57 files changed, 291 insertions, 168 deletions
diff --git a/net/9p/client.c b/net/9p/client.c
index 787ccddb85ea..5bf5f227dbe0 100644
--- a/net/9p/client.c
+++ b/net/9p/client.c
@@ -60,9 +60,9 @@ static struct p9_req_t *
 p9_client_rpc(struct p9_client *c, int8_t type, const char *fmt, ...);
 /**
- * v9fs_parse_options - parse mount options into session structure
+ * parse_options - parse mount options into client structure
- * @options: options string passed from mount
+ * @opts: options string passed from mount
- * @v9ses: existing v9fs session information
+ * @clnt: existing v9fs client information
 *
 * Return 0 upon success, -ERRNO upon failure
 */
@@ -232,7 +232,7 @@ EXPORT_SYMBOL(p9_tag_lookup);
 /**
 * p9_tag_init - setup tags structure and contents
- * @tags: tags structure from the client struct
+ * @c:  v9fs client struct
 *
 * This initializes the tags structure for each client instance.
 *
@@ -258,7 +258,7 @@ error:
 /**
 * p9_tag_cleanup - cleans up tags structure and reclaims resources
- * @tags: tags structure from the client struct
+ * @c:  v9fs client struct
 *
 * This frees resources associated with the tags structure
 *
@@ -411,14 +411,9 @@ static int p9_check_errors(struct p9_client *c, struct p9_req_t *req)
                if (c->dotu)
                        err = -ecode;
-                if (!err) {
+                if (!err || !IS_ERR_VALUE(err))
                        err = p9_errstr2errno(ename, strlen(ename));
-                        /* string match failed */
-                        if (!err)
-                                err = -ESERVERFAULT;
-                }
                P9_DPRINTK(P9_DEBUG_9P, "<<< RERROR (%d) %s\n", -ecode, ename);
                kfree(ename);
@@ -430,8 +425,8 @@ static int p9_check_errors(struct p9_client *c, struct p9_req_t *req)
 /**
 * p9_client_flush - flush (cancel) a request
- * c: client state
+ * @c: client state
- * req: request to cancel
+ * @oldreq: request to cancel
 *
 * This sents a flush for a particular requests and links
 * the flush request to the original request.  The current
diff --git a/net/9p/error.c b/net/9p/error.c
index fdebe4314062..52518512a93e 100644
--- a/net/9p/error.c
+++ b/net/9p/error.c
@@ -239,7 +239,7 @@ int p9_errstr2errno(char *errstr, int len)
                errstr[len] = 0;
                printk(KERN_ERR "%s: server reported unknown error %s\n",
                        __func__, errstr);
-                errno = 1;
+                errno = ESERVERFAULT;
        }
        return -errno;
diff --git a/net/9p/trans_fd.c b/net/9p/trans_fd.c
index 8c2588e4edc0..8d934dd7fd54 100644
--- a/net/9p/trans_fd.c
+++ b/net/9p/trans_fd.c
@@ -119,8 +119,8 @@ struct p9_poll_wait {
 * @wpos: write position for current frame
 * @wsize: amount of data to write for current frame
 * @wbuf: current write buffer
+ * @poll_pending_link: pending links to be polled per conn
 * @poll_wait: array of wait_q's for various worker threads
- * @poll_waddr: ????
 * @pt: poll state
 * @rq: current read work
 * @wq: current write work
@@ -700,9 +700,9 @@ static int p9_fd_cancel(struct p9_client *client, struct p9_req_t *req)
 }
 /**
- * parse_options - parse mount options into session structure
+ * parse_opts - parse mount options into p9_fd_opts structure
- * @options: options string passed from mount
+ * @params: options string passed from mount
- * @opts: transport-specific structure to parse options into
+ * @opts: fd transport-specific structure to parse options into
 *
 * Returns 0 upon success, -ERRNO upon failure
 */
diff --git a/net/9p/trans_rdma.c b/net/9p/trans_rdma.c
index ac4990041ebb..65cb29db03f8 100644
--- a/net/9p/trans_rdma.c
+++ b/net/9p/trans_rdma.c
@@ -67,14 +67,15 @@
 * @pd: Protection Domain pointer
 * @qp: Queue Pair pointer
 * @cq: Completion Queue pointer
+ * @dm_mr: DMA Memory Region pointer
 * @lkey: The local access only memory region key
 * @timeout: Number of uSecs to wait for connection management events
 * @sq_depth: The depth of the Send Queue
 * @sq_sem: Semaphore for the SQ
 * @rq_depth: The depth of the Receive Queue.
+ * @rq_count: Count of requests in the Receive Queue.
 * @addr: The remote peer's address
 * @req_lock: Protects the active request list
- * @send_wait: Wait list when the SQ fills up
 * @cm_done: Completion event for connection management tracking
 */
 struct p9_trans_rdma {
@@ -154,9 +155,9 @@ static match_table_t tokens = {
 };
 /**
- * parse_options - parse mount options into session structure
+ * parse_opts - parse mount options into rdma options structure
- * @options: options string passed from mount
+ * @params: options string passed from mount
- * @opts: transport-specific structure to parse options into
+ * @opts: rdma transport-specific structure to parse options into
 *
 * Returns 0 upon success, -ERRNO upon failure
 */
diff --git a/net/9p/trans_virtio.c b/net/9p/trans_virtio.c
index a49484e67e1d..9bf0b737aa51 100644
--- a/net/9p/trans_virtio.c
+++ b/net/9p/trans_virtio.c
@@ -57,11 +57,9 @@ static int chan_index;
 * @initialized: whether the channel is initialized
 * @inuse: whether the channel is in use
 * @lock: protects multiple elements within this structure
+ * @client: client instance
 * @vdev: virtio dev associated with this channel
 * @vq: virtio queue associated with this channel
- * @tagpool: accounting for tag ids (and request slots)
- * @reqs: array of request slots
- * @max_tag: current number of request_slots allocated
 * @sg: scatter gather list which is used to pack a request (protected?)
 *
 * We keep all per-channel information in a structure.
@@ -92,7 +90,7 @@ static unsigned int rest_of_page(void *data)
 /**
 * p9_virtio_close - reclaim resources of a channel
- * @trans: transport state
+ * @client: client instance
 *
 * This reclaims a channel by freeing its resources and
 * reseting its inuse flag.
