56 files changed, 449 insertions, 404 deletions
diff --git a/net/8021q/vlanproc.c b/net/8021q/vlanproc.c
index 0feefa4e1a4b..3628e0a81b40 100644
--- a/net/8021q/vlanproc.c
+++ b/net/8021q/vlanproc.c
@@ -314,7 +314,7 @@ static int vlandev_seq_show(struct seq_file *seq, void *offset)
                   dev_info->ingress_priority_map[6],
                   dev_info->ingress_priority_map[7]);
-        seq_printf(seq, "EGRESSS priority Mappings: ");
+        seq_printf(seq, " EGRESS priority mappings: ");
        for (i = 0; i < 16; i++) {
                const struct vlan_priority_tci_mapping *mp
                        = dev_info->egress_priority_map[i];
diff --git a/net/9p/Kconfig b/net/9p/Kconfig
index c42c0c400bf9..0663f99e977a 100644
--- a/net/9p/Kconfig
+++ b/net/9p/Kconfig
@@ -13,22 +13,24 @@ menuconfig NET_9P
          If unsure, say N.
+if NET_9P
 config NET_9P_VIRTIO
-        depends on NET_9P && EXPERIMENTAL && VIRTIO
+        depends on EXPERIMENTAL && VIRTIO
        tristate "9P Virtio Transport (Experimental)"
        help
          This builds support for a transports between
          guest partitions and a host partition.
 config NET_9P_RDMA
-        depends on NET_9P && INFINIBAND && EXPERIMENTAL
+        depends on INET && INFINIBAND && EXPERIMENTAL
        tristate "9P RDMA Transport (Experimental)"
        help
-          This builds support for a RDMA transport.
+          This builds support for an RDMA transport.
 config NET_9P_DEBUG
        bool "Debug information"
-        depends on NET_9P
        help
          Say Y if you want the 9P subsystem to log debug information.
+endif
diff --git a/net/atm/svc.c b/net/atm/svc.c
index de1e4f2f3a43..8fb54dc870b3 100644
--- a/net/atm/svc.c
+++ b/net/atm/svc.c
@@ -293,7 +293,10 @@ static int svc_listen(struct socket *sock,int backlog)
                error = -EINVAL;
                goto out;
        }
-        vcc_insert_socket(sk);
+        if (test_bit(ATM_VF_LISTEN, &vcc->flags)) {
+                error = -EADDRINUSE;
+                goto out;
+        }
        set_bit(ATM_VF_WAITING, &vcc->flags);
        prepare_to_wait(sk->sk_sleep, &wait, TASK_UNINTERRUPTIBLE);
        sigd_enq(vcc,as_listen,NULL,NULL,&vcc->local);
@@ -307,6 +310,7 @@ static int svc_listen(struct socket *sock,int backlog)
                goto out;
        }
        set_bit(ATM_VF_LISTEN,&vcc->flags);
+        vcc_insert_socket(sk);
        sk->sk_max_ack_backlog = backlog > 0 ? backlog : ATM_BACKLOG_DEFAULT;
        error = -sk->sk_err;
 out:
diff --git a/net/bridge/br_netfilter.c b/net/bridge/br_netfilter.c
index fa5cda4e552a..45f61c348e36 100644
--- a/net/bridge/br_netfilter.c
+++ b/net/bridge/br_netfilter.c
@@ -101,6 +101,18 @@ static inline __be16 pppoe_proto(const struct sk_buff *skb)
         pppoe_proto(skb) == htons(PPP_IPV6) && \
         brnf_filter_pppoe_tagged)
+static void fake_update_pmtu(struct dst_entry *dst, u32 mtu)
+{
+}
+static struct dst_ops fake_dst_ops = {
+        .family =               AF_INET,
+        .protocol =             __constant_htons(ETH_P_IP),
+        .update_pmtu =          fake_update_pmtu,
+        .entry_size =           sizeof(struct rtable),
+        .entries =              ATOMIC_INIT(0),
+};
 /*
 * Initialize bogus route table used to keep netfilter happy.
 * Currently, we fill in the PMTU entry because netfilter
@@ -117,6 +129,7 @@ void br_netfilter_rtable_init(struct net_bridge *br)
        rt->u.dst.path = &rt->u.dst;
        rt->u.dst.metrics[RTAX_MTU - 1] = 1500;
        rt->u.dst.flags = DST_NOXFRM;
+        rt->u.dst.ops = &fake_dst_ops;
 }
 static inline struct rtable *bridge_parent_rtable(const struct net_device *dev)
diff --git a/net/can/af_can.c b/net/can/af_can.c
index 7d4d2b3c137e..3dadb338addd 100644
--- a/net/can/af_can.c
+++ b/net/can/af_can.c
@@ -319,23 +319,52 @@ static struct dev_rcv_lists *find_dev_rcv_lists(struct net_device *dev)
        return n ? d : NULL;
 }
+/**
+ * find_rcv_list - determine optimal filterlist inside device filter struct
+ * @can_id: pointer to CAN identifier of a given can_filter
+ * @mask: pointer to CAN mask of a given can_filter
+ * @d: pointer to the device filter struct
+ *
+ * Description:
+ *  Returns the optimal filterlist to reduce the filter handling in the
+ *  receive path. This function is called by service functions that need
+ *  to register or unregister a can_filter in the filter lists.
+ *
+ *  A filter matches in general, when
+ *
+ *          <received_can_id> & mask == can_id & mask
+ *
+ *  so every bit set in the mask (even CAN_EFF_FLAG, CAN_RTR_FLAG) describe
+ *  relevant bits for the filter.
+ *
+ *  The filter can be inverted (CAN_INV_FILTER bit set in can_id) or it can
+ *  filter for error frames (CAN_ERR_FLAG bit set in mask). For error frames
+ *  there is a special filterlist and a special rx path filter handling.
+ *
+ * Return:
+ *  Pointer to optimal filterlist for the given can_id/mask pair.
+ *  Constistency checked mask.
+ *  Reduced can_id to have a preprocessed filter compare value.
+ */
 static struct hlist_head *find_rcv_list(canid_t *can_id, canid_t *mask,
                                        struct dev_rcv_lists *d)
 {
        canid_t inv = *can_id & CAN_INV_FILTER; /* save flag before masking */
-        /* filter error frames */
+        /* filter for error frames in extra filterlist */
        if (*mask & CAN_ERR_FLAG) {
-                /* clear CAN_ERR_FLAG in list entry */
+                /* clear CAN_ERR_FLAG in filter entry */
                *mask &= CAN_ERR_MASK;
                return &d->rx[RX_ERR];
        }
-        /* ensure valid values in can_mask */
+        /* with cleared CAN_ERR_FLAG we have a simple mask/value filterpair */
-        if (*mask & CAN_EFF_FLAG)
-                *mask &= (CAN_EFF_MASK | CAN_EFF_FLAG | CAN_RTR_FLAG);
+#define CAN_EFF_RTR_FLAGS (CAN_EFF_FLAG | CAN_RTR_FLAG)
-        else
-                *mask &= (CAN_SFF_MASK | CAN_RTR_FLAG);
+        /* ensure valid values in can_mask for 'SFF only' frame filtering */
+        if ((*mask & CAN_EFF_FLAG) && !(*can_id & CAN_EFF_FLAG))
+                *mask &= (CAN_SFF_MASK | CAN_EFF_RTR_FLAGS);
        /* reduce condition testing at receive time */
        *can_id &= *mask;
@@ -348,15 +377,19 @@ static struct hlist_head *find_rcv_list(canid_t *can_id, canid_t *mask,
        if (!(*mask))
                return &d->rx[RX_ALL];
-        /* use extra filterset for the subscription of exactly *ONE* can_id */
+        /* extra filterlists for the subscription of a single non-RTR can_id */
-        if (*can_id & CAN_EFF_FLAG) {
+        if (((*mask & CAN_EFF_RTR_FLAGS) == CAN_EFF_RTR_FLAGS)
-                if (*mask == (CAN_EFF_MASK | CAN_EFF_FLAG)) {
+            && !(*can_id & CAN_RTR_FLAG)) {
-                        /* RFC: a use-case for hash-tables in the future? */
-                        return &d->rx[RX_EFF];
+                if (*can_id & CAN_EFF_FLAG) {
+                        if (*mask == (CAN_EFF_MASK | CAN_EFF_RTR_FLAGS)) {
+                                /* RFC: a future use-case for hash-tables? */
+                                return &d->rx[RX_EFF];
+                        }
+                } else {
+                        if (*mask == (CAN_SFF_MASK | CAN_EFF_RTR_FLAGS))
+                                return &d->rx_sff[*can_id];
                }
-        } else {
-                if (*mask == CAN_SFF_MASK)
-                        return &d->rx_sff[*can_id];
        }
        /* default: filter via can_id/can_mask */
@@ -589,7 +622,10 @@ static int can_rcv_filter(struct dev_rcv_lists *d, struct sk_buff *skb)
                }
        }
-        /* check CAN_ID specific entries */
+        /* check filterlists for single non-RTR can_ids */
+        if (can_id & CAN_RTR_FLAG)
+                return matches;
        if (can_id & CAN_EFF_FLAG) {
                hlist_for_each_entry_rcu(r, n, &d->rx[RX_EFF], list) {
                        if (r->can_id == can_id) {
diff --git a/net/can/bcm.c b/net/can/bcm.c
index d0dd382001e2..da0d426c0ce4 100644
--- a/net/can/bcm.c
+++ b/net/can/bcm.c
@@ -64,10 +64,11 @@
 #define BCM_CAN_DLC_MASK 0x0F /* clean private flags in can_dlc by masking */
 /* get best masking value for can_rx_register() for a given single can_id */
-#define REGMASK(id) ((id & CAN_RTR_FLAG) | ((id & CAN_EFF_FLAG) ? \
+#define REGMASK(id) ((id & CAN_EFF_FLAG) ? \
-                        (CAN_EFF_MASK | CAN_EFF_FLAG) : CAN_SFF_MASK))
+                     (CAN_EFF_MASK | CAN_EFF_FLAG | CAN_RTR_FLAG) : \
+                     (CAN_SFF_MASK | CAN_EFF_FLAG | CAN_RTR_FLAG))
-#define CAN_BCM_VERSION "20080415"
+#define CAN_BCM_VERSION CAN_VERSION
 static __initdata const char banner[] = KERN_INFO
        "can: broadcast manager protocol (rev " CAN_BCM_VERSION ")\n";
diff --git a/net/compat.c b/net/compat.c
index 67fb6a3834a3..a3a2ba0fac08 100644
--- a/net/compat.c
+++ b/net/compat.c
@@ -226,14 +226,14 @@ int put_cmsg_compat(struct msghdr *kmsg, int level, int type, int len, void *dat
                return 0; /* XXX: return error? check spec. */
        }
-        if (level == SOL_SOCKET && type == SO_TIMESTAMP) {
+        if (level == SOL_SOCKET && type == SCM_TIMESTAMP) {
                struct timeval *tv = (struct timeval *)data;
                ctv.tv_sec = tv->tv_sec;
                ctv.tv_usec = tv->tv_usec;
                data = &ctv;
                len = sizeof(ctv);
        }
-        if (level == SOL_SOCKET && type == SO_TIMESTAMPNS) {
+        if (level == SOL_SOCKET && type == SCM_TIMESTAMPNS) {
                struct timespec *ts = (struct timespec *)data;
                cts.tv_sec = ts->tv_sec;
                cts.tv_nsec = ts->tv_nsec;
@@ -725,7 +725,7 @@ EXPORT_SYMBOL(compat_mc_getsockopt);
 static unsigned char nas[19]={AL(0),AL(3),AL(3),AL(3),AL(2),AL(3),
                                AL(3),AL(3),AL(4),AL(4),AL(4),AL(6),
                                AL(6),AL(2),AL(5),AL(5),AL(3),AL(3),
-                                AL(6)};
+                                AL(4)};
 #undef AL
 asmlinkage long compat_sys_sendmsg(int fd, struct compat_msghdr __user *msg, unsigned flags)
@@ -738,52 +738,13 @@ asmlinkage long compat_sys_recvmsg(int fd, struct compat_msghdr __user *msg, uns
        return sys_recvmsg(fd, (struct msghdr __user *)msg, flags | MSG_CMSG_COMPAT);
 }
-asmlinkage long compat_sys_paccept(int fd, struct sockaddr __user *upeer_sockaddr,
-                                   int __user *upeer_addrlen,
-                                   const compat_sigset_t __user *sigmask,
-                                   compat_size_t sigsetsize, int flags)
-{
-        compat_sigset_t ss32;
-        sigset_t ksigmask, sigsaved;
-        int ret;
-        if (sigmask) {
-                if (sigsetsize != sizeof(compat_sigset_t))
-                        return -EINVAL;
-                if (copy_from_user(&ss32, sigmask, sizeof(ss32)))
-                        return -EFAULT;
-                sigset_from_compat(&ksigmask, &ss32);
-                sigdelsetmask(&ksigmask, sigmask(SIGKILL)|sigmask(SIGSTOP));
-                sigprocmask(SIG_SETMASK, &ksigmask, &sigsaved);
-        }
-        ret = do_accept(fd, upeer_sockaddr, upeer_addrlen, flags);
-        if (ret == -ERESTARTNOHAND) {
-                /*
-                 * Don't restore the signal mask yet. Let do_signal() deliver
-                 * the signal on the way back to userspace, before the signal
-                 * mask is restored.
