300 files changed, 11241 insertions, 4916 deletions

diff --git a/net/8021q/vlan_core.c b/net/8021q/vlan_core.c
index 8ca533c95de0..b258da88f675 100644
--- a/net/8021q/vlan_core.c
+++ b/net/8021q/vlan_core.c
@@ -368,3 +368,9 @@ void vlan_vids_del_by_dev(struct net_device *dev,
                 vlan_vid_del(dev, vid_info->vid);
 }
 EXPORT_SYMBOL(vlan_vids_del_by_dev);
+
+bool vlan_uses_dev(const struct net_device *dev)
+{
+        return rtnl_dereference(dev->vlan_info) ? true : false;
+}
+EXPORT_SYMBOL(vlan_uses_dev);
diff --git a/net/8021q/vlan_dev.c b/net/8021q/vlan_dev.c
index 73a2a83ee2da..402442402af7 100644
--- a/net/8021q/vlan_dev.c
+++ b/net/8021q/vlan_dev.c
@@ -137,9 +137,21 @@ static int vlan_dev_hard_header(struct sk_buff *skb, struct net_device *dev,
         return rc;
 }
 
+static inline netdev_tx_t vlan_netpoll_send_skb(struct vlan_dev_priv *vlan, struct sk_buff *skb)
+{
+#ifdef CONFIG_NET_POLL_CONTROLLER
+        if (vlan->netpoll)
+                netpoll_send_skb(vlan->netpoll, skb);
+#else
+        BUG();
+#endif
+        return NETDEV_TX_OK;
+}
+
 static netdev_tx_t vlan_dev_hard_start_xmit(struct sk_buff *skb,
                                             struct net_device *dev)
 {
+        struct vlan_dev_priv *vlan = vlan_dev_priv(dev);
         struct vlan_ethhdr *veth = (struct vlan_ethhdr *)(skb->data);
         unsigned int len;
         int ret;
@@ -150,29 +162,30 @@ static netdev_tx_t vlan_dev_hard_start_xmit(struct sk_buff *skb,
          * OTHER THINGS LIKE FDDI/TokenRing/802.3 SNAPs...
          */
         if (veth->h_vlan_proto != htons(ETH_P_8021Q) ||
-            vlan_dev_priv(dev)->flags & VLAN_FLAG_REORDER_HDR) {
+            vlan->flags & VLAN_FLAG_REORDER_HDR) {
                 u16 vlan_tci;
-                vlan_tci = vlan_dev_priv(dev)->vlan_id;
+                vlan_tci = vlan->vlan_id;
                 vlan_tci |= vlan_dev_get_egress_qos_mask(dev, skb);
                 skb = __vlan_hwaccel_put_tag(skb, vlan_tci);
         }
 
-        skb->dev = vlan_dev_priv(dev)->real_dev;
+        skb->dev = vlan->real_dev;
         len = skb->len;
-        if (netpoll_tx_running(dev))
-                return skb->dev->netdev_ops->ndo_start_xmit(skb, skb->dev);
+        if (unlikely(netpoll_tx_running(dev)))
+                return vlan_netpoll_send_skb(vlan, skb);
+
         ret = dev_queue_xmit(skb);
 
         if (likely(ret == NET_XMIT_SUCCESS || ret == NET_XMIT_CN)) {
                 struct vlan_pcpu_stats *stats;
 
-                stats = this_cpu_ptr(vlan_dev_priv(dev)->vlan_pcpu_stats);
+                stats = this_cpu_ptr(vlan->vlan_pcpu_stats);
                 u64_stats_update_begin(&stats->syncp);
                 stats->tx_packets++;
                 stats->tx_bytes += len;
                 u64_stats_update_end(&stats->syncp);
         } else {
-                this_cpu_inc(vlan_dev_priv(dev)->vlan_pcpu_stats->tx_dropped);
+                this_cpu_inc(vlan->vlan_pcpu_stats->tx_dropped);
         }
 
         return ret;
@@ -669,25 +682,26 @@ static void vlan_dev_poll_controller(struct net_device *dev)
         return;
 }
 
-static int vlan_dev_netpoll_setup(struct net_device *dev, struct netpoll_info *npinfo)
+static int vlan_dev_netpoll_setup(struct net_device *dev, struct netpoll_info *npinfo,
+                                  gfp_t gfp)
 {
-        struct vlan_dev_priv *info = vlan_dev_priv(dev);
-        struct net_device *real_dev = info->real_dev;
+        struct vlan_dev_priv *vlan = vlan_dev_priv(dev);
+        struct net_device *real_dev = vlan->real_dev;
         struct netpoll *netpoll;
         int err = 0;
 
-        netpoll = kzalloc(sizeof(*netpoll), GFP_KERNEL);
+        netpoll = kzalloc(sizeof(*netpoll), gfp);
         err = -ENOMEM;
         if (!netpoll)
                 goto out;
 
-        err = __netpoll_setup(netpoll, real_dev);
+        err = __netpoll_setup(netpoll, real_dev, gfp);
         if (err) {
                 kfree(netpoll);
                 goto out;
         }
 
-        info->netpoll = netpoll;
+        vlan->netpoll = netpoll;
 
 out:
         return err;
@@ -695,19 +709,15 @@ out:
 
 static void vlan_dev_netpoll_cleanup(struct net_device *dev)
 {
-        struct vlan_dev_priv *info = vlan_dev_priv(dev);
-        struct netpoll *netpoll = info->netpoll;
+        struct vlan_dev_priv *vlan= vlan_dev_priv(dev);
+        struct netpoll *netpoll = vlan->netpoll;
 
         if (!netpoll)
                 return;
 
-        info->netpoll = NULL;
-
-        /* Wait for transmitting packets to finish before freeing. */
-        synchronize_rcu_bh();
+        vlan->netpoll = NULL;
 
-        __netpoll_cleanup(netpoll);
-        kfree(netpoll);
+        __netpoll_free_rcu(netpoll);
 }
 #endif /* CONFIG_NET_POLL_CONTROLLER */
 
diff --git a/net/Kconfig b/net/Kconfig
index 245831bec09a..30b48f523135 100644
--- a/net/Kconfig
+++ b/net/Kconfig
@@ -52,6 +52,8 @@ source "net/iucv/Kconfig"
 
 config INET
         bool "TCP/IP networking"
+        select CRYPTO
+        select CRYPTO_AES
         ---help---
           These are the protocols used on the Internet and on most local
           Ethernets. It is highly recommended to say Y here (this will enlarge
diff --git a/net/appletalk/atalk_proc.c b/net/appletalk/atalk_proc.c
index b5b1a221c242..c30f3a0717fb 100644
--- a/net/appletalk/atalk_proc.c
+++ b/net/appletalk/atalk_proc.c
@@ -183,7 +183,8 @@ static int atalk_seq_socket_show(struct seq_file *seq, void *v)
                    ntohs(at->dest_net), at->dest_node, at->dest_port,
                    sk_wmem_alloc_get(s),
                    sk_rmem_alloc_get(s),
-                   s->sk_state, SOCK_INODE(s->sk_socket)->i_uid);
+                   s->sk_state,
+                   from_kuid_munged(seq_user_ns(seq), sock_i_uid(s)));
 out:
         return 0;
 }
diff --git a/net/atm/common.c b/net/atm/common.c
index b4b44dbed645..0c0ad930a632 100644
--- a/net/atm/common.c
+++ b/net/atm/common.c
@@ -812,6 +812,7 @@ int vcc_getsockopt(struct socket *sock, int level, int optname,
 
                 if (!vcc->dev || !test_bit(ATM_VF_ADDR, &vcc->flags))
                         return -ENOTCONN;
+                memset(&pvc, 0, sizeof(pvc));
                 pvc.sap_family = AF_ATMPVC;
                 pvc.sap_addr.itf = vcc->dev->number;
                 pvc.sap_addr.vpi = vcc->vpi;
diff --git a/net/atm/pvc.c b/net/atm/pvc.c
index 3a734919c36c..ae0324021407 100644
--- a/net/atm/pvc.c
+++ b/net/atm/pvc.c
@@ -95,6 +95,7 @@ static int pvc_getname(struct socket *sock, struct sockaddr *sockaddr,
                 return -ENOTCONN;
         *sockaddr_len = sizeof(struct sockaddr_atmpvc);
         addr = (struct sockaddr_atmpvc *)sockaddr;
+        memset(addr, 0, sizeof(*addr));
         addr->sap_family = AF_ATMPVC;
         addr->sap_addr.itf = vcc->dev->number;
         addr->sap_addr.vpi = vcc->vpi;
diff --git a/net/atm/resources.c b/net/atm/resources.c
index 23f45ce6f351..0447d5d0b639 100644
--- a/net/atm/resources.c
+++ b/net/atm/resources.c
@@ -432,7 +432,7 @@ int atm_dev_ioctl(unsigned int cmd, void __user *arg, int compat)
                         size = dev->ops->ioctl(dev, cmd, buf);
                 }
                 if (size < 0) {
-                        error = (size == -ENOIOCTLCMD ? -EINVAL : size);
+                        error = (size == -ENOIOCTLCMD ? -ENOTTY : size);
                         goto done;
                 }
         }
diff --git a/net/ax25/ax25_uid.c b/net/ax25/ax25_uid.c
index e3c579ba6325..957999e43ff7 100644
--- a/net/ax25/ax25_uid.c
+++ b/net/ax25/ax25_uid.c
@@ -51,14 +51,14 @@ int ax25_uid_policy;
 
 EXPORT_SYMBOL(ax25_uid_policy);
 
-ax25_uid_assoc *ax25_findbyuid(uid_t uid)
+ax25_uid_assoc *ax25_findbyuid(kuid_t uid)
 {
         ax25_uid_assoc *ax25_uid, *res = NULL;
         struct hlist_node *node;
 
         read_lock(&ax25_uid_lock);
         ax25_uid_for_each(ax25_uid, node, &ax25_uid_list) {
-                if (ax25_uid->uid == uid) {
+                if (uid_eq(ax25_uid->uid, uid)) {
                         ax25_uid_hold(ax25_uid);
                         res = ax25_uid;
                         break;
@@ -84,7 +84,7 @@ int ax25_uid_ioctl(int cmd, struct sockaddr_ax25 *sax)
                 read_lock(&ax25_uid_lock);
                 ax25_uid_for_each(ax25_uid, node, &ax25_uid_list) {
                         if (ax25cmp(&sax->sax25_call, &ax25_uid->call) == 0) {
-                                res = ax25_uid->uid;
+                                res = from_kuid_munged(current_user_ns(), ax25_uid->uid);
                                 break;
                         }
                 }
@@ -93,9 +93,14 @@ int ax25_uid_ioctl(int cmd, struct sockaddr_ax25 *sax)
                 return res;
 
         case SIOCAX25ADDUID:
+        {
+                kuid_t sax25_kuid;
                 if (!capable(CAP_NET_ADMIN))
                         return -EPERM;
-                user = ax25_findbyuid(sax->sax25_uid);
+                sax25_kuid = make_kuid(current_user_ns(), sax->sax25_uid);
+                if (!uid_valid(sax25_kuid))
+                        return -EINVAL;
+                user = ax25_findbyuid(sax25_kuid);
                 if (user) {
                         ax25_uid_put(user);
                         return -EEXIST;
@@ -106,7 +111,7 @@ int ax25_uid_ioctl(int cmd, struct sockaddr_ax25 *sax)
                         return -ENOMEM;
 
                 atomic_set(&ax25_uid->refcount, 1);
-                ax25_uid->uid  = sax->sax25_uid;
+                ax25_uid->uid  = sax25_kuid;
                 ax25_uid->call = sax->sax25_call;
 
                 write_lock(&ax25_uid_lock);
@@ -114,7 +119,7 @@ int ax25_uid_ioctl(int cmd, struct sockaddr_ax25 *sax)
                 write_unlock(&ax25_uid_lock);
 
                 return 0;
-
+        }
         case SIOCAX25DELUID:
                 if (!capable(CAP_NET_ADMIN))
                         return -EPERM;
@@ -172,7 +177,9 @@ static int ax25_uid_seq_show(struct seq_file *seq, void *v)
                 struct ax25_uid_assoc *pt;
 
                 pt = hlist_entry(v, struct ax25_uid_assoc, uid_node);
-                seq_printf(seq, "%6d %s\n", pt->uid, ax2asc(buf, &pt->call));
+                seq_printf(seq, "%6d %s\n",
+                        from_kuid_munged(seq_user_ns(seq), pt->uid),
+                        ax2asc(buf, &pt->call));
         }
         return 0;
 }
diff --git a/net/batman-adv/bat_iv_ogm.c b/net/batman-adv/bat_iv_ogm.c
index e877af8bdd1e..df79300dcb7b 100644
--- a/net/batman-adv/bat_iv_ogm.c
+++ b/net/batman-adv/bat_iv_ogm.c
@@ -166,13 +166,15 @@ static void batadv_iv_ogm_send_to_if(struct batadv_forw_packet *forw_packet,
         int16_t buff_pos;
         struct batadv_ogm_packet *batadv_ogm_packet;
         struct sk_buff *skb;
+        uint8_t *packet_pos;
 
         if (hard_iface->if_status != BATADV_IF_ACTIVE)
                 return;
 
         packet_num = 0;
         buff_pos = 0;
-        batadv_ogm_packet = (struct batadv_ogm_packet *)forw_packet->skb->data;
+        packet_pos = forw_packet->skb->data;
+        batadv_ogm_packet = (struct batadv_ogm_packet *)packet_pos;
 
         /* adjust all flags and log packets */
         while (batadv_iv_ogm_aggr_packet(buff_pos, forw_packet->packet_len,
@@ -181,15 +183,17 @@ static void batadv_iv_ogm_send_to_if(struct batadv_forw_packet *forw_packet,
                 /* we might have aggregated direct link packets with an
                  * ordinary base packet
                  */
-                if ((forw_packet->direct_link_flags & (1 << packet_num)) &&
-                    (forw_packet->if_incoming == hard_iface))
+                if (forw_packet->direct_link_flags & BIT(packet_num) &&
+                    forw_packet->if_incoming == hard_iface)
                         batadv_ogm_packet->flags |= BATADV_DIRECTLINK;
                 else
                         batadv_ogm_packet->flags &= ~BATADV_DIRECTLINK;
 
-                fwd_str = (packet_num > 0 ? "Forwarding" : (forw_packet->own ?
-                                                            "Sending own" :
-                                                            "Forwarding"));
+                if (packet_num > 0 || !forw_packet->own)
+                        fwd_str = "Forwarding";
+                else
+                        fwd_str = "Sending own";
+
                 batadv_dbg(BATADV_DBG_BATMAN, bat_priv,
                            "%s %spacket (originator %pM, seqno %u, TQ %d, TTL %d, IDF %s, ttvn %d) on interface %s [%pM]\n",
                            fwd_str, (packet_num > 0 ? "aggregated " : ""),
@@ -204,8 +208,8 @@ static void batadv_iv_ogm_send_to_if(struct batadv_forw_packet *forw_packet,
                 buff_pos += BATADV_OGM_HLEN;
                 buff_pos += batadv_tt_len(batadv_ogm_packet->tt_num_changes);
                 packet_num++;
-                batadv_ogm_packet = (struct batadv_ogm_packet *)
-                                        (forw_packet->skb->data + buff_pos);
+                packet_pos = forw_packet->skb->data + buff_pos;
+                batadv_ogm_packet = (struct batadv_ogm_packet *)packet_pos;
         }
 
         /* create clone because function is called more than once */
@@ -227,9 +231,10 @@ static void batadv_iv_ogm_emit(struct batadv_forw_packet *forw_packet)
         struct batadv_hard_iface *primary_if = NULL;
         struct batadv_ogm_packet *batadv_ogm_packet;
         unsigned char directlink;
+        uint8_t *packet_pos;
 
-        batadv_ogm_packet = (struct batadv_ogm_packet *)
-                                                (forw_packet->skb->data);
+        packet_pos = forw_packet->skb->data;
+        batadv_ogm_packet = (struct batadv_ogm_packet *)packet_pos;
         directlink = (batadv_ogm_packet->flags & BATADV_DIRECTLINK ? 1 : 0);
 
         if (!forw_packet->if_incoming) {
@@ -454,6 +459,7 @@ static void batadv_iv_ogm_aggregate(struct batadv_forw_packet *forw_packet_aggr,
                                     int packet_len, bool direct_link)
 {
         unsigned char *skb_buff;
+        unsigned long new_direct_link_flag;
 
         skb_buff = skb_put(forw_packet_aggr->skb, packet_len);
         memcpy(skb_buff, packet_buff, packet_len);
@@ -461,9 +467,10 @@ static void batadv_iv_ogm_aggregate(struct batadv_forw_packet *forw_packet_aggr,
         forw_packet_aggr->num_packets++;
 
         /* save packet direct link flag status */
-        if (direct_link)
-                forw_packet_aggr->direct_link_flags |=
-                        (1 << forw_packet_aggr->num_packets);
+        if (direct_link) {
+                new_direct_link_flag = BIT(forw_packet_aggr->num_packets);
+                forw_packet_aggr->direct_link_flags |= new_direct_link_flag;
+        }
 }
 
 static void batadv_iv_ogm_queue_add(struct batadv_priv *bat_priv,
@@ -586,6 +593,8 @@ static void batadv_iv_ogm_schedule(struct batadv_hard_iface *hard_iface)
         struct batadv_ogm_packet *batadv_ogm_packet;
         struct batadv_hard_iface *primary_if;
         int vis_server, tt_num_changes = 0;
+        uint32_t seqno;
+        uint8_t bandwidth;
 
         vis_server = atomic_read(&bat_priv->vis_mode);
         primary_if = batadv_primary_if_get_selected(bat_priv);
@@ -599,12 +608,12 @@ static void batadv_iv_ogm_schedule(struct batadv_hard_iface *hard_iface)
         batadv_ogm_packet = (struct batadv_ogm_packet *)hard_iface->packet_buff;
 
         /* change sequence number to network order */
-        batadv_ogm_packet->seqno =
-                        htonl((uint32_t)atomic_read(&hard_iface->seqno));
+        seqno = (uint32_t)atomic_read(&hard_iface->seqno);
+        batadv_ogm_packet->seqno = htonl(seqno);
         atomic_inc(&hard_iface->seqno);
 
-        batadv_ogm_packet->ttvn = atomic_read(&bat_priv->ttvn);
-        batadv_ogm_packet->tt_crc = htons(bat_priv->tt_crc);
+        batadv_ogm_packet->ttvn = atomic_read(&bat_priv->tt.vn);
+        batadv_ogm_packet->tt_crc = htons(bat_priv->tt.local_crc);
         if (tt_num_changes >= 0)
                 batadv_ogm_packet->tt_num_changes = tt_num_changes;
 
@@ -613,12 +622,13 @@ static void batadv_iv_ogm_schedule(struct batadv_hard_iface *hard_iface)
         else
                 batadv_ogm_packet->flags &= ~BATADV_VIS_SERVER;
 
-        if ((hard_iface == primary_if) &&
-            (atomic_read(&bat_priv->gw_mode) == BATADV_GW_MODE_SERVER))
-                batadv_ogm_packet->gw_flags =
-                                (uint8_t)atomic_read(&bat_priv->gw_bandwidth);
-        else
+        if (hard_iface == primary_if &&
+            atomic_read(&bat_priv->gw_mode) == BATADV_GW_MODE_SERVER) {
+                bandwidth = (uint8_t)atomic_read(&bat_priv->gw_bandwidth);
+                batadv_ogm_packet->gw_flags = bandwidth;
+        } else {
                 batadv_ogm_packet->gw_flags = BATADV_NO_FLAGS;
+        }
 
         batadv_slide_own_bcast_window(hard_iface);
         batadv_iv_ogm_queue_add(bat_priv, hard_iface->packet_buff,
@@ -642,8 +652,9 @@ batadv_iv_ogm_orig_update(struct batadv_priv *bat_priv,
         struct batadv_neigh_node *router = NULL;
         struct batadv_orig_node *orig_node_tmp;
         struct hlist_node *node;
-        uint8_t bcast_own_sum_orig, bcast_own_sum_neigh;
+        uint8_t sum_orig, sum_neigh;
         uint8_t *neigh_addr;
+        uint8_t tq_avg;
 
         batadv_dbg(BATADV_DBG_BATMAN, bat_priv,
                    "update_originator(): Searching and updating originator entry of received packet\n");
@@ -667,8 +678,8 @@ batadv_iv_ogm_orig_update(struct batadv_priv *bat_priv,
                 spin_lock_bh(&tmp_neigh_node->lq_update_lock);
                 batadv_ring_buffer_set(tmp_neigh_node->tq_recv,
                                        &tmp_neigh_node->tq_index, 0);
-                tmp_neigh_node->tq_avg =
-                        batadv_ring_buffer_avg(tmp_neigh_node->tq_recv);
+                tq_avg = batadv_ring_buffer_avg(tmp_neigh_node->tq_recv);
+                tmp_neigh_node->tq_avg = tq_avg;
                 spin_unlock_bh(&tmp_neigh_node->lq_update_lock);
         }
 
@@ -727,17 +738,15 @@ batadv_iv_ogm_orig_update(struct batadv_priv *bat_priv,
         if (router && (neigh_node->tq_avg == router->tq_avg)) {
                 orig_node_tmp = router->orig_node;
                 spin_lock_bh(&orig_node_tmp->ogm_cnt_lock);
-                bcast_own_sum_orig =
-                        orig_node_tmp->bcast_own_sum[if_incoming->if_num];
+                sum_orig = orig_node_tmp->bcast_own_sum[if_incoming->if_num];
                 spin_unlock_bh(&orig_node_tmp->ogm_cnt_lock);
 
                 orig_node_tmp = neigh_node->orig_node;
                 spin_lock_bh(&orig_node_tmp->ogm_cnt_lock);
-                bcast_own_sum_neigh =
-                        orig_node_tmp->bcast_own_sum[if_incoming->if_num];
+                sum_neigh = orig_node_tmp->bcast_own_sum[if_incoming->if_num];
                 spin_unlock_bh(&orig_node_tmp->ogm_cnt_lock);
 
-                if (bcast_own_sum_orig >= bcast_own_sum_neigh)
+                if (sum_orig >= sum_neigh)
                         goto update_tt;
         }
 
@@ -835,8 +844,10 @@ static int batadv_iv_ogm_calc_tq(struct batadv_orig_node *orig_node,
         spin_unlock_bh(&orig_node->ogm_cnt_lock);
 
         /* pay attention to not get a value bigger than 100 % */
-        total_count = (orig_eq_count > neigh_rq_count ?
-                       neigh_rq_count : orig_eq_count);
+        if (orig_eq_count > neigh_rq_count)
+                total_count = neigh_rq_count;
+        else
+                total_count = orig_eq_count;
 
         /* if we have too few packets (too less data) we set tq_own to zero
          * if we receive too few packets it is not considered bidirectional
@@ -910,6 +921,7 @@ batadv_iv_ogm_update_seqnos(const struct ethhdr *ethhdr,
         int set_mark, ret = -1;
         uint32_t seqno = ntohl(batadv_ogm_packet->seqno);
         uint8_t *neigh_addr;
+        uint8_t packet_count;
 
         orig_node = batadv_get_orig_node(bat_priv, batadv_ogm_packet->orig);
         if (!orig_node)
@@ -944,9 +956,9 @@ batadv_iv_ogm_update_seqnos(const struct ethhdr *ethhdr,
                                                      tmp_neigh_node->real_bits,
                                                      seq_diff, set_mark);
 
-                tmp_neigh_node->real_packet_count =
-                        bitmap_weight(tmp_neigh_node->real_bits,
-                                      BATADV_TQ_LOCAL_WINDOW_SIZE);
+                packet_count = bitmap_weight(tmp_neigh_node->real_bits,
+                                             BATADV_TQ_LOCAL_WINDOW_SIZE);
+                tmp_neigh_node->real_packet_count = packet_count;
         }
         rcu_read_unlock();
 
@@ -1163,9 +1175,12 @@ static void batadv_iv_ogm_process(const struct ethhdr *ethhdr,
         /* if sender is a direct neighbor the sender mac equals
          * originator mac
          */
-        orig_neigh_node = (is_single_hop_neigh ?
-                           orig_node :
-                           batadv_get_orig_node(bat_priv, ethhdr->h_source));
+        if (is_single_hop_neigh)
+                orig_neigh_node = orig_node;
+        else
+                orig_neigh_node = batadv_get_orig_node(bat_priv,
+                                                       ethhdr->h_source);
+
         if (!orig_neigh_node)
                 goto out;
 
@@ -1251,6 +1266,7 @@ static int batadv_iv_ogm_receive(struct sk_buff *skb,
         int buff_pos = 0, packet_len;
         unsigned char *tt_buff, *packet_buff;
         bool ret;
+        uint8_t *packet_pos;
 
         ret = batadv_check_management_packet(skb, if_incoming, BATADV_OGM_HLEN);
         if (!ret)
@@ -1281,8 +1297,8 @@ static int batadv_iv_ogm_receive(struct sk_buff *skb,
                 buff_pos += BATADV_OGM_HLEN;
                 buff_pos += batadv_tt_len(batadv_ogm_packet->tt_num_changes);
 
-                batadv_ogm_packet = (struct batadv_ogm_packet *)
-                                                (packet_buff + buff_pos);
+                packet_pos = packet_buff + buff_pos;
+                batadv_ogm_packet = (struct batadv_ogm_packet *)packet_pos;
         } while (batadv_iv_ogm_aggr_packet(buff_pos, packet_len,
                                            batadv_ogm_packet->tt_num_changes));
 
diff --git a/net/batman-adv/bridge_loop_avoidance.c b/net/batman-adv/bridge_loop_avoidance.c
index 6705d35b17ce..0a9084ad19a6 100644
--- a/net/batman-adv/bridge_loop_avoidance.c
+++ b/net/batman-adv/bridge_loop_avoidance.c
@@ -133,7 +133,7 @@ static void batadv_claim_free_ref(struct batadv_claim *claim)
 static struct batadv_claim *batadv_claim_hash_find(struct batadv_priv *bat_priv,
                                                    struct batadv_claim *data)
 {
-        struct batadv_hashtable *hash = bat_priv->claim_hash;
+        struct batadv_hashtable *hash = bat_priv->bla.claim_hash;
         struct hlist_head *head;
         struct hlist_node *node;
         struct batadv_claim *claim;
@@ -174,7 +174,7 @@ static struct batadv_backbone_gw *
 batadv_backbone_hash_find(struct batadv_priv *bat_priv,
                           uint8_t *addr, short vid)
 {
-        struct batadv_hashtable *hash = bat_priv->backbone_hash;
+        struct batadv_hashtable *hash = bat_priv->bla.backbone_hash;
         struct hlist_head *head;
         struct hlist_node *node;
         struct batadv_backbone_gw search_entry, *backbone_gw;
@@ -218,7 +218,7 @@ batadv_bla_del_backbone_claims(struct batadv_backbone_gw *backbone_gw)
         int i;
         spinlock_t *list_lock;  /* protects write access to the hash lists */
 
-        hash = backbone_gw->bat_priv->claim_hash;
+        hash = backbone_gw->bat_priv->bla.claim_hash;
         if (!hash)
                 return;
 
@@ -265,7 +265,7 @@ static void batadv_bla_send_claim(struct batadv_priv *bat_priv, uint8_t *mac,
         if (!primary_if)
                 return;
 
-        memcpy(&local_claim_dest, &bat_priv->claim_dest,
+        memcpy(&local_claim_dest, &bat_priv->bla.claim_dest,
                sizeof(local_claim_dest));
         local_claim_dest.type = claimtype;
 
@@ -281,7 +281,7 @@ static void batadv_bla_send_claim(struct batadv_priv *bat_priv, uint8_t *mac,
                          NULL,
                          /* Ethernet SRC/HW SRC:  originator mac */
                          primary_if->net_dev->dev_addr,
-                         /* HW DST: FF:43:05:XX:00:00
+                         /* HW DST: FF:43:05:XX:YY:YY
                           * with XX   = claim type
                           * and YY:YY = group id
                           */
@@ -295,7 +295,7 @@ static void batadv_bla_send_claim(struct batadv_priv *bat_priv, uint8_t *mac,
 
         /* now we pretend that the client would have sent this ... */
         switch (claimtype) {
-        case BATADV_CLAIM_TYPE_ADD:
+        case BATADV_CLAIM_TYPE_CLAIM:
                 /* normal claim frame
                  * set Ethernet SRC to the clients mac
                  */
@@ -303,7 +303,7 @@ static void batadv_bla_send_claim(struct batadv_priv *bat_priv, uint8_t *mac,
                 batadv_dbg(BATADV_DBG_BLA, bat_priv,
                            "bla_send_claim(): CLAIM %pM on vid %d\n", mac, vid);
                 break;
-        case BATADV_CLAIM_TYPE_DEL:
+        case BATADV_CLAIM_TYPE_UNCLAIM:
                 /* unclaim frame
                  * set HW SRC to the clients mac
                  */
@@ -323,7 +323,8 @@ static void batadv_bla_send_claim(struct batadv_priv *bat_priv, uint8_t *mac,
                 break;
         case BATADV_CLAIM_TYPE_REQUEST:
                 /* request frame
-                 * set HW SRC to the special mac containg the crc
+                 * set HW SRC and header destination to the receiving backbone
+                 * gws mac
                  */
                 memcpy(hw_src, mac, ETH_ALEN);
                 memcpy(ethhdr->h_dest, mac, ETH_ALEN);
@@ -339,8 +340,9 @@ static void batadv_bla_send_claim(struct batadv_priv *bat_priv, uint8_t *mac,
 
         skb_reset_mac_header(skb);
         skb->protocol = eth_type_trans(skb, soft_iface);
-        bat_priv->stats.rx_packets++;
-        bat_priv->stats.rx_bytes += skb->len + ETH_HLEN;
+        batadv_inc_counter(bat_priv, BATADV_CNT_RX);
+        batadv_add_counter(bat_priv, BATADV_CNT_RX_BYTES,
+                           skb->len + ETH_HLEN);
         soft_iface->last_rx = jiffies;
 
         netif_rx(skb);
@@ -389,7 +391,7 @@ batadv_bla_get_backbone_gw(struct batadv_priv *bat_priv, uint8_t *orig,
         /* one for the hash, one for returning */
         atomic_set(&entry->refcount, 2);
 
-        hash_added = batadv_hash_add(bat_priv->backbone_hash,
+        hash_added = batadv_hash_add(bat_priv->bla.backbone_hash,
                                      batadv_compare_backbone_gw,
                                      batadv_choose_backbone_gw, entry,
                                      &entry->hash_entry);
@@ -456,7 +458,7 @@ static void batadv_bla_answer_request(struct batadv_priv *bat_priv,
         if (!backbone_gw)
                 return;
 
