45 files changed, 409 insertions, 254 deletions

diff --git a/net/9p/client.c b/net/9p/client.c
index 4b529454616d..821f1ec0b2c3 100644
--- a/net/9p/client.c
+++ b/net/9p/client.c
@@ -627,7 +627,7 @@ static struct p9_fid *p9_fid_create(struct p9_client *clnt)
         memset(&fid->qid, 0, sizeof(struct p9_qid));
         fid->mode = -1;
         fid->rdir_fpos = 0;
-        fid->uid = current->fsuid;
+        fid->uid = current_fsuid();
         fid->clnt = clnt;
         fid->aux = NULL;
 
diff --git a/net/atm/svc.c b/net/atm/svc.c
index de1e4f2f3a43..8fb54dc870b3 100644
--- a/net/atm/svc.c
+++ b/net/atm/svc.c
@@ -293,7 +293,10 @@ static int svc_listen(struct socket *sock,int backlog)
                 error = -EINVAL;
                 goto out;
         }
-        vcc_insert_socket(sk);
+        if (test_bit(ATM_VF_LISTEN, &vcc->flags)) {
+                error = -EADDRINUSE;
+                goto out;
+        }
         set_bit(ATM_VF_WAITING, &vcc->flags);
         prepare_to_wait(sk->sk_sleep, &wait, TASK_UNINTERRUPTIBLE);
         sigd_enq(vcc,as_listen,NULL,NULL,&vcc->local);
@@ -307,6 +310,7 @@ static int svc_listen(struct socket *sock,int backlog)
                 goto out;
         }
         set_bit(ATM_VF_LISTEN,&vcc->flags);
+        vcc_insert_socket(sk);
         sk->sk_max_ack_backlog = backlog > 0 ? backlog : ATM_BACKLOG_DEFAULT;
         error = -sk->sk_err;
 out:
diff --git a/net/ax25/af_ax25.c b/net/ax25/af_ax25.c
index 28c71574a781..00d9e5e13158 100644
--- a/net/ax25/af_ax25.c
+++ b/net/ax25/af_ax25.c
@@ -1045,7 +1045,7 @@ static int ax25_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
         if (addr->fsa_ax25.sax25_family != AF_AX25)
                 return -EINVAL;
 
-        user = ax25_findbyuid(current->euid);
+        user = ax25_findbyuid(current_euid());
         if (user) {
                 call = user->call;
                 ax25_uid_put(user);
diff --git a/net/ax25/ax25_route.c b/net/ax25/ax25_route.c
index 8672cd84fdf9..c833ba4c45a5 100644
--- a/net/ax25/ax25_route.c
+++ b/net/ax25/ax25_route.c
@@ -421,7 +421,7 @@ int ax25_rt_autobind(ax25_cb *ax25, ax25_address *addr)
                 goto put;
         }
 
-        user = ax25_findbyuid(current->euid);
+        user = ax25_findbyuid(current_euid());
         if (user) {
                 ax25->source_addr = user->call;
                 ax25_uid_put(user);
diff --git a/net/bluetooth/rfcomm/core.c b/net/bluetooth/rfcomm/core.c
index ba537fae0a4c..ce68e046d963 100644
--- a/net/bluetooth/rfcomm/core.c
+++ b/net/bluetooth/rfcomm/core.c
@@ -1786,8 +1786,6 @@ static inline void rfcomm_accept_connection(struct rfcomm_session *s)
         if (err < 0)
                 return;
 
-        __module_get(nsock->ops->owner);
-
         /* Set our callbacks */
         nsock->sk->sk_data_ready   = rfcomm_l2data_ready;
         nsock->sk->sk_state_change = rfcomm_l2state_change;
diff --git a/net/bridge/br_netfilter.c b/net/bridge/br_netfilter.c
index fa5cda4e552a..45f61c348e36 100644
--- a/net/bridge/br_netfilter.c
+++ b/net/bridge/br_netfilter.c
@@ -101,6 +101,18 @@ static inline __be16 pppoe_proto(const struct sk_buff *skb)
          pppoe_proto(skb) == htons(PPP_IPV6) && \
          brnf_filter_pppoe_tagged)
 
+static void fake_update_pmtu(struct dst_entry *dst, u32 mtu)
+{
+}
+
+static struct dst_ops fake_dst_ops = {
+        .family =               AF_INET,
+        .protocol =             __constant_htons(ETH_P_IP),
+        .update_pmtu =          fake_update_pmtu,
+        .entry_size =           sizeof(struct rtable),
+        .entries =              ATOMIC_INIT(0),
+};
+
 /*
  * Initialize bogus route table used to keep netfilter happy.
  * Currently, we fill in the PMTU entry because netfilter
@@ -117,6 +129,7 @@ void br_netfilter_rtable_init(struct net_bridge *br)
         rt->u.dst.path = &rt->u.dst;
         rt->u.dst.metrics[RTAX_MTU - 1] = 1500;
         rt->u.dst.flags = DST_NOXFRM;
+        rt->u.dst.ops = &fake_dst_ops;
 }
 
 static inline struct rtable *bridge_parent_rtable(const struct net_device *dev)
diff --git a/net/can/af_can.c b/net/can/af_can.c
index 7d4d2b3c137e..3dadb338addd 100644
--- a/net/can/af_can.c
+++ b/net/can/af_can.c
@@ -319,23 +319,52 @@ static struct dev_rcv_lists *find_dev_rcv_lists(struct net_device *dev)
         return n ? d : NULL;
 }
 
+/**
+ * find_rcv_list - determine optimal filterlist inside device filter struct
+ * @can_id: pointer to CAN identifier of a given can_filter
+ * @mask: pointer to CAN mask of a given can_filter
+ * @d: pointer to the device filter struct
+ *
+ * Description:
+ *  Returns the optimal filterlist to reduce the filter handling in the
+ *  receive path. This function is called by service functions that need
+ *  to register or unregister a can_filter in the filter lists.
+ *
+ *  A filter matches in general, when
+ *
+ *          <received_can_id> & mask == can_id & mask
+ *
+ *  so every bit set in the mask (even CAN_EFF_FLAG, CAN_RTR_FLAG) describe
+ *  relevant bits for the filter.
+ *
+ *  The filter can be inverted (CAN_INV_FILTER bit set in can_id) or it can
+ *  filter for error frames (CAN_ERR_FLAG bit set in mask). For error frames
+ *  there is a special filterlist and a special rx path filter handling.
+ *
+ * Return:
+ *  Pointer to optimal filterlist for the given can_id/mask pair.
+ *  Constistency checked mask.
+ *  Reduced can_id to have a preprocessed filter compare value.
+ */
 static struct hlist_head *find_rcv_list(canid_t *can_id, canid_t *mask,
                                         struct dev_rcv_lists *d)
 {
         canid_t inv = *can_id & CAN_INV_FILTER; /* save flag before masking */
 
-        /* filter error frames */
+        /* filter for error frames in extra filterlist */
         if (*mask & CAN_ERR_FLAG) {
-                /* clear CAN_ERR_FLAG in list entry */
+                /* clear CAN_ERR_FLAG in filter entry */
                 *mask &= CAN_ERR_MASK;
                 return &d->rx[RX_ERR];
         }
 
-        /* ensure valid values in can_mask */
-        if (*mask & CAN_EFF_FLAG)
-                *mask &= (CAN_EFF_MASK | CAN_EFF_FLAG | CAN_RTR_FLAG);
-        else
-                *mask &= (CAN_SFF_MASK | CAN_RTR_FLAG);
+        /* with cleared CAN_ERR_FLAG we have a simple mask/value filterpair */
+
+#define CAN_EFF_RTR_FLAGS (CAN_EFF_FLAG | CAN_RTR_FLAG)
+
+        /* ensure valid values in can_mask for 'SFF only' frame filtering */
+        if ((*mask & CAN_EFF_FLAG) && !(*can_id & CAN_EFF_FLAG))
+                *mask &= (CAN_SFF_MASK | CAN_EFF_RTR_FLAGS);
 
         /* reduce condition testing at receive time */
         *can_id &= *mask;
@@ -348,15 +377,19 @@ static struct hlist_head *find_rcv_list(canid_t *can_id, canid_t *mask,
         if (!(*mask))
                 return &d->rx[RX_ALL];
 
-        /* use extra filterset for the subscription of exactly *ONE* can_id */
-        if (*can_id & CAN_EFF_FLAG) {
-                if (*mask == (CAN_EFF_MASK | CAN_EFF_FLAG)) {
-                        /* RFC: a use-case for hash-tables in the future? */
-                        return &d->rx[RX_EFF];
+        /* extra filterlists for the subscription of a single non-RTR can_id */
+        if (((*mask & CAN_EFF_RTR_FLAGS) == CAN_EFF_RTR_FLAGS)
+            && !(*can_id & CAN_RTR_FLAG)) {
+
+                if (*can_id & CAN_EFF_FLAG) {
+                        if (*mask == (CAN_EFF_MASK | CAN_EFF_RTR_FLAGS)) {
+                                /* RFC: a future use-case for hash-tables? */
+                                return &d->rx[RX_EFF];
+                        }
+                } else {
+                        if (*mask == (CAN_SFF_MASK | CAN_EFF_RTR_FLAGS))
+                                return &d->rx_sff[*can_id];
                 }
-        } else {
-                if (*mask == CAN_SFF_MASK)
-                        return &d->rx_sff[*can_id];
         }
 
         /* default: filter via can_id/can_mask */
@@ -589,7 +622,10 @@ static int can_rcv_filter(struct dev_rcv_lists *d, struct sk_buff *skb)
                 }
         }
 