-                 */
-                if (sigmask) {
-                        memcpy(&current->saved_sigmask, &sigsaved,
-                               sizeof(sigsaved));
-                        set_restore_sigmask();
-                }
-        } else if (sigmask)
-                sigprocmask(SIG_SETMASK, &sigsaved, NULL);
-        return ret;
-}
 asmlinkage long compat_sys_socketcall(int call, u32 __user *args)
 {
        int ret;
        u32 a[6];
        u32 a0, a1;
-        if (call < SYS_SOCKET || call > SYS_PACCEPT)
+        if (call < SYS_SOCKET || call > SYS_ACCEPT4)
                return -EINVAL;
        if (copy_from_user(a, args, nas[call]))
                return -EFAULT;
@@ -804,7 +765,7 @@ asmlinkage long compat_sys_socketcall(int call, u32 __user *args)
                ret = sys_listen(a0, a1);
                break;
        case SYS_ACCEPT:
-                ret = do_accept(a0, compat_ptr(a1), compat_ptr(a[2]), 0);
+                ret = sys_accept4(a0, compat_ptr(a1), compat_ptr(a[2]), 0);
                break;
        case SYS_GETSOCKNAME:
                ret = sys_getsockname(a0, compat_ptr(a1), compat_ptr(a[2]));
@@ -844,9 +805,8 @@ asmlinkage long compat_sys_socketcall(int call, u32 __user *args)
        case SYS_RECVMSG:
                ret = compat_sys_recvmsg(a0, compat_ptr(a1), a[2]);
                break;
-        case SYS_PACCEPT:
+        case SYS_ACCEPT4:
-                ret = compat_sys_paccept(a0, compat_ptr(a1), compat_ptr(a[2]),
+                ret = sys_accept4(a0, compat_ptr(a1), compat_ptr(a[2]), a[3]);
-                                         compat_ptr(a[3]), a[4], a[5]);
                break;
        default:
                ret = -EINVAL;
diff --git a/net/core/netpoll.c b/net/core/netpoll.c
index 6c7af390be0a..dadac6281f20 100644
--- a/net/core/netpoll.c
+++ b/net/core/netpoll.c
@@ -133,9 +133,11 @@ static int poll_one_napi(struct netpoll_info *npinfo,
        npinfo->rx_flags |= NETPOLL_RX_DROP;
        atomic_inc(&trapped);
+        set_bit(NAPI_STATE_NPSVC, &napi->state);
        work = napi->poll(napi, budget);
+        clear_bit(NAPI_STATE_NPSVC, &napi->state);
        atomic_dec(&trapped);
        npinfo->rx_flags &= ~NETPOLL_RX_DROP;
diff --git a/net/core/pktgen.c b/net/core/pktgen.c
index a47f5bad110d..8997e912aaaf 100644
--- a/net/core/pktgen.c
+++ b/net/core/pktgen.c
@@ -1973,13 +1973,7 @@ static void pktgen_setup_inject(struct pktgen_dev *pkt_dev)
        /* make sure that we don't pick a non-existing transmit queue */
        ntxq = pkt_dev->odev->real_num_tx_queues;
-        if (ntxq > num_online_cpus() && (pkt_dev->flags & F_QUEUE_MAP_CPU)) {
-                printk(KERN_WARNING "pktgen: WARNING: QUEUE_MAP_CPU "
-                       "disabled because CPU count (%d) exceeds number "
-                       "of tx queues (%d) on %s\n", num_online_cpus(), ntxq,
-                       pkt_dev->odev->name);
-                pkt_dev->flags &= ~F_QUEUE_MAP_CPU;
-        }
        if (ntxq <= pkt_dev->queue_map_min) {
                printk(KERN_WARNING "pktgen: WARNING: Requested "
                       "queue_map_min (zero-based) (%d) exceeds valid range "
@@ -2202,6 +2196,7 @@ static void set_cur_queue_map(struct pktgen_dev *pkt_dev)
                }
                pkt_dev->cur_queue_map = t;
        }
+        pkt_dev->cur_queue_map  = pkt_dev->cur_queue_map % pkt_dev->odev->real_num_tx_queues;
 }
 /* Increment/randomize headers according to flags and current values
diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
index 31f29d2989fd..4dfb6b4d4559 100644
--- a/net/core/rtnetlink.c
+++ b/net/core/rtnetlink.c
@@ -878,7 +878,9 @@ static int do_setlink(struct net_device *dev, struct ifinfomsg *ifm,
                if (ifm->ifi_change)
                        flags = (flags & ifm->ifi_change) |
                                (dev->flags & ~ifm->ifi_change);
-                dev_change_flags(dev, flags);
+                err = dev_change_flags(dev, flags);
+                if (err < 0)
+                        goto errout;
        }
        if (tb[IFLA_TXQLEN])
diff --git a/net/core/scm.c b/net/core/scm.c
index ab242cc1acca..b12303dd39d9 100644
--- a/net/core/scm.c
+++ b/net/core/scm.c
@@ -75,7 +75,6 @@ static int scm_fp_copy(struct cmsghdr *cmsg, struct scm_fp_list **fplp)
                if (!fpl)
                        return -ENOMEM;
                *fplp = fpl;
-                INIT_LIST_HEAD(&fpl->list);
                fpl->count = 0;
        }
        fpp = &fpl->fp[fpl->count];
@@ -301,7 +300,6 @@ struct scm_fp_list *scm_fp_dup(struct scm_fp_list *fpl)
        new_fpl = kmalloc(sizeof(*fpl), GFP_KERNEL);
        if (new_fpl) {
-                INIT_LIST_HEAD(&new_fpl->list);
                for (i=fpl->count-1; i>=0; i--)
                        get_file(fpl->fp[i]);
                memcpy(new_fpl, fpl, sizeof(*fpl));
diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index ebb6b94f8af2..65f7757465bd 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -149,7 +149,7 @@ void skb_under_panic(struct sk_buff *skb, int sz, void *here)
 void skb_truesize_bug(struct sk_buff *skb)
 {
-        printk(KERN_ERR "SKB BUG: Invalid truesize (%u) "
+        WARN(net_ratelimit(), KERN_ERR "SKB BUG: Invalid truesize (%u) "
               "len=%u, sizeof(sk_buff)=%Zd\n",
               skb->truesize, skb->len, sizeof(struct sk_buff));
 }
@@ -486,8 +486,8 @@ int skb_recycle_check(struct sk_buff *skb, int skb_size)
        shinfo->frag_list = NULL;
        memset(skb, 0, offsetof(struct sk_buff, tail));
-        skb_reset_tail_pointer(skb);
        skb->data = skb->head + NET_SKB_PAD;
+        skb_reset_tail_pointer(skb);
        return 1;
 }
diff --git a/net/core/sock.c b/net/core/sock.c
index 5e2a3132a8c9..edf7220889a4 100644
--- a/net/core/sock.c
+++ b/net/core/sock.c
@@ -136,7 +136,6 @@
 static struct lock_class_key af_family_keys[AF_MAX];
 static struct lock_class_key af_family_slock_keys[AF_MAX];
-#ifdef CONFIG_DEBUG_LOCK_ALLOC
 /*
 * Make lock validator output more readable. (we pre-construct these
 * strings build-time, so that runtime initialization of socket
@@ -187,7 +186,6 @@ static const char *af_family_clock_key_strings[AF_MAX+1] = {
  "clock-AF_RXRPC" , "clock-AF_ISDN"     , "clock-AF_PHONET"   ,
  "clock-AF_MAX"
 };
-#endif
 /*
 * sk_callback_lock locking rules are per-address-family,
@@ -2037,9 +2035,6 @@ static inline void release_proto_idx(struct proto *prot)
 int proto_register(struct proto *prot, int alloc_slab)
 {
-        char *request_sock_slab_name = NULL;
-        char *timewait_sock_slab_name;
        if (alloc_slab) {
                prot->slab = kmem_cache_create(prot->name, prot->obj_size, 0,
                                               SLAB_HWCACHE_ALIGN, NULL);
@@ -2053,12 +2048,12 @@ int proto_register(struct proto *prot, int alloc_slab)
                if (prot->rsk_prot != NULL) {
                        static const char mask[] = "request_sock_%s";
-                        request_sock_slab_name = kmalloc(strlen(prot->name) + sizeof(mask) - 1, GFP_KERNEL);
+                        prot->rsk_prot->slab_name = kmalloc(strlen(prot->name) + sizeof(mask) - 1, GFP_KERNEL);
-                        if (request_sock_slab_name == NULL)
+                        if (prot->rsk_prot->slab_name == NULL)
                                goto out_free_sock_slab;
-                        sprintf(request_sock_slab_name, mask, prot->name);
+                        sprintf(prot->rsk_prot->slab_name, mask, prot->name);
-                        prot->rsk_prot->slab = kmem_cache_create(request_sock_slab_name,
+                        prot->rsk_prot->slab = kmem_cache_create(prot->rsk_prot->slab_name,
                                                                 prot->rsk_prot->obj_size, 0,
                                                                 SLAB_HWCACHE_ALIGN, NULL);
@@ -2072,14 +2067,14 @@ int proto_register(struct proto *prot, int alloc_slab)
                if (prot->twsk_prot != NULL) {
                        static const char mask[] = "tw_sock_%s";
-                        timewait_sock_slab_name = kmalloc(strlen(prot->name) + sizeof(mask) - 1, GFP_KERNEL);
+                        prot->twsk_prot->twsk_slab_name = kmalloc(strlen(prot->name) + sizeof(mask) - 1, GFP_KERNEL);
-                        if (timewait_sock_slab_name == NULL)
+                        if (prot->twsk_prot->twsk_slab_name == NULL)
                                goto out_free_request_sock_slab;
-                        sprintf(timewait_sock_slab_name, mask, prot->name);
+                        sprintf(prot->twsk_prot->twsk_slab_name, mask, prot->name);
                        prot->twsk_prot->twsk_slab =
-                                kmem_cache_create(timewait_sock_slab_name,
+                                kmem_cache_create(prot->twsk_prot->twsk_slab_name,
                                                  prot->twsk_prot->twsk_obj_size,
                                                  0, SLAB_HWCACHE_ALIGN,
                                                  NULL);
@@ -2095,14 +2090,14 @@ int proto_register(struct proto *prot, int alloc_slab)
        return 0;
 out_free_timewait_sock_slab_name:
-        kfree(timewait_sock_slab_name);
+        kfree(prot->twsk_prot->twsk_slab_name);
 out_free_request_sock_slab:
        if (prot->rsk_prot && prot->rsk_prot->slab) {
                kmem_cache_destroy(prot->rsk_prot->slab);
                prot->rsk_prot->slab = NULL;
        }
 out_free_request_sock_slab_name:
-        kfree(request_sock_slab_name);
+        kfree(prot->rsk_prot->slab_name);
 out_free_sock_slab:
        kmem_cache_destroy(prot->slab);
        prot->slab = NULL;
@@ -2125,18 +2120,14 @@ void proto_unregister(struct proto *prot)
        }
        if (prot->rsk_prot != NULL && prot->rsk_prot->slab != NULL) {
-                const char *name = kmem_cache_name(prot->rsk_prot->slab);
                kmem_cache_destroy(prot->rsk_prot->slab);
-                kfree(name);
+                kfree(prot->rsk_prot->slab_name);
                prot->rsk_prot->slab = NULL;
        }
        if (prot->twsk_prot != NULL && prot->twsk_prot->twsk_slab != NULL) {
-                const char *name = kmem_cache_name(prot->twsk_prot->twsk_slab);
                kmem_cache_destroy(prot->twsk_prot->twsk_slab);
-                kfree(name);
+                kfree(prot->twsk_prot->twsk_slab_name);
                prot->twsk_prot->twsk_slab = NULL;
        }
 }
diff --git a/net/dsa/slave.c b/net/dsa/slave.c
index 37616884b8a9..1af5a79309e9 100644
--- a/net/dsa/slave.c
+++ b/net/dsa/slave.c
@@ -10,6 +10,7 @@
 #include <linux/list.h>
 #include <linux/netdevice.h>
+#include <linux/etherdevice.h>
 #include <linux/phy.h>
 #include "dsa_priv.h"
@@ -49,11 +50,57 @@ void dsa_slave_mii_bus_init(struct dsa_switch *ds)
 /* slave device handling ****************************************************/
 static int dsa_slave_open(struct net_device *dev)
 {
+        struct dsa_slave_priv *p = netdev_priv(dev);
+        struct net_device *master = p->parent->master_netdev;
+        int err;
+        if (!(master->flags & IFF_UP))
+                return -ENETDOWN;
+        if (compare_ether_addr(dev->dev_addr, master->dev_addr)) {
+                err = dev_unicast_add(master, dev->dev_addr, ETH_ALEN);
+                if (err < 0)
+                        goto out;
+        }
+        if (dev->flags & IFF_ALLMULTI) {
+                err = dev_set_allmulti(master, 1);
+                if (err < 0)
+                        goto del_unicast;
+        }
+        if (dev->flags & IFF_PROMISC) {
+                err = dev_set_promiscuity(master, 1);
+                if (err < 0)
+                        goto clear_allmulti;
+        }
        return 0;
+clear_allmulti:
+        if (dev->flags & IFF_ALLMULTI)
+                dev_set_allmulti(master, -1);
+del_unicast:
+        if (compare_ether_addr(dev->dev_addr, master->dev_addr))
+                dev_unicast_delete(master, dev->dev_addr, ETH_ALEN);
+out:
+        return err;
 }
 static int dsa_slave_close(struct net_device *dev)
 {
+        struct dsa_slave_priv *p = netdev_priv(dev);
+        struct net_device *master = p->parent->master_netdev;
+        dev_mc_unsync(master, dev);
+        dev_unicast_unsync(master, dev);
+        if (dev->flags & IFF_ALLMULTI)
+                dev_set_allmulti(master, -1);
+        if (dev->flags & IFF_PROMISC)
+                dev_set_promiscuity(master, -1);
+        if (compare_ether_addr(dev->dev_addr, master->dev_addr))
+                dev_unicast_delete(master, dev->dev_addr, ETH_ALEN);
        return 0;
 }
@@ -77,9 +124,30 @@ static void dsa_slave_set_rx_mode(struct net_device *dev)
        dev_unicast_sync(master, dev);
 }
-static int dsa_slave_set_mac_address(struct net_device *dev, void *addr)
+static int dsa_slave_set_mac_address(struct net_device *dev, void *a)
 {
-        memcpy(dev->dev_addr, addr + 2, 6);
+        struct dsa_slave_priv *p = netdev_priv(dev);
+        struct net_device *master = p->parent->master_netdev;
+        struct sockaddr *addr = a;
+        int err;
+        if (!is_valid_ether_addr(addr->sa_data))
+                return -EADDRNOTAVAIL;
+        if (!(dev->flags & IFF_UP))
+                goto out;
+        if (compare_ether_addr(addr->sa_data, master->dev_addr)) {
+                err = dev_unicast_add(master, addr->sa_data, ETH_ALEN);
+                if (err < 0)
+                        return err;
+        }
+        if (compare_ether_addr(dev->dev_addr, master->dev_addr))
+                dev_unicast_delete(master, dev->dev_addr, ETH_ALEN);
+out:
+        memcpy(dev->dev_addr, addr->sa_data, ETH_ALEN);
        return 0;
 }
diff --git a/net/dsa/tag_dsa.c b/net/dsa/tag_dsa.c
index bdc0510b53b7..31866543332e 100644
--- a/net/dsa/tag_dsa.c
+++ b/net/dsa/tag_dsa.c
@@ -159,6 +159,7 @@ static int dsa_rcv(struct sk_buff *skb, struct net_device *dev,
        skb->dev = ds->ports[source_port];
        skb_push(skb, ETH_HLEN);
+        skb->pkt_type = PACKET_HOST;
        skb->protocol = eth_type_trans(skb, skb->dev);
        skb->dev->last_rx = jiffies;
diff --git a/net/dsa/tag_edsa.c b/net/dsa/tag_edsa.c
index f985ea993843..9f4ce55eae59 100644
--- a/net/dsa/tag_edsa.c
+++ b/net/dsa/tag_edsa.c
@@ -178,6 +178,7 @@ static int edsa_rcv(struct sk_buff *skb, struct net_device *dev,
        skb->dev = ds->ports[source_port];
        skb_push(skb, ETH_HLEN);
+        skb->pkt_type = PACKET_HOST;
        skb->protocol = eth_type_trans(skb, skb->dev);
        skb->dev->last_rx = jiffies;
diff --git a/net/dsa/tag_trailer.c b/net/dsa/tag_trailer.c
index d3117764b2c2..efd26697e716 100644
--- a/net/dsa/tag_trailer.c
+++ b/net/dsa/tag_trailer.c
@@ -95,6 +95,7 @@ static int trailer_rcv(struct sk_buff *skb, struct net_device *dev,
        skb->dev = ds->ports[source_port];
        skb_push(skb, ETH_HLEN);
+        skb->pkt_type = PACKET_HOST;
        skb->protocol = eth_type_trans(skb, skb->dev);
        skb->dev->last_rx = jiffies;
diff --git a/net/ipv4/af_inet.c b/net/ipv4/af_inet.c
index 1fbff5fa4241..1aa2dc9e380e 100644
--- a/net/ipv4/af_inet.c
+++ b/net/ipv4/af_inet.c
@@ -1117,6 +1117,7 @@ int inet_sk_rebuild_header(struct sock *sk)
                        },
                },
                .proto = sk->sk_protocol,
+                .flags = inet_sk_flowi_flags(sk),
                .uli_u = {
                        .ports = {
                                .sport = inet->sport,
diff --git a/net/ipv4/ip_input.c b/net/ipv4/ip_input.c
index 861978a4f1a8..cfb38ac9d698 100644
--- a/net/ipv4/ip_input.c
+++ b/net/ipv4/ip_input.c
@@ -209,9 +209,17 @@ static int ip_local_deliver_finish(struct sk_buff *skb)
                hash = protocol & (MAX_INET_PROTOS - 1);
                ipprot = rcu_dereference(inet_protos[hash]);
-                if (ipprot != NULL && (net == &init_net || ipprot->netns_ok)) {
+                if (ipprot != NULL) {
                        int ret;
+                        if (!net_eq(net, &init_net) && !ipprot->netns_ok) {
+                                if (net_ratelimit())
+                                        printk("%s: proto %d isn't netns-ready\n",
+                                                __func__, protocol);
+                                kfree_skb(skb);
+                                goto out;
+                        }
                        if (!ipprot->no_policy) {
                                if (!xfrm4_policy_check(NULL, XFRM_POLICY_IN, skb)) {
                                        kfree_skb(skb);
diff --git a/net/ipv4/ipmr.c b/net/ipv4/ipmr.c
index b42e082cc170..25924b1eb2ef 100644
--- a/net/ipv4/ipmr.c
+++ b/net/ipv4/ipmr.c
@@ -1945,13 +1945,14 @@ int __init ip_mr_init(void)
                goto proc_cache_fail;
 #endif
        return 0;
-reg_notif_fail:
-        kmem_cache_destroy(mrt_cachep);
 #ifdef CONFIG_PROC_FS
-proc_vif_fail:
-        unregister_netdevice_notifier(&ip_mr_notifier);
 proc_cache_fail:
        proc_net_remove(&init_net, "ip_mr_vif");
+proc_vif_fail:
+        unregister_netdevice_notifier(&ip_mr_notifier);
 #endif
+reg_notif_fail:
+        del_timer(&ipmr_expire_timer);
+        kmem_cache_destroy(mrt_cachep);
        return err;
 }
diff --git a/net/ipv4/netfilter/nf_nat_rule.c b/net/ipv4/netfilter/nf_nat_rule.c
index bea54a685109..8d489e746b21 100644
--- a/net/ipv4/netfilter/nf_nat_rule.c
+++ b/net/ipv4/netfilter/nf_nat_rule.c
@@ -61,7 +61,7 @@ static struct
 static struct xt_table nat_table = {
        .name           = "nat",
        .valid_hooks    = NAT_VALID_HOOKS,
-        .lock           = __RW_LOCK_UNLOCKED(__nat_table.lock),
+        .lock           = __RW_LOCK_UNLOCKED(nat_table.lock),
        .me             = THIS_MODULE,
        .af             = AF_INET,
 };
diff --git a/net/ipv4/proc.c b/net/ipv4/proc.c
index 8f5a403f6f6b..a631a1f110ca 100644
--- a/net/ipv4/proc.c
+++ b/net/ipv4/proc.c
@@ -237,43 +237,45 @@ static const struct snmp_mib snmp4_net_list[] = {
        SNMP_MIB_SENTINEL
 };
+static void icmpmsg_put_line(struct seq_file *seq, unsigned long *vals,
+                             unsigned short *type, int count)
+{
+        int j;
+        if (count) {
+                seq_printf(seq, "\nIcmpMsg:");
+                for (j = 0; j < count; ++j)
+                        seq_printf(seq, " %sType%u",
+                                type[j] & 0x100 ? "Out" : "In",
+                                type[j] & 0xff);
+                seq_printf(seq, "\nIcmpMsg:");
+                for (j = 0; j < count; ++j)
+                        seq_printf(seq, " %lu", vals[j]);
+        }
+}
 static void icmpmsg_put(struct seq_file *seq)
 {
 #define PERLINE 16
-        int j, i, count;