-        hash = bat_priv->claim_hash;
+        hash = bat_priv->bla.claim_hash;
         for (i = 0; i < hash->size; i++) {
                 head = &hash->table[i];
 
@@ -467,7 +469,7 @@ static void batadv_bla_answer_request(struct batadv_priv *bat_priv,
                                 continue;
 
                         batadv_bla_send_claim(bat_priv, claim->addr, claim->vid,
-                                              BATADV_CLAIM_TYPE_ADD);
+                                              BATADV_CLAIM_TYPE_CLAIM);
                 }
                 rcu_read_unlock();
         }
@@ -497,7 +499,7 @@ static void batadv_bla_send_request(struct batadv_backbone_gw *backbone_gw)
 
         /* no local broadcasts should be sent or received, for now. */
         if (!atomic_read(&backbone_gw->request_sent)) {
-                atomic_inc(&backbone_gw->bat_priv->bla_num_requests);
+                atomic_inc(&backbone_gw->bat_priv->bla.num_requests);
                 atomic_set(&backbone_gw->request_sent, 1);
         }
 }
@@ -557,7 +559,7 @@ static void batadv_bla_add_claim(struct batadv_priv *bat_priv,
                 batadv_dbg(BATADV_DBG_BLA, bat_priv,
                            "bla_add_claim(): adding new entry %pM, vid %d to hash ...\n",
                            mac, vid);
-                hash_added = batadv_hash_add(bat_priv->claim_hash,
+                hash_added = batadv_hash_add(bat_priv->bla.claim_hash,
                                              batadv_compare_claim,
                                              batadv_choose_claim, claim,
                                              &claim->hash_entry);
@@ -577,8 +579,7 @@ static void batadv_bla_add_claim(struct batadv_priv *bat_priv,
                            "bla_add_claim(): changing ownership for %pM, vid %d\n",
                            mac, vid);
 
-                claim->backbone_gw->crc ^=
-                        crc16(0, claim->addr, ETH_ALEN);
+                claim->backbone_gw->crc ^= crc16(0, claim->addr, ETH_ALEN);
                 batadv_backbone_gw_free_ref(claim->backbone_gw);
 
         }
@@ -610,7 +611,7 @@ static void batadv_bla_del_claim(struct batadv_priv *bat_priv,
         batadv_dbg(BATADV_DBG_BLA, bat_priv, "bla_del_claim(): %pM, vid %d\n",
                    mac, vid);
 
-        batadv_hash_remove(bat_priv->claim_hash, batadv_compare_claim,
+        batadv_hash_remove(bat_priv->bla.claim_hash, batadv_compare_claim,
                            batadv_choose_claim, claim);
         batadv_claim_free_ref(claim); /* reference from the hash is gone */
 
@@ -657,7 +658,7 @@ static int batadv_handle_announce(struct batadv_priv *bat_priv,
                  * we can allow traffic again.
                  */
                 if (atomic_read(&backbone_gw->request_sent)) {
-                        atomic_dec(&backbone_gw->bat_priv->bla_num_requests);
+                        atomic_dec(&backbone_gw->bat_priv->bla.num_requests);
                         atomic_set(&backbone_gw->request_sent, 0);
                 }
         }
@@ -702,7 +703,7 @@ static int batadv_handle_unclaim(struct batadv_priv *bat_priv,
         if (primary_if && batadv_compare_eth(backbone_addr,
                                              primary_if->net_dev->dev_addr))
                 batadv_bla_send_claim(bat_priv, claim_addr, vid,
-                                      BATADV_CLAIM_TYPE_DEL);
+                                      BATADV_CLAIM_TYPE_UNCLAIM);
 
         backbone_gw = batadv_backbone_hash_find(bat_priv, backbone_addr, vid);
 
@@ -738,7 +739,7 @@ static int batadv_handle_claim(struct batadv_priv *bat_priv,
         batadv_bla_add_claim(bat_priv, claim_addr, vid, backbone_gw);
         if (batadv_compare_eth(backbone_addr, primary_if->net_dev->dev_addr))
                 batadv_bla_send_claim(bat_priv, claim_addr, vid,
-                                      BATADV_CLAIM_TYPE_ADD);
+                                      BATADV_CLAIM_TYPE_CLAIM);
 
         /* TODO: we could call something like tt_local_del() here. */
 
@@ -772,7 +773,7 @@ static int batadv_check_claim_group(struct batadv_priv *bat_priv,
         struct batadv_bla_claim_dst *bla_dst, *bla_dst_own;
 
         bla_dst = (struct batadv_bla_claim_dst *)hw_dst;
-        bla_dst_own = &bat_priv->claim_dest;
+        bla_dst_own = &bat_priv->bla.claim_dest;
 
         /* check if it is a claim packet in general */
         if (memcmp(bla_dst->magic, bla_dst_own->magic,
@@ -783,12 +784,12 @@ static int batadv_check_claim_group(struct batadv_priv *bat_priv,
          * otherwise assume it is in the hw_src
          */
         switch (bla_dst->type) {
-        case BATADV_CLAIM_TYPE_ADD:
+        case BATADV_CLAIM_TYPE_CLAIM:
                 backbone_addr = hw_src;
                 break;
         case BATADV_CLAIM_TYPE_REQUEST:
         case BATADV_CLAIM_TYPE_ANNOUNCE:
-        case BATADV_CLAIM_TYPE_DEL:
+        case BATADV_CLAIM_TYPE_UNCLAIM:
                 backbone_addr = ethhdr->h_source;
                 break;
         default:
@@ -904,12 +905,12 @@ static int batadv_bla_process_claim(struct batadv_priv *bat_priv,
 
         /* check for the different types of claim frames ... */
         switch (bla_dst->type) {
-        case BATADV_CLAIM_TYPE_ADD:
+        case BATADV_CLAIM_TYPE_CLAIM:
                 if (batadv_handle_claim(bat_priv, primary_if, hw_src,
                                         ethhdr->h_source, vid))
                         return 1;
                 break;
-        case BATADV_CLAIM_TYPE_DEL:
+        case BATADV_CLAIM_TYPE_UNCLAIM:
                 if (batadv_handle_unclaim(bat_priv, primary_if,
                                           ethhdr->h_source, hw_src, vid))
                         return 1;
@@ -945,7 +946,7 @@ static void batadv_bla_purge_backbone_gw(struct batadv_priv *bat_priv, int now)
         spinlock_t *list_lock;  /* protects write access to the hash lists */
         int i;
 
-        hash = bat_priv->backbone_hash;
+        hash = bat_priv->bla.backbone_hash;
         if (!hash)
                 return;
 
@@ -969,7 +970,7 @@ static void batadv_bla_purge_backbone_gw(struct batadv_priv *bat_priv, int now)
 purge_now:
                         /* don't wait for the pending request anymore */
                         if (atomic_read(&backbone_gw->request_sent))
-                                atomic_dec(&bat_priv->bla_num_requests);
+                                atomic_dec(&bat_priv->bla.num_requests);
 
                         batadv_bla_del_backbone_claims(backbone_gw);
 
@@ -999,7 +1000,7 @@ static void batadv_bla_purge_claims(struct batadv_priv *bat_priv,
         struct batadv_hashtable *hash;
         int i;
 
-        hash = bat_priv->claim_hash;
+        hash = bat_priv->bla.claim_hash;
         if (!hash)
                 return;
 
@@ -1046,11 +1047,12 @@ void batadv_bla_update_orig_address(struct batadv_priv *bat_priv,
         struct hlist_node *node;
         struct hlist_head *head;
         struct batadv_hashtable *hash;
+        __be16 group;
         int i;
 
         /* reset bridge loop avoidance group id */
-        bat_priv->claim_dest.group =
-                htons(crc16(0, primary_if->net_dev->dev_addr, ETH_ALEN));
+        group = htons(crc16(0, primary_if->net_dev->dev_addr, ETH_ALEN));
+        bat_priv->bla.claim_dest.group = group;
 
         if (!oldif) {
                 batadv_bla_purge_claims(bat_priv, NULL, 1);
@@ -1058,7 +1060,7 @@ void batadv_bla_update_orig_address(struct batadv_priv *bat_priv,
                 return;
         }
 
-        hash = bat_priv->backbone_hash;
+        hash = bat_priv->bla.backbone_hash;
         if (!hash)
                 return;
 
@@ -1088,8 +1090,8 @@ void batadv_bla_update_orig_address(struct batadv_priv *bat_priv,
 /* (re)start the timer */
 static void batadv_bla_start_timer(struct batadv_priv *bat_priv)
 {
-        INIT_DELAYED_WORK(&bat_priv->bla_work, batadv_bla_periodic_work);
-        queue_delayed_work(batadv_event_workqueue, &bat_priv->bla_work,
+        INIT_DELAYED_WORK(&bat_priv->bla.work, batadv_bla_periodic_work);
+        queue_delayed_work(batadv_event_workqueue, &bat_priv->bla.work,
                            msecs_to_jiffies(BATADV_BLA_PERIOD_LENGTH));
 }
 
@@ -1099,9 +1101,9 @@ static void batadv_bla_start_timer(struct batadv_priv *bat_priv)
  */
 static void batadv_bla_periodic_work(struct work_struct *work)
 {
-        struct delayed_work *delayed_work =
-                container_of(work, struct delayed_work, work);
+        struct delayed_work *delayed_work;
         struct batadv_priv *bat_priv;
+        struct batadv_priv_bla *priv_bla;
         struct hlist_node *node;
         struct hlist_head *head;
         struct batadv_backbone_gw *backbone_gw;
@@ -1109,7 +1111,9 @@ static void batadv_bla_periodic_work(struct work_struct *work)
         struct batadv_hard_iface *primary_if;
         int i;
 
-        bat_priv = container_of(delayed_work, struct batadv_priv, bla_work);
+        delayed_work = container_of(work, struct delayed_work, work);
+        priv_bla = container_of(delayed_work, struct batadv_priv_bla, work);
+        bat_priv = container_of(priv_bla, struct batadv_priv, bla);
         primary_if = batadv_primary_if_get_selected(bat_priv);
         if (!primary_if)
                 goto out;
@@ -1120,7 +1124,7 @@ static void batadv_bla_periodic_work(struct work_struct *work)
         if (!atomic_read(&bat_priv->bridge_loop_avoidance))
                 goto out;
 
-        hash = bat_priv->backbone_hash;
+        hash = bat_priv->bla.backbone_hash;
         if (!hash)
                 goto out;
 
@@ -1160,40 +1164,41 @@ int batadv_bla_init(struct batadv_priv *bat_priv)
         int i;
         uint8_t claim_dest[ETH_ALEN] = {0xff, 0x43, 0x05, 0x00, 0x00, 0x00};
         struct batadv_hard_iface *primary_if;
+        uint16_t crc;
+        unsigned long entrytime;
 
         batadv_dbg(BATADV_DBG_BLA, bat_priv, "bla hash registering\n");
 
         /* setting claim destination address */
-        memcpy(&bat_priv->claim_dest.magic, claim_dest, 3);
-        bat_priv->claim_dest.type = 0;
+        memcpy(&bat_priv->bla.claim_dest.magic, claim_dest, 3);
+        bat_priv->bla.claim_dest.type = 0;
         primary_if = batadv_primary_if_get_selected(bat_priv);
         if (primary_if) {
-                bat_priv->claim_dest.group =
-                        htons(crc16(0, primary_if->net_dev->dev_addr,
-                                    ETH_ALEN));
+                crc = crc16(0, primary_if->net_dev->dev_addr, ETH_ALEN);
+                bat_priv->bla.claim_dest.group = htons(crc);
                 batadv_hardif_free_ref(primary_if);
         } else {
-                bat_priv->claim_dest.group = 0; /* will be set later */
+                bat_priv->bla.claim_dest.group = 0; /* will be set later */
         }
 
         /* initialize the duplicate list */
+        entrytime = jiffies - msecs_to_jiffies(BATADV_DUPLIST_TIMEOUT);
         for (i = 0; i < BATADV_DUPLIST_SIZE; i++)
-                bat_priv->bcast_duplist[i].entrytime =
-                        jiffies - msecs_to_jiffies(BATADV_DUPLIST_TIMEOUT);
-        bat_priv->bcast_duplist_curr = 0;
+                bat_priv->bla.bcast_duplist[i].entrytime = entrytime;
+        bat_priv->bla.bcast_duplist_curr = 0;
 
-        if (bat_priv->claim_hash)
+        if (bat_priv->bla.claim_hash)
                 return 0;
 
-        bat_priv->claim_hash = batadv_hash_new(128);
-        bat_priv->backbone_hash = batadv_hash_new(32);
+        bat_priv->bla.claim_hash = batadv_hash_new(128);
+        bat_priv->bla.backbone_hash = batadv_hash_new(32);
 
-        if (!bat_priv->claim_hash || !bat_priv->backbone_hash)
+        if (!bat_priv->bla.claim_hash || !bat_priv->bla.backbone_hash)
                 return -ENOMEM;
 
-        batadv_hash_set_lock_class(bat_priv->claim_hash,
+        batadv_hash_set_lock_class(bat_priv->bla.claim_hash,
                                    &batadv_claim_hash_lock_class_key);
-        batadv_hash_set_lock_class(bat_priv->backbone_hash,
+        batadv_hash_set_lock_class(bat_priv->bla.backbone_hash,
                                    &batadv_backbone_hash_lock_class_key);
 
         batadv_dbg(BATADV_DBG_BLA, bat_priv, "bla hashes initialized\n");
@@ -1234,8 +1239,9 @@ int batadv_bla_check_bcast_duplist(struct batadv_priv *bat_priv,
         crc = crc16(0, content, length);
 
         for (i = 0; i < BATADV_DUPLIST_SIZE; i++) {
-                curr = (bat_priv->bcast_duplist_curr + i) % BATADV_DUPLIST_SIZE;
-                entry = &bat_priv->bcast_duplist[curr];
+                curr = (bat_priv->bla.bcast_duplist_curr + i);
+                curr %= BATADV_DUPLIST_SIZE;
+                entry = &bat_priv->bla.bcast_duplist[curr];
 
                 /* we can stop searching if the entry is too old ;
                  * later entries will be even older
@@ -1256,13 +1262,13 @@ int batadv_bla_check_bcast_duplist(struct batadv_priv *bat_priv,
                 return 1;
         }
         /* not found, add a new entry (overwrite the oldest entry) */
-        curr = (bat_priv->bcast_duplist_curr + BATADV_DUPLIST_SIZE - 1);
+        curr = (bat_priv->bla.bcast_duplist_curr + BATADV_DUPLIST_SIZE - 1);
         curr %= BATADV_DUPLIST_SIZE;
-        entry = &bat_priv->bcast_duplist[curr];
+        entry = &bat_priv->bla.bcast_duplist[curr];
         entry->crc = crc;
         entry->entrytime = jiffies;
         memcpy(entry->orig, bcast_packet->orig, ETH_ALEN);
-        bat_priv->bcast_duplist_curr = curr;
+        bat_priv->bla.bcast_duplist_curr = curr;
 
         /* allow it, its the first occurence. */
         return 0;
@@ -1279,7 +1285,7 @@ int batadv_bla_check_bcast_duplist(struct batadv_priv *bat_priv,
  */
 int batadv_bla_is_backbone_gw_orig(struct batadv_priv *bat_priv, uint8_t *orig)
 {
-        struct batadv_hashtable *hash = bat_priv->backbone_hash;
+        struct batadv_hashtable *hash = bat_priv->bla.backbone_hash;
         struct hlist_head *head;
         struct hlist_node *node;
         struct batadv_backbone_gw *backbone_gw;
@@ -1339,8 +1345,7 @@ int batadv_bla_is_backbone_gw(struct sk_buff *skb,
                 if (!pskb_may_pull(skb, hdr_size + sizeof(struct vlan_ethhdr)))
                         return 0;
 
-                vhdr = (struct vlan_ethhdr *)(((uint8_t *)skb->data) +
-                                              hdr_size);
+                vhdr = (struct vlan_ethhdr *)(skb->data + hdr_size);
                 vid = ntohs(vhdr->h_vlan_TCI) & VLAN_VID_MASK;
         }
 
@@ -1359,18 +1364,18 @@ void batadv_bla_free(struct batadv_priv *bat_priv)
 {
         struct batadv_hard_iface *primary_if;
 
-        cancel_delayed_work_sync(&bat_priv->bla_work);
+        cancel_delayed_work_sync(&bat_priv->bla.work);
         primary_if = batadv_primary_if_get_selected(bat_priv);
 
-        if (bat_priv->claim_hash) {
+        if (bat_priv->bla.claim_hash) {
                 batadv_bla_purge_claims(bat_priv, primary_if, 1);
-                batadv_hash_destroy(bat_priv->claim_hash);
-                bat_priv->claim_hash = NULL;
+                batadv_hash_destroy(bat_priv->bla.claim_hash);
+                bat_priv->bla.claim_hash = NULL;
         }
-        if (bat_priv->backbone_hash) {
+        if (bat_priv->bla.backbone_hash) {
                 batadv_bla_purge_backbone_gw(bat_priv, 1);
-                batadv_hash_destroy(bat_priv->backbone_hash);
-                bat_priv->backbone_hash = NULL;
+                batadv_hash_destroy(bat_priv->bla.backbone_hash);
+                bat_priv->bla.backbone_hash = NULL;
         }
         if (primary_if)
                 batadv_hardif_free_ref(primary_if);
@@ -1409,7 +1414,7 @@ int batadv_bla_rx(struct batadv_priv *bat_priv, struct sk_buff *skb, short vid,
                 goto allow;
 
 
-        if (unlikely(atomic_read(&bat_priv->bla_num_requests)))
+        if (unlikely(atomic_read(&bat_priv->bla.num_requests)))
                 /* don't allow broadcasts while requests are in flight */
                 if (is_multicast_ether_addr(ethhdr->h_dest) && is_bcast)
                         goto handled;
@@ -1508,7 +1513,7 @@ int batadv_bla_tx(struct batadv_priv *bat_priv, struct sk_buff *skb, short vid)
 
         ethhdr = (struct ethhdr *)skb_mac_header(skb);
 
-        if (unlikely(atomic_read(&bat_priv->bla_num_requests)))
+        if (unlikely(atomic_read(&bat_priv->bla.num_requests)))
                 /* don't allow broadcasts while requests are in flight */
                 if (is_multicast_ether_addr(ethhdr->h_dest))
                         goto handled;
@@ -1564,7 +1569,7 @@ int batadv_bla_claim_table_seq_print_text(struct seq_file *seq, void *offset)
 {
         struct net_device *net_dev = (struct net_device *)seq->private;
         struct batadv_priv *bat_priv = netdev_priv(net_dev);
-        struct batadv_hashtable *hash = bat_priv->claim_hash;
+        struct batadv_hashtable *hash = bat_priv->bla.claim_hash;
         struct batadv_claim *claim;
         struct batadv_hard_iface *primary_if;
         struct hlist_node *node;
@@ -1593,7 +1598,7 @@ int batadv_bla_claim_table_seq_print_text(struct seq_file *seq, void *offset)
         seq_printf(seq,
                    "Claims announced for the mesh %s (orig %pM, group id %04x)\n",
                    net_dev->name, primary_addr,
-                   ntohs(bat_priv->claim_dest.group));
+                   ntohs(bat_priv->bla.claim_dest.group));
         seq_printf(seq, "   %-17s    %-5s    %-17s [o] (%-4s)\n",
                    "Client", "VID", "Originator", "CRC");
         for (i = 0; i < hash->size; i++) {
@@ -1616,3 +1621,68 @@ out:
                 batadv_hardif_free_ref(primary_if);
         return ret;
 }
+
+int batadv_bla_backbone_table_seq_print_text(struct seq_file *seq, void *offset)
+{
+        struct net_device *net_dev = (struct net_device *)seq->private;
+        struct batadv_priv *bat_priv = netdev_priv(net_dev);
+        struct batadv_hashtable *hash = bat_priv->bla.backbone_hash;
+        struct batadv_backbone_gw *backbone_gw;
+        struct batadv_hard_iface *primary_if;
+        struct hlist_node *node;
+        struct hlist_head *head;
+        int secs, msecs;
+        uint32_t i;
+        bool is_own;
+        int ret = 0;
+        uint8_t *primary_addr;
+
+        primary_if = batadv_primary_if_get_selected(bat_priv);
+        if (!primary_if) {
+                ret = seq_printf(seq,
+                                 "BATMAN mesh %s disabled - please specify interfaces to enable it\n",
+                                 net_dev->name);
+                goto out;
+        }
+
+        if (primary_if->if_status != BATADV_IF_ACTIVE) {
+                ret = seq_printf(seq,
+                                 "BATMAN mesh %s disabled - primary interface not active\n",
+                                 net_dev->name);
+                goto out;
+        }
+
+        primary_addr = primary_if->net_dev->dev_addr;
+        seq_printf(seq,
+                   "Backbones announced for the mesh %s (orig %pM, group id %04x)\n",
+                   net_dev->name, primary_addr,
+                   ntohs(bat_priv->bla.claim_dest.group));
+        seq_printf(seq, "   %-17s    %-5s %-9s (%-4s)\n",
+                   "Originator", "VID", "last seen", "CRC");
+        for (i = 0; i < hash->size; i++) {
+                head = &hash->table[i];
+
+                rcu_read_lock();
+                hlist_for_each_entry_rcu(backbone_gw, node, head, hash_entry) {
+                        msecs = jiffies_to_msecs(jiffies -
+                                                 backbone_gw->lasttime);
+                        secs = msecs / 1000;
+                        msecs = msecs % 1000;
+
+                        is_own = batadv_compare_eth(backbone_gw->orig,
+                                                    primary_addr);
+                        if (is_own)
+                                continue;
+
+                        seq_printf(seq,
+                                   " * %pM on % 5d % 4i.%03is (%04x)\n",
+                                   backbone_gw->orig, backbone_gw->vid,
+                                   secs, msecs, backbone_gw->crc);
+                }
+                rcu_read_unlock();
+        }
+out:
+        if (primary_if)
+                batadv_hardif_free_ref(primary_if);
+        return ret;
+}
diff --git a/net/batman-adv/bridge_loop_avoidance.h b/net/batman-adv/bridge_loop_avoidance.h
index 563cfbf94a7f..789cb73bde67 100644
--- a/net/batman-adv/bridge_loop_avoidance.h
+++ b/net/batman-adv/bridge_loop_avoidance.h
@@ -27,6 +27,8 @@ int batadv_bla_tx(struct batadv_priv *bat_priv, struct sk_buff *skb, short vid);
 int batadv_bla_is_backbone_gw(struct sk_buff *skb,
                               struct batadv_orig_node *orig_node, int hdr_size);
 int batadv_bla_claim_table_seq_print_text(struct seq_file *seq, void *offset);
+int batadv_bla_backbone_table_seq_print_text(struct seq_file *seq,
+                                             void *offset);
 int batadv_bla_is_backbone_gw_orig(struct batadv_priv *bat_priv, uint8_t *orig);
 int batadv_bla_check_bcast_duplist(struct batadv_priv *bat_priv,
                                    struct batadv_bcast_packet *bcast_packet,
@@ -41,8 +43,7 @@ void batadv_bla_free(struct batadv_priv *bat_priv);
 #else /* ifdef CONFIG_BATMAN_ADV_BLA */
 
 static inline int batadv_bla_rx(struct batadv_priv *bat_priv,
-                                struct sk_buff *skb, short vid,
-                                bool is_bcast)
+                                struct sk_buff *skb, short vid, bool is_bcast)
 {
         return 0;
 }
@@ -66,6 +67,12 @@ static inline int batadv_bla_claim_table_seq_print_text(struct seq_file *seq,
         return 0;
 }
 
+static inline int batadv_bla_backbone_table_seq_print_text(struct seq_file *seq,
+                                                           void *offset)
+{
+        return 0;
+}
+
 static inline int batadv_bla_is_backbone_gw_orig(struct batadv_priv *bat_priv,
                                                  uint8_t *orig)
 {
diff --git a/net/batman-adv/debugfs.c b/net/batman-adv/debugfs.c
index 34fbb1667bcd..391d4fb2026f 100644
--- a/net/batman-adv/debugfs.c
+++ b/net/batman-adv/debugfs.c
@@ -267,6 +267,15 @@ static int batadv_bla_claim_table_open(struct inode *inode, struct file *file)
         return single_open(file, batadv_bla_claim_table_seq_print_text,
                            net_dev);
 }
+
+static int batadv_bla_backbone_table_open(struct inode *inode,
+                                          struct file *file)
+{
+        struct net_device *net_dev = (struct net_device *)inode->i_private;
+        return single_open(file, batadv_bla_backbone_table_seq_print_text,
+                           net_dev);
+}
+
 #endif
 
 static int batadv_transtable_local_open(struct inode *inode, struct file *file)
@@ -305,6 +314,8 @@ static BATADV_DEBUGINFO(transtable_global, S_IRUGO,
                         batadv_transtable_global_open);
 #ifdef CONFIG_BATMAN_ADV_BLA
 static BATADV_DEBUGINFO(bla_claim_table, S_IRUGO, batadv_bla_claim_table_open);
+static BATADV_DEBUGINFO(bla_backbone_table, S_IRUGO,
+                        batadv_bla_backbone_table_open);
 #endif
 static BATADV_DEBUGINFO(transtable_local, S_IRUGO,
                         batadv_transtable_local_open);
@@ -316,6 +327,7 @@ static struct batadv_debuginfo *batadv_mesh_debuginfos[] = {
         &batadv_debuginfo_transtable_global,
 #ifdef CONFIG_BATMAN_ADV_BLA
         &batadv_debuginfo_bla_claim_table,
+        &batadv_debuginfo_bla_backbone_table,
 #endif
         &batadv_debuginfo_transtable_local,
         &batadv_debuginfo_vis_data,
diff --git a/net/batman-adv/gateway_client.c b/net/batman-adv/gateway_client.c
index b421cc49d2cd..15d67abc10a4 100644
--- a/net/batman-adv/gateway_client.c
+++ b/net/batman-adv/gateway_client.c
@@ -48,7 +48,7 @@ batadv_gw_get_selected_gw_node(struct batadv_priv *bat_priv)
         struct batadv_gw_node *gw_node;
 
         rcu_read_lock();
-        gw_node = rcu_dereference(bat_priv->curr_gw);
+        gw_node = rcu_dereference(bat_priv->gw.curr_gw);
         if (!gw_node)
                 goto out;
 
@@ -91,23 +91,23 @@ static void batadv_gw_select(struct batadv_priv *bat_priv,
 {
         struct batadv_gw_node *curr_gw_node;
 
-        spin_lock_bh(&bat_priv->gw_list_lock);
+        spin_lock_bh(&bat_priv->gw.list_lock);
 
         if (new_gw_node && !atomic_inc_not_zero(&new_gw_node->refcount))
                 new_gw_node = NULL;
 
-        curr_gw_node = rcu_dereference_protected(bat_priv->curr_gw, 1);
-        rcu_assign_pointer(bat_priv->curr_gw, new_gw_node);
+        curr_gw_node = rcu_dereference_protected(bat_priv->gw.curr_gw, 1);
+        rcu_assign_pointer(bat_priv->gw.curr_gw, new_gw_node);
 
         if (curr_gw_node)
                 batadv_gw_node_free_ref(curr_gw_node);
 
-        spin_unlock_bh(&bat_priv->gw_list_lock);
+        spin_unlock_bh(&bat_priv->gw.list_lock);
 }
 
 void batadv_gw_deselect(struct batadv_priv *bat_priv)
 {
-        atomic_set(&bat_priv->gw_reselect, 1);
+        atomic_set(&bat_priv->gw.reselect, 1);
 }
 
 static struct batadv_gw_node *
@@ -117,12 +117,17 @@ batadv_gw_get_best_gw_node(struct batadv_priv *bat_priv)
         struct hlist_node *node;
         struct batadv_gw_node *gw_node, *curr_gw = NULL;
         uint32_t max_gw_factor = 0, tmp_gw_factor = 0;
+        uint32_t gw_divisor;
         uint8_t max_tq = 0;
         int down, up;
+        uint8_t tq_avg;
         struct batadv_orig_node *orig_node;
 
+        gw_divisor = BATADV_TQ_LOCAL_WINDOW_SIZE * BATADV_TQ_LOCAL_WINDOW_SIZE;
+        gw_divisor *= 64;
+
         rcu_read_lock();
-        hlist_for_each_entry_rcu(gw_node, node, &bat_priv->gw_list, list) {
+        hlist_for_each_entry_rcu(gw_node, node, &bat_priv->gw.list, list) {
                 if (gw_node->deleted)
                         continue;
 
@@ -134,19 +139,19 @@ batadv_gw_get_best_gw_node(struct batadv_priv *bat_priv)
                 if (!atomic_inc_not_zero(&gw_node->refcount))
                         goto next;
 
+                tq_avg = router->tq_avg;
+
                 switch (atomic_read(&bat_priv->gw_sel_class)) {
                 case 1: /* fast connection */
                         batadv_gw_bandwidth_to_kbit(orig_node->gw_flags,
                                                     &down, &up);
 
-                        tmp_gw_factor = (router->tq_avg * router->tq_avg *
-                                         down * 100 * 100) /
-                                         (BATADV_TQ_LOCAL_WINDOW_SIZE *
-                                          BATADV_TQ_LOCAL_WINDOW_SIZE * 64);
+                        tmp_gw_factor = tq_avg * tq_avg * down * 100 * 100;
+                        tmp_gw_factor /= gw_divisor;
 
                         if ((tmp_gw_factor > max_gw_factor) ||
                             ((tmp_gw_factor == max_gw_factor) &&
-                             (router->tq_avg > max_tq))) {
+                             (tq_avg > max_tq))) {
                                 if (curr_gw)
                                         batadv_gw_node_free_ref(curr_gw);
                                 curr_gw = gw_node;
@@ -161,7 +166,7 @@ batadv_gw_get_best_gw_node(struct batadv_priv *bat_priv)
                           *     soon as a better gateway appears which has
                           *     $routing_class more tq points)
                           */
-                        if (router->tq_avg > max_tq) {
+                        if (tq_avg > max_tq) {
                                 if (curr_gw)
                                         batadv_gw_node_free_ref(curr_gw);
                                 curr_gw = gw_node;
@@ -170,8 +175,8 @@ batadv_gw_get_best_gw_node(struct batadv_priv *bat_priv)
                         break;
                 }
 
-                if (router->tq_avg > max_tq)
-                        max_tq = router->tq_avg;
+                if (tq_avg > max_tq)
+                        max_tq = tq_avg;
 
                 if (tmp_gw_factor > max_gw_factor)
                         max_gw_factor = tmp_gw_factor;
@@ -200,11 +205,11 @@ void batadv_gw_election(struct batadv_priv *bat_priv)
         if (atomic_read(&bat_priv->gw_mode) != BATADV_GW_MODE_CLIENT)
                 goto out;
 
-        if (!batadv_atomic_dec_not_zero(&bat_priv->gw_reselect))
-                goto out;
-
         curr_gw = batadv_gw_get_selected_gw_node(bat_priv);
 