@@ -181,9 +179,8 @@ static int p9_virtio_cancel(struct p9_client *client, struct p9_req_t *req)
 /**
 * p9_virtio_request - issue a request
- * @t: transport state
+ * @client: client instance issuing the request
- * @tc: &p9_fcall request to transmit
+ * @req: request to be issued
- * @rc: &p9_fcall to put reponse into
 *
 */
diff --git a/net/appletalk/ddp.c b/net/appletalk/ddp.c
index bfbe13786bb4..875eda5dbad7 100644
--- a/net/appletalk/ddp.c
+++ b/net/appletalk/ddp.c
@@ -1238,6 +1238,7 @@ static int atalk_getname(struct socket *sock, struct sockaddr *uaddr,
                        return -ENOBUFS;
        *uaddr_len = sizeof(struct sockaddr_at);
+        memset(&sat.sat_zero, 0, sizeof(sat.sat_zero));
        if (peer) {
                if (sk->sk_state != TCP_ESTABLISHED)
diff --git a/net/bluetooth/rfcomm/core.c b/net/bluetooth/rfcomm/core.c
index e50566ebf9f9..94b3388c188b 100644
--- a/net/bluetooth/rfcomm/core.c
+++ b/net/bluetooth/rfcomm/core.c
@@ -2080,28 +2080,41 @@ static CLASS_ATTR(rfcomm_dlc, S_IRUGO, rfcomm_dlc_sysfs_show, NULL);
 /* ---- Initialization ---- */
 static int __init rfcomm_init(void)
 {
+        int ret;
        l2cap_load();
        hci_register_cb(&rfcomm_cb);
        rfcomm_thread = kthread_run(rfcomm_run, NULL, "krfcommd");
        if (IS_ERR(rfcomm_thread)) {
-                hci_unregister_cb(&rfcomm_cb);
+                ret = PTR_ERR(rfcomm_thread);
-                return PTR_ERR(rfcomm_thread);
+                goto out_thread;
        }
        if (class_create_file(bt_class, &class_attr_rfcomm_dlc) < 0)
                BT_ERR("Failed to create RFCOMM info file");
-        rfcomm_init_sockets();
+        ret = rfcomm_init_ttys();
+        if (ret)
+                goto out_tty;
-#ifdef CONFIG_BT_RFCOMM_TTY
+        ret = rfcomm_init_sockets();
-        rfcomm_init_ttys();
+        if (ret)
-#endif
+                goto out_sock;
        BT_INFO("RFCOMM ver %s", VERSION);
        return 0;
+out_sock:
+        rfcomm_cleanup_ttys();
+out_tty:
+        kthread_stop(rfcomm_thread);
+out_thread:
+        hci_unregister_cb(&rfcomm_cb);
+        return ret;
 }
 static void __exit rfcomm_exit(void)
@@ -2112,9 +2125,7 @@ static void __exit rfcomm_exit(void)
        kthread_stop(rfcomm_thread);
-#ifdef CONFIG_BT_RFCOMM_TTY
        rfcomm_cleanup_ttys();
-#endif
        rfcomm_cleanup_sockets();
 }
diff --git a/net/bluetooth/rfcomm/sock.c b/net/bluetooth/rfcomm/sock.c
index 7f482784e9f7..0b85e8116859 100644
--- a/net/bluetooth/rfcomm/sock.c
+++ b/net/bluetooth/rfcomm/sock.c
@@ -1132,7 +1132,7 @@ error:
        return err;
 }
-void __exit rfcomm_cleanup_sockets(void)
+void rfcomm_cleanup_sockets(void)
 {
        class_remove_file(bt_class, &class_attr_rfcomm);
diff --git a/net/bridge/br_if.c b/net/bridge/br_if.c
index 8a96672e2c5c..eb404dc3ed6e 100644
--- a/net/bridge/br_if.c
+++ b/net/bridge/br_if.c
@@ -424,7 +424,7 @@ int br_add_if(struct net_bridge *br, struct net_device *dev)
 err2:
        br_fdb_delete_by_port(br, p, 1);
 err1:
-        kobject_del(&p->kobj);
+        kobject_put(&p->kobj);
 err0:
        dev_set_promiscuity(dev, -1);
 put_back:
diff --git a/net/can/raw.c b/net/can/raw.c
index f4cc44548bda..db3152df7d2b 100644
--- a/net/can/raw.c
+++ b/net/can/raw.c
@@ -401,6 +401,7 @@ static int raw_getname(struct socket *sock, struct sockaddr *uaddr,
        if (peer)
                return -EOPNOTSUPP;
+        memset(addr, 0, sizeof(*addr));
        addr->can_family  = AF_CAN;
        addr->can_ifindex = ro->ifindex;
diff --git a/net/core/dev.c b/net/core/dev.c
index 70c27e0c7c32..6a94475aee85 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -3865,10 +3865,12 @@ int dev_unicast_delete(struct net_device *dev, void *addr)
        ASSERT_RTNL();
+        netif_addr_lock_bh(dev);
        err = __hw_addr_del(&dev->uc, addr, dev->addr_len,
                            NETDEV_HW_ADDR_T_UNICAST);
        if (!err)
                __dev_set_rx_mode(dev);
+        netif_addr_unlock_bh(dev);
        return err;
 }
 EXPORT_SYMBOL(dev_unicast_delete);
@@ -3889,10 +3891,12 @@ int dev_unicast_add(struct net_device *dev, void *addr)
        ASSERT_RTNL();
+        netif_addr_lock_bh(dev);
        err = __hw_addr_add(&dev->uc, addr, dev->addr_len,
                            NETDEV_HW_ADDR_T_UNICAST);
        if (!err)
                __dev_set_rx_mode(dev);
+        netif_addr_unlock_bh(dev);
        return err;
 }
 EXPORT_SYMBOL(dev_unicast_add);
@@ -3949,7 +3953,8 @@ void __dev_addr_unsync(struct dev_addr_list **to, int *to_count,
 *      @from: source device
 *
 *      Add newly added addresses to the destination device and release
- *      addresses that have no users left.
+ *      addresses that have no users left. The source device must be
+ *      locked by netif_tx_lock_bh.
 *
 *      This function is intended to be called from the dev->set_rx_mode
 *      function of layered software devices.
@@ -3958,14 +3963,14 @@ int dev_unicast_sync(struct net_device *to, struct net_device *from)
 {
        int err = 0;
-        ASSERT_RTNL();
        if (to->addr_len != from->addr_len)
                return -EINVAL;
+        netif_addr_lock_bh(to);
        err = __hw_addr_sync(&to->uc, &from->uc, to->addr_len);
        if (!err)
                __dev_set_rx_mode(to);
+        netif_addr_unlock_bh(to);
        return err;
 }
 EXPORT_SYMBOL(dev_unicast_sync);
@@ -3981,27 +3986,27 @@ EXPORT_SYMBOL(dev_unicast_sync);
 */
 void dev_unicast_unsync(struct net_device *to, struct net_device *from)
 {
-        ASSERT_RTNL();
        if (to->addr_len != from->addr_len)
                return;
+        netif_addr_lock_bh(from);
+        netif_addr_lock(to);
        __hw_addr_unsync(&to->uc, &from->uc, to->addr_len);
        __dev_set_rx_mode(to);
+        netif_addr_unlock(to);
+        netif_addr_unlock_bh(from);
 }
 EXPORT_SYMBOL(dev_unicast_unsync);
 static void dev_unicast_flush(struct net_device *dev)
 {
-        /* rtnl_mutex must be held here */
+        netif_addr_lock_bh(dev);
        __hw_addr_flush(&dev->uc);
+        netif_addr_unlock_bh(dev);
 }
 static void dev_unicast_init(struct net_device *dev)
 {
-        /* rtnl_mutex must be held here */
        __hw_addr_init(&dev->uc);
 }
diff --git a/net/core/gen_estimator.c b/net/core/gen_estimator.c
index 78e5bfc454ae..493775f4f2f1 100644
--- a/net/core/gen_estimator.c
+++ b/net/core/gen_estimator.c
@@ -81,7 +81,7 @@
 struct gen_estimator
 {
        struct list_head        list;
-        struct gnet_stats_basic *bstats;
+        struct gnet_stats_basic_packed  *bstats;
        struct gnet_stats_rate_est      *rate_est;
        spinlock_t              *stats_lock;
        int                     ewma_log;
@@ -165,7 +165,7 @@ static void gen_add_node(struct gen_estimator *est)
 }
 static
-struct gen_estimator *gen_find_node(const struct gnet_stats_basic *bstats,
+struct gen_estimator *gen_find_node(const struct gnet_stats_basic_packed *bstats,
                                    const struct gnet_stats_rate_est *rate_est)
 {
        struct rb_node *p = est_root.rb_node;
@@ -202,7 +202,7 @@ struct gen_estimator *gen_find_node(const struct gnet_stats_basic *bstats,
 *
 * NOTE: Called under rtnl_mutex
 */
-int gen_new_estimator(struct gnet_stats_basic *bstats,
+int gen_new_estimator(struct gnet_stats_basic_packed *bstats,
                      struct gnet_stats_rate_est *rate_est,
                      spinlock_t *stats_lock,
                      struct nlattr *opt)
@@ -262,7 +262,7 @@ static void __gen_kill_estimator(struct rcu_head *head)
 *
 * NOTE: Called under rtnl_mutex
 */
-void gen_kill_estimator(struct gnet_stats_basic *bstats,
+void gen_kill_estimator(struct gnet_stats_basic_packed *bstats,
                        struct gnet_stats_rate_est *rate_est)
 {
        struct gen_estimator *e;
@@ -292,7 +292,7 @@ EXPORT_SYMBOL(gen_kill_estimator);
 *
 * Returns 0 on success or a negative error code.
 */
-int gen_replace_estimator(struct gnet_stats_basic *bstats,
+int gen_replace_estimator(struct gnet_stats_basic_packed *bstats,
                          struct gnet_stats_rate_est *rate_est,
                          spinlock_t *stats_lock, struct nlattr *opt)
 {
@@ -308,7 +308,7 @@ EXPORT_SYMBOL(gen_replace_estimator);
 *
 * Returns true if estimator is active, and false if not.
 */
-bool gen_estimator_active(const struct gnet_stats_basic *bstats,
+bool gen_estimator_active(const struct gnet_stats_basic_packed *bstats,
                          const struct gnet_stats_rate_est *rate_est)
 {
        ASSERT_RTNL();
diff --git a/net/core/gen_stats.c b/net/core/gen_stats.c
index c3d0ffeac243..8569310268ab 100644
--- a/net/core/gen_stats.c
+++ b/net/core/gen_stats.c
@@ -106,16 +106,21 @@ gnet_stats_start_copy(struct sk_buff *skb, int type, spinlock_t *lock,
 * if the room in the socket buffer was not sufficient.