+        int i, count;
-        static int out[PERLINE];
+        unsigned short type[PERLINE];
+        unsigned long vals[PERLINE], val;
        struct net *net = seq->private;
        count = 0;
        for (i = 0; i < ICMPMSG_MIB_MAX; i++) {
+                val = snmp_fold_field((void **) net->mib.icmpmsg_statistics, i);
-                if (snmp_fold_field((void **) net->mib.icmpmsg_statistics, i))
+                if (val) {
-                        out[count++] = i;
+                        type[count] = i;
-                if (count < PERLINE)
+                        vals[count++] = val;
-                        continue;
+                }
+                if (count == PERLINE) {
-                seq_printf(seq, "\nIcmpMsg:");
+                        icmpmsg_put_line(seq, vals, type, count);
-                for (j = 0; j < PERLINE; ++j)
+                        count = 0;
-                        seq_printf(seq, " %sType%u", i & 0x100 ? "Out" : "In",
+                }
-                                        i & 0xff);
-                seq_printf(seq, "\nIcmpMsg: ");
-                for (j = 0; j < PERLINE; ++j)
-                        seq_printf(seq, " %lu",
-                                snmp_fold_field((void **) net->mib.icmpmsg_statistics,
-                                out[j]));
-                seq_putc(seq, '\n');
-        }
-        if (count) {
-                seq_printf(seq, "\nIcmpMsg:");
-                for (j = 0; j < count; ++j)
-                        seq_printf(seq, " %sType%u", out[j] & 0x100 ? "Out" :
-                                "In", out[j] & 0xff);
-                seq_printf(seq, "\nIcmpMsg:");
-                for (j = 0; j < count; ++j)
-                        seq_printf(seq, " %lu", snmp_fold_field((void **)
-                                net->mib.icmpmsg_statistics, out[j]));
        }
+        icmpmsg_put_line(seq, vals, type, count);
 #undef PERLINE
 }
diff --git a/net/ipv4/tcp_htcp.c b/net/ipv4/tcp_htcp.c
index af99776146ff..937549b8a921 100644
--- a/net/ipv4/tcp_htcp.c
+++ b/net/ipv4/tcp_htcp.c
@@ -69,9 +69,12 @@ static u32 htcp_cwnd_undo(struct sock *sk)
        const struct tcp_sock *tp = tcp_sk(sk);
        struct htcp *ca = inet_csk_ca(sk);
-        ca->last_cong = ca->undo_last_cong;
+        if (ca->undo_last_cong) {
-        ca->maxRTT = ca->undo_maxRTT;
+                ca->last_cong = ca->undo_last_cong;
-        ca->old_maxB = ca->undo_old_maxB;
+                ca->maxRTT = ca->undo_maxRTT;
+                ca->old_maxB = ca->undo_old_maxB;
+                ca->undo_last_cong = 0;
+        }
        return max(tp->snd_cwnd, (tp->snd_ssthresh << 7) / ca->beta);
 }
@@ -268,7 +271,10 @@ static void htcp_state(struct sock *sk, u8 new_state)
        case TCP_CA_Open:
                {
                        struct htcp *ca = inet_csk_ca(sk);
-                        ca->last_cong = jiffies;
+                        if (ca->undo_last_cong) {
+                                ca->last_cong = jiffies;
+                                ca->undo_last_cong = 0;
+                        }
                }
                break;
        case TCP_CA_CWR:
diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
index ba85d8831893..fe3b4bdfd251 100644
--- a/net/ipv4/tcp_output.c
+++ b/net/ipv4/tcp_output.c
@@ -1028,10 +1028,6 @@ unsigned int tcp_sync_mss(struct sock *sk, u32 pmtu)
 /* Compute the current effective MSS, taking SACKs and IP options,
 * and even PMTU discovery events into account.
- *
- * LARGESEND note: !tcp_urg_mode is overkill, only frames up to snd_up
- * cannot be large. However, taking into account rare use of URG, this
- * is not a big flaw.
 */
 unsigned int tcp_current_mss(struct sock *sk, int large_allowed)
 {
@@ -1046,7 +1042,7 @@ unsigned int tcp_current_mss(struct sock *sk, int large_allowed)
        mss_now = tp->mss_cache;
-        if (large_allowed && sk_can_gso(sk) && !tcp_urg_mode(tp))
+        if (large_allowed && sk_can_gso(sk))
                doing_tso = 1;
        if (dst) {
@@ -1516,6 +1512,10 @@ static int tcp_mtu_probe(struct sock *sk)
 * send_head.  This happens as incoming acks open up the remote
 * window for us.
 *
+ * LARGESEND note: !tcp_urg_mode is overkill, only frames between
+ * snd_up-64k-mss .. snd_up cannot be large. However, taking into
+ * account rare use of URG, this is not a big flaw.
+ *
 * Returns 1, if no segments are in flight and we have queued segments, but
 * cannot send anything now because of SWS or another problem.
 */
@@ -1567,7 +1567,7 @@ static int tcp_write_xmit(struct sock *sk, unsigned int mss_now, int nonagle)
                }
                limit = mss_now;
-                if (tso_segs > 1)
+                if (tso_segs > 1 && !tcp_urg_mode(tp))
                        limit = tcp_mss_split_point(sk, skb, mss_now,
                                                    cwnd_quota);
@@ -1616,6 +1616,7 @@ void __tcp_push_pending_frames(struct sock *sk, unsigned int cur_mss,
 */
 void tcp_push_one(struct sock *sk, unsigned int mss_now)
 {
+        struct tcp_sock *tp = tcp_sk(sk);
        struct sk_buff *skb = tcp_send_head(sk);
        unsigned int tso_segs, cwnd_quota;
@@ -1630,7 +1631,7 @@ void tcp_push_one(struct sock *sk, unsigned int mss_now)
                BUG_ON(!tso_segs);
                limit = mss_now;
-                if (tso_segs > 1)
+                if (tso_segs > 1 && !tcp_urg_mode(tp))
                        limit = tcp_mss_split_point(sk, skb, mss_now,
                                                    cwnd_quota);
diff --git a/net/ipv4/tcp_vegas.c b/net/ipv4/tcp_vegas.c
index 14504dada116..a453aac91bd3 100644
--- a/net/ipv4/tcp_vegas.c
+++ b/net/ipv4/tcp_vegas.c
@@ -40,18 +40,14 @@
 #include "tcp_vegas.h"
-/* Default values of the Vegas variables, in fixed-point representation
+static int alpha = 2;
- * with V_PARAM_SHIFT bits to the right of the binary point.
+static int beta  = 4;
- */
+static int gamma = 1;
-#define V_PARAM_SHIFT 1
-static int alpha = 2<<V_PARAM_SHIFT;
-static int beta  = 4<<V_PARAM_SHIFT;
-static int gamma = 1<<V_PARAM_SHIFT;
 module_param(alpha, int, 0644);
-MODULE_PARM_DESC(alpha, "lower bound of packets in network (scale by 2)");
+MODULE_PARM_DESC(alpha, "lower bound of packets in network");
 module_param(beta, int, 0644);
-MODULE_PARM_DESC(beta, "upper bound of packets in network (scale by 2)");
+MODULE_PARM_DESC(beta, "upper bound of packets in network");
 module_param(gamma, int, 0644);
 MODULE_PARM_DESC(gamma, "limit on increase (scale by 2)");
@@ -172,49 +168,13 @@ static void tcp_vegas_cong_avoid(struct sock *sk, u32 ack, u32 in_flight)
                return;
        }
-        /* The key players are v_beg_snd_una and v_beg_snd_nxt.
-         *
-         * These are so named because they represent the approximate values
-         * of snd_una and snd_nxt at the beginning of the current RTT. More
-         * precisely, they represent the amount of data sent during the RTT.
-         * At the end of the RTT, when we receive an ACK for v_beg_snd_nxt,
-         * we will calculate that (v_beg_snd_nxt - v_beg_snd_una) outstanding
-         * bytes of data have been ACKed during the course of the RTT, giving
-         * an "actual" rate of:
-         *
-         *     (v_beg_snd_nxt - v_beg_snd_una) / (rtt duration)
-         *
-         * Unfortunately, v_beg_snd_una is not exactly equal to snd_una,
-         * because delayed ACKs can cover more than one segment, so they
-         * don't line up nicely with the boundaries of RTTs.
-         *
-         * Another unfortunate fact of life is that delayed ACKs delay the
-         * advance of the left edge of our send window, so that the number
-         * of bytes we send in an RTT is often less than our cwnd will allow.
-         * So we keep track of our cwnd separately, in v_beg_snd_cwnd.
-         */
        if (after(ack, vegas->beg_snd_nxt)) {
                /* Do the Vegas once-per-RTT cwnd adjustment. */
-                u32 old_wnd, old_snd_cwnd;
-                /* Here old_wnd is essentially the window of data that was
-                 * sent during the previous RTT, and has all
-                 * been acknowledged in the course of the RTT that ended
-                 * with the ACK we just received. Likewise, old_snd_cwnd
-                 * is the cwnd during the previous RTT.
-                 */
-                old_wnd = (vegas->beg_snd_nxt - vegas->beg_snd_una) /
-                        tp->mss_cache;
-                old_snd_cwnd = vegas->beg_snd_cwnd;
                /* Save the extent of the current window so we can use this
                 * at the end of the next RTT.
                 */
-                vegas->beg_snd_una  = vegas->beg_snd_nxt;
                vegas->beg_snd_nxt  = tp->snd_nxt;
-                vegas->beg_snd_cwnd = tp->snd_cwnd;
                /* We do the Vegas calculations only if we got enough RTT
                 * samples that we can be reasonably sure that we got
@@ -252,22 +212,14 @@ static void tcp_vegas_cong_avoid(struct sock *sk, u32 ack, u32 in_flight)
                         *
                         * This is:
                         *     (actual rate in segments) * baseRTT
-                         * We keep it as a fixed point number with
-                         * V_PARAM_SHIFT bits to the right of the binary point.