+        if (!batadv_atomic_dec_not_zero(&bat_priv->gw.reselect) && curr_gw)
+                goto out;
+
         next_gw = batadv_gw_get_best_gw_node(bat_priv);
 
         if (curr_gw == next_gw)
@@ -321,9 +326,9 @@ static void batadv_gw_node_add(struct batadv_priv *bat_priv,
         gw_node->orig_node = orig_node;
         atomic_set(&gw_node->refcount, 1);
 
-        spin_lock_bh(&bat_priv->gw_list_lock);
-        hlist_add_head_rcu(&gw_node->list, &bat_priv->gw_list);
-        spin_unlock_bh(&bat_priv->gw_list_lock);
+        spin_lock_bh(&bat_priv->gw.list_lock);
+        hlist_add_head_rcu(&gw_node->list, &bat_priv->gw.list);
+        spin_unlock_bh(&bat_priv->gw.list_lock);
 
         batadv_gw_bandwidth_to_kbit(new_gwflags, &down, &up);
         batadv_dbg(BATADV_DBG_BATMAN, bat_priv,
@@ -350,7 +355,7 @@ void batadv_gw_node_update(struct batadv_priv *bat_priv,
         curr_gw = batadv_gw_get_selected_gw_node(bat_priv);
 
         rcu_read_lock();
-        hlist_for_each_entry_rcu(gw_node, node, &bat_priv->gw_list, list) {
+        hlist_for_each_entry_rcu(gw_node, node, &bat_priv->gw.list, list) {
                 if (gw_node->orig_node != orig_node)
                         continue;
 
@@ -404,10 +409,10 @@ void batadv_gw_node_purge(struct batadv_priv *bat_priv)
 
         curr_gw = batadv_gw_get_selected_gw_node(bat_priv);
 
-        spin_lock_bh(&bat_priv->gw_list_lock);
+        spin_lock_bh(&bat_priv->gw.list_lock);
 
         hlist_for_each_entry_safe(gw_node, node, node_tmp,
-                                  &bat_priv->gw_list, list) {
+                                  &bat_priv->gw.list, list) {
                 if (((!gw_node->deleted) ||
                      (time_before(jiffies, gw_node->deleted + timeout))) &&
                     atomic_read(&bat_priv->mesh_state) == BATADV_MESH_ACTIVE)
@@ -420,7 +425,7 @@ void batadv_gw_node_purge(struct batadv_priv *bat_priv)
                 batadv_gw_node_free_ref(gw_node);
         }
 
-        spin_unlock_bh(&bat_priv->gw_list_lock);
+        spin_unlock_bh(&bat_priv->gw.list_lock);
 
         /* gw_deselect() needs to acquire the gw_list_lock */
         if (do_deselect)
@@ -496,7 +501,7 @@ int batadv_gw_client_seq_print_text(struct seq_file *seq, void *offset)
                    primary_if->net_dev->dev_addr, net_dev->name);
 
         rcu_read_lock();
-        hlist_for_each_entry_rcu(gw_node, node, &bat_priv->gw_list, list) {
+        hlist_for_each_entry_rcu(gw_node, node, &bat_priv->gw.list, list) {
                 if (gw_node->deleted)
                         continue;
 
diff --git a/net/batman-adv/hard-interface.c b/net/batman-adv/hard-interface.c
index 282bf6e9353e..d112fd6750b0 100644
--- a/net/batman-adv/hard-interface.c
+++ b/net/batman-adv/hard-interface.c
@@ -103,13 +103,14 @@ static void batadv_primary_if_update_addr(struct batadv_priv *bat_priv,
 {
         struct batadv_vis_packet *vis_packet;
         struct batadv_hard_iface *primary_if;
+        struct sk_buff *skb;
 
         primary_if = batadv_primary_if_get_selected(bat_priv);
         if (!primary_if)
                 goto out;
 
-        vis_packet = (struct batadv_vis_packet *)
-                                bat_priv->my_vis_info->skb_packet->data;
+        skb = bat_priv->vis.my_info->skb_packet;
+        vis_packet = (struct batadv_vis_packet *)skb->data;
         memcpy(vis_packet->vis_orig, primary_if->net_dev->dev_addr, ETH_ALEN);
         memcpy(vis_packet->sender_orig,
                primary_if->net_dev->dev_addr, ETH_ALEN);
@@ -313,7 +314,13 @@ int batadv_hardif_enable_interface(struct batadv_hard_iface *hard_iface,
         hard_iface->if_num = bat_priv->num_ifaces;
         bat_priv->num_ifaces++;
         hard_iface->if_status = BATADV_IF_INACTIVE;
-        batadv_orig_hash_add_if(hard_iface, bat_priv->num_ifaces);
+        ret = batadv_orig_hash_add_if(hard_iface, bat_priv->num_ifaces);
+        if (ret < 0) {
+                bat_priv->bat_algo_ops->bat_iface_disable(hard_iface);
+                bat_priv->num_ifaces--;
+                hard_iface->if_status = BATADV_IF_NOT_IN_USE;
+                goto err_dev;
+        }
 
         hard_iface->batman_adv_ptype.type = ethertype;
         hard_iface->batman_adv_ptype.func = batadv_batman_skb_recv;
diff --git a/net/batman-adv/main.c b/net/batman-adv/main.c
index 13c88b25ab31..b4aa470bc4a6 100644
--- a/net/batman-adv/main.c
+++ b/net/batman-adv/main.c
@@ -58,9 +58,6 @@ static int __init batadv_init(void)
 
         batadv_iv_init();
 
-        /* the name should not be longer than 10 chars - see
-         * http://lwn.net/Articles/23634/
-         */
         batadv_event_workqueue = create_singlethread_workqueue("bat_events");
 
         if (!batadv_event_workqueue)
@@ -97,20 +94,20 @@ int batadv_mesh_init(struct net_device *soft_iface)
 
         spin_lock_init(&bat_priv->forw_bat_list_lock);
         spin_lock_init(&bat_priv->forw_bcast_list_lock);
-        spin_lock_init(&bat_priv->tt_changes_list_lock);
-        spin_lock_init(&bat_priv->tt_req_list_lock);
-        spin_lock_init(&bat_priv->tt_roam_list_lock);
-        spin_lock_init(&bat_priv->tt_buff_lock);
-        spin_lock_init(&bat_priv->gw_list_lock);
-        spin_lock_init(&bat_priv->vis_hash_lock);
-        spin_lock_init(&bat_priv->vis_list_lock);
+        spin_lock_init(&bat_priv->tt.changes_list_lock);
+        spin_lock_init(&bat_priv->tt.req_list_lock);
+        spin_lock_init(&bat_priv->tt.roam_list_lock);
+        spin_lock_init(&bat_priv->tt.last_changeset_lock);
+        spin_lock_init(&bat_priv->gw.list_lock);
+        spin_lock_init(&bat_priv->vis.hash_lock);
+        spin_lock_init(&bat_priv->vis.list_lock);
 
         INIT_HLIST_HEAD(&bat_priv->forw_bat_list);
         INIT_HLIST_HEAD(&bat_priv->forw_bcast_list);
-        INIT_HLIST_HEAD(&bat_priv->gw_list);
-        INIT_LIST_HEAD(&bat_priv->tt_changes_list);
-        INIT_LIST_HEAD(&bat_priv->tt_req_list);
-        INIT_LIST_HEAD(&bat_priv->tt_roam_list);
+        INIT_HLIST_HEAD(&bat_priv->gw.list);
+        INIT_LIST_HEAD(&bat_priv->tt.changes_list);
+        INIT_LIST_HEAD(&bat_priv->tt.req_list);
+        INIT_LIST_HEAD(&bat_priv->tt.roam_list);
 
         ret = batadv_originator_init(bat_priv);
         if (ret < 0)
@@ -131,7 +128,7 @@ int batadv_mesh_init(struct net_device *soft_iface)
         if (ret < 0)
                 goto err;
 
-        atomic_set(&bat_priv->gw_reselect, 0);
+        atomic_set(&bat_priv->gw.reselect, 0);
         atomic_set(&bat_priv->mesh_state, BATADV_MESH_ACTIVE);
 
         return 0;
diff --git a/net/batman-adv/main.h b/net/batman-adv/main.h
index 5d8fa0757947..d57b746219de 100644
--- a/net/batman-adv/main.h
+++ b/net/batman-adv/main.h
@@ -26,7 +26,7 @@
 #define BATADV_DRIVER_DEVICE "batman-adv"
 
 #ifndef BATADV_SOURCE_VERSION
-#define BATADV_SOURCE_VERSION "2012.3.0"
+#define BATADV_SOURCE_VERSION "2012.4.0"
 #endif
 
 /* B.A.T.M.A.N. parameters */
@@ -41,13 +41,14 @@
  * -> TODO: check influence on BATADV_TQ_LOCAL_WINDOW_SIZE
  */
 #define BATADV_PURGE_TIMEOUT 200000 /* 200 seconds */
-#define BATADV_TT_LOCAL_TIMEOUT 3600000 /* in miliseconds */
-#define BATADV_TT_CLIENT_ROAM_TIMEOUT 600000 /* in miliseconds */
+#define BATADV_TT_LOCAL_TIMEOUT 3600000 /* in milliseconds */
+#define BATADV_TT_CLIENT_ROAM_TIMEOUT 600000 /* in milliseconds */
+#define BATADV_TT_CLIENT_TEMP_TIMEOUT 600000 /* in milliseconds */
 /* sliding packet range of received originator messages in sequence numbers
  * (should be a multiple of our word size)
  */
 #define BATADV_TQ_LOCAL_WINDOW_SIZE 64
-/* miliseconds we have to keep pending tt_req */
+/* milliseconds we have to keep pending tt_req */
 #define BATADV_TT_REQUEST_TIMEOUT 3000
 
 #define BATADV_TQ_GLOBAL_WINDOW_SIZE 5
@@ -59,7 +60,7 @@
 #define BATADV_TT_OGM_APPEND_MAX 3
 
 /* Time in which a client can roam at most ROAMING_MAX_COUNT times in
- * miliseconds
+ * milliseconds
  */
 #define BATADV_ROAMING_MAX_TIME 20000
 #define BATADV_ROAMING_MAX_COUNT 5
@@ -123,15 +124,6 @@ enum batadv_uev_type {
 /* Append 'batman-adv: ' before kernel messages */
 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
 
-/* all messages related to routing / flooding / broadcasting / etc */
-enum batadv_dbg_level {
-        BATADV_DBG_BATMAN = 1 << 0,
-        BATADV_DBG_ROUTES = 1 << 1, /* route added / changed / deleted */
-        BATADV_DBG_TT     = 1 << 2, /* translation table operations */
-        BATADV_DBG_BLA    = 1 << 3, /* bridge loop avoidance */
-        BATADV_DBG_ALL    = 15,
-};
-
 /* Kernel headers */
 
 #include <linux/mutex.h>        /* mutex */
@@ -173,6 +165,15 @@ int batadv_algo_register(struct batadv_algo_ops *bat_algo_ops);
 int batadv_algo_select(struct batadv_priv *bat_priv, char *name);
 int batadv_algo_seq_print_text(struct seq_file *seq, void *offset);
 
+/* all messages related to routing / flooding / broadcasting / etc */
+enum batadv_dbg_level {
+        BATADV_DBG_BATMAN = BIT(0),
+        BATADV_DBG_ROUTES = BIT(1), /* route added / changed / deleted */
+        BATADV_DBG_TT     = BIT(2), /* translation table operations */
+        BATADV_DBG_BLA    = BIT(3), /* bridge loop avoidance */
+        BATADV_DBG_ALL    = 15,
+};
+
 #ifdef CONFIG_BATMAN_ADV_DEBUG
 int batadv_debug_log(struct batadv_priv *bat_priv, const char *fmt, ...)
 __printf(2, 3);
diff --git a/net/batman-adv/packet.h b/net/batman-adv/packet.h
index 8d3e55a96adc..2d23a14c220e 100644
--- a/net/batman-adv/packet.h
+++ b/net/batman-adv/packet.h
@@ -37,10 +37,10 @@ enum batadv_packettype {
 #define BATADV_COMPAT_VERSION 14
 
 enum batadv_iv_flags {
-        BATADV_NOT_BEST_NEXT_HOP   = 1 << 3,
-        BATADV_PRIMARIES_FIRST_HOP = 1 << 4,
-        BATADV_VIS_SERVER          = 1 << 5,
-        BATADV_DIRECTLINK          = 1 << 6,
+        BATADV_NOT_BEST_NEXT_HOP   = BIT(3),
+        BATADV_PRIMARIES_FIRST_HOP = BIT(4),
+        BATADV_VIS_SERVER          = BIT(5),
+        BATADV_DIRECTLINK          = BIT(6),
 };
 
 /* ICMP message types */
@@ -60,8 +60,8 @@ enum batadv_vis_packettype {
 
 /* fragmentation defines */
 enum batadv_unicast_frag_flags {
-        BATADV_UNI_FRAG_HEAD      = 1 << 0,
-        BATADV_UNI_FRAG_LARGETAIL = 1 << 1,
+        BATADV_UNI_FRAG_HEAD      = BIT(0),
+        BATADV_UNI_FRAG_LARGETAIL = BIT(1),
 };
 
 /* TT_QUERY subtypes */
@@ -74,26 +74,27 @@ enum batadv_tt_query_packettype {
 
 /* TT_QUERY flags */
 enum batadv_tt_query_flags {
-        BATADV_TT_FULL_TABLE = 1 << 2,
+        BATADV_TT_FULL_TABLE = BIT(2),
 };
 
 /* BATADV_TT_CLIENT flags.
- * Flags from 1 to 1 << 7 are sent on the wire, while flags from 1 << 8 to
- * 1 << 15 are used for local computation only
+ * Flags from BIT(0) to BIT(7) are sent on the wire, while flags from BIT(8) to
+ * BIT(15) are used for local computation only
  */
 enum batadv_tt_client_flags {
-        BATADV_TT_CLIENT_DEL     = 1 << 0,
-        BATADV_TT_CLIENT_ROAM    = 1 << 1,
-        BATADV_TT_CLIENT_WIFI    = 1 << 2,
-        BATADV_TT_CLIENT_NOPURGE = 1 << 8,
-        BATADV_TT_CLIENT_NEW     = 1 << 9,
-        BATADV_TT_CLIENT_PENDING = 1 << 10,
+        BATADV_TT_CLIENT_DEL     = BIT(0),
+        BATADV_TT_CLIENT_ROAM    = BIT(1),
+        BATADV_TT_CLIENT_WIFI    = BIT(2),
+        BATADV_TT_CLIENT_TEMP    = BIT(3),
+        BATADV_TT_CLIENT_NOPURGE = BIT(8),
+        BATADV_TT_CLIENT_NEW     = BIT(9),
+        BATADV_TT_CLIENT_PENDING = BIT(10),
 };
 
 /* claim frame types for the bridge loop avoidance */
 enum batadv_bla_claimframe {
-        BATADV_CLAIM_TYPE_ADD           = 0x00,
-        BATADV_CLAIM_TYPE_DEL           = 0x01,
+        BATADV_CLAIM_TYPE_CLAIM         = 0x00,
+        BATADV_CLAIM_TYPE_UNCLAIM       = 0x01,
         BATADV_CLAIM_TYPE_ANNOUNCE      = 0x02,
         BATADV_CLAIM_TYPE_REQUEST       = 0x03,
 };
diff --git a/net/batman-adv/routing.c b/net/batman-adv/routing.c
index bc2b88bbea1f..939fc01371df 100644
--- a/net/batman-adv/routing.c
+++ b/net/batman-adv/routing.c
@@ -579,32 +579,45 @@ batadv_find_ifalter_router(struct batadv_orig_node *primary_orig,
         return router;
 }
 
-int batadv_recv_tt_query(struct sk_buff *skb, struct batadv_hard_iface *recv_if)
+static int batadv_check_unicast_packet(struct sk_buff *skb, int hdr_size)
 {
-        struct batadv_priv *bat_priv = netdev_priv(recv_if->soft_iface);
-        struct batadv_tt_query_packet *tt_query;
-        uint16_t tt_size;
         struct ethhdr *ethhdr;
-        char tt_flag;
-        size_t packet_size;
 
         /* drop packet if it has not necessary minimum size */
-        if (unlikely(!pskb_may_pull(skb,
-                                    sizeof(struct batadv_tt_query_packet))))
-                goto out;
-
-        /* I could need to modify it */
-        if (skb_cow(skb, sizeof(struct batadv_tt_query_packet)) < 0)
-                goto out;
+        if (unlikely(!pskb_may_pull(skb, hdr_size)))
+                return -1;
 
         ethhdr = (struct ethhdr *)skb_mac_header(skb);
 
         /* packet with unicast indication but broadcast recipient */
         if (is_broadcast_ether_addr(ethhdr->h_dest))
-                goto out;
+                return -1;
 
         /* packet with broadcast sender address */
         if (is_broadcast_ether_addr(ethhdr->h_source))
+                return -1;
+
+        /* not for me */
+        if (!batadv_is_my_mac(ethhdr->h_dest))
+                return -1;
+
+        return 0;
+}
+
+int batadv_recv_tt_query(struct sk_buff *skb, struct batadv_hard_iface *recv_if)
+{
+        struct batadv_priv *bat_priv = netdev_priv(recv_if->soft_iface);
+        struct batadv_tt_query_packet *tt_query;
+        uint16_t tt_size;
+        int hdr_size = sizeof(*tt_query);
+        char tt_flag;
+        size_t packet_size;
+
+        if (batadv_check_unicast_packet(skb, hdr_size) < 0)
+                return NET_RX_DROP;
+
+        /* I could need to modify it */
+        if (skb_cow(skb, sizeof(struct batadv_tt_query_packet)) < 0)
                 goto out;
 
         tt_query = (struct batadv_tt_query_packet *)skb->data;
@@ -721,7 +734,7 @@ int batadv_recv_roam_adv(struct sk_buff *skb, struct batadv_hard_iface *recv_if)
          * been incremented yet. This flag will make me check all the incoming
          * packets for the correct destination.
          */
-        bat_priv->tt_poss_change = true;
+        bat_priv->tt.poss_change = true;
 
         batadv_orig_node_free_ref(orig_node);
 out:
@@ -819,31 +832,6 @@ err:
         return NULL;
 }
 
-static int batadv_check_unicast_packet(struct sk_buff *skb, int hdr_size)
-{
-        struct ethhdr *ethhdr;
-
-        /* drop packet if it has not necessary minimum size */
-        if (unlikely(!pskb_may_pull(skb, hdr_size)))
-                return -1;
-
-        ethhdr = (struct ethhdr *)skb_mac_header(skb);
-
-        /* packet with unicast indication but broadcast recipient */
-        if (is_broadcast_ether_addr(ethhdr->h_dest))
-                return -1;
-
-        /* packet with broadcast sender address */
-        if (is_broadcast_ether_addr(ethhdr->h_source))
-                return -1;
-
-        /* not for me */
-        if (!batadv_is_my_mac(ethhdr->h_dest))
-                return -1;
-
-        return 0;
-}
-
 static int batadv_route_unicast_packet(struct sk_buff *skb,
                                        struct batadv_hard_iface *recv_if)
 {
@@ -947,8 +935,8 @@ static int batadv_check_unicast_ttvn(struct batadv_priv *bat_priv,
         unicast_packet = (struct batadv_unicast_packet *)skb->data;
 
         if (batadv_is_my_mac(unicast_packet->dest)) {
-                tt_poss_change = bat_priv->tt_poss_change;
-                curr_ttvn = (uint8_t)atomic_read(&bat_priv->ttvn);
+                tt_poss_change = bat_priv->tt.poss_change;
+                curr_ttvn = (uint8_t)atomic_read(&bat_priv->tt.vn);
         } else {
                 orig_node = batadv_orig_hash_find(bat_priv,
                                                   unicast_packet->dest);
@@ -993,8 +981,7 @@ static int batadv_check_unicast_ttvn(struct batadv_priv *bat_priv,
                 } else {
                         memcpy(unicast_packet->dest, orig_node->orig,
                                ETH_ALEN);
-                        curr_ttvn = (uint8_t)
-                                atomic_read(&orig_node->last_ttvn);
+                        curr_ttvn = (uint8_t)atomic_read(&orig_node->last_ttvn);
                         batadv_orig_node_free_ref(orig_node);
                 }
 
@@ -1025,8 +1012,9 @@ int batadv_recv_unicast_packet(struct sk_buff *skb,
 
         /* packet for me */
         if (batadv_is_my_mac(unicast_packet->dest)) {
-                batadv_interface_rx(recv_if->soft_iface, skb, recv_if,
-                                    hdr_size);
+                batadv_interface_rx(recv_if->soft_iface, skb, recv_if, hdr_size,
+                                    NULL);
+
                 return NET_RX_SUCCESS;
         }
 
@@ -1063,7 +1051,7 @@ int batadv_recv_ucast_frag_packet(struct sk_buff *skb,
                         return NET_RX_SUCCESS;
 
                 batadv_interface_rx(recv_if->soft_iface, new_skb, recv_if,
-                                    sizeof(struct batadv_unicast_packet));
+                                    sizeof(struct batadv_unicast_packet), NULL);
                 return NET_RX_SUCCESS;
         }
 
@@ -1150,7 +1138,8 @@ int batadv_recv_bcast_packet(struct sk_buff *skb,
                 goto out;
 
         /* broadcast for me */
-        batadv_interface_rx(recv_if->soft_iface, skb, recv_if, hdr_size);
+        batadv_interface_rx(recv_if->soft_iface, skb, recv_if, hdr_size,
+                            orig_node);
         ret = NET_RX_SUCCESS;
         goto out;
 
diff --git a/net/batman-adv/send.c b/net/batman-adv/send.c
index 3b4b2daa3b3e..570a8bce0364 100644
--- a/net/batman-adv/send.c
+++ b/net/batman-adv/send.c
@@ -190,13 +190,13 @@ out:
 static void batadv_send_outstanding_bcast_packet(struct work_struct *work)
 {
         struct batadv_hard_iface *hard_iface;
-        struct delayed_work *delayed_work =
-                container_of(work, struct delayed_work, work);
+        struct delayed_work *delayed_work;
         struct batadv_forw_packet *forw_packet;
         struct sk_buff *skb1;
         struct net_device *soft_iface;
         struct batadv_priv *bat_priv;
 
+        delayed_work = container_of(work, struct delayed_work, work);
         forw_packet = container_of(delayed_work, struct batadv_forw_packet,
                                    delayed_work);
         soft_iface = forw_packet->if_incoming->soft_iface;
@@ -239,11 +239,11 @@ out:
 
 void batadv_send_outstanding_bat_ogm_packet(struct work_struct *work)
 {
-        struct delayed_work *delayed_work =
-                container_of(work, struct delayed_work, work);
+        struct delayed_work *delayed_work;
         struct batadv_forw_packet *forw_packet;
         struct batadv_priv *bat_priv;
 
+        delayed_work = container_of(work, struct delayed_work, work);
         forw_packet = container_of(delayed_work, struct batadv_forw_packet,
                                    delayed_work);
         bat_priv = netdev_priv(forw_packet->if_incoming->soft_iface);
diff --git a/net/batman-adv/soft-interface.c b/net/batman-adv/soft-interface.c
index 109ea2aae96c..7b683e0bd668 100644
--- a/net/batman-adv/soft-interface.c
+++ b/net/batman-adv/soft-interface.c
@@ -93,7 +93,14 @@ static int batadv_interface_release(struct net_device *dev)
 static struct net_device_stats *batadv_interface_stats(struct net_device *dev)
 {
         struct batadv_priv *bat_priv = netdev_priv(dev);
-        return &bat_priv->stats;
+        struct net_device_stats *stats = &bat_priv->stats;
+
+        stats->tx_packets = batadv_sum_counter(bat_priv, BATADV_CNT_TX);
+        stats->tx_bytes = batadv_sum_counter(bat_priv, BATADV_CNT_TX_BYTES);
+        stats->tx_dropped = batadv_sum_counter(bat_priv, BATADV_CNT_TX_DROPPED);
+        stats->rx_packets = batadv_sum_counter(bat_priv, BATADV_CNT_RX);
+        stats->rx_bytes = batadv_sum_counter(bat_priv, BATADV_CNT_RX_BYTES);
+        return stats;
 }
 
 static int batadv_interface_set_mac_addr(struct net_device *dev, void *p)
@@ -142,6 +149,7 @@ static int batadv_interface_tx(struct sk_buff *skb,
         int data_len = skb->len, ret;
         short vid __maybe_unused = -1;
         bool do_bcast = false;
+        uint32_t seqno;
 
         if (atomic_read(&bat_priv->mesh_state) != BATADV_MESH_ACTIVE)
                 goto dropped;
@@ -223,8 +231,8 @@ static int batadv_interface_tx(struct sk_buff *skb,
                        primary_if->net_dev->dev_addr, ETH_ALEN);
 
                 /* set broadcast sequence number */
-                bcast_packet->seqno =
-                        htonl(atomic_inc_return(&bat_priv->bcast_seqno));
+                seqno = atomic_inc_return(&bat_priv->bcast_seqno);
+                bcast_packet->seqno = htonl(seqno);
 
                 batadv_add_bcast_packet_to_list(bat_priv, skb, 1);
 
@@ -246,14 +254,14 @@ static int batadv_interface_tx(struct sk_buff *skb,
                         goto dropped_freed;
         }
 
-        bat_priv->stats.tx_packets++;
-        bat_priv->stats.tx_bytes += data_len;
+        batadv_inc_counter(bat_priv, BATADV_CNT_TX);
+        batadv_add_counter(bat_priv, BATADV_CNT_TX_BYTES, data_len);
         goto end;
 
 dropped:
         kfree_skb(skb);
 dropped_freed:
-        bat_priv->stats.tx_dropped++;
+        batadv_inc_counter(bat_priv, BATADV_CNT_TX_DROPPED);
 end:
         if (primary_if)
                 batadv_hardif_free_ref(primary_if);
@@ -262,7 +270,7 @@ end:
 
 void batadv_interface_rx(struct net_device *soft_iface,
                          struct sk_buff *skb, struct batadv_hard_iface *recv_if,
-                         int hdr_size)
+                         int hdr_size, struct batadv_orig_node *orig_node)
 {
         struct batadv_priv *bat_priv = netdev_priv(soft_iface);
         struct ethhdr *ethhdr;
@@ -308,11 +316,16 @@ void batadv_interface_rx(struct net_device *soft_iface,
 
         /* skb->ip_summed = CHECKSUM_UNNECESSARY; */
 
-        bat_priv->stats.rx_packets++;
-        bat_priv->stats.rx_bytes += skb->len + ETH_HLEN;
+        batadv_inc_counter(bat_priv, BATADV_CNT_RX);
+        batadv_add_counter(bat_priv, BATADV_CNT_RX_BYTES,
+                           skb->len + ETH_HLEN);
 
         soft_iface->last_rx = jiffies;
 
+        if (orig_node)
+                batadv_tt_add_temporary_global_entry(bat_priv, orig_node,
+                                                     ethhdr->h_source);
+
         if (batadv_is_ap_isolated(bat_priv, ethhdr->h_source, ethhdr->h_dest))
                 goto dropped;
 
@@ -379,15 +392,22 @@ struct net_device *batadv_softif_create(const char *name)
         if (!soft_iface)
                 goto out;
 
+        bat_priv = netdev_priv(soft_iface);
+
+        /* batadv_interface_stats() needs to be available as soon as
+         * register_netdevice() has been called
+         */
+        bat_priv->bat_counters = __alloc_percpu(cnt_len, __alignof__(uint64_t));
+        if (!bat_priv->bat_counters)
+                goto free_soft_iface;
+
         ret = register_netdevice(soft_iface);
         if (ret < 0) {
                 pr_err("Unable to register the batman interface '%s': %i\n",
                        name, ret);
-                goto free_soft_iface;
+                goto free_bat_counters;
         }
 
-        bat_priv = netdev_priv(soft_iface);
-
         atomic_set(&bat_priv->aggregated_ogms, 1);
         atomic_set(&bat_priv->bonding, 0);
         atomic_set(&bat_priv->bridge_loop_avoidance, 0);
@@ -405,29 +425,26 @@ struct net_device *batadv_softif_create(const char *name)
 
         atomic_set(&bat_priv->mesh_state, BATADV_MESH_INACTIVE);
         atomic_set(&bat_priv->bcast_seqno, 1);
-        atomic_set(&bat_priv->ttvn, 0);
-        atomic_set(&bat_priv->tt_local_changes, 0);
-        atomic_set(&bat_priv->tt_ogm_append_cnt, 0);
-        atomic_set(&bat_priv->bla_num_requests, 0);
-
-        bat_priv->tt_buff = NULL;
-        bat_priv->tt_buff_len = 0;
-        bat_priv->tt_poss_change = false;
+        atomic_set(&bat_priv->tt.vn, 0);
+        atomic_set(&bat_priv->tt.local_changes, 0);
+        atomic_set(&bat_priv->tt.ogm_append_cnt, 0);
+#ifdef CONFIG_BATMAN_ADV_BLA
+        atomic_set(&bat_priv->bla.num_requests, 0);
+#endif
+        bat_priv->tt.last_changeset = NULL;
+        bat_priv->tt.last_changeset_len = 0;
+        bat_priv->tt.poss_change = false;
 
         bat_priv->primary_if = NULL;
         bat_priv->num_ifaces = 0;
 
-        bat_priv->bat_counters = __alloc_percpu(cnt_len, __alignof__(uint64_t));
-        if (!bat_priv->bat_counters)
-                goto unreg_soft_iface;
-
         ret = batadv_algo_select(bat_priv, batadv_routing_algo);
         if (ret < 0)
-                goto free_bat_counters;
+                goto unreg_soft_iface;
 
         ret = batadv_sysfs_add_meshif(soft_iface);
         if (ret < 0)
-                goto free_bat_counters;
+                goto unreg_soft_iface;
 
         ret = batadv_debugfs_add_meshif(soft_iface);
         if (ret < 0)
@@ -443,12 +460,13 @@ unreg_debugfs:
         batadv_debugfs_del_meshif(soft_iface);
 unreg_sysfs:
         batadv_sysfs_del_meshif(soft_iface);
-free_bat_counters:
-        free_percpu(bat_priv->bat_counters);
 unreg_soft_iface:
+        free_percpu(bat_priv->bat_counters);
         unregister_netdevice(soft_iface);
         return NULL;
 