-        /* check CAN_ID specific entries */
+        /* check filterlists for single non-RTR can_ids */
+        if (can_id & CAN_RTR_FLAG)
+                return matches;
+
         if (can_id & CAN_EFF_FLAG) {
                 hlist_for_each_entry_rcu(r, n, &d->rx[RX_EFF], list) {
                         if (r->can_id == can_id) {
diff --git a/net/can/bcm.c b/net/can/bcm.c
index d0dd382001e2..da0d426c0ce4 100644
--- a/net/can/bcm.c
+++ b/net/can/bcm.c
@@ -64,10 +64,11 @@
 #define BCM_CAN_DLC_MASK 0x0F /* clean private flags in can_dlc by masking */
 
 /* get best masking value for can_rx_register() for a given single can_id */
-#define REGMASK(id) ((id & CAN_RTR_FLAG) | ((id & CAN_EFF_FLAG) ? \
-                        (CAN_EFF_MASK | CAN_EFF_FLAG) : CAN_SFF_MASK))
+#define REGMASK(id) ((id & CAN_EFF_FLAG) ? \
+                     (CAN_EFF_MASK | CAN_EFF_FLAG | CAN_RTR_FLAG) : \
+                     (CAN_SFF_MASK | CAN_EFF_FLAG | CAN_RTR_FLAG))
 
-#define CAN_BCM_VERSION "20080415"
+#define CAN_BCM_VERSION CAN_VERSION
 static __initdata const char banner[] = KERN_INFO
         "can: broadcast manager protocol (rev " CAN_BCM_VERSION ")\n";
 
diff --git a/net/core/dev.c b/net/core/dev.c
index 9174c77d3112..89912ae6de65 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -2961,6 +2961,8 @@ static void dev_change_rx_flags(struct net_device *dev, int flags)
 static int __dev_set_promiscuity(struct net_device *dev, int inc)
 {
         unsigned short old_flags = dev->flags;
+        uid_t uid;
+        gid_t gid;
 
         ASSERT_RTNL();
 
@@ -2985,15 +2987,17 @@ static int __dev_set_promiscuity(struct net_device *dev, int inc)
                 printk(KERN_INFO "device %s %s promiscuous mode\n",
                        dev->name, (dev->flags & IFF_PROMISC) ? "entered" :
                                                                "left");
-                if (audit_enabled)
+                if (audit_enabled) {
+                        current_uid_gid(&uid, &gid);
                         audit_log(current->audit_context, GFP_ATOMIC,
                                 AUDIT_ANOM_PROMISCUOUS,
                                 "dev=%s prom=%d old_prom=%d auid=%u uid=%u gid=%u ses=%u",
                                 dev->name, (dev->flags & IFF_PROMISC),
                                 (old_flags & IFF_PROMISC),
                                 audit_get_loginuid(current),
-                                current->uid, current->gid,
+                                uid, gid,
                                 audit_get_sessionid(current));
+                }
 
                 dev_change_rx_flags(dev, IFF_PROMISC);
         }
diff --git a/net/core/netpoll.c b/net/core/netpoll.c
index 6c7af390be0a..dadac6281f20 100644
--- a/net/core/netpoll.c
+++ b/net/core/netpoll.c
@@ -133,9 +133,11 @@ static int poll_one_napi(struct netpoll_info *npinfo,
 
         npinfo->rx_flags |= NETPOLL_RX_DROP;
         atomic_inc(&trapped);
+        set_bit(NAPI_STATE_NPSVC, &napi->state);
 
         work = napi->poll(napi, budget);
 
+        clear_bit(NAPI_STATE_NPSVC, &napi->state);
         atomic_dec(&trapped);
         npinfo->rx_flags &= ~NETPOLL_RX_DROP;
 
diff --git a/net/core/scm.c b/net/core/scm.c
index b12303dd39d9..b7ba91b074b3 100644
--- a/net/core/scm.c
+++ b/net/core/scm.c
@@ -44,11 +44,13 @@
 
 static __inline__ int scm_check_creds(struct ucred *creds)
 {
+        const struct cred *cred = current_cred();
+
         if ((creds->pid == task_tgid_vnr(current) || capable(CAP_SYS_ADMIN)) &&
-            ((creds->uid == current->uid || creds->uid == current->euid ||
-              creds->uid == current->suid) || capable(CAP_SETUID)) &&
-            ((creds->gid == current->gid || creds->gid == current->egid ||
-              creds->gid == current->sgid) || capable(CAP_SETGID))) {
+            ((creds->uid == cred->uid   || creds->uid == cred->euid ||
+              creds->uid == cred->suid) || capable(CAP_SETUID)) &&
+            ((creds->gid == cred->gid   || creds->gid == cred->egid ||
+              creds->gid == cred->sgid) || capable(CAP_SETGID))) {
                return 0;
         }
         return -EPERM;
diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index d49ef8301b5b..65f7757465bd 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -149,7 +149,7 @@ void skb_under_panic(struct sk_buff *skb, int sz, void *here)
 
 void skb_truesize_bug(struct sk_buff *skb)
 {
-        printk(KERN_ERR "SKB BUG: Invalid truesize (%u) "
+        WARN(net_ratelimit(), KERN_ERR "SKB BUG: Invalid truesize (%u) "
                "len=%u, sizeof(sk_buff)=%Zd\n",
                skb->truesize, skb->len, sizeof(struct sk_buff));
 }
diff --git a/net/core/sock.c b/net/core/sock.c
index 341e39456952..edf7220889a4 100644
--- a/net/core/sock.c
+++ b/net/core/sock.c
@@ -2035,9 +2035,6 @@ static inline void release_proto_idx(struct proto *prot)
 
 int proto_register(struct proto *prot, int alloc_slab)
 {
-        char *request_sock_slab_name = NULL;
-        char *timewait_sock_slab_name;
-
         if (alloc_slab) {
                 prot->slab = kmem_cache_create(prot->name, prot->obj_size, 0,
                                                SLAB_HWCACHE_ALIGN, NULL);
@@ -2051,12 +2048,12 @@ int proto_register(struct proto *prot, int alloc_slab)
                 if (prot->rsk_prot != NULL) {
                         static const char mask[] = "request_sock_%s";
 
-                        request_sock_slab_name = kmalloc(strlen(prot->name) + sizeof(mask) - 1, GFP_KERNEL);
-                        if (request_sock_slab_name == NULL)
+                        prot->rsk_prot->slab_name = kmalloc(strlen(prot->name) + sizeof(mask) - 1, GFP_KERNEL);
+                        if (prot->rsk_prot->slab_name == NULL)
                                 goto out_free_sock_slab;
 
-                        sprintf(request_sock_slab_name, mask, prot->name);
-                        prot->rsk_prot->slab = kmem_cache_create(request_sock_slab_name,
+                        sprintf(prot->rsk_prot->slab_name, mask, prot->name);
+                        prot->rsk_prot->slab = kmem_cache_create(prot->rsk_prot->slab_name,
                                                                  prot->rsk_prot->obj_size, 0,
                                                                  SLAB_HWCACHE_ALIGN, NULL);
 
@@ -2070,14 +2067,14 @@ int proto_register(struct proto *prot, int alloc_slab)
                 if (prot->twsk_prot != NULL) {
                         static const char mask[] = "tw_sock_%s";
 
-                        timewait_sock_slab_name = kmalloc(strlen(prot->name) + sizeof(mask) - 1, GFP_KERNEL);
+                        prot->twsk_prot->twsk_slab_name = kmalloc(strlen(prot->name) + sizeof(mask) - 1, GFP_KERNEL);
 
-                        if (timewait_sock_slab_name == NULL)
+                        if (prot->twsk_prot->twsk_slab_name == NULL)
                                 goto out_free_request_sock_slab;
 
-                        sprintf(timewait_sock_slab_name, mask, prot->name);
+                        sprintf(prot->twsk_prot->twsk_slab_name, mask, prot->name);
                         prot->twsk_prot->twsk_slab =
-                                kmem_cache_create(timewait_sock_slab_name,
+                                kmem_cache_create(prot->twsk_prot->twsk_slab_name,
                                                   prot->twsk_prot->twsk_obj_size,
                                                   0, SLAB_HWCACHE_ALIGN,
                                                   NULL);
@@ -2093,14 +2090,14 @@ int proto_register(struct proto *prot, int alloc_slab)
         return 0;
 
 out_free_timewait_sock_slab_name:
-        kfree(timewait_sock_slab_name);
+        kfree(prot->twsk_prot->twsk_slab_name);
 out_free_request_sock_slab:
         if (prot->rsk_prot && prot->rsk_prot->slab) {
                 kmem_cache_destroy(prot->rsk_prot->slab);
                 prot->rsk_prot->slab = NULL;
         }
 out_free_request_sock_slab_name:
-        kfree(request_sock_slab_name);
+        kfree(prot->rsk_prot->slab_name);
 out_free_sock_slab:
         kmem_cache_destroy(prot->slab);
         prot->slab = NULL;
@@ -2123,18 +2120,14 @@ void proto_unregister(struct proto *prot)
         }
 
         if (prot->rsk_prot != NULL && prot->rsk_prot->slab != NULL) {
-                const char *name = kmem_cache_name(prot->rsk_prot->slab);
-
                 kmem_cache_destroy(prot->rsk_prot->slab);
-                kfree(name);
+                kfree(prot->rsk_prot->slab_name);
                 prot->rsk_prot->slab = NULL;
         }
 