 */
 int
-gnet_stats_copy_basic(struct gnet_dump *d, struct gnet_stats_basic *b)
+gnet_stats_copy_basic(struct gnet_dump *d, struct gnet_stats_basic_packed *b)
 {
        if (d->compat_tc_stats) {
                d->tc_stats.bytes = b->bytes;
                d->tc_stats.packets = b->packets;
        }
-        if (d->tail)
+        if (d->tail) {
-                return gnet_stats_copy(d, TCA_STATS_BASIC, b, sizeof(*b));
+                struct gnet_stats_basic sb;
+                memset(&sb, 0, sizeof(sb));
+                sb.bytes = b->bytes;
+                sb.packets = b->packets;
+                return gnet_stats_copy(d, TCA_STATS_BASIC, &sb, sizeof(sb));
+        }
        return 0;
 }
diff --git a/net/core/net_namespace.c b/net/core/net_namespace.c
index b7292a2719dc..197283072cc8 100644
--- a/net/core/net_namespace.c
+++ b/net/core/net_namespace.c
@@ -488,7 +488,7 @@ int net_assign_generic(struct net *net, int id, void *data)
         */
        ng->len = id;
-        memcpy(&ng->ptr, &old_ng->ptr, old_ng->len);
+        memcpy(&ng->ptr, &old_ng->ptr, old_ng->len * sizeof(void*));
        rcu_assign_pointer(net->gen, ng);
        call_rcu(&old_ng->rcu, net_generic_release);
diff --git a/net/core/netpoll.c b/net/core/netpoll.c
index df30feb2fc72..1b76eb11deb4 100644
--- a/net/core/netpoll.c
+++ b/net/core/netpoll.c
@@ -319,6 +319,11 @@ static void netpoll_send_skb(struct netpoll *np, struct sk_buff *skb)
                        udelay(USEC_PER_POLL);
                }
+                WARN_ONCE(!irqs_disabled(),
+                        "netpoll_send_skb(): %s enabled interrupts in poll (%pF)\n",
+                        dev->name, ops->ndo_start_xmit);
                local_irq_restore(flags);
        }
diff --git a/net/dccp/proto.c b/net/dccp/proto.c
index 94ca8eaace7d..1bca9205104e 100644
--- a/net/dccp/proto.c
+++ b/net/dccp/proto.c
@@ -1066,7 +1066,7 @@ static int __init dccp_init(void)
                       (dccp_hashinfo.ehash_size - 1))
                        dccp_hashinfo.ehash_size--;
                dccp_hashinfo.ehash = (struct inet_ehash_bucket *)
-                        __get_free_pages(GFP_ATOMIC, ehash_order);
+                        __get_free_pages(GFP_ATOMIC|__GFP_NOWARN, ehash_order);
        } while (!dccp_hashinfo.ehash && --ehash_order > 0);
        if (!dccp_hashinfo.ehash) {
@@ -1091,7 +1091,7 @@ static int __init dccp_init(void)
                    bhash_order > 0)
                        continue;
                dccp_hashinfo.bhash = (struct inet_bind_hashbucket *)
-                        __get_free_pages(GFP_ATOMIC, bhash_order);
+                        __get_free_pages(GFP_ATOMIC|__GFP_NOWARN, bhash_order);
        } while (!dccp_hashinfo.bhash && --bhash_order >= 0);
        if (!dccp_hashinfo.bhash) {
@@ -1159,6 +1159,7 @@ static void __exit dccp_fini(void)
        kmem_cache_destroy(dccp_hashinfo.bind_bucket_cachep);
        dccp_ackvec_exit();
        dccp_sysctl_exit();
+        percpu_counter_destroy(&dccp_orphan_count);
 }
 module_init(dccp_init);
diff --git a/net/econet/af_econet.c b/net/econet/af_econet.c
index 2e1f836d4240..f0bbc57926cd 100644
--- a/net/econet/af_econet.c
+++ b/net/econet/af_econet.c
@@ -520,6 +520,7 @@ static int econet_getname(struct socket *sock, struct sockaddr *uaddr,
        if (peer)
                return -EOPNOTSUPP;
+        memset(sec, 0, sizeof(*sec));
        mutex_lock(&econet_mutex);
        sk = sock->sk;
diff --git a/net/ieee802154/af_ieee802154.c b/net/ieee802154/af_ieee802154.c
index 3bb6bdb1dac1..af661805b9fa 100644
--- a/net/ieee802154/af_ieee802154.c
+++ b/net/ieee802154/af_ieee802154.c
@@ -136,7 +136,7 @@ static int ieee802154_dev_ioctl(struct sock *sk, struct ifreq __user *arg,
                unsigned int cmd)
 {
        struct ifreq ifr;
-        int ret = -EINVAL;
+        int ret = -ENOIOCTLCMD;
        struct net_device *dev;
        if (copy_from_user(&ifr, arg, sizeof(struct ifreq)))
@@ -146,8 +146,10 @@ static int ieee802154_dev_ioctl(struct sock *sk, struct ifreq __user *arg,
        dev_load(sock_net(sk), ifr.ifr_name);
        dev = dev_get_by_name(sock_net(sk), ifr.ifr_name);
-        if (dev->type == ARPHRD_IEEE802154 ||
-            dev->type == ARPHRD_IEEE802154_PHY)
+        if ((dev->type == ARPHRD_IEEE802154 ||
+             dev->type == ARPHRD_IEEE802154_PHY) &&
+            dev->netdev_ops->ndo_do_ioctl)
                ret = dev->netdev_ops->ndo_do_ioctl(dev, &ifr, cmd);
        if (!ret && copy_to_user(arg, &ifr, sizeof(struct ifreq)))
diff --git a/net/ieee802154/dgram.c b/net/ieee802154/dgram.c
index 14d39840dd62..ba8b214dda8f 100644
--- a/net/ieee802154/dgram.c
+++ b/net/ieee802154/dgram.c
@@ -377,6 +377,18 @@ int ieee802154_dgram_deliver(struct net_device *dev, struct sk_buff *skb)
        return ret;
 }
+static int dgram_getsockopt(struct sock *sk, int level, int optname,
+                    char __user *optval, int __user *optlen)
+{
+        return -EOPNOTSUPP;
+}
+static int dgram_setsockopt(struct sock *sk, int level, int optname,
+                    char __user *optval, int __user optlen)
+{
+        return -EOPNOTSUPP;
+}
 struct proto ieee802154_dgram_prot = {
        .name           = "IEEE-802.15.4-MAC",
        .owner          = THIS_MODULE,
@@ -391,5 +403,7 @@ struct proto ieee802154_dgram_prot = {
        .connect        = dgram_connect,
        .disconnect     = dgram_disconnect,
        .ioctl          = dgram_ioctl,
+        .getsockopt     = dgram_getsockopt,
+        .setsockopt     = dgram_setsockopt,
 };
diff --git a/net/ieee802154/raw.c b/net/ieee802154/raw.c
index fca44d59f97e..9315977c4c61 100644
--- a/net/ieee802154/raw.c
+++ b/net/ieee802154/raw.c
@@ -238,6 +238,18 @@ void ieee802154_raw_deliver(struct net_device *dev, struct sk_buff *skb)
        read_unlock(&raw_lock);
 }
+static int raw_getsockopt(struct sock *sk, int level, int optname,
+                    char __user *optval, int __user *optlen)
+{
+        return -EOPNOTSUPP;
+}
+static int raw_setsockopt(struct sock *sk, int level, int optname,
+                    char __user *optval, int __user optlen)
+{
+        return -EOPNOTSUPP;
+}
 struct proto ieee802154_raw_prot = {
        .name           = "IEEE-802.15.4-RAW",
        .owner          = THIS_MODULE,
@@ -250,5 +262,7 @@ struct proto ieee802154_raw_prot = {
        .unhash         = raw_unhash,
        .connect        = raw_connect,
        .disconnect     = raw_disconnect,
+        .getsockopt     = raw_getsockopt,
+        .setsockopt     = raw_setsockopt,
 };
diff --git a/net/ipv4/arp.c b/net/ipv4/arp.c
index c29d75d8f1b1..090e9991ac2a 100644
--- a/net/ipv4/arp.c
+++ b/net/ipv4/arp.c
@@ -1304,7 +1304,9 @@ static void arp_format_neigh_entry(struct seq_file *seq,
                hbuffer[k++] = hex_asc_lo(n->ha[j]);
                hbuffer[k++] = ':';
        }
-        hbuffer[--k] = 0;
+        if (k != 0)
+                --k;
+        hbuffer[k] = 0;
 #if defined(CONFIG_AX25) || defined(CONFIG_AX25_MODULE)
        }
 #endif
diff --git a/net/ipv4/ip_gre.c b/net/ipv4/ip_gre.c
index cb4a0f4bd5e5..82c11dd10a62 100644
--- a/net/ipv4/ip_gre.c
+++ b/net/ipv4/ip_gre.c
@@ -951,7 +951,7 @@ static int ipgre_tunnel_bind_dev(struct net_device *dev)
                        addend += 4;
        }
        dev->needed_headroom = addend + hlen;
-        mtu -= dev->hard_header_len - addend;
+        mtu -= dev->hard_header_len + addend;
        if (mtu < 68)
                mtu = 68;
diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c
index 7d0821054729..7ffcd96fe591 100644
--- a/net/ipv4/ip_output.c
+++ b/net/ipv4/ip_output.c
@@ -813,6 +813,8 @@ int ip_append_data(struct sock *sk,
                        inet->cork.addr = ipc->addr;
                }
                rt = *rtp;
+                if (unlikely(!rt))
+                        return -EFAULT;
                /*
                 * We steal reference to this route, caller should not release it
                 */