+free_bat_counters:
+        free_percpu(bat_priv->bat_counters);
 free_soft_iface:
         free_netdev(soft_iface);
 out:
@@ -518,6 +536,11 @@ static u32 batadv_get_link(struct net_device *dev)
 static const struct {
         const char name[ETH_GSTRING_LEN];
 } batadv_counters_strings[] = {
+        { "tx" },
+        { "tx_bytes" },
+        { "tx_dropped" },
+        { "rx" },
+        { "rx_bytes" },
         { "forward" },
         { "forward_bytes" },
         { "mgmt_tx" },
diff --git a/net/batman-adv/soft-interface.h b/net/batman-adv/soft-interface.h
index 852c683b06a1..07a08fed28b9 100644
--- a/net/batman-adv/soft-interface.h
+++ b/net/batman-adv/soft-interface.h
@@ -21,8 +21,9 @@
 #define _NET_BATMAN_ADV_SOFT_INTERFACE_H_
 
 int batadv_skb_head_push(struct sk_buff *skb, unsigned int len);
-void batadv_interface_rx(struct net_device *soft_iface, struct sk_buff *skb,
-                         struct batadv_hard_iface *recv_if, int hdr_size);
+void batadv_interface_rx(struct net_device *soft_iface,
+                         struct sk_buff *skb, struct batadv_hard_iface *recv_if,
+                         int hdr_size, struct batadv_orig_node *orig_node);
 struct net_device *batadv_softif_create(const char *name);
 void batadv_softif_destroy(struct net_device *soft_iface);
 int batadv_softif_is_valid(const struct net_device *net_dev);
diff --git a/net/batman-adv/translation-table.c b/net/batman-adv/translation-table.c
index a438f4b582fc..112edd371b2f 100644
--- a/net/batman-adv/translation-table.c
+++ b/net/batman-adv/translation-table.c
@@ -34,6 +34,10 @@ static void batadv_send_roam_adv(struct batadv_priv *bat_priv, uint8_t *client,
 static void batadv_tt_purge(struct work_struct *work);
 static void
 batadv_tt_global_del_orig_list(struct batadv_tt_global_entry *tt_global_entry);
+static void batadv_tt_global_del(struct batadv_priv *bat_priv,
+                                 struct batadv_orig_node *orig_node,
+                                 const unsigned char *addr,
+                                 const char *message, bool roaming);
 
 /* returns 1 if they are the same mac addr */
 static int batadv_compare_tt(const struct hlist_node *node, const void *data2)
@@ -46,8 +50,8 @@ static int batadv_compare_tt(const struct hlist_node *node, const void *data2)
 
 static void batadv_tt_start_timer(struct batadv_priv *bat_priv)
 {
-        INIT_DELAYED_WORK(&bat_priv->tt_work, batadv_tt_purge);
-        queue_delayed_work(batadv_event_workqueue, &bat_priv->tt_work,
+        INIT_DELAYED_WORK(&bat_priv->tt.work, batadv_tt_purge);
+        queue_delayed_work(batadv_event_workqueue, &bat_priv->tt.work,
                            msecs_to_jiffies(5000));
 }
 
@@ -88,7 +92,7 @@ batadv_tt_local_hash_find(struct batadv_priv *bat_priv, const void *data)
         struct batadv_tt_common_entry *tt_common_entry;
         struct batadv_tt_local_entry *tt_local_entry = NULL;
 
-        tt_common_entry = batadv_tt_hash_find(bat_priv->tt_local_hash, data);
+        tt_common_entry = batadv_tt_hash_find(bat_priv->tt.local_hash, data);
         if (tt_common_entry)
                 tt_local_entry = container_of(tt_common_entry,
                                               struct batadv_tt_local_entry,
@@ -102,7 +106,7 @@ batadv_tt_global_hash_find(struct batadv_priv *bat_priv, const void *data)
         struct batadv_tt_common_entry *tt_common_entry;
         struct batadv_tt_global_entry *tt_global_entry = NULL;
 
-        tt_common_entry = batadv_tt_hash_find(bat_priv->tt_global_hash, data);
+        tt_common_entry = batadv_tt_hash_find(bat_priv->tt.global_hash, data);
         if (tt_common_entry)
                 tt_global_entry = container_of(tt_common_entry,
                                                struct batadv_tt_global_entry,
@@ -152,6 +156,8 @@ static void batadv_tt_orig_list_entry_free_rcu(struct rcu_head *rcu)
 static void
 batadv_tt_orig_list_entry_free_ref(struct batadv_tt_orig_list_entry *orig_entry)
 {
+        if (!atomic_dec_and_test(&orig_entry->refcount))
+                return;
         /* to avoid race conditions, immediately decrease the tt counter */
         atomic_dec(&orig_entry->orig_node->tt_size);
         call_rcu(&orig_entry->rcu, batadv_tt_orig_list_entry_free_rcu);
@@ -175,8 +181,8 @@ static void batadv_tt_local_event(struct batadv_priv *bat_priv,
         del_op_requested = flags & BATADV_TT_CLIENT_DEL;
 
         /* check for ADD+DEL or DEL+ADD events */
-        spin_lock_bh(&bat_priv->tt_changes_list_lock);
-        list_for_each_entry_safe(entry, safe, &bat_priv->tt_changes_list,
+        spin_lock_bh(&bat_priv->tt.changes_list_lock);
+        list_for_each_entry_safe(entry, safe, &bat_priv->tt.changes_list,
                                  list) {
                 if (!batadv_compare_eth(entry->change.addr, addr))
                         continue;
@@ -197,20 +203,21 @@ static void batadv_tt_local_event(struct batadv_priv *bat_priv,
 del:
                 list_del(&entry->list);
                 kfree(entry);
+                kfree(tt_change_node);
                 event_removed = true;
                 goto unlock;
         }
 
         /* track the change in the OGMinterval list */
-        list_add_tail(&tt_change_node->list, &bat_priv->tt_changes_list);
+        list_add_tail(&tt_change_node->list, &bat_priv->tt.changes_list);
 
 unlock:
-        spin_unlock_bh(&bat_priv->tt_changes_list_lock);
+        spin_unlock_bh(&bat_priv->tt.changes_list_lock);
 
         if (event_removed)
-                atomic_dec(&bat_priv->tt_local_changes);
+                atomic_dec(&bat_priv->tt.local_changes);
         else
-                atomic_inc(&bat_priv->tt_local_changes);
+                atomic_inc(&bat_priv->tt.local_changes);
 }
 
 int batadv_tt_len(int changes_num)
@@ -220,12 +227,12 @@ int batadv_tt_len(int changes_num)
 
 static int batadv_tt_local_init(struct batadv_priv *bat_priv)
 {
-        if (bat_priv->tt_local_hash)
+        if (bat_priv->tt.local_hash)
                 return 0;
 
-        bat_priv->tt_local_hash = batadv_hash_new(1024);
+        bat_priv->tt.local_hash = batadv_hash_new(1024);
 
-        if (!bat_priv->tt_local_hash)
+        if (!bat_priv->tt.local_hash)
                 return -ENOMEM;
 
         return 0;
@@ -257,7 +264,7 @@ void batadv_tt_local_add(struct net_device *soft_iface, const uint8_t *addr,
 
         batadv_dbg(BATADV_DBG_TT, bat_priv,
                    "Creating new local tt entry: %pM (ttvn: %d)\n", addr,
-                   (uint8_t)atomic_read(&bat_priv->ttvn));
+                   (uint8_t)atomic_read(&bat_priv->tt.vn));
 
         memcpy(tt_local_entry->common.addr, addr, ETH_ALEN);
         tt_local_entry->common.flags = BATADV_NO_FLAGS;
@@ -265,6 +272,7 @@ void batadv_tt_local_add(struct net_device *soft_iface, const uint8_t *addr,
                 tt_local_entry->common.flags |= BATADV_TT_CLIENT_WIFI;
         atomic_set(&tt_local_entry->common.refcount, 2);
         tt_local_entry->last_seen = jiffies;
+        tt_local_entry->common.added_at = tt_local_entry->last_seen;
 
         /* the batman interface mac address should never be purged */
         if (batadv_compare_eth(addr, soft_iface->dev_addr))
@@ -276,7 +284,7 @@ void batadv_tt_local_add(struct net_device *soft_iface, const uint8_t *addr,
          */
         tt_local_entry->common.flags |= BATADV_TT_CLIENT_NEW;
 
-        hash_added = batadv_hash_add(bat_priv->tt_local_hash, batadv_compare_tt,
+        hash_added = batadv_hash_add(bat_priv->tt.local_hash, batadv_compare_tt,
                                      batadv_choose_orig,
                                      &tt_local_entry->common,
                                      &tt_local_entry->common.hash_entry);
@@ -347,7 +355,7 @@ static void batadv_tt_prepare_packet_buff(struct batadv_priv *bat_priv,
         primary_if = batadv_primary_if_get_selected(bat_priv);
 
         req_len = min_packet_len;
-        req_len += batadv_tt_len(atomic_read(&bat_priv->tt_local_changes));
+        req_len += batadv_tt_len(atomic_read(&bat_priv->tt.local_changes));
 
         /* if we have too many changes for one packet don't send any
          * and wait for the tt table request which will be fragmented
@@ -380,10 +388,10 @@ static int batadv_tt_changes_fill_buff(struct batadv_priv *bat_priv,
         if (new_len > 0)
                 tot_changes = new_len / batadv_tt_len(1);
 
-        spin_lock_bh(&bat_priv->tt_changes_list_lock);
-        atomic_set(&bat_priv->tt_local_changes, 0);
+        spin_lock_bh(&bat_priv->tt.changes_list_lock);
+        atomic_set(&bat_priv->tt.local_changes, 0);
 
-        list_for_each_entry_safe(entry, safe, &bat_priv->tt_changes_list,
+        list_for_each_entry_safe(entry, safe, &bat_priv->tt.changes_list,
                                  list) {
                 if (count < tot_changes) {
                         memcpy(tt_buff + batadv_tt_len(count),
@@ -393,25 +401,25 @@ static int batadv_tt_changes_fill_buff(struct batadv_priv *bat_priv,
                 list_del(&entry->list);
                 kfree(entry);
         }
-        spin_unlock_bh(&bat_priv->tt_changes_list_lock);
+        spin_unlock_bh(&bat_priv->tt.changes_list_lock);
 
         /* Keep the buffer for possible tt_request */
-        spin_lock_bh(&bat_priv->tt_buff_lock);
-        kfree(bat_priv->tt_buff);
-        bat_priv->tt_buff_len = 0;
-        bat_priv->tt_buff = NULL;
+        spin_lock_bh(&bat_priv->tt.last_changeset_lock);
+        kfree(bat_priv->tt.last_changeset);
+        bat_priv->tt.last_changeset_len = 0;
+        bat_priv->tt.last_changeset = NULL;
         /* check whether this new OGM has no changes due to size problems */
         if (new_len > 0) {
                 /* if kmalloc() fails we will reply with the full table
                  * instead of providing the diff
                  */
-                bat_priv->tt_buff = kmalloc(new_len, GFP_ATOMIC);
-                if (bat_priv->tt_buff) {
-                        memcpy(bat_priv->tt_buff, tt_buff, new_len);
-                        bat_priv->tt_buff_len = new_len;
+                bat_priv->tt.last_changeset = kmalloc(new_len, GFP_ATOMIC);
+                if (bat_priv->tt.last_changeset) {
+                        memcpy(bat_priv->tt.last_changeset, tt_buff, new_len);
+                        bat_priv->tt.last_changeset_len = new_len;
                 }
         }
-        spin_unlock_bh(&bat_priv->tt_buff_lock);
+        spin_unlock_bh(&bat_priv->tt.last_changeset_lock);
 
         return count;
 }
@@ -420,7 +428,7 @@ int batadv_tt_local_seq_print_text(struct seq_file *seq, void *offset)
 {
         struct net_device *net_dev = (struct net_device *)seq->private;
         struct batadv_priv *bat_priv = netdev_priv(net_dev);
-        struct batadv_hashtable *hash = bat_priv->tt_local_hash;
+        struct batadv_hashtable *hash = bat_priv->tt.local_hash;
         struct batadv_tt_common_entry *tt_common_entry;
         struct batadv_hard_iface *primary_if;
         struct hlist_node *node;
@@ -445,7 +453,7 @@ int batadv_tt_local_seq_print_text(struct seq_file *seq, void *offset)
 
         seq_printf(seq,
                    "Locally retrieved addresses (from %s) announced via TT (TTVN: %u):\n",
-                   net_dev->name, (uint8_t)atomic_read(&bat_priv->ttvn));
+                   net_dev->name, (uint8_t)atomic_read(&bat_priv->tt.vn));
 
         for (i = 0; i < hash->size; i++) {
                 head = &hash->table[i];
@@ -543,7 +551,7 @@ static void batadv_tt_local_purge_list(struct batadv_priv *bat_priv,
 
 static void batadv_tt_local_purge(struct batadv_priv *bat_priv)
 {
-        struct batadv_hashtable *hash = bat_priv->tt_local_hash;
+        struct batadv_hashtable *hash = bat_priv->tt.local_hash;
         struct hlist_head *head;
         spinlock_t *list_lock; /* protects write access to the hash lists */
         uint32_t i;
@@ -569,10 +577,10 @@ static void batadv_tt_local_table_free(struct batadv_priv *bat_priv)
         struct hlist_head *head;
         uint32_t i;
 
-        if (!bat_priv->tt_local_hash)
+        if (!bat_priv->tt.local_hash)
                 return;
 
-        hash = bat_priv->tt_local_hash;
+        hash = bat_priv->tt.local_hash;
 
         for (i = 0; i < hash->size; i++) {
                 head = &hash->table[i];
@@ -592,17 +600,17 @@ static void batadv_tt_local_table_free(struct batadv_priv *bat_priv)
 
         batadv_hash_destroy(hash);
 
-        bat_priv->tt_local_hash = NULL;
+        bat_priv->tt.local_hash = NULL;
 }
 
 static int batadv_tt_global_init(struct batadv_priv *bat_priv)
 {
-        if (bat_priv->tt_global_hash)
+        if (bat_priv->tt.global_hash)
                 return 0;
 
-        bat_priv->tt_global_hash = batadv_hash_new(1024);
+        bat_priv->tt.global_hash = batadv_hash_new(1024);
 
-        if (!bat_priv->tt_global_hash)
+        if (!bat_priv->tt.global_hash)
                 return -ENOMEM;
 
         return 0;
@@ -612,62 +620,99 @@ static void batadv_tt_changes_list_free(struct batadv_priv *bat_priv)
 {
         struct batadv_tt_change_node *entry, *safe;
 
-        spin_lock_bh(&bat_priv->tt_changes_list_lock);
+        spin_lock_bh(&bat_priv->tt.changes_list_lock);
 
-        list_for_each_entry_safe(entry, safe, &bat_priv->tt_changes_list,
+        list_for_each_entry_safe(entry, safe, &bat_priv->tt.changes_list,
                                  list) {
                 list_del(&entry->list);
                 kfree(entry);
         }
 
-        atomic_set(&bat_priv->tt_local_changes, 0);
-        spin_unlock_bh(&bat_priv->tt_changes_list_lock);
+        atomic_set(&bat_priv->tt.local_changes, 0);
+        spin_unlock_bh(&bat_priv->tt.changes_list_lock);
 }
 
-/* find out if an orig_node is already in the list of a tt_global_entry.
- * returns 1 if found, 0 otherwise
+/* retrieves the orig_tt_list_entry belonging to orig_node from the
+ * batadv_tt_global_entry list
+ *
+ * returns it with an increased refcounter, NULL if not found
  */
-static bool
-batadv_tt_global_entry_has_orig(const struct batadv_tt_global_entry *entry,
-                                const struct batadv_orig_node *orig_node)
+static struct batadv_tt_orig_list_entry *
+batadv_tt_global_orig_entry_find(const struct batadv_tt_global_entry *entry,
+                                 const struct batadv_orig_node *orig_node)
 {
-        struct batadv_tt_orig_list_entry *tmp_orig_entry;
+        struct batadv_tt_orig_list_entry *tmp_orig_entry, *orig_entry = NULL;
         const struct hlist_head *head;
         struct hlist_node *node;
-        bool found = false;
 
         rcu_read_lock();
         head = &entry->orig_list;
         hlist_for_each_entry_rcu(tmp_orig_entry, node, head, list) {
-                if (tmp_orig_entry->orig_node == orig_node) {
-                        found = true;
-                        break;
-                }
+                if (tmp_orig_entry->orig_node != orig_node)
+                        continue;
+                if (!atomic_inc_not_zero(&tmp_orig_entry->refcount))
+                        continue;
+
+                orig_entry = tmp_orig_entry;
+                break;
         }
         rcu_read_unlock();
+
+        return orig_entry;
+}
+
+/* find out if an orig_node is already in the list of a tt_global_entry.
+ * returns true if found, false otherwise
+ */
+static bool
+batadv_tt_global_entry_has_orig(const struct batadv_tt_global_entry *entry,
+                                const struct batadv_orig_node *orig_node)
+{
+        struct batadv_tt_orig_list_entry *orig_entry;
+        bool found = false;
+
+        orig_entry = batadv_tt_global_orig_entry_find(entry, orig_node);
+        if (orig_entry) {
+                found = true;
+                batadv_tt_orig_list_entry_free_ref(orig_entry);
+        }
+
         return found;
 }
 
 static void
-batadv_tt_global_add_orig_entry(struct batadv_tt_global_entry *tt_global_entry,
+batadv_tt_global_orig_entry_add(struct batadv_tt_global_entry *tt_global,
                                 struct batadv_orig_node *orig_node, int ttvn)
 {
         struct batadv_tt_orig_list_entry *orig_entry;
 
+        orig_entry = batadv_tt_global_orig_entry_find(tt_global, orig_node);
+        if (orig_entry) {
+                /* refresh the ttvn: the current value could be a bogus one that
+                 * was added during a "temporary client detection"
+                 */
+                orig_entry->ttvn = ttvn;
+                goto out;
+        }
+
         orig_entry = kzalloc(sizeof(*orig_entry), GFP_ATOMIC);
         if (!orig_entry)
-                return;
+                goto out;
 
         INIT_HLIST_NODE(&orig_entry->list);
         atomic_inc(&orig_node->refcount);
         atomic_inc(&orig_node->tt_size);
         orig_entry->orig_node = orig_node;
         orig_entry->ttvn = ttvn;
+        atomic_set(&orig_entry->refcount, 2);
 
-        spin_lock_bh(&tt_global_entry->list_lock);
+        spin_lock_bh(&tt_global->list_lock);
         hlist_add_head_rcu(&orig_entry->list,
-                           &tt_global_entry->orig_list);
-        spin_unlock_bh(&tt_global_entry->list_lock);
+                           &tt_global->orig_list);
+        spin_unlock_bh(&tt_global->list_lock);
+out:
+        if (orig_entry)
+                batadv_tt_orig_list_entry_free_ref(orig_entry);
 }
 
 /* caller must hold orig_node refcount */
@@ -694,11 +739,12 @@ int batadv_tt_global_add(struct batadv_priv *bat_priv,
                 common->flags = flags;
                 tt_global_entry->roam_at = 0;
                 atomic_set(&common->refcount, 2);
+                common->added_at = jiffies;
 
                 INIT_HLIST_HEAD(&tt_global_entry->orig_list);
                 spin_lock_init(&tt_global_entry->list_lock);
 
-                hash_added = batadv_hash_add(bat_priv->tt_global_hash,
+                hash_added = batadv_hash_add(bat_priv->tt.global_hash,
                                              batadv_compare_tt,
                                              batadv_choose_orig, common,
                                              &common->hash_entry);
@@ -708,11 +754,20 @@ int batadv_tt_global_add(struct batadv_priv *bat_priv,
                         batadv_tt_global_entry_free_ref(tt_global_entry);
                         goto out_remove;
                 }
-
-                batadv_tt_global_add_orig_entry(tt_global_entry, orig_node,
-                                                ttvn);
         } else {
-                /* there is already a global entry, use this one. */
+                /* If there is already a global entry, we can use this one for
+                 * our processing.
+                 * But if we are trying to add a temporary client we can exit
+                 * directly because the temporary information should never
+                 * override any already known client state (whatever it is)
+                 */
+                if (flags & BATADV_TT_CLIENT_TEMP)
+                        goto out;
+
+                /* if the client was temporary added before receiving the first
+                 * OGM announcing it, we have to clear the TEMP flag
+                 */
+                tt_global_entry->common.flags &= ~BATADV_TT_CLIENT_TEMP;
 
                 /* If there is the BATADV_TT_CLIENT_ROAM flag set, there is only
                  * one originator left in the list and we previously received a
@@ -726,12 +781,9 @@ int batadv_tt_global_add(struct batadv_priv *bat_priv,
                         tt_global_entry->common.flags &= ~BATADV_TT_CLIENT_ROAM;
                         tt_global_entry->roam_at = 0;
                 }
-
-                if (!batadv_tt_global_entry_has_orig(tt_global_entry,
-                                                     orig_node))
-                        batadv_tt_global_add_orig_entry(tt_global_entry,
-                                                        orig_node, ttvn);
         }
+        /* add the new orig_entry (if needed) or update it */
+        batadv_tt_global_orig_entry_add(tt_global_entry, orig_node, ttvn);
 
         batadv_dbg(BATADV_DBG_TT, bat_priv,
                    "Creating new global tt entry: %pM (via %pM)\n",
@@ -770,11 +822,12 @@ batadv_tt_global_print_entry(struct batadv_tt_global_entry *tt_global_entry,
         hlist_for_each_entry_rcu(orig_entry, node, head, list) {
                 flags = tt_common_entry->flags;
                 last_ttvn = atomic_read(&orig_entry->orig_node->last_ttvn);
-                seq_printf(seq, " * %pM  (%3u) via %pM     (%3u)   [%c%c]\n",
+                seq_printf(seq, " * %pM  (%3u) via %pM     (%3u)   [%c%c%c]\n",
                            tt_global_entry->common.addr, orig_entry->ttvn,
                            orig_entry->orig_node->orig, last_ttvn,
                            (flags & BATADV_TT_CLIENT_ROAM ? 'R' : '.'),
-                           (flags & BATADV_TT_CLIENT_WIFI ? 'W' : '.'));
+                           (flags & BATADV_TT_CLIENT_WIFI ? 'W' : '.'),
+                           (flags & BATADV_TT_CLIENT_TEMP ? 'T' : '.'));
         }
 }
 
@@ -782,7 +835,7 @@ int batadv_tt_global_seq_print_text(struct seq_file *seq, void *offset)
 {
         struct net_device *net_dev = (struct net_device *)seq->private;
         struct batadv_priv *bat_priv = netdev_priv(net_dev);
-        struct batadv_hashtable *hash = bat_priv->tt_global_hash;
+        struct batadv_hashtable *hash = bat_priv->tt.global_hash;
         struct batadv_tt_common_entry *tt_common_entry;
         struct batadv_tt_global_entry *tt_global;
         struct batadv_hard_iface *primary_if;
@@ -883,7 +936,7 @@ batadv_tt_global_del_struct(struct batadv_priv *bat_priv,
                    "Deleting global tt entry %pM: %s\n",
                    tt_global_entry->common.addr, message);
 
-        batadv_hash_remove(bat_priv->tt_global_hash, batadv_compare_tt,
+        batadv_hash_remove(bat_priv->tt.global_hash, batadv_compare_tt,
                            batadv_choose_orig, tt_global_entry->common.addr);
         batadv_tt_global_entry_free_ref(tt_global_entry);
 
@@ -994,7 +1047,7 @@ void batadv_tt_global_del_orig(struct batadv_priv *bat_priv,
         struct batadv_tt_global_entry *tt_global;
         struct batadv_tt_common_entry *tt_common_entry;
         uint32_t i;
-        struct batadv_hashtable *hash = bat_priv->tt_global_hash;
+        struct batadv_hashtable *hash = bat_priv->tt.global_hash;
         struct hlist_node *node, *safe;
         struct hlist_head *head;
         spinlock_t *list_lock; /* protects write access to the hash lists */
@@ -1029,49 +1082,63 @@ void batadv_tt_global_del_orig(struct batadv_priv *bat_priv,
         orig_node->tt_initialised = false;
 }
 
-static void batadv_tt_global_roam_purge_list(struct batadv_priv *bat_priv,
-                                             struct hlist_head *head)
+static bool batadv_tt_global_to_purge(struct batadv_tt_global_entry *tt_global,
+                                      char **msg)
 {
-        struct batadv_tt_common_entry *tt_common_entry;
-        struct batadv_tt_global_entry *tt_global_entry;
-        struct hlist_node *node, *node_tmp;
-
-        hlist_for_each_entry_safe(tt_common_entry, node, node_tmp, head,
-                                  hash_entry) {
-                tt_global_entry = container_of(tt_common_entry,
-                                               struct batadv_tt_global_entry,
-                                               common);
-                if (!(tt_global_entry->common.flags & BATADV_TT_CLIENT_ROAM))
-                        continue;
-                if (!batadv_has_timed_out(tt_global_entry->roam_at,
-                                          BATADV_TT_CLIENT_ROAM_TIMEOUT))
-                        continue;
+        bool purge = false;
+        unsigned long roam_timeout = BATADV_TT_CLIENT_ROAM_TIMEOUT;
+        unsigned long temp_timeout = BATADV_TT_CLIENT_TEMP_TIMEOUT;
 
-                batadv_dbg(BATADV_DBG_TT, bat_priv,
-                           "Deleting global tt entry (%pM): Roaming timeout\n",
-                           tt_global_entry->common.addr);
+        if ((tt_global->common.flags & BATADV_TT_CLIENT_ROAM) &&
+            batadv_has_timed_out(tt_global->roam_at, roam_timeout)) {
+                purge = true;
+                *msg = "Roaming timeout\n";
+        }
 
-                hlist_del_rcu(node);
-                batadv_tt_global_entry_free_ref(tt_global_entry);
+        if ((tt_global->common.flags & BATADV_TT_CLIENT_TEMP) &&
+            batadv_has_timed_out(tt_global->common.added_at, temp_timeout)) {
+                purge = true;
+                *msg = "Temporary client timeout\n";
         }
+
+        return purge;
 }
 
-static void batadv_tt_global_roam_purge(struct batadv_priv *bat_priv)
+static void batadv_tt_global_purge(struct batadv_priv *bat_priv)
 {
-        struct batadv_hashtable *hash = bat_priv->tt_global_hash;
+        struct batadv_hashtable *hash = bat_priv->tt.global_hash;
         struct hlist_head *head;
+        struct hlist_node *node, *node_tmp;
         spinlock_t *list_lock; /* protects write access to the hash lists */
         uint32_t i;
+        char *msg = NULL;
+        struct batadv_tt_common_entry *tt_common;
+        struct batadv_tt_global_entry *tt_global;
 
         for (i = 0; i < hash->size; i++) {
                 head = &hash->table[i];
                 list_lock = &hash->list_locks[i];
 
                 spin_lock_bh(list_lock);
-                batadv_tt_global_roam_purge_list(bat_priv, head);
+                hlist_for_each_entry_safe(tt_common, node, node_tmp, head,
+                                          hash_entry) {
+                        tt_global = container_of(tt_common,
+                                                 struct batadv_tt_global_entry,
+                                                 common);
+
+                        if (!batadv_tt_global_to_purge(tt_global, &msg))
+                                continue;
+
+                        batadv_dbg(BATADV_DBG_TT, bat_priv,
+                                   "Deleting global tt entry (%pM): %s\n",
+                                   tt_global->common.addr, msg);
+
+                        hlist_del_rcu(node);
+
+                        batadv_tt_global_entry_free_ref(tt_global);
+                }
                 spin_unlock_bh(list_lock);
         }
-
 }
 
 static void batadv_tt_global_table_free(struct batadv_priv *bat_priv)
@@ -1084,10 +1151,10 @@ static void batadv_tt_global_table_free(struct batadv_priv *bat_priv)
         struct hlist_head *head;
         uint32_t i;
 
-        if (!bat_priv->tt_global_hash)
+        if (!bat_priv->tt.global_hash)
                 return;
 
-        hash = bat_priv->tt_global_hash;
+        hash = bat_priv->tt.global_hash;
 
         for (i = 0; i < hash->size; i++) {
                 head = &hash->table[i];
@@ -1107,7 +1174,7 @@ static void batadv_tt_global_table_free(struct batadv_priv *bat_priv)
 
         batadv_hash_destroy(hash);
 
-        bat_priv->tt_global_hash = NULL;
+        bat_priv->tt.global_hash = NULL;
 }
 
 static bool
@@ -1186,7 +1253,7 @@ static uint16_t batadv_tt_global_crc(struct batadv_priv *bat_priv,
                                      struct batadv_orig_node *orig_node)
 {
         uint16_t total = 0, total_one;
-        struct batadv_hashtable *hash = bat_priv->tt_global_hash;
+        struct batadv_hashtable *hash = bat_priv->tt.global_hash;
         struct batadv_tt_common_entry *tt_common;
         struct batadv_tt_global_entry *tt_global;
         struct hlist_node *node;
@@ -1209,6 +1276,12 @@ static uint16_t batadv_tt_global_crc(struct batadv_priv *bat_priv,
                          */
                         if (tt_common->flags & BATADV_TT_CLIENT_ROAM)
                                 continue;
+                        /* Temporary clients have not been announced yet, so
+                         * they have to be skipped while computing the global
+                         * crc
+                         */
+                        if (tt_common->flags & BATADV_TT_CLIENT_TEMP)
+                                continue;
 
                         /* find out if this global entry is announced by this
                          * originator
@@ -1233,7 +1306,7 @@ static uint16_t batadv_tt_global_crc(struct batadv_priv *bat_priv,
 static uint16_t batadv_tt_local_crc(struct batadv_priv *bat_priv)
 {
         uint16_t total = 0, total_one;
-        struct batadv_hashtable *hash = bat_priv->tt_local_hash;
+        struct batadv_hashtable *hash = bat_priv->tt.local_hash;
         struct batadv_tt_common_entry *tt_common;
         struct hlist_node *node;
         struct hlist_head *head;
@@ -1266,14 +1339,14 @@ static void batadv_tt_req_list_free(struct batadv_priv *bat_priv)
 {
         struct batadv_tt_req_node *node, *safe;
 
-        spin_lock_bh(&bat_priv->tt_req_list_lock);
+        spin_lock_bh(&bat_priv->tt.req_list_lock);
 
-        list_for_each_entry_safe(node, safe, &bat_priv->tt_req_list, list) {
+        list_for_each_entry_safe(node, safe, &bat_priv->tt.req_list, list) {
                 list_del(&node->list);
                 kfree(node);
         }
 
-        spin_unlock_bh(&bat_priv->tt_req_list_lock);
+        spin_unlock_bh(&bat_priv->tt.req_list_lock);
 }
 
 static void batadv_tt_save_orig_buffer(struct batadv_priv *bat_priv,
@@ -1303,15 +1376,15 @@ static void batadv_tt_req_purge(struct batadv_priv *bat_priv)
 {
         struct batadv_tt_req_node *node, *safe;
 