         if (prot->twsk_prot != NULL && prot->twsk_prot->twsk_slab != NULL) {
-                const char *name = kmem_cache_name(prot->twsk_prot->twsk_slab);
-
                 kmem_cache_destroy(prot->twsk_prot->twsk_slab);
-                kfree(name);
+                kfree(prot->twsk_prot->twsk_slab_name);
                 prot->twsk_prot->twsk_slab = NULL;
         }
 }
diff --git a/net/ipv4/netfilter/ipt_LOG.c b/net/ipv4/netfilter/ipt_LOG.c
index fc6ce04a3e35..7b5dbe118c09 100644
--- a/net/ipv4/netfilter/ipt_LOG.c
+++ b/net/ipv4/netfilter/ipt_LOG.c
@@ -340,8 +340,8 @@ static void dump_packet(const struct nf_loginfo *info,
                 read_lock_bh(&skb->sk->sk_callback_lock);
                 if (skb->sk->sk_socket && skb->sk->sk_socket->file)
                         printk("UID=%u GID=%u ",
-                                skb->sk->sk_socket->file->f_uid,
-                                skb->sk->sk_socket->file->f_gid);
+                                skb->sk->sk_socket->file->f_cred->fsuid,
+                                skb->sk->sk_socket->file->f_cred->fsgid);
                 read_unlock_bh(&skb->sk->sk_callback_lock);
         }
 
diff --git a/net/ipv4/netfilter/nf_nat_rule.c b/net/ipv4/netfilter/nf_nat_rule.c
index bea54a685109..8d489e746b21 100644
--- a/net/ipv4/netfilter/nf_nat_rule.c
+++ b/net/ipv4/netfilter/nf_nat_rule.c
@@ -61,7 +61,7 @@ static struct
 static struct xt_table nat_table = {
         .name           = "nat",
         .valid_hooks    = NAT_VALID_HOOKS,
-        .lock           = __RW_LOCK_UNLOCKED(__nat_table.lock),
+        .lock           = __RW_LOCK_UNLOCKED(nat_table.lock),
         .me             = THIS_MODULE,
         .af             = AF_INET,
 };
diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
index ba85d8831893..fe3b4bdfd251 100644
--- a/net/ipv4/tcp_output.c
+++ b/net/ipv4/tcp_output.c
@@ -1028,10 +1028,6 @@ unsigned int tcp_sync_mss(struct sock *sk, u32 pmtu)
 
 /* Compute the current effective MSS, taking SACKs and IP options,
  * and even PMTU discovery events into account.
- *
- * LARGESEND note: !tcp_urg_mode is overkill, only frames up to snd_up
- * cannot be large. However, taking into account rare use of URG, this
- * is not a big flaw.
  */
 unsigned int tcp_current_mss(struct sock *sk, int large_allowed)
 {
@@ -1046,7 +1042,7 @@ unsigned int tcp_current_mss(struct sock *sk, int large_allowed)
 
         mss_now = tp->mss_cache;
 
-        if (large_allowed && sk_can_gso(sk) && !tcp_urg_mode(tp))
+        if (large_allowed && sk_can_gso(sk))
                 doing_tso = 1;
 
         if (dst) {
@@ -1516,6 +1512,10 @@ static int tcp_mtu_probe(struct sock *sk)
  * send_head.  This happens as incoming acks open up the remote
  * window for us.
  *
+ * LARGESEND note: !tcp_urg_mode is overkill, only frames between
+ * snd_up-64k-mss .. snd_up cannot be large. However, taking into
+ * account rare use of URG, this is not a big flaw.
+ *
  * Returns 1, if no segments are in flight and we have queued segments, but
  * cannot send anything now because of SWS or another problem.
  */
@@ -1567,7 +1567,7 @@ static int tcp_write_xmit(struct sock *sk, unsigned int mss_now, int nonagle)
                 }
 
                 limit = mss_now;
-                if (tso_segs > 1)
+                if (tso_segs > 1 && !tcp_urg_mode(tp))
                         limit = tcp_mss_split_point(sk, skb, mss_now,
                                                     cwnd_quota);
 
@@ -1616,6 +1616,7 @@ void __tcp_push_pending_frames(struct sock *sk, unsigned int cur_mss,
  */
 void tcp_push_one(struct sock *sk, unsigned int mss_now)
 {
+        struct tcp_sock *tp = tcp_sk(sk);
         struct sk_buff *skb = tcp_send_head(sk);
         unsigned int tso_segs, cwnd_quota;
 
@@ -1630,7 +1631,7 @@ void tcp_push_one(struct sock *sk, unsigned int mss_now)
                 BUG_ON(!tso_segs);
 
                 limit = mss_now;
-                if (tso_segs > 1)
+                if (tso_segs > 1 && !tcp_urg_mode(tp))
                         limit = tcp_mss_split_point(sk, skb, mss_now,
                                                     cwnd_quota);
 
diff --git a/net/ipv4/tcp_vegas.c b/net/ipv4/tcp_vegas.c
index 14504dada116..a453aac91bd3 100644
--- a/net/ipv4/tcp_vegas.c
+++ b/net/ipv4/tcp_vegas.c
@@ -40,18 +40,14 @@
 
 #include "tcp_vegas.h"
 
-/* Default values of the Vegas variables, in fixed-point representation
- * with V_PARAM_SHIFT bits to the right of the binary point.
- */
-#define V_PARAM_SHIFT 1
-static int alpha = 2<<V_PARAM_SHIFT;
-static int beta  = 4<<V_PARAM_SHIFT;
-static int gamma = 1<<V_PARAM_SHIFT;
+static int alpha = 2;
+static int beta  = 4;
+static int gamma = 1;
 
 module_param(alpha, int, 0644);
-MODULE_PARM_DESC(alpha, "lower bound of packets in network (scale by 2)");
+MODULE_PARM_DESC(alpha, "lower bound of packets in network");
 module_param(beta, int, 0644);
-MODULE_PARM_DESC(beta, "upper bound of packets in network (scale by 2)");
+MODULE_PARM_DESC(beta, "upper bound of packets in network");
 module_param(gamma, int, 0644);
 MODULE_PARM_DESC(gamma, "limit on increase (scale by 2)");
 
@@ -172,49 +168,13 @@ static void tcp_vegas_cong_avoid(struct sock *sk, u32 ack, u32 in_flight)
                 return;
         }
 
-        /* The key players are v_beg_snd_una and v_beg_snd_nxt.
-         *
-         * These are so named because they represent the approximate values
-         * of snd_una and snd_nxt at the beginning of the current RTT. More
-         * precisely, they represent the amount of data sent during the RTT.
-         * At the end of the RTT, when we receive an ACK for v_beg_snd_nxt,
-         * we will calculate that (v_beg_snd_nxt - v_beg_snd_una) outstanding
-         * bytes of data have been ACKed during the course of the RTT, giving
-         * an "actual" rate of:
-         *
-         *     (v_beg_snd_nxt - v_beg_snd_una) / (rtt duration)
-         *
-         * Unfortunately, v_beg_snd_una is not exactly equal to snd_una,
-         * because delayed ACKs can cover more than one segment, so they
-         * don't line up nicely with the boundaries of RTTs.
-         *
-         * Another unfortunate fact of life is that delayed ACKs delay the
-         * advance of the left edge of our send window, so that the number
-         * of bytes we send in an RTT is often less than our cwnd will allow.
-         * So we keep track of our cwnd separately, in v_beg_snd_cwnd.
-         */
-
         if (after(ack, vegas->beg_snd_nxt)) {
                 /* Do the Vegas once-per-RTT cwnd adjustment. */
-                u32 old_wnd, old_snd_cwnd;
-
-
-                /* Here old_wnd is essentially the window of data that was
-                 * sent during the previous RTT, and has all
-                 * been acknowledged in the course of the RTT that ended
-                 * with the ACK we just received. Likewise, old_snd_cwnd
-                 * is the cwnd during the previous RTT.
-                 */
-                old_wnd = (vegas->beg_snd_nxt - vegas->beg_snd_una) /
-                        tp->mss_cache;
-                old_snd_cwnd = vegas->beg_snd_cwnd;
 
                 /* Save the extent of the current window so we can use this
                  * at the end of the next RTT.
                  */
-                vegas->beg_snd_una  = vegas->beg_snd_nxt;
                 vegas->beg_snd_nxt  = tp->snd_nxt;
-                vegas->beg_snd_cwnd = tp->snd_cwnd;
 
                 /* We do the Vegas calculations only if we got enough RTT
                  * samples that we can be reasonably sure that we got
@@ -252,22 +212,14 @@ static void tcp_vegas_cong_avoid(struct sock *sk, u32 ack, u32 in_flight)
                          *
                          * This is:
                          *     (actual rate in segments) * baseRTT
-                         * We keep it as a fixed point number with
-                         * V_PARAM_SHIFT bits to the right of the binary point.
                          */
-                        target_cwnd = ((u64)old_wnd * vegas->baseRTT);
-                        target_cwnd <<= V_PARAM_SHIFT;
-                        do_div(target_cwnd, rtt);
+                        target_cwnd = tp->snd_cwnd * vegas->baseRTT / rtt;
 
                         /* Calculate the difference between the window we had,
                          * and the window we would like to have. This quantity
                          * is the "Diff" from the Arizona Vegas papers.
-                         *
-                         * Again, this is a fixed point number with
-                         * V_PARAM_SHIFT bits to the right of the binary
-                         * point.
                          */
-                        diff = (old_wnd << V_PARAM_SHIFT) - target_cwnd;
+                        diff = tp->snd_cwnd * (rtt-vegas->baseRTT) / vegas->baseRTT;
 
                         if (diff > gamma && tp->snd_ssthresh > 2 ) {
                                 /* Going too fast. Time to slow down
@@ -282,16 +234,13 @@ static void tcp_vegas_cong_avoid(struct sock *sk, u32 ack, u32 in_flight)
                                  * truncation robs us of full link
                                  * utilization.
                                  */
-                                tp->snd_cwnd = min(tp->snd_cwnd,
-                                                   ((u32)target_cwnd >>
-                                                    V_PARAM_SHIFT)+1);
+                                tp->snd_cwnd = min(tp->snd_cwnd, (u32)target_cwnd+1);
 