                         */
-                        target_cwnd = ((u64)old_wnd * vegas->baseRTT);
+                        target_cwnd = tp->snd_cwnd * vegas->baseRTT / rtt;
-                        target_cwnd <<= V_PARAM_SHIFT;
-                        do_div(target_cwnd, rtt);
                        /* Calculate the difference between the window we had,
                         * and the window we would like to have. This quantity
                         * is the "Diff" from the Arizona Vegas papers.
-                         *
-                         * Again, this is a fixed point number with
-                         * V_PARAM_SHIFT bits to the right of the binary
-                         * point.
                         */
-                        diff = (old_wnd << V_PARAM_SHIFT) - target_cwnd;
+                        diff = tp->snd_cwnd * (rtt-vegas->baseRTT) / vegas->baseRTT;
                        if (diff > gamma && tp->snd_ssthresh > 2 ) {
                                /* Going too fast. Time to slow down
@@ -282,16 +234,13 @@ static void tcp_vegas_cong_avoid(struct sock *sk, u32 ack, u32 in_flight)
                                 * truncation robs us of full link
                                 * utilization.
                                 */
-                                tp->snd_cwnd = min(tp->snd_cwnd,
+                                tp->snd_cwnd = min(tp->snd_cwnd, (u32)target_cwnd+1);
-                                                   ((u32)target_cwnd >>
-                                                    V_PARAM_SHIFT)+1);
                        } else if (tp->snd_cwnd <= tp->snd_ssthresh) {
                                /* Slow start.  */
                                tcp_slow_start(tp);
                        } else {
                                /* Congestion avoidance. */
-                                u32 next_snd_cwnd;
                                /* Figure out where we would like cwnd
                                 * to be.
@@ -300,32 +249,25 @@ static void tcp_vegas_cong_avoid(struct sock *sk, u32 ack, u32 in_flight)
                                        /* The old window was too fast, so
                                         * we slow down.
                                         */
-                                        next_snd_cwnd = old_snd_cwnd - 1;
+                                        tp->snd_cwnd--;
                                } else if (diff < alpha) {
                                        /* We don't have enough extra packets
                                         * in the network, so speed up.
                                         */
-                                        next_snd_cwnd = old_snd_cwnd + 1;
+                                        tp->snd_cwnd++;
                                } else {
                                        /* Sending just as fast as we
                                         * should be.
                                         */
-                                        next_snd_cwnd = old_snd_cwnd;
                                }
-                                /* Adjust cwnd upward or downward, toward the
-                                 * desired value.
-                                 */
-                                if (next_snd_cwnd > tp->snd_cwnd)
-                                        tp->snd_cwnd++;
-                                else if (next_snd_cwnd < tp->snd_cwnd)
-                                        tp->snd_cwnd--;
                        }
                        if (tp->snd_cwnd < 2)
                                tp->snd_cwnd = 2;
                        else if (tp->snd_cwnd > tp->snd_cwnd_clamp)
                                tp->snd_cwnd = tp->snd_cwnd_clamp;
+                        tp->snd_ssthresh = tcp_current_ssthresh(sk);
                }
                /* Wipe the slate clean for the next RTT. */
diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
index cf02701ced48..98c1fd09be88 100644
--- a/net/ipv4/udp.c
+++ b/net/ipv4/udp.c
@@ -633,6 +633,7 @@ int udp_sendmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
                                                .saddr = saddr,
                                                .tos = tos } },
                                    .proto = sk->sk_protocol,
+                                    .flags = inet_sk_flowi_flags(sk),
                                    .uli_u = { .ports =
                                               { .sport = inet->sport,
                                                 .dport = dport } } };
diff --git a/net/ipv6/datagram.c b/net/ipv6/datagram.c
index 410046a8cc91..e44deb8d4df2 100644
--- a/net/ipv6/datagram.c
+++ b/net/ipv6/datagram.c
@@ -661,6 +661,11 @@ int datagram_send_ctl(struct net *net,
                        switch (rthdr->type) {
 #if defined(CONFIG_IPV6_MIP6) || defined(CONFIG_IPV6_MIP6_MODULE)
                        case IPV6_SRCRT_TYPE_2:
+                                if (rthdr->hdrlen != 2 ||
+                                    rthdr->segments_left != 1) {
+                                        err = -EINVAL;
+                                        goto exit_f;
+                                }
                                break;
 #endif
                        default:
diff --git a/net/ipv6/ip6mr.c b/net/ipv6/ip6mr.c
index 182f8a177e7f..0524769632e7 100644
--- a/net/ipv6/ip6mr.c
+++ b/net/ipv6/ip6mr.c
@@ -224,7 +224,7 @@ static struct file_operations ip6mr_vif_fops = {
        .open    = ip6mr_vif_open,
        .read    = seq_read,
        .llseek  = seq_lseek,
-        .release = seq_release,
+        .release = seq_release_private,
 };
 static void *ipmr_mfc_seq_start(struct seq_file *seq, loff_t *pos)
@@ -338,7 +338,7 @@ static struct file_operations ip6mr_mfc_fops = {
        .open    = ipmr_mfc_open,
        .read    = seq_read,
        .llseek  = seq_lseek,
-        .release = seq_release,
+        .release = seq_release_private,
 };
 #endif
@@ -981,14 +981,15 @@ int __init ip6_mr_init(void)
                goto proc_cache_fail;
 #endif
        return 0;
-reg_notif_fail:
-        kmem_cache_destroy(mrt_cachep);
 #ifdef CONFIG_PROC_FS
-proc_vif_fail:
-        unregister_netdevice_notifier(&ip6_mr_notifier);
 proc_cache_fail:
        proc_net_remove(&init_net, "ip6_mr_vif");
+proc_vif_fail:
+        unregister_netdevice_notifier(&ip6_mr_notifier);
 #endif
+reg_notif_fail:
+        del_timer(&ipmr_expire_timer);
+        kmem_cache_destroy(mrt_cachep);
        return err;
 }
diff --git a/net/ipv6/ipv6_sockglue.c b/net/ipv6/ipv6_sockglue.c
index 4e5eac301f91..2aa294be0c79 100644
--- a/net/ipv6/ipv6_sockglue.c
+++ b/net/ipv6/ipv6_sockglue.c
@@ -366,11 +366,16 @@ static int do_ipv6_setsockopt(struct sock *sk, int level, int optname,
                }
                /* routing header option needs extra check */
+                retv = -EINVAL;
                if (optname == IPV6_RTHDR && opt && opt->srcrt) {
                        struct ipv6_rt_hdr *rthdr = opt->srcrt;
                        switch (rthdr->type) {
 #if defined(CONFIG_IPV6_MIP6) || defined(CONFIG_IPV6_MIP6_MODULE)
                        case IPV6_SRCRT_TYPE_2:
+                                if (rthdr->hdrlen != 2 ||
+                                    rthdr->segments_left != 1)
+                                        goto sticky_done;
                                break;
 #endif
                        default:
diff --git a/net/ipv6/ndisc.c b/net/ipv6/ndisc.c
index 172438320eec..d0f54d18e19b 100644
--- a/net/ipv6/ndisc.c
+++ b/net/ipv6/ndisc.c
@@ -912,8 +912,13 @@ static void ndisc_recv_na(struct sk_buff *skb)
                   is invalid, but ndisc specs say nothing
                   about it. It could be misconfiguration, or
                   an smart proxy agent tries to help us :-)
+                   We should not print the error if NA has been
+                   received from loopback - it is just our own
+                   unsolicited advertisement.
                 */
-                ND_PRINTK1(KERN_WARNING
+                if (skb->pkt_type != PACKET_LOOPBACK)
+                        ND_PRINTK1(KERN_WARNING
                           "ICMPv6 NA: someone advertises our address on %s!\n",
                           ifp->idev->dev->name);
                in6_ifa_put(ifp);
diff --git a/net/ipv6/proc.c b/net/ipv6/proc.c
index 07f0b76e7427..97c17fdd6f75 100644
--- a/net/ipv6/proc.c
+++ b/net/ipv6/proc.c
@@ -132,7 +132,7 @@ static struct snmp_mib snmp6_udplite6_list[] = {
 static void snmp6_seq_show_icmpv6msg(struct seq_file *seq, void **mib)
 {
-        static char name[32];
+        char name[32];
        int i;
        /* print by name -- deprecated items */
@@ -144,7 +144,7 @@ static void snmp6_seq_show_icmpv6msg(struct seq_file *seq, void **mib)
                p = icmp6type2name[icmptype];
                if (!p) /* don't print un-named types here */
                        continue;
-                (void) snprintf(name, sizeof(name)-1, "Icmp6%s%s",
+                snprintf(name, sizeof(name), "Icmp6%s%s",
                        i & 0x100 ? "Out" : "In", p);
                seq_printf(seq, "%-32s\t%lu\n", name,
                        snmp_fold_field(mib, i));
@@ -157,7 +157,7 @@ static void snmp6_seq_show_icmpv6msg(struct seq_file *seq, void **mib)
                val = snmp_fold_field(mib, i);
                if (!val)
                        continue;
-                (void) snprintf(name, sizeof(name)-1, "Icmp6%sType%u",
+                snprintf(name, sizeof(name), "Icmp6%sType%u",
                        i & 0x100 ?  "Out" : "In", i & 0xff);
                seq_printf(seq, "%-32s\t%lu\n", name, val);
        }
diff --git a/net/key/af_key.c b/net/key/af_key.c
index 3440a4637f01..5b22e011653b 100644
--- a/net/key/af_key.c
+++ b/net/key/af_key.c
@@ -3188,6 +3188,7 @@ static struct xfrm_policy *pfkey_compile_policy(struct sock *sk, int opt,
        return xp;
 out:
+        xp->walk.dead = 1;
        xfrm_policy_destroy(xp);
        return NULL;
 }
diff --git a/net/mac80211/debugfs_sta.c b/net/mac80211/debugfs_sta.c
index 189d0bafa91a..b85c4f27b361 100644
--- a/net/mac80211/debugfs_sta.c
+++ b/net/mac80211/debugfs_sta.c
@@ -199,7 +199,7 @@ static ssize_t sta_agg_status_write(struct file *file,
                /* toggle Rx aggregation command */
                tid_num = tid_num - 100;
                if (tid_static_rx[tid_num] == 1) {
-                        strcpy(state, "off ");
+                        strcpy(state, "off");
                        ieee80211_sta_stop_rx_ba_session(sta->sdata, da, tid_num, 0,
                                        WLAN_REASON_QSTA_REQUIRE_SETUP);
                        sta->ampdu_mlme.tid_state_rx[tid_num] |=
diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
index 87665d7bb4f9..409bb7716236 100644
--- a/net/mac80211/mlme.c
+++ b/net/mac80211/mlme.c
@@ -2560,25 +2560,3 @@ void ieee80211_mlme_notify_scan_completed(struct ieee80211_local *local)
                ieee80211_restart_sta_timer(sdata);
        rcu_read_unlock();
 }
-/* driver notification call */
-void ieee80211_notify_mac(struct ieee80211_hw *hw,
-                          enum ieee80211_notification_types  notif_type)
-{
-        struct ieee80211_local *local = hw_to_local(hw);
-        struct ieee80211_sub_if_data *sdata;
-        switch (notif_type) {
-        case IEEE80211_NOTIFY_RE_ASSOC:
-                rcu_read_lock();
-                list_for_each_entry_rcu(sdata, &local->interfaces, list) {
-                        if (sdata->vif.type != NL80211_IFTYPE_STATION)
-                                continue;
-                        ieee80211_sta_req_auth(sdata, &sdata->u.sta);
-                }
-                rcu_read_unlock();
-                break;
-        }
-}
-EXPORT_SYMBOL(ieee80211_notify_mac);
diff --git a/net/mac80211/sta_info.c b/net/mac80211/sta_info.c
index 7fef8ea1f5ec..d254446b85b5 100644
--- a/net/mac80211/sta_info.c
+++ b/net/mac80211/sta_info.c
@@ -99,7 +99,7 @@ struct sta_info *sta_info_get(struct ieee80211_local *local, const u8 *addr)
        sta = rcu_dereference(local->sta_hash[STA_HASH(addr)]);
        while (sta) {
-                if (compare_ether_addr(sta->sta.addr, addr) == 0)
+                if (memcmp(sta->sta.addr, addr, ETH_ALEN) == 0)
                        break;
                sta = rcu_dereference(sta->hnext);
        }
diff --git a/net/mac80211/wext.c b/net/mac80211/wext.c
index 742f811ca416..ab4ddba874be 100644
--- a/net/mac80211/wext.c
+++ b/net/mac80211/wext.c
@@ -271,6 +271,7 @@ static int ieee80211_ioctl_siwmode(struct net_device *dev,
                                   __u32 *mode, char *extra)
 {
        struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
+        struct ieee80211_local *local = sdata->local;
        int type;
        if (sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
@@ -281,6 +282,13 @@ static int ieee80211_ioctl_siwmode(struct net_device *dev,
                type = NL80211_IFTYPE_STATION;
                break;
        case IW_MODE_ADHOC:
+                /* Setting ad-hoc mode on non ibss channel is not
+                 * supported.