-        spin_lock_bh(&bat_priv->tt_req_list_lock);
-        list_for_each_entry_safe(node, safe, &bat_priv->tt_req_list, list) {
+        spin_lock_bh(&bat_priv->tt.req_list_lock);
+        list_for_each_entry_safe(node, safe, &bat_priv->tt.req_list, list) {
                 if (batadv_has_timed_out(node->issued_at,
                                          BATADV_TT_REQUEST_TIMEOUT)) {
                         list_del(&node->list);
                         kfree(node);
                 }
         }
-        spin_unlock_bh(&bat_priv->tt_req_list_lock);
+        spin_unlock_bh(&bat_priv->tt.req_list_lock);
 }
 
 /* returns the pointer to the new tt_req_node struct if no request
@@ -1323,8 +1396,8 @@ batadv_new_tt_req_node(struct batadv_priv *bat_priv,
 {
         struct batadv_tt_req_node *tt_req_node_tmp, *tt_req_node = NULL;
 
-        spin_lock_bh(&bat_priv->tt_req_list_lock);
-        list_for_each_entry(tt_req_node_tmp, &bat_priv->tt_req_list, list) {
+        spin_lock_bh(&bat_priv->tt.req_list_lock);
+        list_for_each_entry(tt_req_node_tmp, &bat_priv->tt.req_list, list) {
                 if (batadv_compare_eth(tt_req_node_tmp, orig_node) &&
                     !batadv_has_timed_out(tt_req_node_tmp->issued_at,
                                           BATADV_TT_REQUEST_TIMEOUT))
@@ -1338,9 +1411,9 @@ batadv_new_tt_req_node(struct batadv_priv *bat_priv,
         memcpy(tt_req_node->addr, orig_node->orig, ETH_ALEN);
         tt_req_node->issued_at = jiffies;
 
-        list_add(&tt_req_node->list, &bat_priv->tt_req_list);
+        list_add(&tt_req_node->list, &bat_priv->tt.req_list);
 unlock:
-        spin_unlock_bh(&bat_priv->tt_req_list_lock);
+        spin_unlock_bh(&bat_priv->tt.req_list_lock);
         return tt_req_node;
 }
 
@@ -1362,7 +1435,8 @@ static int batadv_tt_global_valid(const void *entry_ptr,
         const struct batadv_tt_global_entry *tt_global_entry;
         const struct batadv_orig_node *orig_node = data_ptr;
 
-        if (tt_common_entry->flags & BATADV_TT_CLIENT_ROAM)
+        if (tt_common_entry->flags & BATADV_TT_CLIENT_ROAM ||
+            tt_common_entry->flags & BATADV_TT_CLIENT_TEMP)
                 return 0;
 
         tt_global_entry = container_of(tt_common_entry,
@@ -1506,9 +1580,9 @@ out:
         if (ret)
                 kfree_skb(skb);
         if (ret && tt_req_node) {
-                spin_lock_bh(&bat_priv->tt_req_list_lock);
+                spin_lock_bh(&bat_priv->tt.req_list_lock);
                 list_del(&tt_req_node->list);
-                spin_unlock_bh(&bat_priv->tt_req_list_lock);
+                spin_unlock_bh(&bat_priv->tt.req_list_lock);
                 kfree(tt_req_node);
         }
         return ret;
@@ -1529,6 +1603,7 @@ batadv_send_other_tt_response(struct batadv_priv *bat_priv,
         uint16_t tt_len, tt_tot;
         struct sk_buff *skb = NULL;
         struct batadv_tt_query_packet *tt_response;
+        uint8_t *packet_pos;
         size_t len;
 
         batadv_dbg(BATADV_DBG_TT, bat_priv,
@@ -1582,8 +1657,8 @@ batadv_send_other_tt_response(struct batadv_priv *bat_priv,
                         goto unlock;
 
                 skb_reserve(skb, ETH_HLEN);
-                tt_response = (struct batadv_tt_query_packet *)skb_put(skb,
-                                                                       len);
+                packet_pos = skb_put(skb, len);
+                tt_response = (struct batadv_tt_query_packet *)packet_pos;
                 tt_response->ttvn = req_ttvn;
                 tt_response->tt_data = htons(tt_tot);
 
@@ -1599,7 +1674,7 @@ batadv_send_other_tt_response(struct batadv_priv *bat_priv,
                 ttvn = (uint8_t)atomic_read(&req_dst_orig_node->last_ttvn);
 
                 skb = batadv_tt_response_fill_table(tt_len, ttvn,
-                                                    bat_priv->tt_global_hash,
+                                                    bat_priv->tt.global_hash,
                                                     primary_if,
                                                     batadv_tt_global_valid,
                                                     req_dst_orig_node);
@@ -1662,6 +1737,7 @@ batadv_send_my_tt_response(struct batadv_priv *bat_priv,
         uint16_t tt_len, tt_tot;
         struct sk_buff *skb = NULL;
         struct batadv_tt_query_packet *tt_response;
+        uint8_t *packet_pos;
         size_t len;
 
         batadv_dbg(BATADV_DBG_TT, bat_priv,
@@ -1670,7 +1746,7 @@ batadv_send_my_tt_response(struct batadv_priv *bat_priv,
                    (tt_request->flags & BATADV_TT_FULL_TABLE ? 'F' : '.'));
 
 
-        my_ttvn = (uint8_t)atomic_read(&bat_priv->ttvn);
+        my_ttvn = (uint8_t)atomic_read(&bat_priv->tt.vn);
         req_ttvn = tt_request->ttvn;
 
         orig_node = batadv_orig_hash_find(bat_priv, tt_request->src);
@@ -1689,7 +1765,7 @@ batadv_send_my_tt_response(struct batadv_priv *bat_priv,
          * is too big send the whole local translation table
          */
         if (tt_request->flags & BATADV_TT_FULL_TABLE || my_ttvn != req_ttvn ||
-            !bat_priv->tt_buff)
+            !bat_priv->tt.last_changeset)
                 full_table = true;
         else
                 full_table = false;
@@ -1698,8 +1774,8 @@ batadv_send_my_tt_response(struct batadv_priv *bat_priv,
          * I'll send only one packet with as much TT entries as I can
          */
         if (!full_table) {
-                spin_lock_bh(&bat_priv->tt_buff_lock);
-                tt_len = bat_priv->tt_buff_len;
+                spin_lock_bh(&bat_priv->tt.last_changeset_lock);
+                tt_len = bat_priv->tt.last_changeset_len;
                 tt_tot = tt_len / sizeof(struct batadv_tt_change);
 
                 len = sizeof(*tt_response) + tt_len;
@@ -1708,22 +1784,22 @@ batadv_send_my_tt_response(struct batadv_priv *bat_priv,
                         goto unlock;
 
                 skb_reserve(skb, ETH_HLEN);
-                tt_response = (struct batadv_tt_query_packet *)skb_put(skb,
-                                                                       len);
+                packet_pos = skb_put(skb, len);
+                tt_response = (struct batadv_tt_query_packet *)packet_pos;
                 tt_response->ttvn = req_ttvn;
                 tt_response->tt_data = htons(tt_tot);
 
                 tt_buff = skb->data + sizeof(*tt_response);
-                memcpy(tt_buff, bat_priv->tt_buff,
-                       bat_priv->tt_buff_len);
-                spin_unlock_bh(&bat_priv->tt_buff_lock);
+                memcpy(tt_buff, bat_priv->tt.last_changeset,
+                       bat_priv->tt.last_changeset_len);
+                spin_unlock_bh(&bat_priv->tt.last_changeset_lock);
         } else {
-                tt_len = (uint16_t)atomic_read(&bat_priv->num_local_tt);
+                tt_len = (uint16_t)atomic_read(&bat_priv->tt.local_entry_num);
                 tt_len *= sizeof(struct batadv_tt_change);
-                ttvn = (uint8_t)atomic_read(&bat_priv->ttvn);
+                ttvn = (uint8_t)atomic_read(&bat_priv->tt.vn);
 
                 skb = batadv_tt_response_fill_table(tt_len, ttvn,
-                                                    bat_priv->tt_local_hash,
+                                                    bat_priv->tt.local_hash,
                                                     primary_if,
                                                     batadv_tt_local_valid_entry,
                                                     NULL);
@@ -1755,7 +1831,7 @@ batadv_send_my_tt_response(struct batadv_priv *bat_priv,
         goto out;
 
 unlock:
-        spin_unlock_bh(&bat_priv->tt_buff_lock);
+        spin_unlock_bh(&bat_priv->tt.last_changeset_lock);
 out:
         if (orig_node)
                 batadv_orig_node_free_ref(orig_node);
@@ -1908,14 +1984,14 @@ void batadv_handle_tt_response(struct batadv_priv *bat_priv,
         }
 
         /* Delete the tt_req_node from pending tt_requests list */
-        spin_lock_bh(&bat_priv->tt_req_list_lock);
-        list_for_each_entry_safe(node, safe, &bat_priv->tt_req_list, list) {
+        spin_lock_bh(&bat_priv->tt.req_list_lock);
+        list_for_each_entry_safe(node, safe, &bat_priv->tt.req_list, list) {
                 if (!batadv_compare_eth(node->addr, tt_response->src))
                         continue;
                 list_del(&node->list);
                 kfree(node);
         }
-        spin_unlock_bh(&bat_priv->tt_req_list_lock);
+        spin_unlock_bh(&bat_priv->tt.req_list_lock);
 
         /* Recalculate the CRC for this orig_node and store it */
         orig_node->tt_crc = batadv_tt_global_crc(bat_priv, orig_node);
@@ -1949,22 +2025,22 @@ static void batadv_tt_roam_list_free(struct batadv_priv *bat_priv)
 {
         struct batadv_tt_roam_node *node, *safe;
 
-        spin_lock_bh(&bat_priv->tt_roam_list_lock);
+        spin_lock_bh(&bat_priv->tt.roam_list_lock);
 
-        list_for_each_entry_safe(node, safe, &bat_priv->tt_roam_list, list) {
+        list_for_each_entry_safe(node, safe, &bat_priv->tt.roam_list, list) {
                 list_del(&node->list);
                 kfree(node);
         }
 
-        spin_unlock_bh(&bat_priv->tt_roam_list_lock);
+        spin_unlock_bh(&bat_priv->tt.roam_list_lock);
 }
 
 static void batadv_tt_roam_purge(struct batadv_priv *bat_priv)
 {
         struct batadv_tt_roam_node *node, *safe;
 
-        spin_lock_bh(&bat_priv->tt_roam_list_lock);
-        list_for_each_entry_safe(node, safe, &bat_priv->tt_roam_list, list) {
+        spin_lock_bh(&bat_priv->tt.roam_list_lock);
+        list_for_each_entry_safe(node, safe, &bat_priv->tt.roam_list, list) {
                 if (!batadv_has_timed_out(node->first_time,
                                           BATADV_ROAMING_MAX_TIME))
                         continue;
@@ -1972,7 +2048,7 @@ static void batadv_tt_roam_purge(struct batadv_priv *bat_priv)
                 list_del(&node->list);
                 kfree(node);
         }
-        spin_unlock_bh(&bat_priv->tt_roam_list_lock);
+        spin_unlock_bh(&bat_priv->tt.roam_list_lock);
 }
 
 /* This function checks whether the client already reached the
@@ -1987,11 +2063,11 @@ static bool batadv_tt_check_roam_count(struct batadv_priv *bat_priv,
         struct batadv_tt_roam_node *tt_roam_node;
         bool ret = false;
 
-        spin_lock_bh(&bat_priv->tt_roam_list_lock);
+        spin_lock_bh(&bat_priv->tt.roam_list_lock);
         /* The new tt_req will be issued only if I'm not waiting for a
          * reply from the same orig_node yet
          */
-        list_for_each_entry(tt_roam_node, &bat_priv->tt_roam_list, list) {
+        list_for_each_entry(tt_roam_node, &bat_priv->tt.roam_list, list) {
                 if (!batadv_compare_eth(tt_roam_node->addr, client))
                         continue;
 
@@ -2016,12 +2092,12 @@ static bool batadv_tt_check_roam_count(struct batadv_priv *bat_priv,
                            BATADV_ROAMING_MAX_COUNT - 1);
                 memcpy(tt_roam_node->addr, client, ETH_ALEN);
 
-                list_add(&tt_roam_node->list, &bat_priv->tt_roam_list);
+                list_add(&tt_roam_node->list, &bat_priv->tt.roam_list);
                 ret = true;
         }
 
 unlock:
-        spin_unlock_bh(&bat_priv->tt_roam_list_lock);
+        spin_unlock_bh(&bat_priv->tt.roam_list_lock);
         return ret;
 }
 
@@ -2085,13 +2161,15 @@ out:
 static void batadv_tt_purge(struct work_struct *work)
 {
         struct delayed_work *delayed_work;
+        struct batadv_priv_tt *priv_tt;
         struct batadv_priv *bat_priv;
 
         delayed_work = container_of(work, struct delayed_work, work);
-        bat_priv = container_of(delayed_work, struct batadv_priv, tt_work);
+        priv_tt = container_of(delayed_work, struct batadv_priv_tt, work);
+        bat_priv = container_of(priv_tt, struct batadv_priv, tt);
 
         batadv_tt_local_purge(bat_priv);
-        batadv_tt_global_roam_purge(bat_priv);
+        batadv_tt_global_purge(bat_priv);
         batadv_tt_req_purge(bat_priv);
         batadv_tt_roam_purge(bat_priv);
 
@@ -2100,7 +2178,7 @@ static void batadv_tt_purge(struct work_struct *work)
 
 void batadv_tt_free(struct batadv_priv *bat_priv)
 {
-        cancel_delayed_work_sync(&bat_priv->tt_work);
+        cancel_delayed_work_sync(&bat_priv->tt.work);
 
         batadv_tt_local_table_free(bat_priv);
         batadv_tt_global_table_free(bat_priv);
@@ -2108,7 +2186,7 @@ void batadv_tt_free(struct batadv_priv *bat_priv)
         batadv_tt_changes_list_free(bat_priv);
         batadv_tt_roam_list_free(bat_priv);
 
-        kfree(bat_priv->tt_buff);
+        kfree(bat_priv->tt.last_changeset);
 }
 
 /* This function will enable or disable the specified flags for all the entries
@@ -2152,7 +2230,7 @@ out:
 /* Purge out all the tt local entries marked with BATADV_TT_CLIENT_PENDING */
 static void batadv_tt_local_purge_pending_clients(struct batadv_priv *bat_priv)
 {
-        struct batadv_hashtable *hash = bat_priv->tt_local_hash;
+        struct batadv_hashtable *hash = bat_priv->tt.local_hash;
         struct batadv_tt_common_entry *tt_common;
         struct batadv_tt_local_entry *tt_local;
         struct hlist_node *node, *node_tmp;
@@ -2177,7 +2255,7 @@ static void batadv_tt_local_purge_pending_clients(struct batadv_priv *bat_priv)
                                    "Deleting local tt entry (%pM): pending\n",
                                    tt_common->addr);
 
-                        atomic_dec(&bat_priv->num_local_tt);
+                        atomic_dec(&bat_priv->tt.local_entry_num);
                         hlist_del_rcu(node);
                         tt_local = container_of(tt_common,
                                                 struct batadv_tt_local_entry,
@@ -2195,26 +2273,26 @@ static int batadv_tt_commit_changes(struct batadv_priv *bat_priv,
 {
         uint16_t changed_num = 0;
 
-        if (atomic_read(&bat_priv->tt_local_changes) < 1)
+        if (atomic_read(&bat_priv->tt.local_changes) < 1)
                 return -ENOENT;
 
-        changed_num = batadv_tt_set_flags(bat_priv->tt_local_hash,
+        changed_num = batadv_tt_set_flags(bat_priv->tt.local_hash,
                                           BATADV_TT_CLIENT_NEW, false);
 
         /* all reset entries have to be counted as local entries */
-        atomic_add(changed_num, &bat_priv->num_local_tt);
+        atomic_add(changed_num, &bat_priv->tt.local_entry_num);
         batadv_tt_local_purge_pending_clients(bat_priv);
-        bat_priv->tt_crc = batadv_tt_local_crc(bat_priv);
+        bat_priv->tt.local_crc = batadv_tt_local_crc(bat_priv);
 
         /* Increment the TTVN only once per OGM interval */
-        atomic_inc(&bat_priv->ttvn);
+        atomic_inc(&bat_priv->tt.vn);
         batadv_dbg(BATADV_DBG_TT, bat_priv,
                    "Local changes committed, updating to ttvn %u\n",
-                   (uint8_t)atomic_read(&bat_priv->ttvn));
-        bat_priv->tt_poss_change = false;
+                   (uint8_t)atomic_read(&bat_priv->tt.vn));
+        bat_priv->tt.poss_change = false;
 
         /* reset the sending counter */
-        atomic_set(&bat_priv->tt_ogm_append_cnt, BATADV_TT_OGM_APPEND_MAX);
+        atomic_set(&bat_priv->tt.ogm_append_cnt, BATADV_TT_OGM_APPEND_MAX);
 
         return batadv_tt_changes_fill_buff(bat_priv, packet_buff,
                                            packet_buff_len, packet_min_len);
@@ -2234,7 +2312,7 @@ int batadv_tt_append_diff(struct batadv_priv *bat_priv,
 
         /* if the changes have been sent often enough */
         if ((tt_num_changes < 0) &&
-            (!batadv_atomic_dec_not_zero(&bat_priv->tt_ogm_append_cnt))) {
+            (!batadv_atomic_dec_not_zero(&bat_priv->tt.ogm_append_cnt))) {
                 batadv_tt_realloc_packet_buff(packet_buff, packet_buff_len,
                                               packet_min_len, packet_min_len);
                 tt_num_changes = 0;
@@ -2365,3 +2443,22 @@ bool batadv_tt_global_client_is_roaming(struct batadv_priv *bat_priv,
 out:
         return ret;
 }
+
+bool batadv_tt_add_temporary_global_entry(struct batadv_priv *bat_priv,
+                                          struct batadv_orig_node *orig_node,
+                                          const unsigned char *addr)
+{
+        bool ret = false;
+
+        if (!batadv_tt_global_add(bat_priv, orig_node, addr,
+                                  BATADV_TT_CLIENT_TEMP,
+                                  atomic_read(&orig_node->last_ttvn)))
+                goto out;
+
+        batadv_dbg(BATADV_DBG_TT, bat_priv,
+                   "Added temporary global client (addr: %pM orig: %pM)\n",
+                   addr, orig_node->orig);
+        ret = true;
+out:
+        return ret;
+}
diff --git a/net/batman-adv/translation-table.h b/net/batman-adv/translation-table.h
index ffa87355096b..811fffd4760c 100644
--- a/net/batman-adv/translation-table.h
+++ b/net/batman-adv/translation-table.h
@@ -59,6 +59,8 @@ int batadv_tt_append_diff(struct batadv_priv *bat_priv,
                           int packet_min_len);
 bool batadv_tt_global_client_is_roaming(struct batadv_priv *bat_priv,
                                         uint8_t *addr);
-
+bool batadv_tt_add_temporary_global_entry(struct batadv_priv *bat_priv,
+                                          struct batadv_orig_node *orig_node,
+                                          const unsigned char *addr);
 
 #endif /* _NET_BATMAN_ADV_TRANSLATION_TABLE_H_ */
diff --git a/net/batman-adv/types.h b/net/batman-adv/types.h
index 12635fd2c3d3..2ed82caacdca 100644
--- a/net/batman-adv/types.h
+++ b/net/batman-adv/types.h
@@ -145,6 +145,11 @@ struct batadv_bcast_duplist_entry {
 #endif
 
 enum batadv_counters {
+        BATADV_CNT_TX,
+        BATADV_CNT_TX_BYTES,
+        BATADV_CNT_TX_DROPPED,
+        BATADV_CNT_RX,
+        BATADV_CNT_RX_BYTES,
         BATADV_CNT_FORWARD,
         BATADV_CNT_FORWARD_BYTES,
         BATADV_CNT_MGMT_TX,
@@ -160,6 +165,67 @@ enum batadv_counters {
         BATADV_CNT_NUM,
 };
 
+/**
+ * struct batadv_priv_tt - per mesh interface translation table data
+ * @vn: translation table version number
+ * @local_changes: changes registered in an originator interval
+ * @poss_change: Detect an ongoing roaming phase. If true, then this node
+ *  received a roaming_adv and has to inspect every packet directed to it to
+ *  check whether it still is the true destination or not. This flag will be
+ *  reset to false as soon as the this node's ttvn is increased
+ * @changes_list: tracks tt local changes within an originator interval
+ * @req_list: list of pending tt_requests
+ * @local_crc: Checksum of the local table, recomputed before sending a new OGM
+ */
+struct batadv_priv_tt {
+        atomic_t vn;
+        atomic_t ogm_append_cnt;
+        atomic_t local_changes;
+        bool poss_change;
+        struct list_head changes_list;
+        struct batadv_hashtable *local_hash;
+        struct batadv_hashtable *global_hash;
+        struct list_head req_list;
+        struct list_head roam_list;
+        spinlock_t changes_list_lock; /* protects changes */
+        spinlock_t req_list_lock; /* protects req_list */
+        spinlock_t roam_list_lock; /* protects roam_list */
+        atomic_t local_entry_num;
+        uint16_t local_crc;
+        unsigned char *last_changeset;
+        int16_t last_changeset_len;
+        spinlock_t last_changeset_lock; /* protects last_changeset */
+        struct delayed_work work;
+};
+
+#ifdef CONFIG_BATMAN_ADV_BLA
+struct batadv_priv_bla {
+        atomic_t num_requests; /* number of bla requests in flight */
+        struct batadv_hashtable *claim_hash;
+        struct batadv_hashtable *backbone_hash;
+        struct batadv_bcast_duplist_entry bcast_duplist[BATADV_DUPLIST_SIZE];
+        int bcast_duplist_curr;
+        struct batadv_bla_claim_dst claim_dest;
+        struct delayed_work work;
+};
+#endif
+
+struct batadv_priv_gw {
+        struct hlist_head list;
+        spinlock_t list_lock; /* protects gw_list and curr_gw */
+        struct batadv_gw_node __rcu *curr_gw;  /* rcu protected pointer */
+        atomic_t reselect;
+};
+
+struct batadv_priv_vis {
+        struct list_head send_list;
+        struct batadv_hashtable *hash;
+        spinlock_t hash_lock; /* protects hash */
+        spinlock_t list_lock; /* protects info::recv_list */
+        struct delayed_work work;
+        struct batadv_vis_info *my_info;
+};
+
 struct batadv_priv {
         atomic_t mesh_state;
         struct net_device_stats stats;
@@ -179,64 +245,24 @@ struct batadv_priv {
         atomic_t bcast_seqno;
         atomic_t bcast_queue_left;
         atomic_t batman_queue_left;
-        atomic_t ttvn; /* translation table version number */
-        atomic_t tt_ogm_append_cnt;
-        atomic_t tt_local_changes; /* changes registered in a OGM interval */
-        atomic_t bla_num_requests; /* number of bla requests in flight */
-        /* The tt_poss_change flag is used to detect an ongoing roaming phase.
-         * If true, then I received a Roaming_adv and I have to inspect every
-         * packet directed to me to check whether I am still the true
-         * destination or not. This flag will be reset to false as soon as I
-         * increase my TTVN
-         */
-        bool tt_poss_change;
         char num_ifaces;
         struct batadv_debug_log *debug_log;
         struct kobject *mesh_obj;
         struct dentry *debug_dir;
         struct hlist_head forw_bat_list;
         struct hlist_head forw_bcast_list;
-        struct hlist_head gw_list;
-        struct list_head tt_changes_list; /* tracks changes in a OGM int */
-        struct list_head vis_send_list;
         struct batadv_hashtable *orig_hash;
-        struct batadv_hashtable *tt_local_hash;
-        struct batadv_hashtable *tt_global_hash;
-#ifdef CONFIG_BATMAN_ADV_BLA
-        struct batadv_hashtable *claim_hash;
-        struct batadv_hashtable *backbone_hash;
-#endif
-        struct list_head tt_req_list; /* list of pending tt_requests */
-        struct list_head tt_roam_list;
-        struct batadv_hashtable *vis_hash;
-#ifdef CONFIG_BATMAN_ADV_BLA
-        struct batadv_bcast_duplist_entry bcast_duplist[BATADV_DUPLIST_SIZE];
-        int bcast_duplist_curr;
-        struct batadv_bla_claim_dst claim_dest;
-#endif
         spinlock_t forw_bat_list_lock; /* protects forw_bat_list */
         spinlock_t forw_bcast_list_lock; /* protects  */
-        spinlock_t tt_changes_list_lock; /* protects tt_changes */
-        spinlock_t tt_req_list_lock; /* protects tt_req_list */
-        spinlock_t tt_roam_list_lock; /* protects tt_roam_list */
-        spinlock_t gw_list_lock; /* protects gw_list and curr_gw */
-        spinlock_t vis_hash_lock; /* protects vis_hash */
-        spinlock_t vis_list_lock; /* protects vis_info::recv_list */
-        atomic_t num_local_tt;
-        /* Checksum of the local table, recomputed before sending a new OGM */
-        uint16_t tt_crc;
-        unsigned char *tt_buff;
-        int16_t tt_buff_len;
-        spinlock_t tt_buff_lock; /* protects tt_buff */
-        struct delayed_work tt_work;
         struct delayed_work orig_work;
-        struct delayed_work vis_work;
-        struct delayed_work bla_work;
-        struct batadv_gw_node __rcu *curr_gw;  /* rcu protected pointer */
-        atomic_t gw_reselect;
         struct batadv_hard_iface __rcu *primary_if;  /* rcu protected pointer */
-        struct batadv_vis_info *my_vis_info;
         struct batadv_algo_ops *bat_algo_ops;
+#ifdef CONFIG_BATMAN_ADV_BLA
+        struct batadv_priv_bla bla;
+#endif
+        struct batadv_priv_gw gw;
+        struct batadv_priv_tt tt;
+        struct batadv_priv_vis vis;
 };
 
 struct batadv_socket_client {
@@ -258,6 +284,7 @@ struct batadv_tt_common_entry {
         uint8_t addr[ETH_ALEN];
         struct hlist_node hash_entry;
         uint16_t flags;
+        unsigned long added_at;
         atomic_t refcount;
         struct rcu_head rcu;
 };
@@ -277,6 +304,7 @@ struct batadv_tt_global_entry {
 struct batadv_tt_orig_list_entry {
         struct batadv_orig_node *orig_node;
         uint8_t ttvn;
+        atomic_t refcount;
         struct rcu_head rcu;
         struct hlist_node list;
 };
diff --git a/net/batman-adv/unicast.c b/net/batman-adv/unicast.c
index 00164645b3f7..f39723281ca1 100644
--- a/net/batman-adv/unicast.c
+++ b/net/batman-adv/unicast.c
@@ -39,6 +39,7 @@ batadv_frag_merge_packet(struct list_head *head,
         struct batadv_unicast_packet *unicast_packet;
         int hdr_len = sizeof(*unicast_packet);
         int uni_diff = sizeof(*up) - hdr_len;
+        uint8_t *packet_pos;
 
         up = (struct batadv_unicast_frag_packet *)skb->data;
         /* set skb to the first part and tmp_skb to the second part */
@@ -65,8 +66,8 @@ batadv_frag_merge_packet(struct list_head *head,
         kfree_skb(tmp_skb);
 
         memmove(skb->data + uni_diff, skb->data, hdr_len);
-        unicast_packet = (struct batadv_unicast_packet *)skb_pull(skb,
-                                                                  uni_diff);
+        packet_pos = skb_pull(skb, uni_diff);
+        unicast_packet = (struct batadv_unicast_packet *)packet_pos;
         unicast_packet->header.packet_type = BATADV_UNICAST;
 
         return skb;
@@ -121,6 +122,7 @@ batadv_frag_search_packet(struct list_head *head,
 {
         struct batadv_frag_packet_list_entry *tfp;
         struct batadv_unicast_frag_packet *tmp_up = NULL;
+        int is_head_tmp, is_head;
         uint16_t search_seqno;
 
         if (up->flags & BATADV_UNI_FRAG_HEAD)
@@ -128,6 +130,8 @@ batadv_frag_search_packet(struct list_head *head,
         else
                 search_seqno = ntohs(up->seqno)-1;
 
+        is_head = !!(up->flags & BATADV_UNI_FRAG_HEAD);
+
         list_for_each_entry(tfp, head, list) {
 
                 if (!tfp->skb)
@@ -139,9 +143,8 @@ batadv_frag_search_packet(struct list_head *head,
                 tmp_up = (struct batadv_unicast_frag_packet *)tfp->skb->data;
 
                 if (tfp->seqno == search_seqno) {
-
-                        if ((tmp_up->flags & BATADV_UNI_FRAG_HEAD) !=
-                            (up->flags & BATADV_UNI_FRAG_HEAD))
+                        is_head_tmp = !!(tmp_up->flags & BATADV_UNI_FRAG_HEAD);
+                        if (is_head_tmp != is_head)
                                 return tfp;
                         else
                                 goto mov_tail;
@@ -334,8 +337,7 @@ find_router:
         /* copy the destination for faster routing */
         memcpy(unicast_packet->dest, orig_node->orig, ETH_ALEN);
         /* set the destination tt version number */
-        unicast_packet->ttvn =
-                (uint8_t)atomic_read(&orig_node->last_ttvn);
+        unicast_packet->ttvn = (uint8_t)atomic_read(&orig_node->last_ttvn);
 
         /* inform the destination node that we are still missing a correct route
          * for this client. The destination will receive this packet and will
diff --git a/net/batman-adv/vis.c b/net/batman-adv/vis.c
index 2a2ea0681469..5abd1454fb07 100644
--- a/net/batman-adv/vis.c
+++ b/net/batman-adv/vis.c
@@ -41,13 +41,13 @@ static void batadv_free_info(struct kref *ref)
         bat_priv = info->bat_priv;
 
         list_del_init(&info->send_list);
-        spin_lock_bh(&bat_priv->vis_list_lock);
+        spin_lock_bh(&bat_priv->vis.list_lock);
         list_for_each_entry_safe(entry, tmp, &info->recv_list, list) {
                 list_del(&entry->list);
                 kfree(entry);
         }
 
-        spin_unlock_bh(&bat_priv->vis_list_lock);
+        spin_unlock_bh(&bat_priv->vis.list_lock);
         kfree_skb(info->skb_packet);
         kfree(info);
 }
@@ -94,7 +94,7 @@ static uint32_t batadv_vis_info_choose(const void *data, uint32_t size)
 static struct batadv_vis_info *
 batadv_vis_hash_find(struct batadv_priv *bat_priv, const void *data)
 {
-        struct batadv_hashtable *hash = bat_priv->vis_hash;
+        struct batadv_hashtable *hash = bat_priv->vis.hash;
         struct hlist_head *head;
         struct hlist_node *node;
         struct batadv_vis_info *vis_info, *vis_info_tmp = NULL;
@@ -252,7 +252,7 @@ int batadv_vis_seq_print_text(struct seq_file *seq, void *offset)
         struct hlist_head *head;
         struct net_device *net_dev = (struct net_device *)seq->private;
         struct batadv_priv *bat_priv = netdev_priv(net_dev);
-        struct batadv_hashtable *hash = bat_priv->vis_hash;
+        struct batadv_hashtable *hash = bat_priv->vis.hash;
         uint32_t i;
         int ret = 0;
         int vis_server = atomic_read(&bat_priv->vis_mode);
@@ -264,12 +264,12 @@ int batadv_vis_seq_print_text(struct seq_file *seq, void *offset)
         if (vis_server == BATADV_VIS_TYPE_CLIENT_UPDATE)
                 goto out;
 