                         } else if (tp->snd_cwnd <= tp->snd_ssthresh) {
                                 /* Slow start.  */
                                 tcp_slow_start(tp);
                         } else {
                                 /* Congestion avoidance. */
-                                u32 next_snd_cwnd;
 
                                 /* Figure out where we would like cwnd
                                  * to be.
@@ -300,32 +249,25 @@ static void tcp_vegas_cong_avoid(struct sock *sk, u32 ack, u32 in_flight)
                                         /* The old window was too fast, so
                                          * we slow down.
                                          */
-                                        next_snd_cwnd = old_snd_cwnd - 1;
+                                        tp->snd_cwnd--;
                                 } else if (diff < alpha) {
                                         /* We don't have enough extra packets
                                          * in the network, so speed up.
                                          */
-                                        next_snd_cwnd = old_snd_cwnd + 1;
+                                        tp->snd_cwnd++;
                                 } else {
                                         /* Sending just as fast as we
                                          * should be.
                                          */
-                                        next_snd_cwnd = old_snd_cwnd;
                                 }
-
-                                /* Adjust cwnd upward or downward, toward the
-                                 * desired value.
-                                 */
-                                if (next_snd_cwnd > tp->snd_cwnd)
-                                        tp->snd_cwnd++;
-                                else if (next_snd_cwnd < tp->snd_cwnd)
-                                        tp->snd_cwnd--;
                         }
 
                         if (tp->snd_cwnd < 2)
                                 tp->snd_cwnd = 2;
                         else if (tp->snd_cwnd > tp->snd_cwnd_clamp)
                                 tp->snd_cwnd = tp->snd_cwnd_clamp;
+
+                        tp->snd_ssthresh = tcp_current_ssthresh(sk);
                 }
 
                 /* Wipe the slate clean for the next RTT. */
diff --git a/net/ipv6/ip6_flowlabel.c b/net/ipv6/ip6_flowlabel.c
index 37a4e777e347..bd3c7b96bbaa 100644
--- a/net/ipv6/ip6_flowlabel.c
+++ b/net/ipv6/ip6_flowlabel.c
@@ -388,7 +388,7 @@ fl_create(struct net *net, struct in6_flowlabel_req *freq, char __user *optval,
                 fl->owner = current->pid;
                 break;
         case IPV6_FL_S_USER:
-                fl->owner = current->euid;
+                fl->owner = current_euid();
                 break;
         default:
                 err = -EINVAL;
diff --git a/net/ipv6/ndisc.c b/net/ipv6/ndisc.c
index 172438320eec..d0f54d18e19b 100644
--- a/net/ipv6/ndisc.c
+++ b/net/ipv6/ndisc.c
@@ -912,8 +912,13 @@ static void ndisc_recv_na(struct sk_buff *skb)
                    is invalid, but ndisc specs say nothing
                    about it. It could be misconfiguration, or
                    an smart proxy agent tries to help us :-)
+
+                   We should not print the error if NA has been
+                   received from loopback - it is just our own
+                   unsolicited advertisement.
                  */
-                ND_PRINTK1(KERN_WARNING
+                if (skb->pkt_type != PACKET_LOOPBACK)
+                        ND_PRINTK1(KERN_WARNING
                            "ICMPv6 NA: someone advertises our address on %s!\n",
                            ifp->idev->dev->name);
                 in6_ifa_put(ifp);
diff --git a/net/ipv6/netfilter/ip6t_LOG.c b/net/ipv6/netfilter/ip6t_LOG.c
index caa441d09567..871d157cec4e 100644
--- a/net/ipv6/netfilter/ip6t_LOG.c
+++ b/net/ipv6/netfilter/ip6t_LOG.c
@@ -364,8 +364,8 @@ static void dump_packet(const struct nf_loginfo *info,
                 read_lock_bh(&skb->sk->sk_callback_lock);
                 if (skb->sk->sk_socket && skb->sk->sk_socket->file)
                         printk("UID=%u GID=%u ",
-                                skb->sk->sk_socket->file->f_uid,
-                                skb->sk->sk_socket->file->f_gid);
+                                skb->sk->sk_socket->file->f_cred->fsuid,
+                                skb->sk->sk_socket->file->f_cred->fsgid);
                 read_unlock_bh(&skb->sk->sk_callback_lock);
         }
 
diff --git a/net/iucv/af_iucv.c b/net/iucv/af_iucv.c
index 29f7baa25110..af3192d2a5a3 100644
--- a/net/iucv/af_iucv.c
+++ b/net/iucv/af_iucv.c
@@ -8,6 +8,9 @@
  *  Author(s):  Jennifer Hunt <jenhunt@us.ibm.com>
  */
 
+#define KMSG_COMPONENT "af_iucv"
+#define pr_fmt(fmt) KMSG_COMPONENT ": " fmt
+
 #include <linux/module.h>
 #include <linux/types.h>
 #include <linux/list.h>
@@ -616,6 +619,8 @@ static int iucv_sock_sendmsg(struct kiocb *iocb, struct socket *sock,
         struct iucv_sock *iucv = iucv_sk(sk);
         struct sk_buff *skb;
         struct iucv_message txmsg;
+        char user_id[9];
+        char appl_id[9];
         int err;
 
         err = sock_error(sk);
@@ -651,8 +656,15 @@ static int iucv_sock_sendmsg(struct kiocb *iocb, struct socket *sock,
                 err = iucv_message_send(iucv->path, &txmsg, 0, 0,
                                         (void *) skb->data, skb->len);
                 if (err) {
-                        if (err == 3)
-                                printk(KERN_ERR "AF_IUCV msg limit exceeded\n");
+                        if (err == 3) {
+                                user_id[8] = 0;
+                                memcpy(user_id, iucv->dst_user_id, 8);
+                                appl_id[8] = 0;
+                                memcpy(appl_id, iucv->dst_name, 8);
+                                pr_err("Application %s on z/VM guest %s"
+                                       " exceeds message limit\n",
+                                       user_id, appl_id);
+                        }
                         skb_unlink(skb, &iucv->send_skb_q);
                         err = -EPIPE;
                         goto fail;
@@ -1190,7 +1202,8 @@ static int __init afiucv_init(void)
         int err;
 
         if (!MACHINE_IS_VM) {
-                printk(KERN_ERR "AF_IUCV connection needs VM as base\n");
+                pr_err("The af_iucv module cannot be loaded"
+                       " without z/VM\n");
                 err = -EPROTONOSUPPORT;
                 goto out;
         }
diff --git a/net/iucv/iucv.c b/net/iucv/iucv.c
index d7b54b5bfa69..8f57d4f4328a 100644
--- a/net/iucv/iucv.c
+++ b/net/iucv/iucv.c
@@ -30,6 +30,9 @@
  * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  */
 
+#define KMSG_COMPONENT "iucv"
+#define pr_fmt(fmt) KMSG_COMPONENT ": " fmt
+
 #include <linux/module.h>
 #include <linux/moduleparam.h>
 #include <linux/spinlock.h>
@@ -424,8 +427,8 @@ static void iucv_declare_cpu(void *data)
                         err = "Paging or storage error";
                         break;
                 }
-                printk(KERN_WARNING "iucv_register: iucv_declare_buffer "
-                       "on cpu %i returned error 0x%02x (%s)\n", cpu, rc, err);
+                pr_warning("Defining an interrupt buffer on CPU %i"
+                           " failed with 0x%02x (%s)\n", cpu, rc, err);
                 return;
         }
 
@@ -957,7 +960,52 @@ int iucv_message_purge(struct iucv_path *path, struct iucv_message *msg,
 EXPORT_SYMBOL(iucv_message_purge);
 
 /**
- * iucv_message_receive
+ * iucv_message_receive_iprmdata
+ * @path: address of iucv path structure
+ * @msg: address of iucv msg structure
+ * @flags: how the message is received (IUCV_IPBUFLST)
+ * @buffer: address of data buffer or address of struct iucv_array
+ * @size: length of data buffer
+ * @residual:
+ *
+ * Internal function used by iucv_message_receive and __iucv_message_receive
+ * to receive RMDATA data stored in struct iucv_message.
+ */
+static int iucv_message_receive_iprmdata(struct iucv_path *path,
+                                         struct iucv_message *msg,
+                                         u8 flags, void *buffer,
+                                         size_t size, size_t *residual)
+{
+        struct iucv_array *array;
+        u8 *rmmsg;
+        size_t copy;
+
+        /*
+         * Message is 8 bytes long and has been stored to the
+         * message descriptor itself.
+         */
+        if (residual)
+                *residual = abs(size - 8);
+        rmmsg = msg->rmmsg;
+        if (flags & IUCV_IPBUFLST) {
+                /* Copy to struct iucv_array. */
+                size = (size < 8) ? size : 8;
+                for (array = buffer; size > 0; array++) {
+                        copy = min_t(size_t, size, array->length);
+                        memcpy((u8 *)(addr_t) array->address,
+                                rmmsg, copy);
+                        rmmsg += copy;
+                        size -= copy;
+                }
+        } else {
+                /* Copy to direct buffer. */
+                memcpy(buffer, rmmsg, min_t(size_t, size, 8));
+        }
+        return 0;
+}
+
+/**
+ * __iucv_message_receive
  * @path: address of iucv path structure
  * @msg: address of iucv msg structure
  * @flags: how the message is received (IUCV_IPBUFLST)
@@ -969,44 +1017,19 @@ EXPORT_SYMBOL(iucv_message_purge);
  * established paths. This function will deal with RMDATA messages
  * embedded in struct iucv_message as well.
  *
+ * Locking:     no locking
+ *
  * Returns the result from the CP IUCV call.
  */
-int iucv_message_receive(struct iucv_path *path, struct iucv_message *msg,
-                         u8 flags, void *buffer, size_t size, size_t *residual)
+int __iucv_message_receive(struct iucv_path *path, struct iucv_message *msg,
+                           u8 flags, void *buffer, size_t size, size_t *residual)
 {
         union iucv_param *parm;
-        struct iucv_array *array;
-        u8 *rmmsg;
-        size_t copy;
         int rc;
 