diff --git a/net/ipv6/af_inet6.c b/net/ipv6/af_inet6.c
index caa0278d30a9..45f9a2a42d56 100644
--- a/net/ipv6/af_inet6.c
+++ b/net/ipv6/af_inet6.c
@@ -306,8 +306,10 @@ int inet6_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
                    v4addr != htonl(INADDR_ANY) &&
                    chk_addr_ret != RTN_LOCAL &&
                    chk_addr_ret != RTN_MULTICAST &&
-                    chk_addr_ret != RTN_BROADCAST)
+                    chk_addr_ret != RTN_BROADCAST) {
+                        err = -EADDRNOTAVAIL;
                        goto out;
+                }
        } else {
                if (addr_type != IPV6_ADDR_ANY) {
                        struct net_device *dev = NULL;
diff --git a/net/irda/af_irda.c b/net/irda/af_irda.c
index 80cf29aae096..50b43c57d5d8 100644
--- a/net/irda/af_irda.c
+++ b/net/irda/af_irda.c
@@ -715,6 +715,7 @@ static int irda_getname(struct socket *sock, struct sockaddr *uaddr,
        struct sock *sk = sock->sk;
        struct irda_sock *self = irda_sk(sk);
+        memset(&saddr, 0, sizeof(saddr));
        if (peer) {
                if (sk->sk_state != TCP_ESTABLISHED)
                        return -ENOTCONN;
diff --git a/net/irda/irttp.c b/net/irda/irttp.c
index ecf4eb2717cb..9cb79f95bf63 100644
--- a/net/irda/irttp.c
+++ b/net/irda/irttp.c
@@ -1453,6 +1453,7 @@ struct tsap_cb *irttp_dup(struct tsap_cb *orig, void *instance)
        }
        /* Dup */
        memcpy(new, orig, sizeof(struct tsap_cb));
+        spin_lock_init(&new->lock);
        /* We don't need the old instance any more */
        spin_unlock_irqrestore(&irttp->tsaps->hb_spinlock, flags);
diff --git a/net/llc/af_llc.c b/net/llc/af_llc.c
index 9208cf5f2bd5..c45eee1c0e8d 100644
--- a/net/llc/af_llc.c
+++ b/net/llc/af_llc.c
@@ -914,6 +914,7 @@ static int llc_ui_getname(struct socket *sock, struct sockaddr *uaddr,
        struct llc_sock *llc = llc_sk(sk);
        int rc = 0;
+        memset(&sllc, 0, sizeof(sllc));
        lock_sock(sk);
        if (sock_flag(sk, SOCK_ZAPPED))
                goto out;
diff --git a/net/mac80211/Kconfig b/net/mac80211/Kconfig
index ba2643a43c73..7836ee928983 100644
--- a/net/mac80211/Kconfig
+++ b/net/mac80211/Kconfig
@@ -83,6 +83,7 @@ endmenu
 config MAC80211_MESH
        bool "Enable mac80211 mesh networking (pre-802.11s) support"
        depends on MAC80211 && EXPERIMENTAL
+        depends on BROKEN
        ---help---
         This options enables support of Draft 802.11s mesh networking.
         The implementation is based on Draft 1.08 of the Mesh Networking
diff --git a/net/mac80211/agg-tx.c b/net/mac80211/agg-tx.c
index 9e5762ad307d..a24e59816b93 100644
--- a/net/mac80211/agg-tx.c
+++ b/net/mac80211/agg-tx.c
@@ -381,6 +381,14 @@ static void ieee80211_agg_splice_packets(struct ieee80211_local *local,
                &local->hw, queue,
                IEEE80211_QUEUE_STOP_REASON_AGGREGATION);
+        if (!(sta->ampdu_mlme.tid_state_tx[tid] & HT_ADDBA_REQUESTED_MSK))
+                return;
+        if (WARN(!sta->ampdu_mlme.tid_tx[tid],
+                 "TID %d gone but expected when splicing aggregates from"
+                 "the pending queue\n", tid))
+                return;
        if (!skb_queue_empty(&sta->ampdu_mlme.tid_tx[tid]->pending)) {
                spin_lock_irqsave(&local->queue_stop_reason_lock, flags);
                /* mark queue as pending, it is stopped already */
diff --git a/net/mac80211/key.c b/net/mac80211/key.c
index ce267565e180..659a42d529e3 100644
--- a/net/mac80211/key.c
+++ b/net/mac80211/key.c
@@ -67,6 +67,8 @@ static DECLARE_WORK(todo_work, key_todo);
 *
 * @key: key to add to do item for
 * @flag: todo flag(s)
+ *
+ * Must be called with IRQs or softirqs disabled.
 */
 static void add_todo(struct ieee80211_key *key, u32 flag)
 {
@@ -140,9 +142,9 @@ static void ieee80211_key_enable_hw_accel(struct ieee80211_key *key)
        ret = drv_set_key(key->local, SET_KEY, &sdata->vif, sta, &key->conf);
        if (!ret) {
-                spin_lock(&todo_lock);
+                spin_lock_bh(&todo_lock);
                key->flags |= KEY_FLAG_UPLOADED_TO_HARDWARE;
-                spin_unlock(&todo_lock);
+                spin_unlock_bh(&todo_lock);
        }
        if (ret && ret != -ENOSPC && ret != -EOPNOTSUPP)
@@ -164,12 +166,12 @@ static void ieee80211_key_disable_hw_accel(struct ieee80211_key *key)
        if (!key || !key->local->ops->set_key)
                return;
-        spin_lock(&todo_lock);
+        spin_lock_bh(&todo_lock);
        if (!(key->flags & KEY_FLAG_UPLOADED_TO_HARDWARE)) {
-                spin_unlock(&todo_lock);
+                spin_unlock_bh(&todo_lock);
                return;
        }
-        spin_unlock(&todo_lock);
+        spin_unlock_bh(&todo_lock);
        sta = get_sta_for_key(key);
        sdata = key->sdata;
@@ -188,9 +190,9 @@ static void ieee80211_key_disable_hw_accel(struct ieee80211_key *key)
                       wiphy_name(key->local->hw.wiphy),
                       key->conf.keyidx, sta ? sta->addr : bcast_addr, ret);
-        spin_lock(&todo_lock);
+        spin_lock_bh(&todo_lock);
        key->flags &= ~KEY_FLAG_UPLOADED_TO_HARDWARE;
-        spin_unlock(&todo_lock);
+        spin_unlock_bh(&todo_lock);
 }
 static void __ieee80211_set_default_key(struct ieee80211_sub_if_data *sdata,
@@ -437,14 +439,14 @@ void ieee80211_key_link(struct ieee80211_key *key,
        __ieee80211_key_replace(sdata, sta, old_key, key);
-        spin_unlock_irqrestore(&sdata->local->key_lock, flags);
        /* free old key later */
        add_todo(old_key, KEY_FLAG_TODO_DELETE);
        add_todo(key, KEY_FLAG_TODO_ADD_DEBUGFS);
        if (netif_running(sdata->dev))
                add_todo(key, KEY_FLAG_TODO_HWACCEL_ADD);
+        spin_unlock_irqrestore(&sdata->local->key_lock, flags);
 }
 static void __ieee80211_key_free(struct ieee80211_key *key)
@@ -547,7 +549,7 @@ static void __ieee80211_key_todo(void)
         */
        synchronize_rcu();
-        spin_lock(&todo_lock);
+        spin_lock_bh(&todo_lock);
        while (!list_empty(&todo_list)) {
                key = list_first_entry(&todo_list, struct ieee80211_key, todo);
                list_del_init(&key->todo);
@@ -558,7 +560,7 @@ static void __ieee80211_key_todo(void)
                                          KEY_FLAG_TODO_HWACCEL_REMOVE |
                                          KEY_FLAG_TODO_DELETE);
                key->flags &= ~todoflags;
-                spin_unlock(&todo_lock);
+                spin_unlock_bh(&todo_lock);
                work_done = false;
@@ -591,9 +593,9 @@ static void __ieee80211_key_todo(void)
                WARN_ON(!work_done);
-                spin_lock(&todo_lock);
+                spin_lock_bh(&todo_lock);
        }
-        spin_unlock(&todo_lock);
+        spin_unlock_bh(&todo_lock);
 }
 void ieee80211_key_todo(void)
diff --git a/net/mac80211/mesh_pathtbl.c b/net/mac80211/mesh_pathtbl.c
index 3c72557df45a..479597e88583 100644
--- a/net/mac80211/mesh_pathtbl.c
+++ b/net/mac80211/mesh_pathtbl.c
@@ -175,6 +175,8 @@ int mesh_path_add(u8 *dst, struct ieee80211_sub_if_data *sdata)
        int err = 0;
        u32 hash_idx;
+        might_sleep();
        if (memcmp(dst, sdata->dev->dev_addr, ETH_ALEN) == 0)
                /* never add ourselves as neighbours */
                return -ENOTSUPP;
@@ -265,6 +267,7 @@ int mpp_path_add(u8 *dst, u8 *mpp, struct ieee80211_sub_if_data *sdata)
        int err = 0;
        u32 hash_idx;
+        might_sleep();
        if (memcmp(dst, sdata->dev->dev_addr, ETH_ALEN) == 0)
                /* never add ourselves as neighbours */
@@ -491,8 +494,10 @@ void mesh_path_tx_pending(struct mesh_path *mpath)
 * @skb: frame to discard
 * @sdata: network subif the frame was to be sent through
 *
- * If the frame was beign forwarded from another MP, a PERR frame will be sent
+ * If the frame was being forwarded from another MP, a PERR frame will be sent
- * to the precursor.