-        spin_lock_bh(&bat_priv->vis_hash_lock);
+        spin_lock_bh(&bat_priv->vis.hash_lock);
         for (i = 0; i < hash->size; i++) {
                 head = &hash->table[i];
                 batadv_vis_seq_print_text_bucket(seq, head);
         }
-        spin_unlock_bh(&bat_priv->vis_hash_lock);
+        spin_unlock_bh(&bat_priv->vis.hash_lock);
 
 out:
         if (primary_if)
@@ -285,7 +285,7 @@ static void batadv_send_list_add(struct batadv_priv *bat_priv,
 {
         if (list_empty(&info->send_list)) {
                 kref_get(&info->refcount);
-                list_add_tail(&info->send_list, &bat_priv->vis_send_list);
+                list_add_tail(&info->send_list, &bat_priv->vis.send_list);
         }
 }
 
@@ -311,9 +311,9 @@ static void batadv_recv_list_add(struct batadv_priv *bat_priv,
                 return;
 
         memcpy(entry->mac, mac, ETH_ALEN);
-        spin_lock_bh(&bat_priv->vis_list_lock);
+        spin_lock_bh(&bat_priv->vis.list_lock);
         list_add_tail(&entry->list, recv_list);
-        spin_unlock_bh(&bat_priv->vis_list_lock);
+        spin_unlock_bh(&bat_priv->vis.list_lock);
 }
 
 /* returns 1 if this mac is in the recv_list */
@@ -323,14 +323,14 @@ static int batadv_recv_list_is_in(struct batadv_priv *bat_priv,
 {
         const struct batadv_recvlist_node *entry;
 
-        spin_lock_bh(&bat_priv->vis_list_lock);
+        spin_lock_bh(&bat_priv->vis.list_lock);
         list_for_each_entry(entry, recv_list, list) {
                 if (batadv_compare_eth(entry->mac, mac)) {
-                        spin_unlock_bh(&bat_priv->vis_list_lock);
+                        spin_unlock_bh(&bat_priv->vis.list_lock);
                         return 1;
                 }
         }
-        spin_unlock_bh(&bat_priv->vis_list_lock);
+        spin_unlock_bh(&bat_priv->vis.list_lock);
         return 0;
 }
 
@@ -354,7 +354,7 @@ batadv_add_packet(struct batadv_priv *bat_priv,
 
         *is_new = 0;
         /* sanity check */
-        if (!bat_priv->vis_hash)
+        if (!bat_priv->vis.hash)
                 return NULL;
 
         /* see if the packet is already in vis_hash */
@@ -385,7 +385,7 @@ batadv_add_packet(struct batadv_priv *bat_priv,
                         }
                 }
                 /* remove old entry */
-                batadv_hash_remove(bat_priv->vis_hash, batadv_vis_info_cmp,
+                batadv_hash_remove(bat_priv->vis.hash, batadv_vis_info_cmp,
                                    batadv_vis_info_choose, old_info);
                 batadv_send_list_del(old_info);
                 kref_put(&old_info->refcount, batadv_free_info);
@@ -426,7 +426,7 @@ batadv_add_packet(struct batadv_priv *bat_priv,
         batadv_recv_list_add(bat_priv, &info->recv_list, packet->sender_orig);
 
         /* try to add it */
-        hash_added = batadv_hash_add(bat_priv->vis_hash, batadv_vis_info_cmp,
+        hash_added = batadv_hash_add(bat_priv->vis.hash, batadv_vis_info_cmp,
                                      batadv_vis_info_choose, info,
                                      &info->hash_entry);
         if (hash_added != 0) {
@@ -449,7 +449,7 @@ void batadv_receive_server_sync_packet(struct batadv_priv *bat_priv,
 
         make_broadcast = (vis_server == BATADV_VIS_TYPE_SERVER_SYNC);
 
-        spin_lock_bh(&bat_priv->vis_hash_lock);
+        spin_lock_bh(&bat_priv->vis.hash_lock);
         info = batadv_add_packet(bat_priv, vis_packet, vis_info_len,
                                  &is_new, make_broadcast);
         if (!info)
@@ -461,7 +461,7 @@ void batadv_receive_server_sync_packet(struct batadv_priv *bat_priv,
         if (vis_server == BATADV_VIS_TYPE_SERVER_SYNC && is_new)
                 batadv_send_list_add(bat_priv, info);
 end:
-        spin_unlock_bh(&bat_priv->vis_hash_lock);
+        spin_unlock_bh(&bat_priv->vis.hash_lock);
 }
 
 /* handle an incoming client update packet and schedule forward if needed. */
@@ -484,7 +484,7 @@ void batadv_receive_client_update_packet(struct batadv_priv *bat_priv,
             batadv_is_my_mac(vis_packet->target_orig))
                 are_target = 1;
 
-        spin_lock_bh(&bat_priv->vis_hash_lock);
+        spin_lock_bh(&bat_priv->vis.hash_lock);
         info = batadv_add_packet(bat_priv, vis_packet, vis_info_len,
                                  &is_new, are_target);
 
@@ -505,7 +505,7 @@ void batadv_receive_client_update_packet(struct batadv_priv *bat_priv,
         }
 
 end:
-        spin_unlock_bh(&bat_priv->vis_hash_lock);
+        spin_unlock_bh(&bat_priv->vis.hash_lock);
 }
 
 /* Walk the originators and find the VIS server with the best tq. Set the packet
@@ -574,10 +574,11 @@ static int batadv_generate_vis_packet(struct batadv_priv *bat_priv)
         struct hlist_head *head;
         struct batadv_orig_node *orig_node;
         struct batadv_neigh_node *router;
-        struct batadv_vis_info *info = bat_priv->my_vis_info;
+        struct batadv_vis_info *info = bat_priv->vis.my_info;
         struct batadv_vis_packet *packet;
         struct batadv_vis_info_entry *entry;
         struct batadv_tt_common_entry *tt_common_entry;
+        uint8_t *packet_pos;
         int best_tq = -1;
         uint32_t i;
 
@@ -618,8 +619,8 @@ static int batadv_generate_vis_packet(struct batadv_priv *bat_priv)
                                 goto next;
 
                         /* fill one entry into buffer. */
-                        entry = (struct batadv_vis_info_entry *)
-                                      skb_put(info->skb_packet, sizeof(*entry));
+                        packet_pos = skb_put(info->skb_packet, sizeof(*entry));
+                        entry = (struct batadv_vis_info_entry *)packet_pos;
                         memcpy(entry->src,
                                router->if_incoming->net_dev->dev_addr,
                                ETH_ALEN);
@@ -636,7 +637,7 @@ next:
                 rcu_read_unlock();
         }
 
-        hash = bat_priv->tt_local_hash;
+        hash = bat_priv->tt.local_hash;
 
         for (i = 0; i < hash->size; i++) {
                 head = &hash->table[i];
@@ -644,9 +645,8 @@ next:
                 rcu_read_lock();
                 hlist_for_each_entry_rcu(tt_common_entry, node, head,
                                          hash_entry) {
-                        entry = (struct batadv_vis_info_entry *)
-                                        skb_put(info->skb_packet,
-                                                sizeof(*entry));
+                        packet_pos = skb_put(info->skb_packet, sizeof(*entry));
+                        entry = (struct batadv_vis_info_entry *)packet_pos;
                         memset(entry->src, 0, ETH_ALEN);
                         memcpy(entry->dest, tt_common_entry->addr, ETH_ALEN);
                         entry->quality = 0; /* 0 means TT */
@@ -671,7 +671,7 @@ unlock:
 static void batadv_purge_vis_packets(struct batadv_priv *bat_priv)
 {
         uint32_t i;
-        struct batadv_hashtable *hash = bat_priv->vis_hash;
+        struct batadv_hashtable *hash = bat_priv->vis.hash;
         struct hlist_node *node, *node_tmp;
         struct hlist_head *head;
         struct batadv_vis_info *info;
@@ -682,7 +682,7 @@ static void batadv_purge_vis_packets(struct batadv_priv *bat_priv)
                 hlist_for_each_entry_safe(info, node, node_tmp,
                                           head, hash_entry) {
                         /* never purge own data. */
-                        if (info == bat_priv->my_vis_info)
+                        if (info == bat_priv->vis.my_info)
                                 continue;
 
                         if (batadv_has_timed_out(info->first_seen,
@@ -814,34 +814,36 @@ out:
 /* called from timer; send (and maybe generate) vis packet. */
 static void batadv_send_vis_packets(struct work_struct *work)
 {
-        struct delayed_work *delayed_work =
-                container_of(work, struct delayed_work, work);
+        struct delayed_work *delayed_work;
         struct batadv_priv *bat_priv;
+        struct batadv_priv_vis *priv_vis;
         struct batadv_vis_info *info;
 
-        bat_priv = container_of(delayed_work, struct batadv_priv, vis_work);
-        spin_lock_bh(&bat_priv->vis_hash_lock);
+        delayed_work = container_of(work, struct delayed_work, work);
+        priv_vis = container_of(delayed_work, struct batadv_priv_vis, work);
+        bat_priv = container_of(priv_vis, struct batadv_priv, vis);
+        spin_lock_bh(&bat_priv->vis.hash_lock);
         batadv_purge_vis_packets(bat_priv);
 
         if (batadv_generate_vis_packet(bat_priv) == 0) {
                 /* schedule if generation was successful */
-                batadv_send_list_add(bat_priv, bat_priv->my_vis_info);
+                batadv_send_list_add(bat_priv, bat_priv->vis.my_info);
         }
 
-        while (!list_empty(&bat_priv->vis_send_list)) {
-                info = list_first_entry(&bat_priv->vis_send_list,
+        while (!list_empty(&bat_priv->vis.send_list)) {
+                info = list_first_entry(&bat_priv->vis.send_list,
                                         typeof(*info), send_list);
 
                 kref_get(&info->refcount);
-                spin_unlock_bh(&bat_priv->vis_hash_lock);
+                spin_unlock_bh(&bat_priv->vis.hash_lock);
 
                 batadv_send_vis_packet(bat_priv, info);
 
-                spin_lock_bh(&bat_priv->vis_hash_lock);
+                spin_lock_bh(&bat_priv->vis.hash_lock);
                 batadv_send_list_del(info);
                 kref_put(&info->refcount, batadv_free_info);
         }
-        spin_unlock_bh(&bat_priv->vis_hash_lock);
+        spin_unlock_bh(&bat_priv->vis.hash_lock);
         batadv_start_vis_timer(bat_priv);
 }
 
@@ -856,37 +858,37 @@ int batadv_vis_init(struct batadv_priv *bat_priv)
         unsigned long first_seen;
         struct sk_buff *tmp_skb;
 
-        if (bat_priv->vis_hash)
+        if (bat_priv->vis.hash)
                 return 0;
 
-        spin_lock_bh(&bat_priv->vis_hash_lock);
+        spin_lock_bh(&bat_priv->vis.hash_lock);
 
-        bat_priv->vis_hash = batadv_hash_new(256);
-        if (!bat_priv->vis_hash) {
+        bat_priv->vis.hash = batadv_hash_new(256);
+        if (!bat_priv->vis.hash) {
                 pr_err("Can't initialize vis_hash\n");
                 goto err;
         }
 
-        bat_priv->my_vis_info = kmalloc(BATADV_MAX_VIS_PACKET_SIZE, GFP_ATOMIC);
-        if (!bat_priv->my_vis_info)
+        bat_priv->vis.my_info = kmalloc(BATADV_MAX_VIS_PACKET_SIZE, GFP_ATOMIC);
+        if (!bat_priv->vis.my_info)
                 goto err;
 
         len = sizeof(*packet) + BATADV_MAX_VIS_PACKET_SIZE + ETH_HLEN;
-        bat_priv->my_vis_info->skb_packet = dev_alloc_skb(len);
-        if (!bat_priv->my_vis_info->skb_packet)
+        bat_priv->vis.my_info->skb_packet = dev_alloc_skb(len);
+        if (!bat_priv->vis.my_info->skb_packet)
                 goto free_info;
 
-        skb_reserve(bat_priv->my_vis_info->skb_packet, ETH_HLEN);
-        tmp_skb = bat_priv->my_vis_info->skb_packet;
+        skb_reserve(bat_priv->vis.my_info->skb_packet, ETH_HLEN);
+        tmp_skb = bat_priv->vis.my_info->skb_packet;
         packet = (struct batadv_vis_packet *)skb_put(tmp_skb, sizeof(*packet));
 
         /* prefill the vis info */
         first_seen = jiffies - msecs_to_jiffies(BATADV_VIS_INTERVAL);
-        bat_priv->my_vis_info->first_seen = first_seen;
-        INIT_LIST_HEAD(&bat_priv->my_vis_info->recv_list);
-        INIT_LIST_HEAD(&bat_priv->my_vis_info->send_list);
-        kref_init(&bat_priv->my_vis_info->refcount);
-        bat_priv->my_vis_info->bat_priv = bat_priv;
+        bat_priv->vis.my_info->first_seen = first_seen;
+        INIT_LIST_HEAD(&bat_priv->vis.my_info->recv_list);
+        INIT_LIST_HEAD(&bat_priv->vis.my_info->send_list);
+        kref_init(&bat_priv->vis.my_info->refcount);
+        bat_priv->vis.my_info->bat_priv = bat_priv;
         packet->header.version = BATADV_COMPAT_VERSION;
         packet->header.packet_type = BATADV_VIS;
         packet->header.ttl = BATADV_TTL;
@@ -894,28 +896,28 @@ int batadv_vis_init(struct batadv_priv *bat_priv)
         packet->reserved = 0;
         packet->entries = 0;
 
-        INIT_LIST_HEAD(&bat_priv->vis_send_list);
+        INIT_LIST_HEAD(&bat_priv->vis.send_list);
 
-        hash_added = batadv_hash_add(bat_priv->vis_hash, batadv_vis_info_cmp,
+        hash_added = batadv_hash_add(bat_priv->vis.hash, batadv_vis_info_cmp,
                                      batadv_vis_info_choose,
-                                     bat_priv->my_vis_info,
-                                     &bat_priv->my_vis_info->hash_entry);
+                                     bat_priv->vis.my_info,
+                                     &bat_priv->vis.my_info->hash_entry);
         if (hash_added != 0) {
                 pr_err("Can't add own vis packet into hash\n");
                 /* not in hash, need to remove it manually. */
-                kref_put(&bat_priv->my_vis_info->refcount, batadv_free_info);
+                kref_put(&bat_priv->vis.my_info->refcount, batadv_free_info);
                 goto err;
         }
 
-        spin_unlock_bh(&bat_priv->vis_hash_lock);
+        spin_unlock_bh(&bat_priv->vis.hash_lock);
         batadv_start_vis_timer(bat_priv);
         return 0;
 
 free_info:
-        kfree(bat_priv->my_vis_info);
-        bat_priv->my_vis_info = NULL;
+        kfree(bat_priv->vis.my_info);
+        bat_priv->vis.my_info = NULL;
 err:
-        spin_unlock_bh(&bat_priv->vis_hash_lock);
+        spin_unlock_bh(&bat_priv->vis.hash_lock);
         batadv_vis_quit(bat_priv);
         return -ENOMEM;
 }
@@ -933,23 +935,23 @@ static void batadv_free_info_ref(struct hlist_node *node, void *arg)
 /* shutdown vis-server */
 void batadv_vis_quit(struct batadv_priv *bat_priv)
 {
-        if (!bat_priv->vis_hash)
+        if (!bat_priv->vis.hash)
                 return;
 
-        cancel_delayed_work_sync(&bat_priv->vis_work);
+        cancel_delayed_work_sync(&bat_priv->vis.work);
 
-        spin_lock_bh(&bat_priv->vis_hash_lock);
+        spin_lock_bh(&bat_priv->vis.hash_lock);
         /* properly remove, kill timers ... */
-        batadv_hash_delete(bat_priv->vis_hash, batadv_free_info_ref, NULL);
-        bat_priv->vis_hash = NULL;
-        bat_priv->my_vis_info = NULL;
-        spin_unlock_bh(&bat_priv->vis_hash_lock);
+        batadv_hash_delete(bat_priv->vis.hash, batadv_free_info_ref, NULL);
+        bat_priv->vis.hash = NULL;
+        bat_priv->vis.my_info = NULL;
+        spin_unlock_bh(&bat_priv->vis.hash_lock);
 }
 
 /* schedule packets for (re)transmission */
 static void batadv_start_vis_timer(struct batadv_priv *bat_priv)
 {
-        INIT_DELAYED_WORK(&bat_priv->vis_work, batadv_send_vis_packets);
-        queue_delayed_work(batadv_event_workqueue, &bat_priv->vis_work,
+        INIT_DELAYED_WORK(&bat_priv->vis.work, batadv_send_vis_packets);
+        queue_delayed_work(batadv_event_workqueue, &bat_priv->vis.work,
                            msecs_to_jiffies(BATADV_VIS_INTERVAL));
 }
diff --git a/net/batman-adv/vis.h b/net/batman-adv/vis.h
index 84e716ed8963..873282fa86da 100644
--- a/net/batman-adv/vis.h
+++ b/net/batman-adv/vis.h
@@ -20,7 +20,7 @@
 #ifndef _NET_BATMAN_ADV_VIS_H_
 #define _NET_BATMAN_ADV_VIS_H_
 
-/* timeout of vis packets in miliseconds */
+/* timeout of vis packets in milliseconds */
 #define BATADV_VIS_TIMEOUT              200000
 
 int batadv_vis_seq_print_text(struct seq_file *seq, void *offset);
diff --git a/net/bluetooth/a2mp.c b/net/bluetooth/a2mp.c
index 4ff0bf3ba9a5..0760d1fed6f0 100644
--- a/net/bluetooth/a2mp.c
+++ b/net/bluetooth/a2mp.c
@@ -316,7 +316,7 @@ send_rsp:
 static inline int a2mp_cmd_rsp(struct amp_mgr *mgr, struct sk_buff *skb,
                                struct a2mp_cmd *hdr)
 {
-        BT_DBG("ident %d code %d", hdr->ident, hdr->code);
+        BT_DBG("ident %d code 0x%2.2x", hdr->ident, hdr->code);
 
         skb_pull(skb, le16_to_cpu(hdr->len));
         return 0;
@@ -325,17 +325,19 @@ static inline int a2mp_cmd_rsp(struct amp_mgr *mgr, struct sk_buff *skb,
 /* Handle A2MP signalling */
 static int a2mp_chan_recv_cb(struct l2cap_chan *chan, struct sk_buff *skb)
 {
-        struct a2mp_cmd *hdr = (void *) skb->data;
+        struct a2mp_cmd *hdr;
         struct amp_mgr *mgr = chan->data;
         int err = 0;
 
         amp_mgr_get(mgr);
 
         while (skb->len >= sizeof(*hdr)) {
-                struct a2mp_cmd *hdr = (void *) skb->data;
-                u16 len = le16_to_cpu(hdr->len);
+                u16 len;
 
-                BT_DBG("code 0x%02x id %d len %d", hdr->code, hdr->ident, len);
+                hdr = (void *) skb->data;
+                len = le16_to_cpu(hdr->len);
+
+                BT_DBG("code 0x%2.2x id %d len %u", hdr->code, hdr->ident, len);
 
                 skb_pull(skb, sizeof(*hdr));
 
@@ -393,7 +395,9 @@ static int a2mp_chan_recv_cb(struct l2cap_chan *chan, struct sk_buff *skb)
 
         if (err) {
                 struct a2mp_cmd_rej rej;
+
                 rej.reason = __constant_cpu_to_le16(0);
+                hdr = (void *) skb->data;
 
                 BT_DBG("Send A2MP Rej: cmd 0x%2.2x err %d", hdr->code, err);
 
@@ -412,7 +416,7 @@ static int a2mp_chan_recv_cb(struct l2cap_chan *chan, struct sk_buff *skb)
 
 static void a2mp_chan_close_cb(struct l2cap_chan *chan)
 {
-        l2cap_chan_destroy(chan);
+        l2cap_chan_put(chan);
 }
 
 static void a2mp_chan_state_change_cb(struct l2cap_chan *chan, int state)
diff --git a/net/bluetooth/af_bluetooth.c b/net/bluetooth/af_bluetooth.c
index f7db5792ec64..58f9762b339a 100644
--- a/net/bluetooth/af_bluetooth.c
+++ b/net/bluetooth/af_bluetooth.c
@@ -28,6 +28,7 @@
 #include <asm/ioctls.h>
 
 #include <net/bluetooth/bluetooth.h>
+#include <linux/proc_fs.h>
 
 #define VERSION "2.16"
 
@@ -532,6 +533,146 @@ int bt_sock_wait_state(struct sock *sk, int state, unsigned long timeo)
 }
 EXPORT_SYMBOL(bt_sock_wait_state);
 
+#ifdef CONFIG_PROC_FS
+struct bt_seq_state {
+        struct bt_sock_list *l;
+};
+
+static void *bt_seq_start(struct seq_file *seq, loff_t *pos)
+        __acquires(seq->private->l->lock)
+{
+        struct bt_seq_state *s = seq->private;
+        struct bt_sock_list *l = s->l;
+
+        read_lock(&l->lock);
+        return seq_hlist_start_head(&l->head, *pos);
+}
+
+static void *bt_seq_next(struct seq_file *seq, void *v, loff_t *pos)
+{
+        struct bt_seq_state *s = seq->private;
+        struct bt_sock_list *l = s->l;
+
+        return seq_hlist_next(v, &l->head, pos);
+}
+
+static void bt_seq_stop(struct seq_file *seq, void *v)
+        __releases(seq->private->l->lock)
+{
+        struct bt_seq_state *s = seq->private;
+        struct bt_sock_list *l = s->l;
+
+        read_unlock(&l->lock);
+}
+
+static int bt_seq_show(struct seq_file *seq, void *v)
+{
+        struct sock *sk;
+        struct bt_sock *bt;
+        struct bt_seq_state *s = seq->private;
+        struct bt_sock_list *l = s->l;
+        bdaddr_t src_baswapped, dst_baswapped;
+
+        if (v == SEQ_START_TOKEN) {
+                seq_puts(seq ,"sk               RefCnt Rmem   Wmem   User   Inode  Src Dst Parent");
+
+                if (l->custom_seq_show) {
+                        seq_putc(seq, ' ');
+                        l->custom_seq_show(seq, v);
+                }
+
+                seq_putc(seq, '\n');
+        } else {
+                sk = sk_entry(v);
+                bt = bt_sk(sk);
+                baswap(&src_baswapped, &bt->src);
+                baswap(&dst_baswapped, &bt->dst);
+
+                seq_printf(seq, "%pK %-6d %-6u %-6u %-6u %-6lu %pM %pM %-6lu",
+                           sk,
+                           atomic_read(&sk->sk_refcnt),
+                           sk_rmem_alloc_get(sk),
+                           sk_wmem_alloc_get(sk),
+                           sock_i_uid(sk),
+                           sock_i_ino(sk),
+                           &src_baswapped,
+                           &dst_baswapped,
+                           bt->parent? sock_i_ino(bt->parent): 0LU);
+
+                if (l->custom_seq_show) {
+                        seq_putc(seq, ' ');
+                        l->custom_seq_show(seq, v);
+                }
+
+                seq_putc(seq, '\n');
+        }
+        return 0;
+}
+
+static struct seq_operations bt_seq_ops = {
+        .start = bt_seq_start,
+        .next  = bt_seq_next,
+        .stop  = bt_seq_stop,
+        .show  = bt_seq_show,
+};
+
+static int bt_seq_open(struct inode *inode, struct file *file)
+{
+        struct bt_sock_list *sk_list;
+        struct bt_seq_state *s;
+
+        sk_list = PDE(inode)->data;
+        s = __seq_open_private(file, &bt_seq_ops,
+                               sizeof(struct bt_seq_state));
+        if (s == NULL)
+                return -ENOMEM;
+
+        s->l = sk_list;
+        return 0;
+}
+
+int bt_procfs_init(struct module* module, struct net *net, const char *name,
+                   struct bt_sock_list* sk_list,
+                   int (* seq_show)(struct seq_file *, void *))
+{
+        struct proc_dir_entry * pde;
+
+        sk_list->custom_seq_show = seq_show;
+
+        sk_list->fops.owner     = module;
+        sk_list->fops.open      = bt_seq_open;
+        sk_list->fops.read      = seq_read;
+        sk_list->fops.llseek    = seq_lseek;
+        sk_list->fops.release   = seq_release_private;
+
+        pde = proc_net_fops_create(net, name, 0, &sk_list->fops);
+        if (pde == NULL)
+                return -ENOMEM;
+
+        pde->data = sk_list;
+
+        return 0;
+}
+
+void bt_procfs_cleanup(struct net *net, const char *name)
+{
+        proc_net_remove(net, name);
+}
+#else
+int bt_procfs_init(struct module* module, struct net *net, const char *name,
+                   struct bt_sock_list* sk_list,
+                   int (* seq_show)(struct seq_file *, void *))
+{
+        return 0;
+}
+
+void bt_procfs_cleanup(struct net *net, const char *name)
+{
+}
+#endif
+EXPORT_SYMBOL(bt_procfs_init);
+EXPORT_SYMBOL(bt_procfs_cleanup);
+
 static struct net_proto_family bt_sock_family_ops = {
         .owner  = THIS_MODULE,
         .family = PF_BLUETOOTH,
diff --git a/net/bluetooth/bnep/sock.c b/net/bluetooth/bnep/sock.c
index 5e5f5b410e0b..5b6cc0bf4dec 100644
--- a/net/bluetooth/bnep/sock.c
+++ b/net/bluetooth/bnep/sock.c
@@ -29,6 +29,10 @@
 
 #include "bnep.h"
 
+static struct bt_sock_list bnep_sk_list = {
+        .lock = __RW_LOCK_UNLOCKED(bnep_sk_list.lock)
+};
+
 static int bnep_sock_release(struct socket *sock)
 {
         struct sock *sk = sock->sk;
@@ -38,6 +42,8 @@ static int bnep_sock_release(struct socket *sock)
         if (!sk)
                 return 0;
 
+        bt_sock_unlink(&bnep_sk_list, sk);
+
         sock_orphan(sk);
         sock_put(sk);
         return 0;
@@ -204,6 +210,7 @@ static int bnep_sock_create(struct net *net, struct socket *sock, int protocol,
         sk->sk_protocol = protocol;
         sk->sk_state    = BT_OPEN;
 
+        bt_sock_link(&bnep_sk_list, sk);
         return 0;
 }
 
@@ -222,19 +229,30 @@ int __init bnep_sock_init(void)
                 return err;
 
         err = bt_sock_register(BTPROTO_BNEP, &bnep_sock_family_ops);
-        if (err < 0)
+        if (err < 0) {
+                BT_ERR("Can't register BNEP socket");
                 goto error;
+        }
+
+        err = bt_procfs_init(THIS_MODULE, &init_net, "bnep", &bnep_sk_list, NULL);
+        if (err < 0) {
+                BT_ERR("Failed to create BNEP proc file");
+                bt_sock_unregister(BTPROTO_BNEP);
+                goto error;
+        }
+
+        BT_INFO("BNEP socket layer initialized");
 
         return 0;
 
 error:
-        BT_ERR("Can't register BNEP socket");
         proto_unregister(&bnep_proto);
         return err;
 }
 
 void __exit bnep_sock_cleanup(void)
 {
+        bt_procfs_cleanup(&init_net, "bnep");
         if (bt_sock_unregister(BTPROTO_BNEP) < 0)
                 BT_ERR("Can't unregister BNEP socket");
 
diff --git a/net/bluetooth/cmtp/sock.c b/net/bluetooth/cmtp/sock.c
index 311668d14571..d5cacef52748 100644
--- a/net/bluetooth/cmtp/sock.c
+++ b/net/bluetooth/cmtp/sock.c
@@ -42,6 +42,10 @@
 
 #include "cmtp.h"
 
+static struct bt_sock_list cmtp_sk_list = {
+        .lock = __RW_LOCK_UNLOCKED(cmtp_sk_list.lock)
+};
+
 static int cmtp_sock_release(struct socket *sock)
 {
         struct sock *sk = sock->sk;
@@ -51,6 +55,8 @@ static int cmtp_sock_release(struct socket *sock)
         if (!sk)
                 return 0;
 
+        bt_sock_unlink(&cmtp_sk_list, sk);
+
         sock_orphan(sk);
         sock_put(sk);
 
@@ -214,6 +220,8 @@ static int cmtp_sock_create(struct net *net, struct socket *sock, int protocol,
         sk->sk_protocol = protocol;
         sk->sk_state    = BT_OPEN;
 
+        bt_sock_link(&cmtp_sk_list, sk);
+
         return 0;
 }
 
@@ -232,19 +240,30 @@ int cmtp_init_sockets(void)
                 return err;
 
         err = bt_sock_register(BTPROTO_CMTP, &cmtp_sock_family_ops);
-        if (err < 0)
+        if (err < 0) {
+                BT_ERR("Can't register CMTP socket");
                 goto error;
+        }
+
+        err = bt_procfs_init(THIS_MODULE, &init_net, "cmtp", &cmtp_sk_list, NULL);
+        if (err < 0) {
+                BT_ERR("Failed to create CMTP proc file");
+                bt_sock_unregister(BTPROTO_HIDP);
+                goto error;
+        }
+
+        BT_INFO("CMTP socket layer initialized");
 
         return 0;
 
 error:
-        BT_ERR("Can't register CMTP socket");
         proto_unregister(&cmtp_proto);
         return err;
 }
 
 void cmtp_cleanup_sockets(void)
 {
+        bt_procfs_cleanup(&init_net, "cmtp");
         if (bt_sock_unregister(BTPROTO_CMTP) < 0)
                 BT_ERR("Can't unregister CMTP socket");
 
diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c
index d4de5db18d5a..fa974a19d365 100644
--- a/net/bluetooth/hci_core.c
+++ b/net/bluetooth/hci_core.c
@@ -696,7 +696,8 @@ int hci_dev_open(__u16 dev)
                 hci_dev_hold(hdev);
                 set_bit(HCI_UP, &hdev->flags);
                 hci_notify(hdev, HCI_DEV_UP);
-                if (!test_bit(HCI_SETUP, &hdev->dev_flags)) {
+                if (!test_bit(HCI_SETUP, &hdev->dev_flags) &&
+                    mgmt_valid_hdev(hdev)) {
                         hci_dev_lock(hdev);
                         mgmt_powered(hdev, 1);
                         hci_dev_unlock(hdev);
@@ -797,7 +798,8 @@ static int hci_dev_do_close(struct hci_dev *hdev)
          * and no tasks are scheduled. */
         hdev->close(hdev);
 
