pid, u32 seq,
        return genlmsg_end(msg, hdr);
 nla_put_failure:
-        return genlmsg_cancel(msg, hdr);
+        genlmsg_cancel(msg, hdr);
+        return -EMSGSIZE;
 }
 static int nl80211_dump_station(struct sk_buff *skb,
@@ -1267,7 +1270,8 @@ static int nl80211_send_mpath(struct sk_buff *msg, u32 pid, u32 seq,
        return genlmsg_end(msg, hdr);
 nla_put_failure:
-        return genlmsg_cancel(msg, hdr);
+        genlmsg_cancel(msg, hdr);
+        return -EMSGSIZE;
 }
 static int nl80211_dump_mpath(struct sk_buff *skb,