+ * to the precursor.  The precursor's address (i.e. the previous hop) was saved
+ * in addr1 of the frame-to-be-forwarded, and would only be overwritten once
+ * the destination is successfully resolved.
 *
 * Locking: the function must me called within a rcu_read_lock region
 */
@@ -507,7 +512,7 @@ void mesh_path_discard_frame(struct sk_buff *skb,
                u8 *ra, *da;
                da = hdr->addr3;
-                ra = hdr->addr2;
+                ra = hdr->addr1;
                mpath = mesh_path_lookup(da, sdata);
                if (mpath)
                        dsn = ++mpath->dsn;
diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
index aca22b00b6a3..07e7e41816be 100644
--- a/net/mac80211/mlme.c
+++ b/net/mac80211/mlme.c
@@ -721,7 +721,7 @@ void ieee80211_dynamic_ps_timer(unsigned long data)
 {
        struct ieee80211_local *local = (void *) data;
-        if (local->quiescing)
+        if (local->quiescing || local->suspended)
                return;
        queue_work(local->hw.workqueue, &local->dynamic_ps_enable_work);
diff --git a/net/mac80211/pm.c b/net/mac80211/pm.c
index 7a549f9deb96..5e3d476972f9 100644
--- a/net/mac80211/pm.c
+++ b/net/mac80211/pm.c
@@ -55,15 +55,6 @@ int __ieee80211_suspend(struct ieee80211_hw *hw)
        rcu_read_unlock();
-        /* flush again, in case driver queued work */
-        flush_workqueue(local->hw.workqueue);
-        /* stop hardware - this must stop RX */
-        if (local->open_count) {
-                ieee80211_led_radio(local, false);
-                drv_stop(local);
-        }
        /* remove STAs */
        spin_lock_irqsave(&local->sta_lock, flags);
        list_for_each_entry(sta, &local->sta_list, list) {
@@ -111,7 +102,22 @@ int __ieee80211_suspend(struct ieee80211_hw *hw)
                drv_remove_interface(local, &conf);
        }
+        /* stop hardware - this must stop RX */
+        if (local->open_count) {
+                ieee80211_led_radio(local, false);
+                drv_stop(local);
+        }
+        /*
+         * flush again, in case driver queued work -- it
+         * shouldn't be doing (or cancel everything in the
+         * stop callback) that but better safe than sorry.
+         */
+        flush_workqueue(local->hw.workqueue);
        local->suspended = true;
+        /* need suspended to be visible before quiescing is false */
+        barrier();
        local->quiescing = false;
        return 0;
diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
index de5bba7f910a..0936fc24942d 100644
--- a/net/mac80211/rx.c
+++ b/net/mac80211/rx.c
@@ -2453,6 +2453,18 @@ void __ieee80211_rx(struct ieee80211_hw *hw, struct sk_buff *skb,
                return;
        }
+        /*
+         * If we're suspending, it is possible although not too likely
+         * that we'd be receiving frames after having already partially
+         * quiesced the stack. We can't process such frames then since
+         * that might, for example, cause stations to be added or other
+         * driver callbacks be invoked.
+         */
+        if (unlikely(local->quiescing || local->suspended)) {
+                kfree_skb(skb);
+                return;
+        }
        if (status->flag & RX_FLAG_HT) {
                /* rate_idx is MCS index */
                if (WARN_ON(status->rate_idx < 0 ||
diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c
index d238a8939a09..3a8922cd1038 100644
--- a/net/mac80211/tx.c
+++ b/net/mac80211/tx.c
@@ -1455,7 +1455,7 @@ int ieee80211_master_start_xmit(struct sk_buff *skb, struct net_device *dev)
                monitor_iface = UNKNOWN_ADDRESS;
                len_rthdr = ieee80211_get_radiotap_len(skb->data);
-                hdr = (struct ieee80211_hdr *)skb->data + len_rthdr;
+                hdr = (struct ieee80211_hdr *)(skb->data + len_rthdr);
                hdrlen = ieee80211_hdrlen(hdr->frame_control);
                /* check the header is complete in the frame */
diff --git a/net/netfilter/xt_RATEEST.c b/net/netfilter/xt_RATEEST.c
index 43f5676b1af4..d80b8192e0d4 100644
--- a/net/netfilter/xt_RATEEST.c
+++ b/net/netfilter/xt_RATEEST.c
@@ -74,7 +74,7 @@ static unsigned int
 xt_rateest_tg(struct sk_buff *skb, const struct xt_target_param *par)
 {
        const struct xt_rateest_target_info *info = par->targinfo;
-        struct gnet_stats_basic *stats = &info->est->bstats;
+        struct gnet_stats_basic_packed *stats = &info->est->bstats;
        spin_lock_bh(&info->est->lock);
        stats->bytes += skb->len;
diff --git a/net/netfilter/xt_quota.c b/net/netfilter/xt_quota.c
index 98fc190e8f0e..390b7d09fe51 100644
--- a/net/netfilter/xt_quota.c
+++ b/net/netfilter/xt_quota.c
@@ -52,7 +52,7 @@ static bool quota_mt_check(const struct xt_mtchk_param *par)
        q->master = kmalloc(sizeof(*q->master), GFP_KERNEL);
        if (q->master == NULL)
-                return -ENOMEM;
+                return false;
        q->master->quota = q->quota;
        return true;
diff --git a/net/netlabel/netlabel_kapi.c b/net/netlabel/netlabel_kapi.c
index b0e582f2d37a..16e6c4378ff1 100644
--- a/net/netlabel/netlabel_kapi.c
+++ b/net/netlabel/netlabel_kapi.c
@@ -151,7 +151,7 @@ int netlbl_cfg_unlbl_map_add(const char *domain,
                        addr6 = addr;
                        mask6 = mask;
                        map6 = kzalloc(sizeof(*map6), GFP_ATOMIC);
-                        if (map4 == NULL)
+                        if (map6 == NULL)
                                goto cfg_unlbl_map_add_failure;
                        map6->type = NETLBL_NLTYPE_UNLABELED;
                        ipv6_addr_copy(&map6->list.addr, addr6);
diff --git a/net/netrom/af_netrom.c b/net/netrom/af_netrom.c
index ce51ce012cda..ce1a34b99c23 100644
--- a/net/netrom/af_netrom.c
+++ b/net/netrom/af_netrom.c
@@ -847,6 +847,7 @@ static int nr_getname(struct socket *sock, struct sockaddr *uaddr,
                sax->fsa_ax25.sax25_family = AF_NETROM;
                sax->fsa_ax25.sax25_ndigis = 1;
                sax->fsa_ax25.sax25_call   = nr->user_addr;
+                memset(sax->fsa_digipeater, 0, sizeof(sax->fsa_digipeater));
                sax->fsa_digipeater[0]     = nr->dest_addr;
                *uaddr_len = sizeof(struct full_sockaddr_ax25);
        } else {
diff --git a/net/netrom/nr_route.c b/net/netrom/nr_route.c
index e943c16552a2..4eb1ac9a7679 100644
--- a/net/netrom/nr_route.c
+++ b/net/netrom/nr_route.c
@@ -630,23 +630,23 @@ out:
        return dev;
 }
-static ax25_digi *nr_call_to_digi(int ndigis, ax25_address *digipeaters)
+static ax25_digi *nr_call_to_digi(ax25_digi *digi, int ndigis,
+        ax25_address *digipeaters)
 {
-        static ax25_digi ax25_digi;
        int i;
        if (ndigis == 0)
                return NULL;
        for (i = 0; i < ndigis; i++) {
-                ax25_digi.calls[i]    = digipeaters[i];
+                digi->calls[i]    = digipeaters[i];
-                ax25_digi.repeated[i] = 0;
+                digi->repeated[i] = 0;
        }
-        ax25_digi.ndigi      = ndigis;
+        digi->ndigi      = ndigis;
-        ax25_digi.lastrepeat = -1;
+        digi->lastrepeat = -1;
-        return &ax25_digi;
+        return digi;
 }
 /*
@@ -656,6 +656,7 @@ int nr_rt_ioctl(unsigned int cmd, void __user *arg)
 {
        struct nr_route_struct nr_route;
        struct net_device *dev;
+        ax25_digi digi;
        int ret;
        switch (cmd) {
@@ -673,13 +674,15 @@ int nr_rt_ioctl(unsigned int cmd, void __user *arg)