-        if (msg->flags & IUCV_IPRMDATA) {
-                /*
-                 * Message is 8 bytes long and has been stored to the
-                 * message descriptor itself.
-                 */
-                rc = (size < 8) ? 5 : 0;
-                if (residual)
-                        *residual = abs(size - 8);
-                rmmsg = msg->rmmsg;
-                if (flags & IUCV_IPBUFLST) {
-                        /* Copy to struct iucv_array. */
-                        size = (size < 8) ? size : 8;
-                        for (array = buffer; size > 0; array++) {
-                                copy = min_t(size_t, size, array->length);
-                                memcpy((u8 *)(addr_t) array->address,
-                                       rmmsg, copy);
-                                rmmsg += copy;
-                                size -= copy;
-                        }
-                } else {
-                        /* Copy to direct buffer. */
-                        memcpy(buffer, rmmsg, min_t(size_t, size, 8));
-                }
-                return 0;
-        }
-
-        local_bh_disable();
+        if (msg->flags & IUCV_IPRMDATA)
+                return iucv_message_receive_iprmdata(path, msg, flags,
+                                                     buffer, size, residual);
         parm = iucv_param[smp_processor_id()];
         memset(parm, 0, sizeof(union iucv_param));
         parm->db.ipbfadr1 = (u32)(addr_t) buffer;
@@ -1022,6 +1045,37 @@ int iucv_message_receive(struct iucv_path *path, struct iucv_message *msg,
                 if (residual)
                         *residual = parm->db.ipbfln1f;
         }
+        return rc;
+}
+EXPORT_SYMBOL(__iucv_message_receive);
+
+/**
+ * iucv_message_receive
+ * @path: address of iucv path structure
+ * @msg: address of iucv msg structure
+ * @flags: how the message is received (IUCV_IPBUFLST)
+ * @buffer: address of data buffer or address of struct iucv_array
+ * @size: length of data buffer
+ * @residual:
+ *
+ * This function receives messages that are being sent to you over
+ * established paths. This function will deal with RMDATA messages
+ * embedded in struct iucv_message as well.
+ *
+ * Locking:     local_bh_enable/local_bh_disable
+ *
+ * Returns the result from the CP IUCV call.
+ */
+int iucv_message_receive(struct iucv_path *path, struct iucv_message *msg,
+                         u8 flags, void *buffer, size_t size, size_t *residual)
+{
+        int rc;
+
+        if (msg->flags & IUCV_IPRMDATA)
+                return iucv_message_receive_iprmdata(path, msg, flags,
+                                                     buffer, size, residual);
+        local_bh_disable();
+        rc = __iucv_message_receive(path, msg, flags, buffer, size, residual);
         local_bh_enable();
         return rc;
 }
@@ -1101,7 +1155,7 @@ int iucv_message_reply(struct iucv_path *path, struct iucv_message *msg,
 EXPORT_SYMBOL(iucv_message_reply);
 
 /**
- * iucv_message_send
+ * __iucv_message_send
  * @path: address of iucv path structure
  * @msg: address of iucv msg structure
  * @flags: how the message is sent (IUCV_IPRMDATA, IUCV_IPPRTY, IUCV_IPBUFLST)
@@ -1113,15 +1167,16 @@ EXPORT_SYMBOL(iucv_message_reply);
  * transmitted is in a buffer and this is a one-way message and the
  * receiver will not reply to the message.
  *
+ * Locking:     no locking
+ *
  * Returns the result from the CP IUCV call.
  */
-int iucv_message_send(struct iucv_path *path, struct iucv_message *msg,
+int __iucv_message_send(struct iucv_path *path, struct iucv_message *msg,
                       u8 flags, u32 srccls, void *buffer, size_t size)
 {
         union iucv_param *parm;
         int rc;
 
-        local_bh_disable();
         parm = iucv_param[smp_processor_id()];
         memset(parm, 0, sizeof(union iucv_param));
         if (flags & IUCV_IPRMDATA) {
@@ -1144,6 +1199,34 @@ int iucv_message_send(struct iucv_path *path, struct iucv_message *msg,
         rc = iucv_call_b2f0(IUCV_SEND, parm);
         if (!rc)
                 msg->id = parm->db.ipmsgid;
+        return rc;
+}
+EXPORT_SYMBOL(__iucv_message_send);
+
+/**
+ * iucv_message_send
+ * @path: address of iucv path structure
+ * @msg: address of iucv msg structure
+ * @flags: how the message is sent (IUCV_IPRMDATA, IUCV_IPPRTY, IUCV_IPBUFLST)
+ * @srccls: source class of message
+ * @buffer: address of send buffer or address of struct iucv_array
+ * @size: length of send buffer
+ *
+ * This function transmits data to another application. Data to be
+ * transmitted is in a buffer and this is a one-way message and the
+ * receiver will not reply to the message.
+ *
+ * Locking:     local_bh_enable/local_bh_disable
+ *
+ * Returns the result from the CP IUCV call.
+ */
+int iucv_message_send(struct iucv_path *path, struct iucv_message *msg,
+                      u8 flags, u32 srccls, void *buffer, size_t size)
+{
+        int rc;
+
+        local_bh_disable();
+        rc = __iucv_message_send(path, msg, flags, srccls, buffer, size);
         local_bh_enable();
         return rc;
 }
@@ -1572,7 +1655,7 @@ static void iucv_external_interrupt(u16 code)
         BUG_ON(p->iptype  < 0x01 || p->iptype > 0x09);
         work = kmalloc(sizeof(struct iucv_irq_list), GFP_ATOMIC);
         if (!work) {
-                printk(KERN_WARNING "iucv_external_interrupt: out of memory\n");
+                pr_warning("iucv_external_interrupt: out of memory\n");
                 return;
         }
         memcpy(&work->data, p, sizeof(work->data));
diff --git a/net/mac80211/sta_info.c b/net/mac80211/sta_info.c
index 7fef8ea1f5ec..d254446b85b5 100644
--- a/net/mac80211/sta_info.c
+++ b/net/mac80211/sta_info.c
@@ -99,7 +99,7 @@ struct sta_info *sta_info_get(struct ieee80211_local *local, const u8 *addr)
 
         sta = rcu_dereference(local->sta_hash[STA_HASH(addr)]);
         while (sta) {
-                if (compare_ether_addr(sta->sta.addr, addr) == 0)
+                if (memcmp(sta->sta.addr, addr, ETH_ALEN) == 0)
                         break;
                 sta = rcu_dereference(sta->hnext);
         }
diff --git a/net/mac80211/wext.c b/net/mac80211/wext.c
index 742f811ca416..ab4ddba874be 100644
--- a/net/mac80211/wext.c
+++ b/net/mac80211/wext.c
@@ -271,6 +271,7 @@ static int ieee80211_ioctl_siwmode(struct net_device *dev,
                                    __u32 *mode, char *extra)
 {
         struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
+        struct ieee80211_local *local = sdata->local;
         int type;
 
         if (sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
@@ -281,6 +282,13 @@ static int ieee80211_ioctl_siwmode(struct net_device *dev,
                 type = NL80211_IFTYPE_STATION;
                 break;
         case IW_MODE_ADHOC:
+                /* Setting ad-hoc mode on non ibss channel is not
+                 * supported.
+                 */
+                if (local->oper_channel &&
+                    (local->oper_channel->flags & IEEE80211_CHAN_NO_IBSS))
+                        return -EOPNOTSUPP;
+
                 type = NL80211_IFTYPE_ADHOC;
                 break;
         case IW_MODE_REPEAT:
diff --git a/net/netfilter/nf_conntrack_core.c b/net/netfilter/nf_conntrack_core.c
index 622d7c671cb7..233fdd2d7d21 100644
--- a/net/netfilter/nf_conntrack_core.c
+++ b/net/netfilter/nf_conntrack_core.c
@@ -305,9 +305,7 @@ void nf_conntrack_hash_insert(struct nf_conn *ct)
         hash = hash_conntrack(&ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple);
         repl_hash = hash_conntrack(&ct->tuplehash[IP_CT_DIR_REPLY].tuple);
 
-        spin_lock_bh(&nf_conntrack_lock);
         __nf_conntrack_hash_insert(ct, hash, repl_hash);
-        spin_unlock_bh(&nf_conntrack_lock);
 }
 EXPORT_SYMBOL_GPL(nf_conntrack_hash_insert);
 
diff --git a/net/netfilter/nf_conntrack_netlink.c b/net/netfilter/nf_conntrack_netlink.c
index a040d46f85d6..5f4a6516b3b6 100644
--- a/net/netfilter/nf_conntrack_netlink.c
+++ b/net/netfilter/nf_conntrack_netlink.c
@@ -1090,7 +1090,7 @@ ctnetlink_create_conntrack(struct nlattr *cda[],
         struct nf_conn_help *help;
         struct nf_conntrack_helper *helper;
 
-        ct = nf_conntrack_alloc(&init_net, otuple, rtuple, GFP_KERNEL);
+        ct = nf_conntrack_alloc(&init_net, otuple, rtuple, GFP_ATOMIC);
         if (ct == NULL || IS_ERR(ct))
                 return -ENOMEM;
 
@@ -1138,7 +1138,7 @@ ctnetlink_create_conntrack(struct nlattr *cda[],
                 }
         }
 
-        nf_ct_acct_ext_add(ct, GFP_KERNEL);
+        nf_ct_acct_ext_add(ct, GFP_ATOMIC);
 