-        if (!test_and_clear_bit(HCI_AUTO_OFF, &hdev->dev_flags)) {
+        if (!test_and_clear_bit(HCI_AUTO_OFF, &hdev->dev_flags) &&
+            mgmt_valid_hdev(hdev)) {
                 hci_dev_lock(hdev);
                 mgmt_powered(hdev, 0);
                 hci_dev_unlock(hdev);
diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c
index 41ff978a33f9..4fd2cf3bcd05 100644
--- a/net/bluetooth/hci_event.c
+++ b/net/bluetooth/hci_event.c
@@ -513,7 +513,7 @@ static void hci_setup_event_mask(struct hci_dev *hdev)
         if (hdev->features[3] & LMP_RSSI_INQ)
                 events[4] |= 0x02; /* Inquiry Result with RSSI */
 
-        if (hdev->features[5] & LMP_SNIFF_SUBR)
+        if (lmp_sniffsubr_capable(hdev))
                 events[5] |= 0x20; /* Sniff Subrating */
 
         if (hdev->features[5] & LMP_PAUSE_ENC)
@@ -522,13 +522,13 @@ static void hci_setup_event_mask(struct hci_dev *hdev)
         if (hdev->features[6] & LMP_EXT_INQ)
                 events[5] |= 0x40; /* Extended Inquiry Result */
 
-        if (hdev->features[6] & LMP_NO_FLUSH)
+        if (lmp_no_flush_capable(hdev))
                 events[7] |= 0x01; /* Enhanced Flush Complete */
 
         if (hdev->features[7] & LMP_LSTO)
                 events[6] |= 0x80; /* Link Supervision Timeout Changed */
 
-        if (hdev->features[6] & LMP_SIMPLE_PAIR) {
+        if (lmp_ssp_capable(hdev)) {
                 events[6] |= 0x01;      /* IO Capability Request */
                 events[6] |= 0x02;      /* IO Capability Response */
                 events[6] |= 0x04;      /* User Confirmation Request */
@@ -541,7 +541,7 @@ static void hci_setup_event_mask(struct hci_dev *hdev)
                                          * Features Notification */
         }
 
-        if (hdev->features[4] & LMP_LE)
+        if (lmp_le_capable(hdev))
                 events[7] |= 0x20;      /* LE Meta-Event */
 
         hci_send_cmd(hdev, HCI_OP_SET_EVENT_MASK, sizeof(events), events);
@@ -623,11 +623,11 @@ static void hci_setup_link_policy(struct hci_dev *hdev)
         struct hci_cp_write_def_link_policy cp;
         u16 link_policy = 0;
 
-        if (hdev->features[0] & LMP_RSWITCH)
+        if (lmp_rswitch_capable(hdev))
                 link_policy |= HCI_LP_RSWITCH;
         if (hdev->features[0] & LMP_HOLD)
                 link_policy |= HCI_LP_HOLD;
-        if (hdev->features[0] & LMP_SNIFF)
+        if (lmp_sniff_capable(hdev))
                 link_policy |= HCI_LP_SNIFF;
         if (hdev->features[1] & LMP_PARK)
                 link_policy |= HCI_LP_PARK;
@@ -686,7 +686,7 @@ static void hci_cc_read_local_features(struct hci_dev *hdev,
                 hdev->esco_type |= (ESCO_HV3);
         }
 
-        if (hdev->features[3] & LMP_ESCO)
+        if (lmp_esco_capable(hdev))
                 hdev->esco_type |= (ESCO_EV3);
 
         if (hdev->features[4] & LMP_EV4)
@@ -746,7 +746,7 @@ static void hci_cc_read_local_ext_features(struct hci_dev *hdev,
                 break;
         }
 
-        if (test_bit(HCI_INIT, &hdev->flags) && hdev->features[4] & LMP_LE)
+        if (test_bit(HCI_INIT, &hdev->flags) && lmp_le_capable(hdev))
                 hci_set_le_support(hdev);
 
 done:
@@ -1365,6 +1365,9 @@ static bool hci_resolve_next_name(struct hci_dev *hdev)
                 return false;
 
         e = hci_inquiry_cache_lookup_resolve(hdev, BDADDR_ANY, NAME_NEEDED);
+        if (!e)
+                return false;
+
         if (hci_resolve_name(hdev, e) == 0) {
                 e->name_state = NAME_PENDING;
                 return true;
@@ -1393,12 +1396,20 @@ static void hci_check_pending_name(struct hci_dev *hdev, struct hci_conn *conn,
                 return;
 
         e = hci_inquiry_cache_lookup_resolve(hdev, bdaddr, NAME_PENDING);
-        if (e) {
+        /* If the device was not found in a list of found devices names of which
+         * are pending. there is no need to continue resolving a next name as it
+         * will be done upon receiving another Remote Name Request Complete
+         * Event */
+        if (!e)
+                return;
+
+        list_del(&e->list);
+        if (name) {
                 e->name_state = NAME_KNOWN;
-                list_del(&e->list);
-                if (name)
-                        mgmt_remote_name(hdev, bdaddr, ACL_LINK, 0x00,
-                                         e->data.rssi, name, name_len);
+                mgmt_remote_name(hdev, bdaddr, ACL_LINK, 0x00,
+                                 e->data.rssi, name, name_len);
+        } else {
+                e->name_state = NAME_NOT_KNOWN;
         }
 
         if (hci_resolve_next_name(hdev))
@@ -1614,43 +1625,30 @@ static void hci_cs_disconnect(struct hci_dev *hdev, u8 status)
 
 static void hci_cs_le_create_conn(struct hci_dev *hdev, __u8 status)
 {
-        struct hci_cp_le_create_conn *cp;
         struct hci_conn *conn;
 
         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 
-        cp = hci_sent_cmd_data(hdev, HCI_OP_LE_CREATE_CONN);
-        if (!cp)
-                return;
+        if (status) {
+                hci_dev_lock(hdev);
 
-        hci_dev_lock(hdev);
+                conn = hci_conn_hash_lookup_state(hdev, LE_LINK, BT_CONNECT);
+                if (!conn) {
+                        hci_dev_unlock(hdev);
+                        return;
+                }
 
-        conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->peer_addr);
+                BT_DBG("%s bdaddr %s conn %p", hdev->name, batostr(&conn->dst),
+                       conn);
 
-        BT_DBG("%s bdaddr %s conn %p", hdev->name, batostr(&cp->peer_addr),
-               conn);
+                conn->state = BT_CLOSED;
+                mgmt_connect_failed(hdev, &conn->dst, conn->type,
+                                    conn->dst_type, status);
+                hci_proto_connect_cfm(conn, status);
+                hci_conn_del(conn);
 
-        if (status) {
-                if (conn && conn->state == BT_CONNECT) {
-                        conn->state = BT_CLOSED;
-                        mgmt_connect_failed(hdev, &cp->peer_addr, conn->type,
-                                            conn->dst_type, status);
-                        hci_proto_connect_cfm(conn, status);
-                        hci_conn_del(conn);
-                }
-        } else {
-                if (!conn) {
-                        conn = hci_conn_add(hdev, LE_LINK, &cp->peer_addr);
-                        if (conn) {
-                                conn->dst_type = cp->peer_addr_type;
-                                conn->out = true;
-                        } else {
-                                BT_ERR("No memory for new connection");
-                        }
-                }
+                hci_dev_unlock(hdev);
         }
-
-        hci_dev_unlock(hdev);
 }
 
 static void hci_cs_le_start_enc(struct hci_dev *hdev, u8 status)
@@ -1762,7 +1760,12 @@ static void hci_conn_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
                 if (conn->type == ACL_LINK) {
                         conn->state = BT_CONFIG;
                         hci_conn_hold(conn);
-                        conn->disc_timeout = HCI_DISCONN_TIMEOUT;
+
+                        if (!conn->out && !hci_conn_ssp_enabled(conn) &&
+                            !hci_find_link_key(hdev, &ev->bdaddr))
+                                conn->disc_timeout = HCI_PAIRING_TIMEOUT;
+                        else
+                                conn->disc_timeout = HCI_DISCONN_TIMEOUT;
                 } else
                         conn->state = BT_CONNECTED;
 
@@ -3252,12 +3255,8 @@ static void hci_user_passkey_request_evt(struct hci_dev *hdev,
 
         BT_DBG("%s", hdev->name);
 
-        hci_dev_lock(hdev);
-
         if (test_bit(HCI_MGMT, &hdev->dev_flags))
                 mgmt_user_passkey_request(hdev, &ev->bdaddr, ACL_LINK, 0);
-
-        hci_dev_unlock(hdev);
 }
 
 static void hci_simple_pair_complete_evt(struct hci_dev *hdev,
@@ -3350,11 +3349,23 @@ static void hci_le_conn_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
 
         hci_dev_lock(hdev);
 
-        if (ev->status) {
-                conn = hci_conn_hash_lookup_state(hdev, LE_LINK, BT_CONNECT);
-                if (!conn)
+        conn = hci_conn_hash_lookup_state(hdev, LE_LINK, BT_CONNECT);
+        if (!conn) {
+                conn = hci_conn_add(hdev, LE_LINK, &ev->bdaddr);
+                if (!conn) {
+                        BT_ERR("No memory for new connection");
                         goto unlock;
+                }
+
+                conn->dst_type = ev->bdaddr_type;
 
+                if (ev->role == LE_CONN_ROLE_MASTER) {
+                        conn->out = true;
+                        conn->link_mode |= HCI_LM_MASTER;
+                }
+        }
+
+        if (ev->status) {
                 mgmt_connect_failed(hdev, &conn->dst, conn->type,
                                     conn->dst_type, ev->status);
                 hci_proto_connect_cfm(conn, ev->status);
@@ -3363,18 +3374,6 @@ static void hci_le_conn_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
                 goto unlock;
         }
 
-        conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &ev->bdaddr);
-        if (!conn) {
-                conn = hci_conn_add(hdev, LE_LINK, &ev->bdaddr);
-                if (!conn) {
-                        BT_ERR("No memory for new connection");
-                        hci_dev_unlock(hdev);
-                        return;
-                }
-
-                conn->dst_type = ev->bdaddr_type;
-        }
-
         if (!test_and_set_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags))
                 mgmt_device_connected(hdev, &ev->bdaddr, conn->type,
                                       conn->dst_type, 0, NULL, 0, NULL);
diff --git a/net/bluetooth/hci_sock.c b/net/bluetooth/hci_sock.c
index a7f04de03d79..bb64331db3b7 100644
--- a/net/bluetooth/hci_sock.c
+++ b/net/bluetooth/hci_sock.c
@@ -694,6 +694,7 @@ static int hci_sock_getname(struct socket *sock, struct sockaddr *addr,
         *addr_len = sizeof(*haddr);
         haddr->hci_family = AF_BLUETOOTH;
         haddr->hci_dev    = hdev->id;
+        haddr->hci_channel= 0;
 
         release_sock(sk);
         return 0;
@@ -1009,6 +1010,7 @@ static int hci_sock_getsockopt(struct socket *sock, int level, int optname,
                 {
                         struct hci_filter *f = &hci_pi(sk)->filter;
 
+                        memset(&uf, 0, sizeof(uf));
                         uf.type_mask = f->type_mask;
                         uf.opcode    = f->opcode;
                         uf.event_mask[0] = *((u32 *) f->event_mask + 0);
@@ -1100,21 +1102,30 @@ int __init hci_sock_init(void)
                 return err;
 
         err = bt_sock_register(BTPROTO_HCI, &hci_sock_family_ops);
-        if (err < 0)
+        if (err < 0) {
+                BT_ERR("HCI socket registration failed");
                 goto error;
+        }
+
+        err = bt_procfs_init(THIS_MODULE, &init_net, "hci", &hci_sk_list, NULL);
+        if (err < 0) {
+                BT_ERR("Failed to create HCI proc file");
+                bt_sock_unregister(BTPROTO_HCI);
+                goto error;
+        }
 
         BT_INFO("HCI socket layer initialized");
 
         return 0;
 
 error:
-        BT_ERR("HCI socket registration failed");
         proto_unregister(&hci_sk_proto);
         return err;
 }
 
 void hci_sock_cleanup(void)
 {
+        bt_procfs_cleanup(&init_net, "hci");
         if (bt_sock_unregister(BTPROTO_HCI) < 0)
                 BT_ERR("HCI socket unregistration failed");
 
diff --git a/net/bluetooth/hidp/sock.c b/net/bluetooth/hidp/sock.c
index 18b3f6892a36..eca3889371c4 100644
--- a/net/bluetooth/hidp/sock.c
+++ b/net/bluetooth/hidp/sock.c
@@ -25,6 +25,10 @@
 
 #include "hidp.h"
 
+static struct bt_sock_list hidp_sk_list = {
+        .lock = __RW_LOCK_UNLOCKED(hidp_sk_list.lock)
+};
+
 static int hidp_sock_release(struct socket *sock)
 {
         struct sock *sk = sock->sk;
@@ -34,6 +38,8 @@ static int hidp_sock_release(struct socket *sock)
         if (!sk)
                 return 0;
 
+        bt_sock_unlink(&hidp_sk_list, sk);
+
         sock_orphan(sk);
         sock_put(sk);
 
@@ -253,6 +259,8 @@ static int hidp_sock_create(struct net *net, struct socket *sock, int protocol,
         sk->sk_protocol = protocol;
         sk->sk_state    = BT_OPEN;
 
+        bt_sock_link(&hidp_sk_list, sk);
+
         return 0;
 }
 
@@ -271,8 +279,19 @@ int __init hidp_init_sockets(void)
                 return err;
 
         err = bt_sock_register(BTPROTO_HIDP, &hidp_sock_family_ops);
-        if (err < 0)
+        if (err < 0) {
+                BT_ERR("Can't register HIDP socket");
                 goto error;
+        }
+
+        err = bt_procfs_init(THIS_MODULE, &init_net, "hidp", &hidp_sk_list, NULL);
+        if (err < 0) {
+                BT_ERR("Failed to create HIDP proc file");
+                bt_sock_unregister(BTPROTO_HIDP);
+                goto error;
+        }
+
+        BT_INFO("HIDP socket layer initialized");
 
         return 0;
 
@@ -284,6 +303,7 @@ error:
 
 void __exit hidp_cleanup_sockets(void)
 {
+        bt_procfs_cleanup(&init_net, "hidp");
         if (bt_sock_unregister(BTPROTO_HIDP) < 0)
                 BT_ERR("Can't unregister HIDP socket");
 
diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
index a8964db04bfb..f0a3ab156ec6 100644
--- a/net/bluetooth/l2cap_core.c
+++ b/net/bluetooth/l2cap_core.c
@@ -416,13 +416,30 @@ struct l2cap_chan *l2cap_chan_create(void)
         return chan;
 }
 
-void l2cap_chan_destroy(struct l2cap_chan *chan)
+static void l2cap_chan_destroy(struct l2cap_chan *chan)
 {
+        BT_DBG("chan %p", chan);
+
         write_lock(&chan_list_lock);
         list_del(&chan->global_l);
         write_unlock(&chan_list_lock);
 
-        l2cap_chan_put(chan);
+        kfree(chan);
+}
+
+void l2cap_chan_hold(struct l2cap_chan *c)
+{
+        BT_DBG("chan %p orig refcnt %d", c, atomic_read(&c->refcnt));
+
+        atomic_inc(&c->refcnt);
+}
+
+void l2cap_chan_put(struct l2cap_chan *c)
+{
+        BT_DBG("chan %p orig refcnt %d", c, atomic_read(&c->refcnt));
+
+        if (atomic_dec_and_test(&c->refcnt))
+                l2cap_chan_destroy(c);
 }
 
 void l2cap_chan_set_defaults(struct l2cap_chan *chan)
@@ -1181,6 +1198,7 @@ static void l2cap_le_conn_ready(struct l2cap_conn *conn)
         sk = chan->sk;
 
         hci_conn_hold(conn->hcon);
+        conn->hcon->disc_timeout = HCI_DISCONN_TIMEOUT;
 
         bacpy(&bt_sk(sk)->src, conn->src);
         bacpy(&bt_sk(sk)->dst, conn->dst);
@@ -5329,7 +5347,7 @@ int l2cap_connect_ind(struct hci_dev *hdev, bdaddr_t *bdaddr)
         return exact ? lm1 : lm2;
 }
 
-int l2cap_connect_cfm(struct hci_conn *hcon, u8 status)
+void l2cap_connect_cfm(struct hci_conn *hcon, u8 status)
 {
         struct l2cap_conn *conn;
 
@@ -5342,7 +5360,6 @@ int l2cap_connect_cfm(struct hci_conn *hcon, u8 status)
         } else
                 l2cap_conn_del(hcon, bt_to_errno(status));
 
-        return 0;
 }
 
 int l2cap_disconn_ind(struct hci_conn *hcon)
@@ -5356,12 +5373,11 @@ int l2cap_disconn_ind(struct hci_conn *hcon)
         return conn->disc_reason;
 }
 
-int l2cap_disconn_cfm(struct hci_conn *hcon, u8 reason)
+void l2cap_disconn_cfm(struct hci_conn *hcon, u8 reason)
 {
         BT_DBG("hcon %p reason %d", hcon, reason);
 
         l2cap_conn_del(hcon, bt_to_errno(reason));
-        return 0;
 }
 
 static inline void l2cap_check_encryption(struct l2cap_chan *chan, u8 encrypt)
@@ -5404,6 +5420,11 @@ int l2cap_security_cfm(struct hci_conn *hcon, u8 status, u8 encrypt)
                 BT_DBG("chan %p scid 0x%4.4x state %s", chan, chan->scid,
                        state_to_string(chan->state));
 
+                if (chan->chan_type == L2CAP_CHAN_CONN_FIX_A2MP) {
+                        l2cap_chan_unlock(chan);
+                        continue;
+                }
+
                 if (chan->scid == L2CAP_CID_LE_DATA) {
                         if (!status && encrypt) {
                                 chan->sec_level = hcon->sec_level;
diff --git a/net/bluetooth/l2cap_sock.c b/net/bluetooth/l2cap_sock.c
index a4bb27e8427e..3a6ce73541d9 100644
--- a/net/bluetooth/l2cap_sock.c
+++ b/net/bluetooth/l2cap_sock.c
@@ -34,6 +34,10 @@
 #include <net/bluetooth/l2cap.h>
 #include <net/bluetooth/smp.h>
 
+static struct bt_sock_list l2cap_sk_list = {
+        .lock = __RW_LOCK_UNLOCKED(l2cap_sk_list.lock)
+};
+
 static const struct proto_ops l2cap_sock_ops;
 static void l2cap_sock_init(struct sock *sk, struct sock *parent);
 static struct sock *l2cap_sock_alloc(struct net *net, struct socket *sock, int proto, gfp_t prio);
@@ -245,6 +249,7 @@ static int l2cap_sock_getname(struct socket *sock, struct sockaddr *addr, int *l
 
         BT_DBG("sock %p, sk %p", sock, sk);
 
+        memset(la, 0, sizeof(struct sockaddr_l2));
         addr->sa_family = AF_BLUETOOTH;
         *len = sizeof(struct sockaddr_l2);
 
@@ -823,7 +828,7 @@ static void l2cap_sock_kill(struct sock *sk)
 
         /* Kill poor orphan */
 
-        l2cap_chan_destroy(l2cap_pi(sk)->chan);
+        l2cap_chan_put(l2cap_pi(sk)->chan);
         sock_set_flag(sk, SOCK_DEAD);
         sock_put(sk);
 }
@@ -886,6 +891,8 @@ static int l2cap_sock_release(struct socket *sock)
         if (!sk)
                 return 0;
 
+        bt_sock_unlink(&l2cap_sk_list, sk);
+
         err = l2cap_sock_shutdown(sock, 2);
 
         sock_orphan(sk);
@@ -1174,7 +1181,7 @@ static struct sock *l2cap_sock_alloc(struct net *net, struct socket *sock, int p
 
         chan = l2cap_chan_create();
         if (!chan) {
-                l2cap_sock_kill(sk);
+                sk_free(sk);
                 return NULL;
         }
 
@@ -1210,6 +1217,7 @@ static int l2cap_sock_create(struct net *net, struct socket *sock, int protocol,
                 return -ENOMEM;
 
         l2cap_sock_init(sk, NULL);
+        bt_sock_link(&l2cap_sk_list, sk);
         return 0;
 }
 
@@ -1248,21 +1256,30 @@ int __init l2cap_init_sockets(void)
                 return err;
 
         err = bt_sock_register(BTPROTO_L2CAP, &l2cap_sock_family_ops);
-        if (err < 0)
+        if (err < 0) {
+                BT_ERR("L2CAP socket registration failed");
                 goto error;
+        }
+
+        err = bt_procfs_init(THIS_MODULE, &init_net, "l2cap", &l2cap_sk_list, NULL);
+        if (err < 0) {
+                BT_ERR("Failed to create L2CAP proc file");
+                bt_sock_unregister(BTPROTO_L2CAP);
+                goto error;
+        }
 
         BT_INFO("L2CAP socket layer initialized");
 
         return 0;
 
 error:
-        BT_ERR("L2CAP socket registration failed");
         proto_unregister(&l2cap_proto);
         return err;
 }
 
 void l2cap_cleanup_sockets(void)
 {
+        bt_procfs_cleanup(&init_net, "l2cap");
         if (bt_sock_unregister(BTPROTO_L2CAP) < 0)
                 BT_ERR("L2CAP socket unregistration failed");
 
diff --git a/net/bluetooth/mgmt.c b/net/bluetooth/mgmt.c
index ad6613d17ca6..a3329cbd3e4d 100644
--- a/net/bluetooth/mgmt.c
+++ b/net/bluetooth/mgmt.c
@@ -193,6 +193,11 @@ static u8 mgmt_status_table[] = {
         MGMT_STATUS_CONNECT_FAILED,     /* MAC Connection Failed */
 };
 
+bool mgmt_valid_hdev(struct hci_dev *hdev)
+{
+        return hdev->dev_type == HCI_BREDR;
+}
+
 static u8 mgmt_status(u8 hci_status)
 {
         if (hci_status < ARRAY_SIZE(mgmt_status_table))
@@ -317,7 +322,6 @@ static int read_index_list(struct sock *sk, struct hci_dev *hdev, void *data,
                            u16 data_len)
 {
         struct mgmt_rp_read_index_list *rp;
-        struct list_head *p;
         struct hci_dev *d;
         size_t rp_len;
         u16 count;
@@ -328,7 +332,10 @@ static int read_index_list(struct sock *sk, struct hci_dev *hdev, void *data,
         read_lock(&hci_dev_list_lock);
 
         count = 0;
-        list_for_each(p, &hci_dev_list) {
+        list_for_each_entry(d, &hci_dev_list, list) {
+                if (!mgmt_valid_hdev(d))
+                        continue;
+
                 count++;
         }
 
@@ -346,6 +353,9 @@ static int read_index_list(struct sock *sk, struct hci_dev *hdev, void *data,
                 if (test_bit(HCI_SETUP, &d->dev_flags))
                         continue;
 
+                if (!mgmt_valid_hdev(d))
+                        continue;
+
                 rp->index[i++] = cpu_to_le16(d->id);
                 BT_DBG("Added hci%u", d->id);
         }
@@ -370,10 +380,10 @@ static u32 get_supported_settings(struct hci_dev *hdev)
         settings |= MGMT_SETTING_DISCOVERABLE;
         settings |= MGMT_SETTING_PAIRABLE;
 
-        if (hdev->features[6] & LMP_SIMPLE_PAIR)
+        if (lmp_ssp_capable(hdev))
                 settings |= MGMT_SETTING_SSP;
 
-        if (!(hdev->features[4] & LMP_NO_BREDR)) {
+        if (lmp_bredr_capable(hdev)) {
                 settings |= MGMT_SETTING_BREDR;
                 settings |= MGMT_SETTING_LINK_SECURITY;
         }
@@ -381,7 +391,7 @@ static u32 get_supported_settings(struct hci_dev *hdev)
         if (enable_hs)
                 settings |= MGMT_SETTING_HS;
 
-        if (hdev->features[4] & LMP_LE)
+        if (lmp_le_capable(hdev))
                 settings |= MGMT_SETTING_LE;
 
         return settings;
@@ -403,7 +413,7 @@ static u32 get_current_settings(struct hci_dev *hdev)
         if (test_bit(HCI_PAIRABLE, &hdev->dev_flags))
                 settings |= MGMT_SETTING_PAIRABLE;
 
-        if (!(hdev->features[4] & LMP_NO_BREDR))
+        if (lmp_bredr_capable(hdev))
                 settings |= MGMT_SETTING_BREDR;
 
         if (test_bit(HCI_LE_ENABLED, &hdev->dev_flags))
@@ -1111,7 +1121,7 @@ static int set_ssp(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
 
         hci_dev_lock(hdev);
 
-        if (!(hdev->features[6] & LMP_SIMPLE_PAIR)) {
+        if (!lmp_ssp_capable(hdev)) {
                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
                                  MGMT_STATUS_NOT_SUPPORTED);
                 goto failed;
@@ -1195,7 +1205,7 @@ static int set_le(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
 
         hci_dev_lock(hdev);
 
-        if (!(hdev->features[4] & LMP_LE)) {
+        if (!lmp_le_capable(hdev)) {
                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
                                  MGMT_STATUS_NOT_SUPPORTED);
                 goto unlock;
@@ -2191,7 +2201,7 @@ static int read_local_oob_data(struct sock *sk, struct hci_dev *hdev,
                 goto unlock;
         }
 
-        if (!(hdev->features[6] & LMP_SIMPLE_PAIR)) {
+        if (!lmp_ssp_capable(hdev)) {
                 err = cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
                                  MGMT_STATUS_NOT_SUPPORTED);
                 goto unlock;
@@ -2820,6 +2830,9 @@ static void cmd_status_rsp(struct pending_cmd *cmd, void *data)
 
 int mgmt_index_added(struct hci_dev *hdev)
 {
+        if (!mgmt_valid_hdev(hdev))
+                return -ENOTSUPP;
+
         return mgmt_event(MGMT_EV_INDEX_ADDED, hdev, NULL, 0, NULL);
 }
 
@@ -2827,6 +2840,9 @@ int mgmt_index_removed(struct hci_dev *hdev)
 {
         u8 status = MGMT_STATUS_INVALID_INDEX;
 
+        if (!mgmt_valid_hdev(hdev))
+                return -ENOTSUPP;
+
         mgmt_pending_foreach(0, hdev, cmd_status_rsp, &status);
 
         return mgmt_event(MGMT_EV_INDEX_REMOVED, hdev, NULL, 0, NULL);
diff --git a/net/bluetooth/rfcomm/sock.c b/net/bluetooth/rfcomm/sock.c
index 7e1e59645c05..b3226f3658cf 100644
--- a/net/bluetooth/rfcomm/sock.c
+++ b/net/bluetooth/rfcomm/sock.c
@@ -528,6 +528,7 @@ static int rfcomm_sock_getname(struct socket *sock, struct sockaddr *addr, int *
 
         BT_DBG("sock %p, sk %p", sock, sk);
 
+        memset(sa, 0, sizeof(*sa));
         sa->rc_family  = AF_BLUETOOTH;
         sa->rc_channel = rfcomm_pi(sk)->channel;
         if (peer)
@@ -822,6 +823,7 @@ static int rfcomm_sock_getsockopt(struct socket *sock, int level, int optname, c
                 }
 
                 sec.level = rfcomm_pi(sk)->sec_level;
+                sec.key_size = 0;
 
                 len = min_t(unsigned int, len, sizeof(sec));
                 if (copy_to_user(optval, (char *) &sec, len))
@@ -1033,8 +1035,17 @@ int __init rfcomm_init_sockets(void)
                 return err;
 
         err = bt_sock_register(BTPROTO_RFCOMM, &rfcomm_sock_family_ops);
-        if (err < 0)
+        if (err < 0) {
+                BT_ERR("RFCOMM socket layer registration failed");
+                goto error;
+        }
+
+        err = bt_procfs_init(THIS_MODULE, &init_net, "rfcomm", &rfcomm_sk_list, NULL);
+        if (err < 0) {
+                BT_ERR("Failed to create RFCOMM proc file");
+                bt_sock_unregister(BTPROTO_RFCOMM);
                 goto error;
+        }
 
         if (bt_debugfs) {
                 rfcomm_sock_debugfs = debugfs_create_file("rfcomm", 0444,
@@ -1048,13 +1059,14 @@ int __init rfcomm_init_sockets(void)
         return 0;
 
 error:
-        BT_ERR("RFCOMM socket layer registration failed");
         proto_unregister(&rfcomm_proto);
         return err;
 }
 
 void __exit rfcomm_cleanup_sockets(void)
 {
+        bt_procfs_cleanup(&init_net, "rfcomm");
+
         debugfs_remove(rfcomm_sock_debugfs);
 
         if (bt_sock_unregister(BTPROTO_RFCOMM) < 0)
diff --git a/net/bluetooth/rfcomm/tty.c b/net/bluetooth/rfcomm/tty.c
index cb960773c002..56f182393c4c 100644
--- a/net/bluetooth/rfcomm/tty.c
+++ b/net/bluetooth/rfcomm/tty.c
@@ -456,7 +456,7 @@ static int rfcomm_get_dev_list(void __user *arg)
 
         size = sizeof(*dl) + dev_num * sizeof(*di);
 
-        dl = kmalloc(size, GFP_KERNEL);
+        dl = kzalloc(size, GFP_KERNEL);
         if (!dl)
                 return -ENOMEM;
 
diff --git a/net/bluetooth/sco.c b/net/bluetooth/sco.c
index 40bbe25dcff7..dc42b917aaaf 100644
--- a/net/bluetooth/sco.c
+++ b/net/bluetooth/sco.c
@@ -131,6 +131,15 @@ static int sco_conn_del(struct hci_conn *hcon, int err)
                 sco_sock_clear_timer(sk);
                 sco_chan_del(sk, err);
                 bh_unlock_sock(sk);
+
+                sco_conn_lock(conn);
+                conn->sk = NULL;
+                sco_pi(sk)->conn = NULL;
+                sco_conn_unlock(conn);
+
+                if (conn->hcon)
+                        hci_conn_put(conn->hcon);
+
                 sco_sock_kill(sk);
         }
 
@@ -821,16 +830,6 @@ static void sco_chan_del(struct sock *sk, int err)
 
         BT_DBG("sk %p, conn %p, err %d", sk, conn, err);
 