                        ret = nr_add_node(&nr_route.callsign,
                                nr_route.mnemonic,
                                &nr_route.neighbour,
-                                nr_call_to_digi(nr_route.ndigis, nr_route.digipeaters),
+                                nr_call_to_digi(&digi, nr_route.ndigis,
+                                                nr_route.digipeaters),
                                dev, nr_route.quality,
                                nr_route.obs_count);
                        break;
                case NETROM_NEIGH:
                        ret = nr_add_neigh(&nr_route.callsign,
-                                nr_call_to_digi(nr_route.ndigis, nr_route.digipeaters),
+                                nr_call_to_digi(&digi, nr_route.ndigis,
+                                                nr_route.digipeaters),
                                dev, nr_route.quality);
                        break;
                default:
diff --git a/net/phonet/pn_dev.c b/net/phonet/pn_dev.c
index b0d6ddd82a9d..c2b77a698695 100644
--- a/net/phonet/pn_dev.c
+++ b/net/phonet/pn_dev.c
@@ -96,7 +96,7 @@ struct net_device *phonet_device_get(struct net *net)
 {
        struct phonet_device_list *pndevs = phonet_device_list(net);
        struct phonet_device *pnd;
-        struct net_device *dev;
+        struct net_device *dev = NULL;
        spin_lock_bh(&pndevs->lock);
        list_for_each_entry(pnd, &pndevs->list, list) {
diff --git a/net/rfkill/core.c b/net/rfkill/core.c
index 79693fe2001e..2fc4a1724eb8 100644
--- a/net/rfkill/core.c
+++ b/net/rfkill/core.c
@@ -549,6 +549,10 @@ void rfkill_set_states(struct rfkill *rfkill, bool sw, bool hw)
        swprev = !!(rfkill->state & RFKILL_BLOCK_SW);
        hwprev = !!(rfkill->state & RFKILL_BLOCK_HW);
        __rfkill_set_sw_state(rfkill, sw);
+        if (hw)
+                rfkill->state |= RFKILL_BLOCK_HW;
+        else
+                rfkill->state &= ~RFKILL_BLOCK_HW;
        spin_unlock_irqrestore(&rfkill->lock, flags);
@@ -648,15 +652,26 @@ static ssize_t rfkill_state_store(struct device *dev,
                                  struct device_attribute *attr,
                                  const char *buf, size_t count)
 {
-        /*
+        struct rfkill *rfkill = to_rfkill(dev);
-         * The intention was that userspace can only take control over
+        unsigned long state;
-         * a given device when/if rfkill-input doesn't control it due
+        int err;
-         * to user_claim. Since user_claim is currently unsupported,
-         * we never support changing the state from userspace -- this
+        if (!capable(CAP_NET_ADMIN))
-         * can be implemented again later.
+                return -EPERM;
-         */
+        err = strict_strtoul(buf, 0, &state);
+        if (err)
+                return err;
+        if (state != RFKILL_USER_STATE_SOFT_BLOCKED &&
+            state != RFKILL_USER_STATE_UNBLOCKED)
+                return -EINVAL;
+        mutex_lock(&rfkill_global_mutex);
+        rfkill_set_block(rfkill, state == RFKILL_USER_STATE_SOFT_BLOCKED);
+        mutex_unlock(&rfkill_global_mutex);
-        return -EPERM;
+        return err ?: count;
 }
 static ssize_t rfkill_claim_show(struct device *dev,
diff --git a/net/rose/af_rose.c b/net/rose/af_rose.c
index 6bd8e93869ed..e5f478ca3d61 100644
--- a/net/rose/af_rose.c
+++ b/net/rose/af_rose.c
@@ -92,23 +92,21 @@ static void rose_set_lockdep_key(struct net_device *dev)
 /*
 *      Convert a ROSE address into text.
 */
-const char *rose2asc(const rose_address *addr)
+char *rose2asc(char *buf, const rose_address *addr)
 {
-        static char buffer[11];
        if (addr->rose_addr[0] == 0x00 && addr->rose_addr[1] == 0x00 &&
            addr->rose_addr[2] == 0x00 && addr->rose_addr[3] == 0x00 &&
            addr->rose_addr[4] == 0x00) {
-                strcpy(buffer, "*");
+                strcpy(buf, "*");
        } else {
-                sprintf(buffer, "%02X%02X%02X%02X%02X", addr->rose_addr[0] & 0xFF,
+                sprintf(buf, "%02X%02X%02X%02X%02X", addr->rose_addr[0] & 0xFF,
                                                addr->rose_addr[1] & 0xFF,
                                                addr->rose_addr[2] & 0xFF,
                                                addr->rose_addr[3] & 0xFF,
                                                addr->rose_addr[4] & 0xFF);
        }
-        return buffer;
+        return buf;
 }
 /*
@@ -956,6 +954,7 @@ static int rose_getname(struct socket *sock, struct sockaddr *uaddr,
        struct rose_sock *rose = rose_sk(sk);
        int n;
+        memset(srose, 0, sizeof(*srose));
        if (peer != 0) {
                if (sk->sk_state != TCP_ESTABLISHED)
                        return -ENOTCONN;
@@ -1437,7 +1436,7 @@ static void rose_info_stop(struct seq_file *seq, void *v)
 static int rose_info_show(struct seq_file *seq, void *v)
 {
-        char buf[11];
+        char buf[11], rsbuf[11];
        if (v == SEQ_START_TOKEN)
                seq_puts(seq,
@@ -1455,8 +1454,8 @@ static int rose_info_show(struct seq_file *seq, void *v)
                        devname = dev->name;
                seq_printf(seq, "%-10s %-9s ",
-                        rose2asc(&rose->dest_addr),
+                           rose2asc(rsbuf, &rose->dest_addr),
-                        ax2asc(buf, &rose->dest_call));
+                           ax2asc(buf, &rose->dest_call));
                if (ax25cmp(&rose->source_call, &null_ax25_address) == 0)
                        callsign = "??????-?";
@@ -1465,7 +1464,7 @@ static int rose_info_show(struct seq_file *seq, void *v)
                seq_printf(seq,
                           "%-10s %-9s %-5s %3.3X %05d  %d  %d  %d  %d %3lu %3lu %3lu %3lu %3lu %3lu/%03lu %5d %5d %ld\n",
-                        rose2asc(&rose->source_addr),
+                        rose2asc(rsbuf, &rose->source_addr),
                        callsign,
                        devname,
                        rose->lci & 0x0FFF,
diff --git a/net/rose/rose_route.c b/net/rose/rose_route.c
index a81066a1010a..9478d9b3d977 100644
--- a/net/rose/rose_route.c
+++ b/net/rose/rose_route.c
@@ -1104,6 +1104,7 @@ static void rose_node_stop(struct seq_file *seq, void *v)
 static int rose_node_show(struct seq_file *seq, void *v)
 {
+        char rsbuf[11];
        int i;
        if (v == SEQ_START_TOKEN)
@@ -1112,13 +1113,13 @@ static int rose_node_show(struct seq_file *seq, void *v)
                const struct rose_node *rose_node = v;
                /* if (rose_node->loopback) {
                        seq_printf(seq, "%-10s %04d 1 loopback\n",
-                                rose2asc(&rose_node->address),
+                                   rose2asc(rsbuf, &rose_node->address),
-                                rose_node->mask);
+                                   rose_node->mask);
                } else { */
                        seq_printf(seq, "%-10s %04d %d",
-                                rose2asc(&rose_node->address),
+                                   rose2asc(rsbuf, &rose_node->address),
-                                rose_node->mask,
+                                   rose_node->mask,
-                                rose_node->count);
+                                   rose_node->count);
                        for (i = 0; i < rose_node->count; i++)
                                seq_printf(seq, " %05d",