+                 */
+                if (local->oper_channel &&
+                    (local->oper_channel->flags & IEEE80211_CHAN_NO_IBSS))
+                        return -EOPNOTSUPP;
                type = NL80211_IFTYPE_ADHOC;
                break;
        case IW_MODE_REPEAT:
diff --git a/net/netfilter/ipvs/ip_vs_xmit.c b/net/netfilter/ipvs/ip_vs_xmit.c
index 02ddc2b3ce2e..e90d52f199bc 100644
--- a/net/netfilter/ipvs/ip_vs_xmit.c
+++ b/net/netfilter/ipvs/ip_vs_xmit.c
@@ -713,7 +713,8 @@ ip_vs_tunnel_xmit_v6(struct sk_buff *skb, struct ip_vs_conn *cp,
        iph                     =       ipv6_hdr(skb);
        iph->version            =       6;
        iph->nexthdr            =       IPPROTO_IPV6;
-        iph->payload_len        =       old_iph->payload_len + sizeof(old_iph);
+        iph->payload_len        =       old_iph->payload_len;
+        be16_add_cpu(&iph->payload_len, sizeof(*old_iph));
        iph->priority           =       old_iph->priority;
        memset(&iph->flow_lbl, 0, sizeof(iph->flow_lbl));
        iph->daddr              =       rt->rt6i_dst.addr;
diff --git a/net/netfilter/nf_conntrack_core.c b/net/netfilter/nf_conntrack_core.c
index 622d7c671cb7..233fdd2d7d21 100644
--- a/net/netfilter/nf_conntrack_core.c
+++ b/net/netfilter/nf_conntrack_core.c
@@ -305,9 +305,7 @@ void nf_conntrack_hash_insert(struct nf_conn *ct)
        hash = hash_conntrack(&ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple);
        repl_hash = hash_conntrack(&ct->tuplehash[IP_CT_DIR_REPLY].tuple);
-        spin_lock_bh(&nf_conntrack_lock);
        __nf_conntrack_hash_insert(ct, hash, repl_hash);
-        spin_unlock_bh(&nf_conntrack_lock);
 }
 EXPORT_SYMBOL_GPL(nf_conntrack_hash_insert);
diff --git a/net/netfilter/nf_conntrack_netlink.c b/net/netfilter/nf_conntrack_netlink.c
index a040d46f85d6..5f4a6516b3b6 100644
--- a/net/netfilter/nf_conntrack_netlink.c
+++ b/net/netfilter/nf_conntrack_netlink.c
@@ -1090,7 +1090,7 @@ ctnetlink_create_conntrack(struct nlattr *cda[],
        struct nf_conn_help *help;
        struct nf_conntrack_helper *helper;
-        ct = nf_conntrack_alloc(&init_net, otuple, rtuple, GFP_KERNEL);
+        ct = nf_conntrack_alloc(&init_net, otuple, rtuple, GFP_ATOMIC);
        if (ct == NULL || IS_ERR(ct))
                return -ENOMEM;
@@ -1138,7 +1138,7 @@ ctnetlink_create_conntrack(struct nlattr *cda[],
                }
        }
-        nf_ct_acct_ext_add(ct, GFP_KERNEL);
+        nf_ct_acct_ext_add(ct, GFP_ATOMIC);
 #if defined(CONFIG_NF_CONNTRACK_MARK)
        if (cda[CTA_MARK])
@@ -1212,13 +1212,14 @@ ctnetlink_new_conntrack(struct sock *ctnl, struct sk_buff *skb,
                        atomic_inc(&master_ct->ct_general.use);
                }
-                spin_unlock_bh(&nf_conntrack_lock);
                err = -ENOENT;
                if (nlh->nlmsg_flags & NLM_F_CREATE)
                        err = ctnetlink_create_conntrack(cda,
                                                         &otuple,
                                                         &rtuple,
                                                         master_ct);
+                spin_unlock_bh(&nf_conntrack_lock);
                if (err < 0 && master_ct)
                        nf_ct_put(master_ct);
diff --git a/net/netfilter/xt_socket.c b/net/netfilter/xt_socket.c
index 02a8fed21082..1acc089be7e9 100644
--- a/net/netfilter/xt_socket.c
+++ b/net/netfilter/xt_socket.c
@@ -141,7 +141,7 @@ socket_mt(const struct sk_buff *skb, const struct xt_match_param *par)
        sk = nf_tproxy_get_sock_v4(dev_net(skb->dev), protocol,
                                   saddr, daddr, sport, dport, par->in, false);
        if (sk != NULL) {
-                bool wildcard = (inet_sk(sk)->rcv_saddr == 0);
+                bool wildcard = (sk->sk_state != TCP_TIME_WAIT && inet_sk(sk)->rcv_saddr == 0);
                nf_tproxy_put_sock(sk);
                if (wildcard)
diff --git a/net/netlabel/netlabel_unlabeled.c b/net/netlabel/netlabel_unlabeled.c
index e8a5c32b0f10..8c0308032178 100644
--- a/net/netlabel/netlabel_unlabeled.c
+++ b/net/netlabel/netlabel_unlabeled.c
@@ -562,7 +562,6 @@ static int netlbl_unlhsh_remove_addr4(struct net *net,
                                      const struct in_addr *mask,
                                      struct netlbl_audit *audit_info)
 {
-        int ret_val = 0;
        struct netlbl_af4list *list_entry;
        struct netlbl_unlhsh_addr4 *entry;
        struct audit_buffer *audit_buf;
@@ -574,9 +573,10 @@ static int netlbl_unlhsh_remove_addr4(struct net *net,
        list_entry = netlbl_af4list_remove(addr->s_addr, mask->s_addr,
                                           &iface->addr4_list);
        spin_unlock(&netlbl_unlhsh_lock);
-        if (list_entry == NULL)
+        if (list_entry != NULL)
-                ret_val = -ENOENT;
+                entry = netlbl_unlhsh_addr4_entry(list_entry);
-        entry = netlbl_unlhsh_addr4_entry(list_entry);
+        else
+                entry = NULL;
        audit_buf = netlbl_audit_start_common(AUDIT_MAC_UNLBL_STCDEL,
                                              audit_info);
@@ -587,19 +587,21 @@ static int netlbl_unlhsh_remove_addr4(struct net *net,
                                          addr->s_addr, mask->s_addr);
                if (dev != NULL)
                        dev_put(dev);
-                if (entry && security_secid_to_secctx(entry->secid,
+                if (entry != NULL &&
-                                                      &secctx,
+                    security_secid_to_secctx(entry->secid,
-                                                      &secctx_len) == 0) {
+                                             &secctx, &secctx_len) == 0) {
                        audit_log_format(audit_buf, " sec_obj=%s", secctx);
                        security_release_secctx(secctx, secctx_len);
                }
-                audit_log_format(audit_buf, " res=%u", ret_val == 0 ? 1 : 0);
+                audit_log_format(audit_buf, " res=%u", entry != NULL ? 1 : 0);
                audit_log_end(audit_buf);
        }
-        if (ret_val == 0)
+        if (entry == NULL)
-                call_rcu(&entry->rcu, netlbl_unlhsh_free_addr4);
+                return -ENOENT;
-        return ret_val;
+        call_rcu(&entry->rcu, netlbl_unlhsh_free_addr4);
+        return 0;
 }
 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
@@ -623,7 +625,6 @@ static int netlbl_unlhsh_remove_addr6(struct net *net,
                                      const struct in6_addr *mask,
                                      struct netlbl_audit *audit_info)
 {
-        int ret_val = 0;
        struct netlbl_af6list *list_entry;
        struct netlbl_unlhsh_addr6 *entry;
        struct audit_buffer *audit_buf;
@@ -634,9 +635,10 @@ static int netlbl_unlhsh_remove_addr6(struct net *net,
        spin_lock(&netlbl_unlhsh_lock);
        list_entry = netlbl_af6list_remove(addr, mask, &iface->addr6_list);
        spin_unlock(&netlbl_unlhsh_lock);
-        if (list_entry == NULL)
+        if (list_entry != NULL)
-                ret_val = -ENOENT;
+                entry = netlbl_unlhsh_addr6_entry(list_entry);
-        entry = netlbl_unlhsh_addr6_entry(list_entry);
+        else
+                entry = NULL;
        audit_buf = netlbl_audit_start_common(AUDIT_MAC_UNLBL_STCDEL,
                                              audit_info);
@@ -647,19 +649,21 @@ static int netlbl_unlhsh_remove_addr6(struct net *net,
                                          addr, mask);
                if (dev != NULL)
                        dev_put(dev);
-                if (entry && security_secid_to_secctx(entry->secid,
+                if (entry != NULL &&
-                                                      &secctx,
+                    security_secid_to_secctx(entry->secid,
-                                                      &secctx_len) == 0) {
+                                             &secctx, &secctx_len) == 0) {
                        audit_log_format(audit_buf, " sec_obj=%s", secctx);
                        security_release_secctx(secctx, secctx_len);
                }
-                audit_log_format(audit_buf, " res=%u", ret_val == 0 ? 1 : 0);
+                audit_log_format(audit_buf, " res=%u", entry != NULL ? 1 : 0);
                audit_log_end(audit_buf);
        }
-        if (ret_val == 0)
+        if (entry == NULL)
-                call_rcu(&entry->rcu, netlbl_unlhsh_free_addr6);
+                return -ENOENT;
-        return ret_val;
+        call_rcu(&entry->rcu, netlbl_unlhsh_free_addr6);
+        return 0;
 }
 #endif /* IPv6 */
diff --git a/net/phonet/af_phonet.c b/net/phonet/af_phonet.c
index defeb7a0d502..9d211f12582b 100644
--- a/net/phonet/af_phonet.c
+++ b/net/phonet/af_phonet.c
@@ -33,9 +33,30 @@
 #include <net/phonet/phonet.h>
 #include <net/phonet/pn_dev.h>
-static struct net_proto_family phonet_proto_family;
+/* Transport protocol registration */
-static struct phonet_protocol *phonet_proto_get(int protocol);