 #if defined(CONFIG_NF_CONNTRACK_MARK)
         if (cda[CTA_MARK])
@@ -1212,13 +1212,14 @@ ctnetlink_new_conntrack(struct sock *ctnl, struct sk_buff *skb,
                         atomic_inc(&master_ct->ct_general.use);
                 }
 
-                spin_unlock_bh(&nf_conntrack_lock);
                 err = -ENOENT;
                 if (nlh->nlmsg_flags & NLM_F_CREATE)
                         err = ctnetlink_create_conntrack(cda,
                                                          &otuple,
                                                          &rtuple,
                                                          master_ct);
+                spin_unlock_bh(&nf_conntrack_lock);
+
                 if (err < 0 && master_ct)
                         nf_ct_put(master_ct);
 
diff --git a/net/netfilter/nfnetlink_log.c b/net/netfilter/nfnetlink_log.c
index 41e0105d3828..38f9efd90e8d 100644
--- a/net/netfilter/nfnetlink_log.c
+++ b/net/netfilter/nfnetlink_log.c
@@ -474,8 +474,9 @@ __build_packet_message(struct nfulnl_instance *inst,
         if (skb->sk) {
                 read_lock_bh(&skb->sk->sk_callback_lock);
                 if (skb->sk->sk_socket && skb->sk->sk_socket->file) {
-                        __be32 uid = htonl(skb->sk->sk_socket->file->f_uid);
-                        __be32 gid = htonl(skb->sk->sk_socket->file->f_gid);
+                        struct file *file = skb->sk->sk_socket->file;
+                        __be32 uid = htonl(file->f_cred->fsuid);
+                        __be32 gid = htonl(file->f_cred->fsgid);
                         /* need to unlock here since NLA_PUT may goto */
                         read_unlock_bh(&skb->sk->sk_callback_lock);
                         NLA_PUT_BE32(inst->skb, NFULA_UID, uid);
diff --git a/net/netfilter/xt_owner.c b/net/netfilter/xt_owner.c
index f19ebd9b78f5..22b2a5e881ea 100644
--- a/net/netfilter/xt_owner.c
+++ b/net/netfilter/xt_owner.c
@@ -34,12 +34,12 @@ owner_mt_v0(const struct sk_buff *skb, const struct xt_match_param *par)
                 return false;
 
         if (info->match & IPT_OWNER_UID)
-                if ((filp->f_uid != info->uid) ^
+                if ((filp->f_cred->fsuid != info->uid) ^
                     !!(info->invert & IPT_OWNER_UID))
                         return false;
 
         if (info->match & IPT_OWNER_GID)
-                if ((filp->f_gid != info->gid) ^
+                if ((filp->f_cred->fsgid != info->gid) ^
                     !!(info->invert & IPT_OWNER_GID))
                         return false;
 
@@ -60,12 +60,12 @@ owner_mt6_v0(const struct sk_buff *skb, const struct xt_match_param *par)
                 return false;
 
         if (info->match & IP6T_OWNER_UID)
-                if ((filp->f_uid != info->uid) ^
+                if ((filp->f_cred->fsuid != info->uid) ^
                     !!(info->invert & IP6T_OWNER_UID))
                         return false;
 
         if (info->match & IP6T_OWNER_GID)
-                if ((filp->f_gid != info->gid) ^
+                if ((filp->f_cred->fsgid != info->gid) ^
                     !!(info->invert & IP6T_OWNER_GID))
                         return false;
 
@@ -93,14 +93,14 @@ owner_mt(const struct sk_buff *skb, const struct xt_match_param *par)
                        (XT_OWNER_UID | XT_OWNER_GID)) == 0;
 
         if (info->match & XT_OWNER_UID)
-                if ((filp->f_uid >= info->uid_min &&
-                    filp->f_uid <= info->uid_max) ^
+                if ((filp->f_cred->fsuid >= info->uid_min &&
+                    filp->f_cred->fsuid <= info->uid_max) ^
                     !(info->invert & XT_OWNER_UID))
                         return false;
 
         if (info->match & XT_OWNER_GID)
-                if ((filp->f_gid >= info->gid_min &&
-                    filp->f_gid <= info->gid_max) ^
+                if ((filp->f_cred->fsgid >= info->gid_min &&
+                    filp->f_cred->fsgid <= info->gid_max) ^
                     !(info->invert & XT_OWNER_GID))
                         return false;
 
diff --git a/net/netfilter/xt_socket.c b/net/netfilter/xt_socket.c
index 02a8fed21082..1acc089be7e9 100644
--- a/net/netfilter/xt_socket.c
+++ b/net/netfilter/xt_socket.c
@@ -141,7 +141,7 @@ socket_mt(const struct sk_buff *skb, const struct xt_match_param *par)
         sk = nf_tproxy_get_sock_v4(dev_net(skb->dev), protocol,
                                    saddr, daddr, sport, dport, par->in, false);
         if (sk != NULL) {
-                bool wildcard = (inet_sk(sk)->rcv_saddr == 0);
+                bool wildcard = (sk->sk_state != TCP_TIME_WAIT && inet_sk(sk)->rcv_saddr == 0);
 
                 nf_tproxy_put_sock(sk);
                 if (wildcard)
diff --git a/net/netlabel/netlabel_unlabeled.c b/net/netlabel/netlabel_unlabeled.c
index e8a5c32b0f10..8c0308032178 100644
--- a/net/netlabel/netlabel_unlabeled.c
+++ b/net/netlabel/netlabel_unlabeled.c
@@ -562,7 +562,6 @@ static int netlbl_unlhsh_remove_addr4(struct net *net,
                                       const struct in_addr *mask,
                                       struct netlbl_audit *audit_info)
 {
-        int ret_val = 0;
         struct netlbl_af4list *list_entry;
         struct netlbl_unlhsh_addr4 *entry;
         struct audit_buffer *audit_buf;
@@ -574,9 +573,10 @@ static int netlbl_unlhsh_remove_addr4(struct net *net,
         list_entry = netlbl_af4list_remove(addr->s_addr, mask->s_addr,
                                            &iface->addr4_list);
         spin_unlock(&netlbl_unlhsh_lock);
-        if (list_entry == NULL)
-                ret_val = -ENOENT;
-        entry = netlbl_unlhsh_addr4_entry(list_entry);
+        if (list_entry != NULL)
+                entry = netlbl_unlhsh_addr4_entry(list_entry);
+        else
+                entry = NULL;
 
         audit_buf = netlbl_audit_start_common(AUDIT_MAC_UNLBL_STCDEL,
                                               audit_info);
@@ -587,19 +587,21 @@ static int netlbl_unlhsh_remove_addr4(struct net *net,
                                           addr->s_addr, mask->s_addr);
                 if (dev != NULL)
                         dev_put(dev);
-                if (entry && security_secid_to_secctx(entry->secid,
-                                                      &secctx,
-                                                      &secctx_len) == 0) {
+                if (entry != NULL &&
+                    security_secid_to_secctx(entry->secid,
+                                             &secctx, &secctx_len) == 0) {
                         audit_log_format(audit_buf, " sec_obj=%s", secctx);
                         security_release_secctx(secctx, secctx_len);
                 }
-                audit_log_format(audit_buf, " res=%u", ret_val == 0 ? 1 : 0);
+                audit_log_format(audit_buf, " res=%u", entry != NULL ? 1 : 0);
                 audit_log_end(audit_buf);
         }
 
-        if (ret_val == 0)
-                call_rcu(&entry->rcu, netlbl_unlhsh_free_addr4);
-        return ret_val;
+        if (entry == NULL)
+                return -ENOENT;
+
+        call_rcu(&entry->rcu, netlbl_unlhsh_free_addr4);
+        return 0;
 }
 
 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
@@ -623,7 +625,6 @@ static int netlbl_unlhsh_remove_addr6(struct net *net,
                                       const struct in6_addr *mask,
                                       struct netlbl_audit *audit_info)
 {
-        int ret_val = 0;
         struct netlbl_af6list *list_entry;
         struct netlbl_unlhsh_addr6 *entry;
         struct audit_buffer *audit_buf;
@@ -634,9 +635,10 @@ static int netlbl_unlhsh_remove_addr6(struct net *net,
         spin_lock(&netlbl_unlhsh_lock);
         list_entry = netlbl_af6list_remove(addr, mask, &iface->addr6_list);
         spin_unlock(&netlbl_unlhsh_lock);
-        if (list_entry == NULL)
-                ret_val = -ENOENT;
-        entry = netlbl_unlhsh_addr6_entry(list_entry);
+        if (list_entry != NULL)
+                entry = netlbl_unlhsh_addr6_entry(list_entry);
+        else
+                entry = NULL;
 
         audit_buf = netlbl_audit_start_common(AUDIT_MAC_UNLBL_STCDEL,
                                               audit_info);
@@ -647,19 +649,21 @@ static int netlbl_unlhsh_remove_addr6(struct net *net,
                                           addr, mask);
                 if (dev != NULL)
                         dev_put(dev);
-                if (entry && security_secid_to_secctx(entry->secid,
-                                                      &secctx,
-                                                      &secctx_len) == 0) {
+                if (entry != NULL &&
+                    security_secid_to_secctx(entry->secid,
+                                             &secctx, &secctx_len) == 0) {
                         audit_log_format(audit_buf, " sec_obj=%s", secctx);
                         security_release_secctx(secctx, secctx_len);
                 }
-                audit_log_format(audit_buf, " res=%u", ret_val == 0 ? 1 : 0);
+                audit_log_format(audit_buf, " res=%u", entry != NULL ? 1 : 0);
                 audit_log_end(audit_buf);
         }
 