@@ -1267,7 +1268,7 @@ static void rose_route_stop(struct seq_file *seq, void *v)
 static int rose_route_show(struct seq_file *seq, void *v)
 {
-        char buf[11];
+        char buf[11], rsbuf[11];
        if (v == SEQ_START_TOKEN)
                seq_puts(seq,
@@ -1279,7 +1280,7 @@ static int rose_route_show(struct seq_file *seq, void *v)
                        seq_printf(seq,
                                   "%3.3X  %-10s  %-9s  %05d      ",
                                   rose_route->lci1,
-                                   rose2asc(&rose_route->src_addr),
+                                   rose2asc(rsbuf, &rose_route->src_addr),
                                   ax2asc(buf, &rose_route->src_call),
                                   rose_route->neigh1->number);
                else
@@ -1289,10 +1290,10 @@ static int rose_route_show(struct seq_file *seq, void *v)
                if (rose_route->neigh2)
                        seq_printf(seq,
                                   "%3.3X  %-10s  %-9s  %05d\n",
-                                rose_route->lci2,
+                                   rose_route->lci2,
-                                rose2asc(&rose_route->dest_addr),
+                                   rose2asc(rsbuf, &rose_route->dest_addr),
-                                ax2asc(buf, &rose_route->dest_call),
+                                   ax2asc(buf, &rose_route->dest_call),
-                                rose_route->neigh2->number);
+                                   rose_route->neigh2->number);
                 else
                         seq_puts(seq,
                                  "000  *           *          00000\n");
diff --git a/net/sched/sch_api.c b/net/sched/sch_api.c
index 24d17ce9c294..92e6f3a52c13 100644
--- a/net/sched/sch_api.c
+++ b/net/sched/sch_api.c
@@ -458,7 +458,7 @@ EXPORT_SYMBOL(qdisc_warn_nonwc);
 static enum hrtimer_restart qdisc_watchdog(struct hrtimer *timer)
 {
        struct qdisc_watchdog *wd = container_of(timer, struct qdisc_watchdog,
-                                                 timer);
+                                                 timer.timer);
        wd->qdisc->flags &= ~TCQ_F_THROTTLED;
        __netif_schedule(qdisc_root(wd->qdisc));
@@ -468,8 +468,8 @@ static enum hrtimer_restart qdisc_watchdog(struct hrtimer *timer)
 void qdisc_watchdog_init(struct qdisc_watchdog *wd, struct Qdisc *qdisc)
 {
-        hrtimer_init(&wd->timer, CLOCK_MONOTONIC, HRTIMER_MODE_ABS);
+        tasklet_hrtimer_init(&wd->timer, qdisc_watchdog,
-        wd->timer.function = qdisc_watchdog;
+                             CLOCK_MONOTONIC, HRTIMER_MODE_ABS);
        wd->qdisc = qdisc;
 }
 EXPORT_SYMBOL(qdisc_watchdog_init);
@@ -485,13 +485,13 @@ void qdisc_watchdog_schedule(struct qdisc_watchdog *wd, psched_time_t expires)
        wd->qdisc->flags |= TCQ_F_THROTTLED;
        time = ktime_set(0, 0);
        time = ktime_add_ns(time, PSCHED_TICKS2NS(expires));
-        hrtimer_start(&wd->timer, time, HRTIMER_MODE_ABS);
+        tasklet_hrtimer_start(&wd->timer, time, HRTIMER_MODE_ABS);
 }
 EXPORT_SYMBOL(qdisc_watchdog_schedule);
 void qdisc_watchdog_cancel(struct qdisc_watchdog *wd)
 {
-        hrtimer_cancel(&wd->timer);
+        tasklet_hrtimer_cancel(&wd->timer);
        wd->qdisc->flags &= ~TCQ_F_THROTTLED;
 }
 EXPORT_SYMBOL(qdisc_watchdog_cancel);
diff --git a/net/sched/sch_atm.c b/net/sched/sch_atm.c
index 2a8b83af7c47..ab82f145f689 100644
--- a/net/sched/sch_atm.c
+++ b/net/sched/sch_atm.c
@@ -49,7 +49,7 @@ struct atm_flow_data {
        struct socket           *sock;          /* for closing */
        u32                     classid;        /* x:y type ID */
        int                     ref;            /* reference count */
-        struct gnet_stats_basic bstats;
+        struct gnet_stats_basic_packed  bstats;
        struct gnet_stats_queue qstats;
        struct atm_flow_data    *next;
        struct atm_flow_data    *excess;        /* flow for excess traffic;
diff --git a/net/sched/sch_cbq.c b/net/sched/sch_cbq.c
index 23a167670fd5..149b0405c5ec 100644
--- a/net/sched/sch_cbq.c
+++ b/net/sched/sch_cbq.c
@@ -128,7 +128,7 @@ struct cbq_class
        long                    avgidle;
        long                    deficit;        /* Saved deficit for WRR */
        psched_time_t           penalized;
-        struct gnet_stats_basic bstats;
+        struct gnet_stats_basic_packed bstats;
        struct gnet_stats_queue qstats;
        struct gnet_stats_rate_est rate_est;
        struct tc_cbq_xstats    xstats;
@@ -163,7 +163,7 @@ struct cbq_sched_data
        psched_time_t           now_rt;         /* Cached real time */
        unsigned                pmask;
-        struct hrtimer          delay_timer;
+        struct tasklet_hrtimer  delay_timer;
        struct qdisc_watchdog   watchdog;       /* Watchdog timer,
                                                   started when CBQ has
                                                   backlog, but cannot
@@ -503,6 +503,8 @@ static void cbq_ovl_delay(struct cbq_class *cl)
                cl->undertime = q->now + delay;
                if (delay > 0) {
+                        struct hrtimer *ht;
                        sched += delay + cl->penalty;
                        cl->penalized = sched;
                        cl->cpriority = TC_CBQ_MAXPRIO;
@@ -510,12 +512,12 @@ static void cbq_ovl_delay(struct cbq_class *cl)
                        expires = ktime_set(0, 0);
                        expires = ktime_add_ns(expires, PSCHED_TICKS2NS(sched));
-                        if (hrtimer_try_to_cancel(&q->delay_timer) &&
+                        ht = &q->delay_timer.timer;
-                            ktime_to_ns(ktime_sub(
+                        if (hrtimer_try_to_cancel(ht) &&
-                                        hrtimer_get_expires(&q->delay_timer),
+                            ktime_to_ns(ktime_sub(hrtimer_get_expires(ht),
-                                        expires)) > 0)
+                                                  expires)) > 0)
-                                hrtimer_set_expires(&q->delay_timer, expires);
+                                hrtimer_set_expires(ht, expires);
-                        hrtimer_restart(&q->delay_timer);
+                        hrtimer_restart(ht);
                        cl->delayed = 1;
                        cl->xstats.overactions++;
                        return;
@@ -591,7 +593,7 @@ static psched_tdiff_t cbq_undelay_prio(struct cbq_sched_data *q, int prio,
 static enum hrtimer_restart cbq_undelay(struct hrtimer *timer)
 {
        struct cbq_sched_data *q = container_of(timer, struct cbq_sched_data,
-                                                delay_timer);
+                                                delay_timer.timer);
        struct Qdisc *sch = q->watchdog.qdisc;
        psched_time_t now;
        psched_tdiff_t delay = 0;
@@ -621,7 +623,7 @@ static enum hrtimer_restart cbq_undelay(struct hrtimer *timer)
                time = ktime_set(0, 0);
                time = ktime_add_ns(time, PSCHED_TICKS2NS(now + delay));
-                hrtimer_start(&q->delay_timer, time, HRTIMER_MODE_ABS);
+                tasklet_hrtimer_start(&q->delay_timer, time, HRTIMER_MODE_ABS);
        }
        sch->flags &= ~TCQ_F_THROTTLED;
@@ -1214,7 +1216,7 @@ cbq_reset(struct Qdisc* sch)
        q->tx_class = NULL;
        q->tx_borrowed = NULL;
        qdisc_watchdog_cancel(&q->watchdog);