+static struct phonet_protocol *proto_tab[PHONET_NPROTO] __read_mostly;
-static inline void phonet_proto_put(struct phonet_protocol *pp);
+static DEFINE_SPINLOCK(proto_tab_lock);
+static struct phonet_protocol *phonet_proto_get(int protocol)
+{
+        struct phonet_protocol *pp;
+        if (protocol >= PHONET_NPROTO)
+                return NULL;
+        spin_lock(&proto_tab_lock);
+        pp = proto_tab[protocol];
+        if (pp && !try_module_get(pp->prot->owner))
+                pp = NULL;
+        spin_unlock(&proto_tab_lock);
+        return pp;
+}
+static inline void phonet_proto_put(struct phonet_protocol *pp)
+{
+        module_put(pp->prot->owner);
+}
 /* protocol family functions */
@@ -144,8 +165,8 @@ static int pn_send(struct sk_buff *skb, struct net_device *dev,
        struct phonethdr *ph;
        int err;
-        if (skb->len + 2 > 0xffff) {
+        if (skb->len + 2 > 0xffff /* Phonet length field limit */ ||
-                /* Phonet length field would overflow */
+            skb->len + sizeof(struct phonethdr) > dev->mtu) {
                err = -EMSGSIZE;
                goto drop;
        }
@@ -375,10 +396,6 @@ static struct packet_type phonet_packet_type = {
        .func = phonet_rcv,
 };
-/* Transport protocol registration */
-static struct phonet_protocol *proto_tab[PHONET_NPROTO] __read_mostly;
-static DEFINE_SPINLOCK(proto_tab_lock);
 int __init_or_module phonet_proto_register(int protocol,
                                                struct phonet_protocol *pp)
 {
@@ -412,27 +429,6 @@ void phonet_proto_unregister(int protocol, struct phonet_protocol *pp)
 }
 EXPORT_SYMBOL(phonet_proto_unregister);
-static struct phonet_protocol *phonet_proto_get(int protocol)
-{
-        struct phonet_protocol *pp;
-        if (protocol >= PHONET_NPROTO)
-                return NULL;
-        spin_lock(&proto_tab_lock);
-        pp = proto_tab[protocol];
-        if (pp && !try_module_get(pp->prot->owner))
-                pp = NULL;
-        spin_unlock(&proto_tab_lock);
-        return pp;
-}
-static inline void phonet_proto_put(struct phonet_protocol *pp)
-{
-        module_put(pp->prot->owner);
-}
 /* Module registration */
 static int __init phonet_init(void)
 {
diff --git a/net/phonet/pep-gprs.c b/net/phonet/pep-gprs.c
index 9978afbd9f2a..803eeef0aa85 100644
--- a/net/phonet/pep-gprs.c
+++ b/net/phonet/pep-gprs.c
@@ -155,12 +155,13 @@ static void gprs_data_ready(struct sock *sk, int len)
 static void gprs_write_space(struct sock *sk)
 {
        struct gprs_dev *dev = sk->sk_user_data;
+        struct net_device *net = dev->net;
        unsigned credits = pep_writeable(sk);
        spin_lock_bh(&dev->tx_lock);
        dev->tx_max = credits;
-        if (credits > skb_queue_len(&dev->tx_queue))
+        if (credits > skb_queue_len(&dev->tx_queue) && netif_running(net))
-                netif_wake_queue(dev->net);
+                netif_wake_queue(net);
        spin_unlock_bh(&dev->tx_lock);
 }
@@ -168,6 +169,23 @@ static void gprs_write_space(struct sock *sk)
 * Network device callbacks
 */
+static int gprs_open(struct net_device *dev)
+{
+        struct gprs_dev *gp = netdev_priv(dev);
+        gprs_write_space(gp->sk);
+        return 0;
+}
+static int gprs_close(struct net_device *dev)
+{
+        struct gprs_dev *gp = netdev_priv(dev);
+        netif_stop_queue(dev);
+        flush_work(&gp->tx_work);
+        return 0;
+}
 static int gprs_xmit(struct sk_buff *skb, struct net_device *net)
 {
        struct gprs_dev *dev = netdev_priv(net);
@@ -254,6 +272,8 @@ static void gprs_setup(struct net_device *net)
        net->tx_queue_len       = 10;
        net->destructor         = free_netdev;
+        net->open               = gprs_open;
+        net->stop               = gprs_close;
        net->hard_start_xmit    = gprs_xmit; /* mandatory */
        net->change_mtu         = gprs_set_mtu;
        net->get_stats          = gprs_get_stats;
@@ -318,7 +338,6 @@ int gprs_attach(struct sock *sk)
        dev->sk = sk;
        printk(KERN_DEBUG"%s: attached\n", net->name);
-        gprs_write_space(sk); /* kick off TX */
        return net->ifindex;
 out_rel:
@@ -341,7 +360,5 @@ void gprs_detach(struct sock *sk)
        printk(KERN_DEBUG"%s: detached\n", net->name);
        unregister_netdev(net);
-        flush_scheduled_work();
        sock_put(sk);
-        skb_queue_purge(&dev->tx_queue);
 }
diff --git a/net/phonet/pn_dev.c b/net/phonet/pn_dev.c
index 53be9fc82aaa..f93ff8ef47d0 100644
--- a/net/phonet/pn_dev.c
+++ b/net/phonet/pn_dev.c
@@ -115,7 +115,7 @@ int phonet_address_del(struct net_device *dev, u8 addr)
        pnd = __phonet_get(dev);
        if (!pnd || !test_and_clear_bit(addr >> 2, pnd->addrs))
                err = -EADDRNOTAVAIL;
-        if (bitmap_empty(pnd->addrs, 64))
+        else if (bitmap_empty(pnd->addrs, 64))
                __phonet_device_free(pnd);
        spin_unlock_bh(&pndevs.lock);
        return err;
diff --git a/net/phonet/pn_netlink.c b/net/phonet/pn_netlink.c
index b1770d66bc8d..242fe8f8c322 100644
--- a/net/phonet/pn_netlink.c
+++ b/net/phonet/pn_netlink.c
@@ -123,6 +123,7 @@ nla_put_failure:
 static int getaddr_dumpit(struct sk_buff *skb, struct netlink_callback *cb)
 {
+        struct net *net = sock_net(skb->sk);
        struct phonet_device *pnd;
        int dev_idx = 0, dev_start_idx = cb->args[0];
        int addr_idx = 0, addr_start_idx = cb->args[1];
@@ -131,6 +132,8 @@ static int getaddr_dumpit(struct sk_buff *skb, struct netlink_callback *cb)
        list_for_each_entry(pnd, &pndevs.list, list) {
                u8 addr;
+                if (!net_eq(dev_net(pnd->netdev), net))
+                        continue;
                if (dev_idx > dev_start_idx)
                        addr_start_idx = 0;
                if (dev_idx++ < dev_start_idx)
diff --git a/net/rose/af_rose.c b/net/rose/af_rose.c
index a7f1ce11bc22..0c1cc7612800 100644
--- a/net/rose/af_rose.c
+++ b/net/rose/af_rose.c
@@ -1072,6 +1072,10 @@ static int rose_sendmsg(struct kiocb *iocb, struct socket *sock,
        unsigned char *asmptr;
        int n, size, qbit = 0;
+        /* ROSE empty frame has no meaning : don't send */
+        if (len == 0)
+                return 0;
        if (msg->msg_flags & ~(MSG_DONTWAIT|MSG_EOR|MSG_CMSG_COMPAT))
                return -EINVAL;
@@ -1265,6 +1269,12 @@ static int rose_recvmsg(struct kiocb *iocb, struct socket *sock,
        skb_reset_transport_header(skb);
        copied     = skb->len;
+        /* ROSE empty frame has no meaning : ignore it */
+        if (copied == 0) {
+                skb_free_datagram(sk, skb);
+                return copied;
+        }
        if (copied > size) {
                copied = size;
                msg->msg_flags |= MSG_TRUNC;
diff --git a/net/sched/sch_api.c b/net/sched/sch_api.c
index b16ad2972c6b..6ab4a2f92ca0 100644
--- a/net/sched/sch_api.c
+++ b/net/sched/sch_api.c
@@ -417,6 +417,8 @@ static int qdisc_dump_stab(struct sk_buff *skb, struct qdisc_size_table *stab)
        struct nlattr *nest;
        nest = nla_nest_start(skb, TCA_STAB);
+        if (nest == NULL)
+                goto nla_put_failure;
        NLA_PUT(skb, TCA_STAB_BASE, sizeof(stab->szopts), &stab->szopts);
        nla_nest_end(skb, nest);
diff --git a/net/sched/sch_generic.c b/net/sched/sch_generic.c
index 93cd30ce6501..cdcd16fcfeda 100644
--- a/net/sched/sch_generic.c
+++ b/net/sched/sch_generic.c
@@ -270,6 +270,8 @@ static void dev_watchdog_down(struct net_device *dev)
 void netif_carrier_on(struct net_device *dev)
 {
        if (test_and_clear_bit(__LINK_STATE_NOCARRIER, &dev->state)) {
+                if (dev->reg_state == NETREG_UNINITIALIZED)
+                        return;
                linkwatch_fire_event(dev);
                if (netif_running(dev))
                        __netdev_watchdog_up(dev);
@@ -285,8 +287,11 @@ EXPORT_SYMBOL(netif_carrier_on);
 */
 void netif_carrier_off(struct net_device *dev)
 {
-        if (!test_and_set_bit(__LINK_STATE_NOCARRIER, &dev->state))
+        if (!test_and_set_bit(__LINK_STATE_NOCARRIER, &dev->state)) {
+                if (dev->reg_state == NETREG_UNINITIALIZED)
+                        return;
                linkwatch_fire_event(dev);
+        }
 }
 EXPORT_SYMBOL(netif_carrier_off);
diff --git a/net/sched/sch_netem.c b/net/sched/sch_netem.c
index a11959908d9a..98402f0efa47 100644
--- a/net/sched/sch_netem.c
+++ b/net/sched/sch_netem.c
@@ -46,9 +46,6 @@
         layering other disciplines.  It does not need to do bandwidth
         control either since that can be handled by using token
         bucket or other rate control.
-         The simulator is limited by the Linux timer resolution
-         and will create packet bursts on the HZ boundary (1ms).
 */
 struct netem_sched_data {
diff --git a/net/socket.c b/net/socket.c
index 57550c3bcabe..92764d836891 100644
--- a/net/socket.c
+++ b/net/socket.c
@@ -1426,8 +1426,8 @@ asmlinkage long sys_listen(int fd, int backlog)
 *      clean when we restucture accept also.