-        if (ret_val == 0)
-                call_rcu(&entry->rcu, netlbl_unlhsh_free_addr6);
-        return ret_val;
+        if (entry == NULL)
+                return -ENOENT;
+
+        call_rcu(&entry->rcu, netlbl_unlhsh_free_addr6);
+        return 0;
 }
 #endif /* IPv6 */
 
diff --git a/net/netrom/af_netrom.c b/net/netrom/af_netrom.c
index 9f1ea4a27b35..e9c05b8f4f45 100644
--- a/net/netrom/af_netrom.c
+++ b/net/netrom/af_netrom.c
@@ -609,7 +609,7 @@ static int nr_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
         } else {
                 source = &addr->fsa_ax25.sax25_call;
 
-                user = ax25_findbyuid(current->euid);
+                user = ax25_findbyuid(current_euid());
                 if (user) {
                         nr->user_addr   = user->call;
                         ax25_uid_put(user);
@@ -683,7 +683,7 @@ static int nr_connect(struct socket *sock, struct sockaddr *uaddr,
                 }
                 source = (ax25_address *)dev->dev_addr;
 
-                user = ax25_findbyuid(current->euid);
+                user = ax25_findbyuid(current_euid());
                 if (user) {
                         nr->user_addr   = user->call;
                         ax25_uid_put(user);
diff --git a/net/phonet/pep-gprs.c b/net/phonet/pep-gprs.c
index 9978afbd9f2a..803eeef0aa85 100644
--- a/net/phonet/pep-gprs.c
+++ b/net/phonet/pep-gprs.c
@@ -155,12 +155,13 @@ static void gprs_data_ready(struct sock *sk, int len)
 static void gprs_write_space(struct sock *sk)
 {
         struct gprs_dev *dev = sk->sk_user_data;
+        struct net_device *net = dev->net;
         unsigned credits = pep_writeable(sk);
 
         spin_lock_bh(&dev->tx_lock);
         dev->tx_max = credits;
-        if (credits > skb_queue_len(&dev->tx_queue))
-                netif_wake_queue(dev->net);
+        if (credits > skb_queue_len(&dev->tx_queue) && netif_running(net))
+                netif_wake_queue(net);
         spin_unlock_bh(&dev->tx_lock);
 }
 
@@ -168,6 +169,23 @@ static void gprs_write_space(struct sock *sk)
  * Network device callbacks
  */
 
+static int gprs_open(struct net_device *dev)
+{
+        struct gprs_dev *gp = netdev_priv(dev);
+
+        gprs_write_space(gp->sk);
+        return 0;
+}
+
+static int gprs_close(struct net_device *dev)
+{
+        struct gprs_dev *gp = netdev_priv(dev);
+
+        netif_stop_queue(dev);
+        flush_work(&gp->tx_work);
+        return 0;
+}
+
 static int gprs_xmit(struct sk_buff *skb, struct net_device *net)
 {
         struct gprs_dev *dev = netdev_priv(net);
@@ -254,6 +272,8 @@ static void gprs_setup(struct net_device *net)
         net->tx_queue_len       = 10;
 
         net->destructor         = free_netdev;
+        net->open               = gprs_open;
+        net->stop               = gprs_close;
         net->hard_start_xmit    = gprs_xmit; /* mandatory */
         net->change_mtu         = gprs_set_mtu;
         net->get_stats          = gprs_get_stats;
@@ -318,7 +338,6 @@ int gprs_attach(struct sock *sk)
         dev->sk = sk;
 
         printk(KERN_DEBUG"%s: attached\n", net->name);
-        gprs_write_space(sk); /* kick off TX */
         return net->ifindex;
 
 out_rel:
@@ -341,7 +360,5 @@ void gprs_detach(struct sock *sk)
 
         printk(KERN_DEBUG"%s: detached\n", net->name);
         unregister_netdev(net);
-        flush_scheduled_work();
         sock_put(sk);
-        skb_queue_purge(&dev->tx_queue);
 }
diff --git a/net/phonet/pn_dev.c b/net/phonet/pn_dev.c
index 53be9fc82aaa..f93ff8ef47d0 100644
--- a/net/phonet/pn_dev.c
+++ b/net/phonet/pn_dev.c
@@ -115,7 +115,7 @@ int phonet_address_del(struct net_device *dev, u8 addr)
         pnd = __phonet_get(dev);
         if (!pnd || !test_and_clear_bit(addr >> 2, pnd->addrs))
                 err = -EADDRNOTAVAIL;
-        if (bitmap_empty(pnd->addrs, 64))
+        else if (bitmap_empty(pnd->addrs, 64))
                 __phonet_device_free(pnd);
         spin_unlock_bh(&pndevs.lock);
         return err;
diff --git a/net/phonet/pn_netlink.c b/net/phonet/pn_netlink.c
index b1770d66bc8d..242fe8f8c322 100644
--- a/net/phonet/pn_netlink.c
+++ b/net/phonet/pn_netlink.c
@@ -123,6 +123,7 @@ nla_put_failure:
 
 static int getaddr_dumpit(struct sk_buff *skb, struct netlink_callback *cb)
 {
+        struct net *net = sock_net(skb->sk);
         struct phonet_device *pnd;
         int dev_idx = 0, dev_start_idx = cb->args[0];
         int addr_idx = 0, addr_start_idx = cb->args[1];
@@ -131,6 +132,8 @@ static int getaddr_dumpit(struct sk_buff *skb, struct netlink_callback *cb)
         list_for_each_entry(pnd, &pndevs.list, list) {
                 u8 addr;
 
+                if (!net_eq(dev_net(pnd->netdev), net))
+                        continue;
                 if (dev_idx > dev_start_idx)
                         addr_start_idx = 0;
                 if (dev_idx++ < dev_start_idx)
diff --git a/net/rose/af_rose.c b/net/rose/af_rose.c
index a7f1ce11bc22..01392649b462 100644
--- a/net/rose/af_rose.c
+++ b/net/rose/af_rose.c
@@ -690,7 +690,7 @@ static int rose_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
 
         source = &addr->srose_call;
 
-        user = ax25_findbyuid(current->euid);
+        user = ax25_findbyuid(current_euid());
         if (user) {
                 rose->source_call = user->call;
                 ax25_uid_put(user);
@@ -791,7 +791,7 @@ static int rose_connect(struct socket *sock, struct sockaddr *uaddr, int addr_le
                         goto out_release;
                 }
 
-                user = ax25_findbyuid(current->euid);
+                user = ax25_findbyuid(current_euid());
                 if (!user) {
                         err = -EINVAL;
                         goto out_release;
@@ -1072,6 +1072,10 @@ static int rose_sendmsg(struct kiocb *iocb, struct socket *sock,
         unsigned char *asmptr;
         int n, size, qbit = 0;
 
+        /* ROSE empty frame has no meaning : don't send */
+        if (len == 0)
+                return 0;
+
         if (msg->msg_flags & ~(MSG_DONTWAIT|MSG_EOR|MSG_CMSG_COMPAT))
                 return -EINVAL;
 
@@ -1265,6 +1269,12 @@ static int rose_recvmsg(struct kiocb *iocb, struct socket *sock,
         skb_reset_transport_header(skb);
         copied     = skb->len;
 
+        /* ROSE empty frame has no meaning : ignore it */
+        if (copied == 0) {
+                skb_free_datagram(sk, skb);
+                return copied;
+        }
+
         if (copied > size) {
                 copied = size;
                 msg->msg_flags |= MSG_TRUNC;
diff --git a/net/rxrpc/ar-key.c b/net/rxrpc/ar-key.c
index 9a8ff684da79..ad8c7a782da1 100644
--- a/net/rxrpc/ar-key.c
+++ b/net/rxrpc/ar-key.c
@@ -287,6 +287,7 @@ int rxrpc_get_server_data_key(struct rxrpc_connection *conn,
                               time_t expiry,
                               u32 kvno)
 {
+        const struct cred *cred = current_cred();
         struct key *key;
         int ret;
 
@@ -297,7 +298,7 @@ int rxrpc_get_server_data_key(struct rxrpc_connection *conn,
 
         _enter("");
 
-        key = key_alloc(&key_type_rxrpc, "x", 0, 0, current, 0,
+        key = key_alloc(&key_type_rxrpc, "x", 0, 0, cred, 0,
                         KEY_ALLOC_NOT_IN_QUOTA);
         if (IS_ERR(key)) {
                 _leave(" = -ENOMEM [alloc %ld]", PTR_ERR(key));
@@ -340,10 +341,11 @@ EXPORT_SYMBOL(rxrpc_get_server_data_key);
  */
 struct key *rxrpc_get_null_key(const char *keyname)
 {
+        const struct cred *cred = current_cred();
         struct key *key;
         int ret;
 