-        hrtimer_cancel(&q->delay_timer);
+        tasklet_hrtimer_cancel(&q->delay_timer);
        q->toplevel = TC_CBQ_MAXLEVEL;
        q->now = psched_get_time();
        q->now_rt = q->now;
@@ -1397,7 +1399,8 @@ static int cbq_init(struct Qdisc *sch, struct nlattr *opt)
        q->link.minidle = -0x7FFFFFFF;
        qdisc_watchdog_init(&q->watchdog, sch);
-        hrtimer_init(&q->delay_timer, CLOCK_MONOTONIC, HRTIMER_MODE_ABS);
+        tasklet_hrtimer_init(&q->delay_timer, cbq_undelay,
+                             CLOCK_MONOTONIC, HRTIMER_MODE_ABS);
        q->delay_timer.function = cbq_undelay;
        q->toplevel = TC_CBQ_MAXLEVEL;
        q->now = psched_get_time();
diff --git a/net/sched/sch_drr.c b/net/sched/sch_drr.c
index 7597fe146866..12b2fb04b29b 100644
--- a/net/sched/sch_drr.c
+++ b/net/sched/sch_drr.c
@@ -22,7 +22,7 @@ struct drr_class {
        unsigned int                    refcnt;
        unsigned int                    filter_cnt;
-        struct gnet_stats_basic         bstats;
+        struct gnet_stats_basic_packed          bstats;
        struct gnet_stats_queue         qstats;
        struct gnet_stats_rate_est      rate_est;
        struct list_head                alist;
diff --git a/net/sched/sch_hfsc.c b/net/sched/sch_hfsc.c
index 362c2811b2df..dad0144423da 100644
--- a/net/sched/sch_hfsc.c
+++ b/net/sched/sch_hfsc.c
@@ -116,7 +116,7 @@ struct hfsc_class
        struct Qdisc_class_common cl_common;
        unsigned int    refcnt;         /* usage count */
-        struct gnet_stats_basic bstats;
+        struct gnet_stats_basic_packed bstats;
        struct gnet_stats_queue qstats;
        struct gnet_stats_rate_est rate_est;
        unsigned int    level;          /* class level in hierarchy */
diff --git a/net/sched/sch_htb.c b/net/sched/sch_htb.c
index 88cd02626621..ec4d46399d59 100644
--- a/net/sched/sch_htb.c
+++ b/net/sched/sch_htb.c
@@ -74,7 +74,7 @@ enum htb_cmode {
 struct htb_class {
        struct Qdisc_class_common common;
        /* general class parameters */
-        struct gnet_stats_basic bstats;
+        struct gnet_stats_basic_packed bstats;
        struct gnet_stats_queue qstats;
        struct gnet_stats_rate_est rate_est;
        struct tc_htb_xstats xstats;    /* our special stats */
diff --git a/net/sctp/protocol.c b/net/sctp/protocol.c
index 79cbd47f4df7..a76da657244a 100644
--- a/net/sctp/protocol.c
+++ b/net/sctp/protocol.c
@@ -160,6 +160,7 @@ static void sctp_proc_exit(void)
                remove_proc_entry("sctp", init_net.proc_net);
        }
 #endif
+        percpu_counter_destroy(&sctp_sockets_allocated);
 }
 /* Private helper to extract ipv4 address and stash them in
diff --git a/net/socket.c b/net/socket.c
index 791d71a36a93..6d4716559047 100644
--- a/net/socket.c
+++ b/net/socket.c
@@ -736,7 +736,7 @@ static ssize_t sock_sendpage(struct file *file, struct page *page,
        if (more)
                flags |= MSG_MORE;
-        return sock->ops->sendpage(sock, page, offset, size, flags);
+        return kernel_sendpage(sock, page, offset, size, flags);
 }
 static ssize_t sock_splice_read(struct file *file, loff_t *ppos,
diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
index 43bdb1372cae..634496b3ed77 100644
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -997,7 +997,7 @@ static int nl80211_get_key(struct sk_buff *skb, struct genl_info *info)
        if (IS_ERR(hdr)) {
                err = PTR_ERR(hdr);
-                goto out;
+                goto free_msg;
        }
        cookie.msg = msg;
@@ -1011,7 +1011,7 @@ static int nl80211_get_key(struct sk_buff *skb, struct genl_info *info)
                                &cookie, get_key_callback);
        if (err)
-                goto out;
+                goto free_msg;
        if (cookie.error)
                goto nla_put_failure;
@@ -1022,6 +1022,7 @@ static int nl80211_get_key(struct sk_buff *skb, struct genl_info *info)
 nla_put_failure:
        err = -ENOBUFS;
+ free_msg:
        nlmsg_free(msg);
 out:
        cfg80211_put_dev(drv);
diff --git a/net/wireless/reg.c b/net/wireless/reg.c
index 5e14371cda70..75a406d33619 100644
--- a/net/wireless/reg.c
+++ b/net/wireless/reg.c
@@ -1089,17 +1089,18 @@ static void handle_reg_beacon(struct wiphy *wiphy,
        chan->beacon_found = true;
+        if (wiphy->disable_beacon_hints)
+                return;
        chan_before.center_freq = chan->center_freq;
        chan_before.flags = chan->flags;
-        if ((chan->flags & IEEE80211_CHAN_PASSIVE_SCAN) &&
+        if (chan->flags & IEEE80211_CHAN_PASSIVE_SCAN) {
-            !(chan->orig_flags & IEEE80211_CHAN_PASSIVE_SCAN)) {
                chan->flags &= ~IEEE80211_CHAN_PASSIVE_SCAN;
                channel_changed = true;
        }
-        if ((chan->flags & IEEE80211_CHAN_NO_IBSS) &&
+        if (chan->flags & IEEE80211_CHAN_NO_IBSS) {
-            !(chan->orig_flags & IEEE80211_CHAN_NO_IBSS)) {
                chan->flags &= ~IEEE80211_CHAN_NO_IBSS;
                channel_changed = true;
        }
diff --git a/net/wireless/reg.h b/net/wireless/reg.h
index e37829a49dc4..4e167a8e11be 100644
--- a/net/wireless/reg.h
+++ b/net/wireless/reg.h
@@ -30,7 +30,8 @@ int set_regdom(const struct ieee80211_regdomain *rd);
 * non-radar 5 GHz channels.
 *
 * Drivers do not need to call this, cfg80211 will do it for after a scan
- * on a newly found BSS.
+ * on a newly found BSS. If you cannot make use of this feature you can
+ * set the wiphy->disable_beacon_hints to true.
 */
 int regulatory_hint_found_beacon(struct wiphy *wiphy,
                                        struct ieee80211_channel *beacon_chan,
diff --git a/net/wireless/scan.c b/net/wireless/scan.c
index f8e71b300001..7e595ce24eeb 100644
--- a/net/wireless/scan.c
+++ b/net/wireless/scan.c
@@ -35,8 +35,6 @@ void cfg80211_scan_done(struct cfg80211_scan_request *request, bool aborted)
        else
                nl80211_send_scan_done(wiphy_to_dev(request->wiphy), dev);
-        wiphy_to_dev(request->wiphy)->scan_req = NULL;
 #ifdef CONFIG_WIRELESS_EXT
        if (!aborted) {
                memset(&wrqu, 0, sizeof(wrqu));
@@ -48,6 +46,7 @@ void cfg80211_scan_done(struct cfg80211_scan_request *request, bool aborted)
        dev_put(dev);
 out:
+        wiphy_to_dev(request->wiphy)->scan_req = NULL;
        kfree(request);
 }
 EXPORT_SYMBOL(cfg80211_scan_done);
@@ -119,7 +118,7 @@ static int cmp_ies(u8 num, u8 *ies1, size_t len1, u8 *ies2, size_t len2)
        if (!ie1 && !ie2)
                return 0;
-        if (!ie1)
+        if (!ie1 || !ie2)
                return -1;
        r = memcmp(ie1 + 2, ie2 + 2, min(ie1[1], ie2[1]));
@@ -172,6 +171,8 @@ static bool is_mesh(struct cfg80211_bss *a,
        ie = find_ie(WLAN_EID_MESH_CONFIG,
                     a->information_elements,
                     a->len_information_elements);
+        if (!ie)
+                return false;
        if (ie[1] != IEEE80211_MESH_CONFIG_LEN)
                return false;
diff --git a/net/xfrm/xfrm_hash.h b/net/xfrm/xfrm_hash.h
index d401dc8f05ed..e5195c99f71e 100644
--- a/net/xfrm/xfrm_hash.h
+++ b/net/xfrm/xfrm_hash.h
@@ -16,7 +16,7 @@ static inline unsigned int __xfrm6_addr_hash(xfrm_address_t *addr)
 static inline unsigned int __xfrm4_daddr_saddr_hash(xfrm_address_t *daddr, xfrm_address_t *saddr)
 {
-        return ntohl(daddr->a4 ^ saddr->a4);
+        return ntohl(daddr->a4 + saddr->a4);
 }
 static inline unsigned int __xfrm6_daddr_saddr_hash(xfrm_address_t *daddr, xfrm_address_t *saddr)