 */
-long do_accept(int fd, struct sockaddr __user *upeer_sockaddr,
+asmlinkage long sys_accept4(int fd, struct sockaddr __user *upeer_sockaddr,
-               int __user *upeer_addrlen, int flags)
+                            int __user *upeer_addrlen, int flags)
 {
        struct socket *sock, *newsock;
        struct file *newfile;
@@ -1510,66 +1510,10 @@ out_fd:
        goto out_put;
 }
-#if 0
-#ifdef HAVE_SET_RESTORE_SIGMASK
-asmlinkage long sys_paccept(int fd, struct sockaddr __user *upeer_sockaddr,
-                            int __user *upeer_addrlen,
-                            const sigset_t __user *sigmask,
-                            size_t sigsetsize, int flags)
-{
-        sigset_t ksigmask, sigsaved;
-        int ret;
-        if (sigmask) {
-                /* XXX: Don't preclude handling different sized sigset_t's.  */
-                if (sigsetsize != sizeof(sigset_t))
-                        return -EINVAL;
-                if (copy_from_user(&ksigmask, sigmask, sizeof(ksigmask)))
-                        return -EFAULT;
-                sigdelsetmask(&ksigmask, sigmask(SIGKILL)|sigmask(SIGSTOP));
-                sigprocmask(SIG_SETMASK, &ksigmask, &sigsaved);
-        }
-        ret = do_accept(fd, upeer_sockaddr, upeer_addrlen, flags);
-        if (ret < 0 && signal_pending(current)) {
-                /*
-                 * Don't restore the signal mask yet. Let do_signal() deliver
-                 * the signal on the way back to userspace, before the signal
-                 * mask is restored.
-                 */
-                if (sigmask) {
-                        memcpy(&current->saved_sigmask, &sigsaved,
-                               sizeof(sigsaved));
-                        set_restore_sigmask();
-                }
-        } else if (sigmask)
-                sigprocmask(SIG_SETMASK, &sigsaved, NULL);
-        return ret;
-}
-#else
-asmlinkage long sys_paccept(int fd, struct sockaddr __user *upeer_sockaddr,
-                            int __user *upeer_addrlen,
-                            const sigset_t __user *sigmask,
-                            size_t sigsetsize, int flags)
-{
-        /* The platform does not support restoring the signal mask in the
-         * return path.  So we do not allow using paccept() with a signal
-         * mask.  */
-        if (sigmask)
-                return -EINVAL;
-        return do_accept(fd, upeer_sockaddr, upeer_addrlen, flags);
-}
-#endif
-#endif
 asmlinkage long sys_accept(int fd, struct sockaddr __user *upeer_sockaddr,
                           int __user *upeer_addrlen)
 {
-        return do_accept(fd, upeer_sockaddr, upeer_addrlen, 0);
+        return sys_accept4(fd, upeer_sockaddr, upeer_addrlen, 0);
 }
 /*
@@ -2096,7 +2040,7 @@ static const unsigned char nargs[19]={
        AL(0),AL(3),AL(3),AL(3),AL(2),AL(3),
        AL(3),AL(3),AL(4),AL(4),AL(4),AL(6),
        AL(6),AL(2),AL(5),AL(5),AL(3),AL(3),
-        AL(6)
+        AL(4)
 };
 #undef AL
@@ -2115,7 +2059,7 @@ asmlinkage long sys_socketcall(int call, unsigned long __user *args)
        unsigned long a0, a1;
        int err;
-        if (call < 1 || call > SYS_PACCEPT)
+        if (call < 1 || call > SYS_ACCEPT4)
                return -EINVAL;
        /* copy_from_user should be SMP safe. */
@@ -2143,9 +2087,8 @@ asmlinkage long sys_socketcall(int call, unsigned long __user *args)
                err = sys_listen(a0, a1);
                break;
        case SYS_ACCEPT:
-                err =
+                err = sys_accept4(a0, (struct sockaddr __user *)a1,
-                    do_accept(a0, (struct sockaddr __user *)a1,
+                                  (int __user *)a[2], 0);
-                              (int __user *)a[2], 0);
                break;
        case SYS_GETSOCKNAME:
                err =
@@ -2192,12 +2135,9 @@ asmlinkage long sys_socketcall(int call, unsigned long __user *args)
        case SYS_RECVMSG:
                err = sys_recvmsg(a0, (struct msghdr __user *)a1, a[2]);
                break;
-        case SYS_PACCEPT:
+        case SYS_ACCEPT4:
-                err =
+                err = sys_accept4(a0, (struct sockaddr __user *)a1,
-                    sys_paccept(a0, (struct sockaddr __user *)a1,
+                                  (int __user *)a[2], a[3]);
-                                (int __user *)a[2],
-                                (const sigset_t __user *) a[3],
-                                a[4], a[5]);
                break;
        default:
                err = -EINVAL;
diff --git a/net/sunrpc/auth_generic.c b/net/sunrpc/auth_generic.c
index 744b79fdcb19..4028502f0528 100644
--- a/net/sunrpc/auth_generic.c
+++ b/net/sunrpc/auth_generic.c
@@ -133,13 +133,29 @@ static int
 generic_match(struct auth_cred *acred, struct rpc_cred *cred, int flags)
 {
        struct generic_cred *gcred = container_of(cred, struct generic_cred, gc_base);
+        int i;
        if (gcred->acred.uid != acred->uid ||
            gcred->acred.gid != acred->gid ||
-            gcred->acred.group_info != acred->group_info ||
            gcred->acred.machine_cred != acred->machine_cred)
-                return 0;
+                goto out_nomatch;
+        /* Optimisation in the case where pointers are identical... */
+        if (gcred->acred.group_info == acred->group_info)
+                goto out_match;
+        /* Slow path... */
+        if (gcred->acred.group_info->ngroups != acred->group_info->ngroups)
+                goto out_nomatch;
+        for (i = 0; i < gcred->acred.group_info->ngroups; i++) {
+                if (GROUP_AT(gcred->acred.group_info, i) !=
+                                GROUP_AT(acred->group_info, i))
+                        goto out_nomatch;
+        }
+out_match:
        return 1;
+out_nomatch:
+        return 0;
 }
 void __init rpc_init_generic_auth(void)
diff --git a/net/sunrpc/svcsock.c b/net/sunrpc/svcsock.c
index 95293f549e9c..a1951dcc5776 100644
--- a/net/sunrpc/svcsock.c
+++ b/net/sunrpc/svcsock.c
@@ -1183,7 +1183,11 @@ int svc_addsock(struct svc_serv *serv,
        else if (so->state > SS_UNCONNECTED)
                err = -EISCONN;
        else {
-                svsk = svc_setup_socket(serv, so, &err, SVC_SOCK_DEFAULTS);
+                if (!try_module_get(THIS_MODULE))
+                        err = -ENOENT;
+                else
+                        svsk = svc_setup_socket(serv, so, &err,
+                                                SVC_SOCK_DEFAULTS);
                if (svsk) {
                        struct sockaddr_storage addr;
                        struct sockaddr *sin = (struct sockaddr *)&addr;
@@ -1196,7 +1200,8 @@ int svc_addsock(struct svc_serv *serv,
                        spin_unlock_bh(&serv->sv_lock);
                        svc_xprt_received(&svsk->sk_xprt);
                        err = 0;
-                }
+                } else
+                        module_put(THIS_MODULE);
        }
        if (err) {
                sockfd_put(so);
diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c
index eb90f77bb0e2..66d5ac4773ab 100644
--- a/net/unix/af_unix.c
+++ b/net/unix/af_unix.c
@@ -1343,6 +1343,7 @@ static int unix_dgram_sendmsg(struct kiocb *kiocb, struct socket *sock,
        if (NULL == siocb->scm)
                siocb->scm = &tmp_scm;
+        wait_for_unix_gc();
        err = scm_send(sock, msg, siocb->scm);
        if (err < 0)
                return err;
@@ -1493,6 +1494,7 @@ static int unix_stream_sendmsg(struct kiocb *kiocb, struct socket *sock,
        if (NULL == siocb->scm)
                siocb->scm = &tmp_scm;
+        wait_for_unix_gc();
        err = scm_send(sock, msg, siocb->scm);
        if (err < 0)
                return err;
diff --git a/net/unix/garbage.c b/net/unix/garbage.c
index 6d4a9a8de5ef..abb3ab34cb1e 100644
--- a/net/unix/garbage.c
+++ b/net/unix/garbage.c
@@ -80,6 +80,7 @@
 #include <linux/file.h>
 #include <linux/proc_fs.h>
 #include <linux/mutex.h>
+#include <linux/wait.h>
 #include <net/sock.h>
 #include <net/af_unix.h>
@@ -91,6 +92,7 @@
 static LIST_HEAD(gc_inflight_list);
 static LIST_HEAD(gc_candidates);
 static DEFINE_SPINLOCK(unix_gc_lock);
+static DECLARE_WAIT_QUEUE_HEAD(unix_gc_wait);
 unsigned int unix_tot_inflight;
@@ -266,12 +268,16 @@ static void inc_inflight_move_tail(struct unix_sock *u)
                list_move_tail(&u->link, &gc_candidates);
 }
-/* The external entry point: unix_gc() */
+static bool gc_in_progress = false;
-void unix_gc(void)
+void wait_for_unix_gc(void)
 {
-        static bool gc_in_progress = false;
+        wait_event(unix_gc_wait, gc_in_progress == false);
+}
+/* The external entry point: unix_gc() */
+void unix_gc(void)
+{
        struct unix_sock *u;
        struct unix_sock *next;
        struct sk_buff_head hitlist;
@@ -376,6 +382,7 @@ void unix_gc(void)
        /* All candidates should have been detached by now. */
        BUG_ON(!list_empty(&gc_candidates));
        gc_in_progress = false;
+        wake_up(&unix_gc_wait);
 out:
        spin_unlock(&unix_gc_lock);
diff --git a/net/wireless/reg.c b/net/wireless/reg.c
index 626dbb688499..eb3b1a9f9b12 100644
--- a/net/wireless/reg.c
+++ b/net/wireless/reg.c
@@ -343,9 +343,9 @@ static int ignore_request(struct wiphy *wiphy, enum reg_set_by set_by,
                                return 0;
                        return -EALREADY;
                }
-                if (WARN_ON(!is_alpha2_set(alpha2) || !is_an_alpha2(alpha2)),
+                if (WARN(!is_alpha2_set(alpha2) || !is_an_alpha2(alpha2),
                                "Invalid Country IE regulatory hint passed "
-                                "to the wireless core\n")
+                                "to the wireless core\n"))
                        return -EINVAL;
                /* We ignore Country IE hints for now, as we haven't yet
                 * added the dot11MultiDomainCapabilityEnabled flag
diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c
index 058f04f54b90..fb216c9adf86 100644
--- a/net/xfrm/xfrm_policy.c
+++ b/net/xfrm/xfrm_policy.c
@@ -817,6 +817,7 @@ int xfrm_policy_flush(u8 type, struct xfrm_audit *audit_info)
                                continue;
                        hlist_del(&pol->bydst);
                        hlist_del(&pol->byidx);
+                        list_del(&pol->walk.all);
                        write_unlock_bh(&xfrm_policy_lock);
                        xfrm_audit_policy_delete(pol, 1, audit_info->loginuid,