-        key = key_alloc(&key_type_rxrpc, keyname, 0, 0, current,
+        key = key_alloc(&key_type_rxrpc, keyname, 0, 0, cred,
                         KEY_POS_SEARCH, KEY_ALLOC_NOT_IN_QUOTA);
         if (IS_ERR(key))
                 return key;
diff --git a/net/sched/cls_flow.c b/net/sched/cls_flow.c
index 0ebaff637e31..0ef4e3065bcd 100644
--- a/net/sched/cls_flow.c
+++ b/net/sched/cls_flow.c
@@ -260,14 +260,14 @@ static u32 flow_get_rtclassid(const struct sk_buff *skb)
 static u32 flow_get_skuid(const struct sk_buff *skb)
 {
         if (skb->sk && skb->sk->sk_socket && skb->sk->sk_socket->file)
-                return skb->sk->sk_socket->file->f_uid;
+                return skb->sk->sk_socket->file->f_cred->fsuid;
         return 0;
 }
 
 static u32 flow_get_skgid(const struct sk_buff *skb)
 {
         if (skb->sk && skb->sk->sk_socket && skb->sk->sk_socket->file)
-                return skb->sk->sk_socket->file->f_gid;
+                return skb->sk->sk_socket->file->f_cred->fsgid;
         return 0;
 }
 
diff --git a/net/sched/sch_netem.c b/net/sched/sch_netem.c
index a11959908d9a..98402f0efa47 100644
--- a/net/sched/sch_netem.c
+++ b/net/sched/sch_netem.c
@@ -46,9 +46,6 @@
          layering other disciplines.  It does not need to do bandwidth
          control either since that can be handled by using token
          bucket or other rate control.
-
-         The simulator is limited by the Linux timer resolution
-         and will create packet bursts on the HZ boundary (1ms).
 */
 
 struct netem_sched_data {
diff --git a/net/socket.c b/net/socket.c
index 92764d836891..072e2e525ae6 100644
--- a/net/socket.c
+++ b/net/socket.c
@@ -491,8 +491,8 @@ static struct socket *sock_alloc(void)
         sock = SOCKET_I(inode);
 
         inode->i_mode = S_IFSOCK | S_IRWXUGO;
-        inode->i_uid = current->fsuid;
-        inode->i_gid = current->fsgid;
+        inode->i_uid = current_fsuid();
+        inode->i_gid = current_fsgid();
 
         get_cpu_var(sockets_in_use)++;
         put_cpu_var(sockets_in_use);
@@ -2307,6 +2307,7 @@ int kernel_accept(struct socket *sock, struct socket **newsock, int flags)
         }
 
         (*newsock)->ops = sock->ops;
+        __module_get((*newsock)->ops->owner);
 
 done:
         return err;
diff --git a/net/sunrpc/auth.c b/net/sunrpc/auth.c
index cb216b2df666..0443f8349458 100644
--- a/net/sunrpc/auth.c
+++ b/net/sunrpc/auth.c
@@ -350,16 +350,18 @@ EXPORT_SYMBOL_GPL(rpcauth_lookup_credcache);
 struct rpc_cred *
 rpcauth_lookupcred(struct rpc_auth *auth, int flags)
 {
-        struct auth_cred acred = {
-                .uid = current->fsuid,
-                .gid = current->fsgid,
-                .group_info = current->group_info,
-        };
+        struct auth_cred acred;
         struct rpc_cred *ret;
+        const struct cred *cred = current_cred();
 
         dprintk("RPC:       looking up %s cred\n",
                 auth->au_ops->au_name);
-        get_group_info(acred.group_info);
+
+        memset(&acred, 0, sizeof(acred));
+        acred.uid = cred->fsuid;
+        acred.gid = cred->fsgid;
+        acred.group_info = get_group_info(((struct cred *)cred)->group_info);
+
         ret = auth->au_ops->lookup_cred(auth, &acred, flags);
         put_group_info(acred.group_info);
         return ret;
diff --git a/net/sunrpc/svcsock.c b/net/sunrpc/svcsock.c
index 95293f549e9c..a1951dcc5776 100644
--- a/net/sunrpc/svcsock.c
+++ b/net/sunrpc/svcsock.c
@@ -1183,7 +1183,11 @@ int svc_addsock(struct svc_serv *serv,
         else if (so->state > SS_UNCONNECTED)
                 err = -EISCONN;
         else {
-                svsk = svc_setup_socket(serv, so, &err, SVC_SOCK_DEFAULTS);
+                if (!try_module_get(THIS_MODULE))
+                        err = -ENOENT;
+                else
+                        svsk = svc_setup_socket(serv, so, &err,
+                                                SVC_SOCK_DEFAULTS);
                 if (svsk) {
                         struct sockaddr_storage addr;
                         struct sockaddr *sin = (struct sockaddr *)&addr;
@@ -1196,7 +1200,8 @@ int svc_addsock(struct svc_serv *serv,
                         spin_unlock_bh(&serv->sv_lock);
                         svc_xprt_received(&svsk->sk_xprt);
                         err = 0;
-                }
+                } else
+                        module_put(THIS_MODULE);
         }
         if (err) {
                 sockfd_put(so);
diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c
index eb90f77bb0e2..b152e2b9b988 100644
--- a/net/unix/af_unix.c
+++ b/net/unix/af_unix.c
@@ -467,8 +467,7 @@ static int unix_listen(struct socket *sock, int backlog)
         sk->sk_state            = TCP_LISTEN;
         /* set credentials so connect can copy them */
         sk->sk_peercred.pid     = task_tgid_vnr(current);
-        sk->sk_peercred.uid     = current->euid;
-        sk->sk_peercred.gid     = current->egid;
+        current_euid_egid(&sk->sk_peercred.uid, &sk->sk_peercred.gid);
         err = 0;
 
 out_unlock:
@@ -1126,8 +1125,7 @@ restart:
         newsk->sk_state         = TCP_ESTABLISHED;
         newsk->sk_type          = sk->sk_type;
         newsk->sk_peercred.pid  = task_tgid_vnr(current);
-        newsk->sk_peercred.uid  = current->euid;
-        newsk->sk_peercred.gid  = current->egid;
+        current_euid_egid(&newsk->sk_peercred.uid, &newsk->sk_peercred.gid);
         newu = unix_sk(newsk);
         newsk->sk_sleep         = &newu->peer_wait;
         otheru = unix_sk(other);
@@ -1187,8 +1185,9 @@ static int unix_socketpair(struct socket *socka, struct socket *sockb)
         unix_peer(ska)=skb;
         unix_peer(skb)=ska;
         ska->sk_peercred.pid = skb->sk_peercred.pid = task_tgid_vnr(current);
-        ska->sk_peercred.uid = skb->sk_peercred.uid = current->euid;
-        ska->sk_peercred.gid = skb->sk_peercred.gid = current->egid;
+        current_euid_egid(&skb->sk_peercred.uid, &skb->sk_peercred.gid);
+        ska->sk_peercred.uid = skb->sk_peercred.uid;
+        ska->sk_peercred.gid = skb->sk_peercred.gid;
 
         if (ska->sk_type != SOCK_DGRAM) {
                 ska->sk_state = TCP_ESTABLISHED;
@@ -1343,6 +1342,7 @@ static int unix_dgram_sendmsg(struct kiocb *kiocb, struct socket *sock,
 
         if (NULL == siocb->scm)
                 siocb->scm = &tmp_scm;
+        wait_for_unix_gc();
         err = scm_send(sock, msg, siocb->scm);
         if (err < 0)
                 return err;
@@ -1493,6 +1493,7 @@ static int unix_stream_sendmsg(struct kiocb *kiocb, struct socket *sock,
 
         if (NULL == siocb->scm)
                 siocb->scm = &tmp_scm;
+        wait_for_unix_gc();
         err = scm_send(sock, msg, siocb->scm);
         if (err < 0)
                 return err;
diff --git a/net/unix/garbage.c b/net/unix/garbage.c
index 6d4a9a8de5ef..abb3ab34cb1e 100644
--- a/net/unix/garbage.c
+++ b/net/unix/garbage.c
@@ -80,6 +80,7 @@
 #include <linux/file.h>
 #include <linux/proc_fs.h>
 #include <linux/mutex.h>
+#include <linux/wait.h>
 
 #include <net/sock.h>
 #include <net/af_unix.h>
@@ -91,6 +92,7 @@
 static LIST_HEAD(gc_inflight_list);
 static LIST_HEAD(gc_candidates);
 static DEFINE_SPINLOCK(unix_gc_lock);
+static DECLARE_WAIT_QUEUE_HEAD(unix_gc_wait);
 
 unsigned int unix_tot_inflight;
 
@@ -266,12 +268,16 @@ static void inc_inflight_move_tail(struct unix_sock *u)
                 list_move_tail(&u->link, &gc_candidates);
 }
 
-/* The external entry point: unix_gc() */
+static bool gc_in_progress = false;
 
-void unix_gc(void)
+void wait_for_unix_gc(void)
 {
-        static bool gc_in_progress = false;
+        wait_event(unix_gc_wait, gc_in_progress == false);
+}
 
+/* The external entry point: unix_gc() */
+void unix_gc(void)
+{
         struct unix_sock *u;
         struct unix_sock *next;
         struct sk_buff_head hitlist;
@@ -376,6 +382,7 @@ void unix_gc(void)
         /* All candidates should have been detached by now. */
         BUG_ON(!list_empty(&gc_candidates));
         gc_in_progress = false;
+        wake_up(&unix_gc_wait);
 
  out:
         spin_unlock(&unix_gc_lock);
diff --git a/net/wireless/reg.c b/net/wireless/reg.c
index 626dbb688499..eb3b1a9f9b12 100644
--- a/net/wireless/reg.c
+++ b/net/wireless/reg.c
@@ -343,9 +343,9 @@ static int ignore_request(struct wiphy *wiphy, enum reg_set_by set_by,
                                 return 0;
                         return -EALREADY;
                 }
-                if (WARN_ON(!is_alpha2_set(alpha2) || !is_an_alpha2(alpha2)),
+                if (WARN(!is_alpha2_set(alpha2) || !is_an_alpha2(alpha2),
                                 "Invalid Country IE regulatory hint passed "
-                                "to the wireless core\n")
+                                "to the wireless core\n"))
                         return -EINVAL;
                 /* We ignore Country IE hints for now, as we haven't yet
                  * added the dot11MultiDomainCapabilityEnabled flag
diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c
index 058f04f54b90..fb216c9adf86 100644
--- a/net/xfrm/xfrm_policy.c
+++ b/net/xfrm/xfrm_policy.c
@@ -817,6 +817,7 @@ int xfrm_policy_flush(u8 type, struct xfrm_audit *audit_info)
                                 continue;
                         hlist_del(&pol->bydst);
                         hlist_del(&pol->byidx);
+                        list_del(&pol->walk.all);
                         write_unlock_bh(&xfrm_policy_lock);
 
                         xfrm_audit_policy_delete(pol, 1, audit_info->loginuid,