-        if (conn) {
-                sco_conn_lock(conn);
-                conn->sk = NULL;
-                sco_pi(sk)->conn = NULL;
-                sco_conn_unlock(conn);
-
-                if (conn->hcon)
-                        hci_conn_put(conn->hcon);
-        }
-
         sk->sk_state = BT_CLOSED;
         sk->sk_err   = err;
         sk->sk_state_change(sk);
@@ -913,7 +912,7 @@ int sco_connect_ind(struct hci_dev *hdev, bdaddr_t *bdaddr)
         return lm;
 }
 
-int sco_connect_cfm(struct hci_conn *hcon, __u8 status)
+void sco_connect_cfm(struct hci_conn *hcon, __u8 status)
 {
         BT_DBG("hcon %p bdaddr %s status %d", hcon, batostr(&hcon->dst), status);
         if (!status) {
@@ -924,16 +923,13 @@ int sco_connect_cfm(struct hci_conn *hcon, __u8 status)
                         sco_conn_ready(conn);
         } else
                 sco_conn_del(hcon, bt_to_errno(status));
-
-        return 0;
 }
 
-int sco_disconn_cfm(struct hci_conn *hcon, __u8 reason)
+void sco_disconn_cfm(struct hci_conn *hcon, __u8 reason)
 {
         BT_DBG("hcon %p reason %d", hcon, reason);
 
         sco_conn_del(hcon, bt_to_errno(reason));
-        return 0;
 }
 
 int sco_recv_scodata(struct hci_conn *hcon, struct sk_buff *skb)
@@ -1026,6 +1022,13 @@ int __init sco_init(void)
                 goto error;
         }
 
+        err = bt_procfs_init(THIS_MODULE, &init_net, "sco", &sco_sk_list, NULL);
+        if (err < 0) {
+                BT_ERR("Failed to create SCO proc file");
+                bt_sock_unregister(BTPROTO_SCO);
+                goto error;
+        }
+
         if (bt_debugfs) {
                 sco_debugfs = debugfs_create_file("sco", 0444, bt_debugfs,
                                                   NULL, &sco_debugfs_fops);
@@ -1044,6 +1047,8 @@ error:
 
 void __exit sco_exit(void)
 {
+        bt_procfs_cleanup(&init_net, "sco");
+
         debugfs_remove(sco_debugfs);
 
         if (bt_sock_unregister(BTPROTO_SCO) < 0)
diff --git a/net/bluetooth/smp.c b/net/bluetooth/smp.c
index 16ef0dc85a0a..901a616c8083 100644
--- a/net/bluetooth/smp.c
+++ b/net/bluetooth/smp.c
@@ -579,8 +579,11 @@ static u8 smp_cmd_pairing_req(struct l2cap_conn *conn, struct sk_buff *skb)
 
         if (!test_and_set_bit(HCI_CONN_LE_SMP_PEND, &conn->hcon->flags))
                 smp = smp_chan_create(conn);
+        else
+                smp = conn->smp_chan;
 
-        smp = conn->smp_chan;
+        if (!smp)
+                return SMP_UNSPECIFIED;
 
         smp->preq[0] = SMP_CMD_PAIRING_REQ;
         memcpy(&smp->preq[1], req, sizeof(*req));
diff --git a/net/bridge/br_device.c b/net/bridge/br_device.c
index 333484537600..070e8a68cfc6 100644
--- a/net/bridge/br_device.c
+++ b/net/bridge/br_device.c
@@ -31,9 +31,11 @@ netdev_tx_t br_dev_xmit(struct sk_buff *skb, struct net_device *dev)
         struct net_bridge_mdb_entry *mdst;
         struct br_cpu_netstats *brstats = this_cpu_ptr(br->stats);
 
+        rcu_read_lock();
 #ifdef CONFIG_BRIDGE_NETFILTER
         if (skb->nf_bridge && (skb->nf_bridge->mask & BRNF_BRIDGED_DNAT)) {
                 br_nf_pre_routing_finish_bridge_slow(skb);
+                rcu_read_unlock();
                 return NETDEV_TX_OK;
         }
 #endif
@@ -48,7 +50,6 @@ netdev_tx_t br_dev_xmit(struct sk_buff *skb, struct net_device *dev)
         skb_reset_mac_header(skb);
         skb_pull(skb, ETH_HLEN);
 
-        rcu_read_lock();
         if (is_broadcast_ether_addr(dest))
                 br_flood_deliver(br, skb);
         else if (is_multicast_ether_addr(dest)) {
@@ -206,24 +207,23 @@ static void br_poll_controller(struct net_device *br_dev)
 static void br_netpoll_cleanup(struct net_device *dev)
 {
         struct net_bridge *br = netdev_priv(dev);
-        struct net_bridge_port *p, *n;
+        struct net_bridge_port *p;
 
-        list_for_each_entry_safe(p, n, &br->port_list, list) {
+        list_for_each_entry(p, &br->port_list, list)
                 br_netpoll_disable(p);
-        }
 }
 
-static int br_netpoll_setup(struct net_device *dev, struct netpoll_info *ni)
+static int br_netpoll_setup(struct net_device *dev, struct netpoll_info *ni,
+                            gfp_t gfp)
 {
         struct net_bridge *br = netdev_priv(dev);
-        struct net_bridge_port *p, *n;
+        struct net_bridge_port *p;
         int err = 0;
 
-        list_for_each_entry_safe(p, n, &br->port_list, list) {
+        list_for_each_entry(p, &br->port_list, list) {
                 if (!p->dev)
                         continue;
-
-                err = br_netpoll_enable(p);
+                err = br_netpoll_enable(p, gfp);
                 if (err)
                         goto fail;
         }
@@ -236,17 +236,17 @@ fail:
         goto out;
 }
 
-int br_netpoll_enable(struct net_bridge_port *p)
+int br_netpoll_enable(struct net_bridge_port *p, gfp_t gfp)
 {
         struct netpoll *np;
         int err = 0;
 
-        np = kzalloc(sizeof(*p->np), GFP_KERNEL);
+        np = kzalloc(sizeof(*p->np), gfp);
         err = -ENOMEM;
         if (!np)
                 goto out;
 
-        err = __netpoll_setup(np, p->dev);
+        err = __netpoll_setup(np, p->dev, gfp);
         if (err) {
                 kfree(np);
                 goto out;
@@ -267,11 +267,7 @@ void br_netpoll_disable(struct net_bridge_port *p)
 
         p->np = NULL;
 
-        /* Wait for transmitting packets to finish before freeing. */
-        synchronize_rcu_bh();
-
-        __netpoll_cleanup(np);
-        kfree(np);
+        __netpoll_free_rcu(np);
 }
 
 #endif
diff --git a/net/bridge/br_fdb.c b/net/bridge/br_fdb.c
index d21f32383517..9ce430b4657c 100644
--- a/net/bridge/br_fdb.c
+++ b/net/bridge/br_fdb.c
@@ -312,7 +312,7 @@ int br_fdb_fillbuf(struct net_bridge *br, void *buf,
 
                         fe->is_local = f->is_local;
                         if (!f->is_static)
-                                fe->ageing_timer_value = jiffies_to_clock_t(jiffies - f->updated);
+                                fe->ageing_timer_value = jiffies_delta_to_clock_t(jiffies - f->updated);
                         ++fe;
                         ++num;
                 }
diff --git a/net/bridge/br_forward.c b/net/bridge/br_forward.c
index e9466d412707..02015a505d2a 100644
--- a/net/bridge/br_forward.c
+++ b/net/bridge/br_forward.c
@@ -65,7 +65,7 @@ static void __br_deliver(const struct net_bridge_port *to, struct sk_buff *skb)
 {
         skb->dev = to->dev;
 
-        if (unlikely(netpoll_tx_running(to->dev))) {
+        if (unlikely(netpoll_tx_running(to->br->dev))) {
                 if (packet_length(skb) > skb->dev->mtu && !skb_is_gso(skb))
                         kfree_skb(skb);
                 else {
diff --git a/net/bridge/br_if.c b/net/bridge/br_if.c
index e1144e1617be..1c8fdc3558cd 100644
--- a/net/bridge/br_if.c
+++ b/net/bridge/br_if.c
@@ -361,7 +361,7 @@ int br_add_if(struct net_bridge *br, struct net_device *dev)
         if (err)
                 goto err2;
 
-        if (br_netpoll_info(br) && ((err = br_netpoll_enable(p))))
+        if (br_netpoll_info(br) && ((err = br_netpoll_enable(p, GFP_KERNEL))))
                 goto err3;
 
         err = netdev_set_master(dev, br->dev);
@@ -427,6 +427,10 @@ int br_del_if(struct net_bridge *br, struct net_device *dev)
         if (!p || p->br != br)
                 return -EINVAL;
 
+        /* Since more than one interface can be attached to a bridge,
+         * there still maybe an alternate path for netconsole to use;
+         * therefore there is no reason for a NETDEV_RELEASE event.
+         */
         del_nbp(p);
 
         spin_lock_bh(&br->lock);
diff --git a/net/bridge/br_private.h b/net/bridge/br_private.h
index a768b2408edf..f507d2af9646 100644
--- a/net/bridge/br_private.h
+++ b/net/bridge/br_private.h
@@ -316,7 +316,7 @@ static inline void br_netpoll_send_skb(const struct net_bridge_port *p,
                 netpoll_send_skb(np, skb);
 }
 
-extern int br_netpoll_enable(struct net_bridge_port *p);
+extern int br_netpoll_enable(struct net_bridge_port *p, gfp_t gfp);
 extern void br_netpoll_disable(struct net_bridge_port *p);
 #else
 static inline struct netpoll_info *br_netpoll_info(struct net_bridge *br)
@@ -329,7 +329,7 @@ static inline void br_netpoll_send_skb(const struct net_bridge_port *p,
 {
 }
 
-static inline int br_netpoll_enable(struct net_bridge_port *p)
+static inline int br_netpoll_enable(struct net_bridge_port *p, gfp_t gfp)
 {
         return 0;
 }
diff --git a/net/bridge/br_stp_timer.c b/net/bridge/br_stp_timer.c
index a6747e673426..c3530a81a33b 100644
--- a/net/bridge/br_stp_timer.c
+++ b/net/bridge/br_stp_timer.c
@@ -170,5 +170,5 @@ void br_stp_port_timer_init(struct net_bridge_port *p)
 unsigned long br_timer_value(const struct timer_list *timer)
 {
         return timer_pending(timer)
-                ? jiffies_to_clock_t(timer->expires - jiffies) : 0;
+                ? jiffies_delta_to_clock_t(timer->expires - jiffies) : 0;
 }
diff --git a/net/bridge/netfilter/ebtable_filter.c b/net/bridge/netfilter/ebtable_filter.c
index 42e6bd094574..3c2e9dced9e0 100644
--- a/net/bridge/netfilter/ebtable_filter.c
+++ b/net/bridge/netfilter/ebtable_filter.c
@@ -100,9 +100,7 @@ static struct nf_hook_ops ebt_ops_filter[] __read_mostly = {
 static int __net_init frame_filter_net_init(struct net *net)
 {
         net->xt.frame_filter = ebt_register_table(net, &frame_filter);
-        if (IS_ERR(net->xt.frame_filter))
-                return PTR_ERR(net->xt.frame_filter);
-        return 0;
+        return PTR_RET(net->xt.frame_filter);
 }
 
 static void __net_exit frame_filter_net_exit(struct net *net)
diff --git a/net/bridge/netfilter/ebtable_nat.c b/net/bridge/netfilter/ebtable_nat.c
index 6dc2f878ae05..10871bc77908 100644
--- a/net/bridge/netfilter/ebtable_nat.c
+++ b/net/bridge/netfilter/ebtable_nat.c
@@ -100,9 +100,7 @@ static struct nf_hook_ops ebt_ops_nat[] __read_mostly = {
 static int __net_init frame_nat_net_init(struct net *net)
 {
         net->xt.frame_nat = ebt_register_table(net, &frame_nat);
-        if (IS_ERR(net->xt.frame_nat))
-                return PTR_ERR(net->xt.frame_nat);
-        return 0;
+        return PTR_RET(net->xt.frame_nat);
 }
 
 static void __net_exit frame_nat_net_exit(struct net *net)
diff --git a/net/caif/chnl_net.c b/net/caif/chnl_net.c
index 69771c04ba8f..e597733affb8 100644
--- a/net/caif/chnl_net.c
+++ b/net/caif/chnl_net.c
@@ -94,6 +94,10 @@ static int chnl_recv_cb(struct cflayer *layr, struct cfpkt *pkt)
 
         /* check the version of IP */
         ip_version = skb_header_pointer(skb, 0, 1, &buf);
+        if (!ip_version) {
+                kfree_skb(skb);
+                return -EINVAL;
+        }
 
         switch (*ip_version >> 4) {
         case 4:
diff --git a/net/ceph/ceph_common.c b/net/ceph/ceph_common.c
index 69e38db28e5f..a8020293f342 100644
--- a/net/ceph/ceph_common.c
+++ b/net/ceph/ceph_common.c
@@ -84,7 +84,6 @@ int ceph_check_fsid(struct ceph_client *client, struct ceph_fsid *fsid)
                         return -1;
                 }
         } else {
-                pr_info("client%lld fsid %pU\n", ceph_client_id(client), fsid);
                 memcpy(&client->fsid, fsid, sizeof(*fsid));
         }
         return 0;
diff --git a/net/ceph/debugfs.c b/net/ceph/debugfs.c
index 54b531a01121..38b5dc1823d4 100644
--- a/net/ceph/debugfs.c
+++ b/net/ceph/debugfs.c
@@ -189,6 +189,9 @@ int ceph_debugfs_client_init(struct ceph_client *client)
         snprintf(name, sizeof(name), "%pU.client%lld", &client->fsid,
                  client->monc.auth->global_id);
 
+        dout("ceph_debugfs_client_init %p %s\n", client, name);
+
+        BUG_ON(client->debugfs_dir);
         client->debugfs_dir = debugfs_create_dir(name, ceph_debugfs_dir);
         if (!client->debugfs_dir)
                 goto out;
@@ -234,6 +237,7 @@ out:
 
 void ceph_debugfs_client_cleanup(struct ceph_client *client)
 {
+        dout("ceph_debugfs_client_cleanup %p\n", client);
         debugfs_remove(client->debugfs_osdmap);
         debugfs_remove(client->debugfs_monmap);
         debugfs_remove(client->osdc.debugfs_file);
diff --git a/net/ceph/messenger.c b/net/ceph/messenger.c
index b9796750034a..24c5eea8c45b 100644
--- a/net/ceph/messenger.c
+++ b/net/ceph/messenger.c
@@ -915,7 +915,6 @@ static int prepare_write_connect(struct ceph_connection *con)
         con->out_connect.authorizer_len = auth ?
                 cpu_to_le32(auth->authorizer_buf_len) : 0;
 
-        con_out_kvec_reset(con);
         con_out_kvec_add(con, sizeof (con->out_connect),
                                         &con->out_connect);
         if (auth && auth->authorizer_buf_len)
@@ -1557,6 +1556,7 @@ static int process_connect(struct ceph_connection *con)
                         return -1;
                 }
                 con->auth_retry = 1;
+                con_out_kvec_reset(con);
                 ret = prepare_write_connect(con);
                 if (ret < 0)
                         return ret;
@@ -1577,6 +1577,7 @@ static int process_connect(struct ceph_connection *con)
                        ENTITY_NAME(con->peer_name),
                        ceph_pr_addr(&con->peer_addr.in_addr));
                 reset_connection(con);
+                con_out_kvec_reset(con);
                 ret = prepare_write_connect(con);
                 if (ret < 0)
                         return ret;
@@ -1601,6 +1602,7 @@ static int process_connect(struct ceph_connection *con)
                      le32_to_cpu(con->out_connect.connect_seq),
                      le32_to_cpu(con->in_reply.connect_seq));
                 con->connect_seq = le32_to_cpu(con->in_reply.connect_seq);
+                con_out_kvec_reset(con);
                 ret = prepare_write_connect(con);
                 if (ret < 0)
                         return ret;
@@ -1617,6 +1619,7 @@ static int process_connect(struct ceph_connection *con)
                      le32_to_cpu(con->in_reply.global_seq));
                 get_global_seq(con->msgr,
                                le32_to_cpu(con->in_reply.global_seq));
+                con_out_kvec_reset(con);
                 ret = prepare_write_connect(con);
                 if (ret < 0)
                         return ret;
@@ -2135,7 +2138,11 @@ more:
                 BUG_ON(con->state != CON_STATE_CONNECTING);
                 con->state = CON_STATE_NEGOTIATING;
 
-                /* Banner is good, exchange connection info */
+                /*
+                 * Received banner is good, exchange connection info.
+                 * Do not reset out_kvec, as sending our banner raced
+                 * with receiving peer banner after connect completed.
+                 */
                 ret = prepare_write_connect(con);
                 if (ret < 0)
                         goto out;
diff --git a/net/ceph/mon_client.c b/net/ceph/mon_client.c
index 105d533b55f3..900ea0f043fc 100644
--- a/net/ceph/mon_client.c
+++ b/net/ceph/mon_client.c
@@ -311,6 +311,17 @@ int ceph_monc_open_session(struct ceph_mon_client *monc)
 EXPORT_SYMBOL(ceph_monc_open_session);
 
 /*
+ * We require the fsid and global_id in order to initialize our
+ * debugfs dir.
+ */
+static bool have_debugfs_info(struct ceph_mon_client *monc)
+{
+        dout("have_debugfs_info fsid %d globalid %lld\n",
+             (int)monc->client->have_fsid, monc->auth->global_id);
+        return monc->client->have_fsid && monc->auth->global_id > 0;
+}
+
+/*
  * The monitor responds with mount ack indicate mount success.  The
  * included client ticket allows the client to talk to MDSs and OSDs.
  */
@@ -320,9 +331,12 @@ static void ceph_monc_handle_map(struct ceph_mon_client *monc,
         struct ceph_client *client = monc->client;
         struct ceph_monmap *monmap = NULL, *old = monc->monmap;
         void *p, *end;
+        int had_debugfs_info, init_debugfs = 0;
 
         mutex_lock(&monc->mutex);
 
+        had_debugfs_info = have_debugfs_info(monc);
+
         dout("handle_monmap\n");
         p = msg->front.iov_base;
         end = p + msg->front.iov_len;
@@ -344,12 +358,22 @@ static void ceph_monc_handle_map(struct ceph_mon_client *monc,
 
         if (!client->have_fsid) {
                 client->have_fsid = true;
+                if (!had_debugfs_info && have_debugfs_info(monc)) {
+                        pr_info("client%lld fsid %pU\n",
+                                ceph_client_id(monc->client),
+                                &monc->client->fsid);
+                        init_debugfs = 1;
+                }
                 mutex_unlock(&monc->mutex);
-                /*
-                 * do debugfs initialization without mutex to avoid
-                 * creating a locking dependency
-                 */
-                ceph_debugfs_client_init(client);
+
+                if (init_debugfs) {
+                        /*
+                         * do debugfs initialization without mutex to avoid
+                         * creating a locking dependency
+                         */
+                        ceph_debugfs_client_init(monc->client);
+                }
+
                 goto out_unlocked;
         }
 out:
@@ -865,8 +889,10 @@ static void handle_auth_reply(struct ceph_mon_client *monc,
 {
         int ret;
         int was_auth = 0;
+        int had_debugfs_info, init_debugfs = 0;
 
         mutex_lock(&monc->mutex);
+        had_debugfs_info = have_debugfs_info(monc);
         if (monc->auth->ops)
                 was_auth = monc->auth->ops->is_authenticated(monc->auth);
         monc->pending_auth = 0;
@@ -889,7 +915,22 @@ static void handle_auth_reply(struct ceph_mon_client *monc,
                 __send_subscribe(monc);
                 __resend_generic_request(monc);
         }
+
+        if (!had_debugfs_info && have_debugfs_info(monc)) {
+                pr_info("client%lld fsid %pU\n",
+                        ceph_client_id(monc->client),
+                        &monc->client->fsid);
+                init_debugfs = 1;
+        }
         mutex_unlock(&monc->mutex);
+
+        if (init_debugfs) {
+                /*
+                 * do debugfs initialization without mutex to avoid
+                 * creating a locking dependency
+                 */
+                ceph_debugfs_client_init(monc->client);
+        }
 }
 
 static int __validate_auth(struct ceph_mon_client *monc)
diff --git a/net/core/dev.c b/net/core/dev.c
index 0cb3fe8d8e72..b1e6d6385516 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -1055,6 +1055,8 @@ rollback:
  */
 int dev_set_alias(struct net_device *dev, const char *alias, size_t len)
 {
+        char *new_ifalias;
+
         ASSERT_RTNL();
 
         if (len >= IFALIASZ)
@@ -1068,9 +1070,10 @@ int dev_set_alias(struct net_device *dev, const char *alias, size_t len)
                 return 0;
         }
 
-        dev->ifalias = krealloc(dev->ifalias, len + 1, GFP_KERNEL);
-        if (!dev->ifalias)
+        new_ifalias = krealloc(dev->ifalias, len + 1, GFP_KERNEL);
+        if (!new_ifalias)
                 return -ENOMEM;
+        dev->ifalias = new_ifalias;
 
         strlcpy(dev->ifalias, alias, len+1);
         return len;
@@ -1106,11 +1109,23 @@ void netdev_state_change(struct net_device *dev)
 }
 EXPORT_SYMBOL(netdev_state_change);
 
-int netdev_bonding_change(struct net_device *dev, unsigned long event)
+/**
+ *      netdev_notify_peers - notify network peers about existence of @dev
+ *      @dev: network device
+ *
+ * Generate traffic such that interested network peers are aware of
+ * @dev, such as by generating a gratuitous ARP. This may be used when
+ * a device wants to inform the rest of the network about some sort of
+ * reconfiguration such as a failover event or virtual machine
+ * migration.
+ */
+void netdev_notify_peers(struct net_device *dev)
 {
-        return call_netdevice_notifiers(event, dev);
+        rtnl_lock();
+        call_netdevice_notifiers(NETDEV_NOTIFY_PEERS, dev);
+        rtnl_unlock();
 }
-EXPORT_SYMBOL(netdev_bonding_change);
+EXPORT_SYMBOL(netdev_notify_peers);
 
 /**
  *      dev_load        - load a network module
@@ -1391,7 +1406,6 @@ rollback:
                                 nb->notifier_call(nb, NETDEV_DOWN, dev);
                         }
                         nb->notifier_call(nb, NETDEV_UNREGISTER, dev);
-                        nb->notifier_call(nb, NETDEV_UNREGISTER_BATCH, dev);
                 }
         }
 
@@ -1433,7 +1447,6 @@ int unregister_netdevice_notifier(struct notifier_block *nb)
                                 nb->notifier_call(nb, NETDEV_DOWN, dev);
                         }
                         nb->notifier_call(nb, NETDEV_UNREGISTER, dev);
-                        nb->notifier_call(nb, NETDEV_UNREGISTER_BATCH, dev);
                 }
         }
 unlock:
@@ -1639,6 +1652,19 @@ static inline int deliver_skb(struct sk_buff *skb,
         return pt_prev->func(skb, skb->dev, pt_prev, orig_dev);
 }
 
+static inline bool skb_loop_sk(struct packet_type *ptype, struct sk_buff *skb)
+{
+        if (ptype->af_packet_priv == NULL)
+                return false;
+
+        if (ptype->id_match)
+                return ptype->id_match(ptype, skb->sk);
+        else if ((struct sock *)ptype->af_packet_priv == skb->sk)
+                return true;
+
+        return false;
+}
+
 /*
  *      Support routine. Sends outgoing frames to any network
  *      taps currently in use.
@@ -1656,8 +1682,7 @@ static void dev_queue_xmit_nit(struct sk_buff *skb, struct net_device *dev)
                  * they originated from - MvS (miquels@drinkel.ow.org)
                  */
                 if ((ptype->dev == dev || !ptype->dev) &&
-                    (ptype->af_packet_priv == NULL ||
-                     (struct sock *)ptype->af_packet_priv != skb->sk)) {
+                    (!skb_loop_sk(ptype, skb))) {
                         if (pt_prev) {
                                 deliver_skb(skb2, pt_prev, skb->dev);
                                 pt_prev = ptype;
@@ -2134,6 +2159,9 @@ netdev_features_t netif_skb_features(struct sk_buff *skb)
         __be16 protocol = skb->protocol;
         netdev_features_t features = skb->dev->features;
 
+        if (skb_shinfo(skb)->gso_segs > skb->dev->gso_max_segs)
+                features &= ~NETIF_F_GSO_MASK;
+
         if (protocol == htons(ETH_P_8021Q)) {
                 struct vlan_ethhdr *veh = (struct vlan_ethhdr *)skb->data;
                 protocol = veh->h_vlan_encapsulated_proto;
@@ -2156,9 +2184,7 @@ EXPORT_SYMBOL(netif_skb_features);
 /*
  * Returns true if either:
  *      1. skb has frag_list and the device doesn't support FRAGLIST, or
- *      2. skb is fragmented and the device does not support SG, or if
- *         at least one of fragments is in highmem and device does not
- *         support DMA from it.
+ *      2. skb is fragmented and the device does not support SG.
  */
 static inline int skb_needs_linearize(struct sk_buff *skb,
                                       int features)
@@ -4492,8 +4518,8 @@ static void dev_change_rx_flags(struct net_device *dev, int flags)
 static int __dev_set_promiscuity(struct net_device *dev, int inc)
 {
         unsigned int old_flags = dev->flags;
-        uid_t uid;
-        gid_t gid;
+        kuid_t uid;
+        kgid_t gid;
 
         ASSERT_RTNL();
 
@@ -4525,7 +4551,8 @@ static int __dev_set_promiscuity(struct net_device *dev, int inc)
                                 dev->name, (dev->flags & IFF_PROMISC),
                                 (old_flags & IFF_PROMISC),
                                 audit_get_loginuid(current),
-                                uid, gid,
+                                from_kuid(&init_user_ns, uid),
+                                from_kgid(&init_user_ns, gid),
                                 audit_get_sessionid(current));
                 }
 
@@ -5218,12 +5245,12 @@ int dev_ioctl(struct net *net, unsigned int cmd, void __user *arg)
  */
 static int dev_new_index(struct net *net)
 {
-        static int ifindex;
+        int ifindex = net->ifindex;
         for (;;) {
                 if (++ifindex <= 0)
                         ifindex = 1;
                 if (!__dev_get_by_index(net, ifindex))
-                        return ifindex;
+                        return net->ifindex = ifindex;
         }
 }
 
@@ -5301,10 +5328,6 @@ static void rollback_registered_many(struct list_head *head)
                 netdev_unregister_kobject(dev);
         }
 
-        /* Process any work delayed until the end of the batch */
-        dev = list_first_entry(head, struct net_device, unreg_list);
-        call_netdevice_notifiers(NETDEV_UNREGISTER_BATCH, dev);
-
         synchronize_net();
 
         list_for_each_entry(dev, head, unreg_list)
@@ -5576,7 +5599,12 @@ int register_netdevice(struct net_device *dev)
                 }
         }
 
-        dev->ifindex = dev_new_index(net);
+        ret = -EBUSY;
+        if (!dev->ifindex)
+                dev->ifindex = dev_new_index(net);
+        else if (__dev_get_by_index(net, dev->ifindex))
+                goto err_uninit;
+
         if (dev->iflink == -1)
                 dev->iflink = dev->ifindex;
 
@@ -5619,6 +5647,8 @@ int register_netdevice(struct net_device *dev)
 
         set_bit(__LINK_STATE_PRESENT, &dev->state);
 
+        linkwatch_init_dev(dev);
+
         dev_init_scheduler(dev);
         dev_hold(dev);
         list_netdevice(dev);
@@ -5726,6 +5756,7 @@ EXPORT_SYMBOL(netdev_refcnt_read);
 
 /**
  * netdev_wait_allrefs - wait until all references are gone.
+ * @dev: target net_device
  *
  * This is called when unregistering network devices.
  *
@@ -5751,9 +5782,12 @@ static void netdev_wait_allrefs(struct net_device *dev)
 
                         /* Rebroadcast unregister notification */
                         call_netdevice_notifiers(NETDEV_UNREGISTER, dev);
-                        /* don't resend NETDEV_UNREGISTER_BATCH, _BATCH users
-                         * should have already handle it the first time */
 
+                        __rtnl_unlock();
+                        rcu_barrier();
+                        rtnl_lock();
+
+                        call_netdevice_notifiers(NETDEV_UNREGISTER_FINAL, dev);
                         if (test_bit(__LINK_STATE_LINKWATCH_PENDING,
                                      &dev->state)) {
                                 /* We must not have linkwatch events
@@ -5815,9 +5849,8 @@ void netdev_run_todo(void)
 
         __rtnl_unlock();
 
-        /* Wait for rcu callbacks to finish before attempting to drain
-         * the device list.  This usually avoids a 250ms wait.
-         */
+
+        /* Wait for rcu callbacks to finish before next phase */
         if (!list_empty(&list))
                 rcu_barrier();
 
@@ -5826,6 +5859,10 @@ void netdev_run_todo(void)
                         = list_first_entry(&list, struct net_device, todo_list);
                 list_del(&dev->todo_list);
 
+                rtnl_lock();
+                call_netdevice_notifiers(NETDEV_UNREGISTER_FINAL, dev);
+                __rtnl_unlock();
+
                 if (unlikely(dev->reg_state != NETREG_UNREGISTERING)) {
                         pr_err("network todo '%s' but state %d\n",
                                dev->name, dev->reg_state);
@@ -5986,6 +6023,7 @@ struct net_device *alloc_netdev_mqs(int sizeof_priv, const char *name,
         dev_net_set(dev, &init_net);
 
         dev->gso_max_size = GSO_MAX_SIZE;
+        dev->gso_max_segs = GSO_MAX_SEGS;
 
         INIT_LIST_HEAD(&dev->napi_list);
         INIT_LIST_HEAD(&dev->unreg_list);
@@ -6219,7 +6257,8 @@ int dev_change_net_namespace(struct net_device *dev, struct net *net, const char
            the device is just moving and can keep their slaves up.
         */
         call_netdevice_notifiers(NETDEV_UNREGISTER, dev);
-        call_netdevice_notifiers(NETDEV_UNREGISTER_BATCH, dev);
+        rcu_barrier();
+        call_netdevice_notifiers(NETDEV_UNREGISTER_FINAL, dev);
         rtmsg_ifinfo(RTM_DELLINK, dev, ~0U);
 
         /*
diff --git a/net/core/dst.c b/net/core/dst.c
index 069d51d29414..f6593d238e9a 100644
--- a/net/core/dst.c
+++ b/net/core/dst.c
@@ -149,7 +149,15 @@ int dst_discard(struct sk_buff *skb)
 }
 EXPORT_SYMBOL(dst_discard);
 
-const u32 dst_default_metrics[RTAX_MAX];
+const u32 dst_default_metrics[RTAX_MAX + 1] = {
+        /* This initializer is needed to force linker to place this variable
+         * into const section. Otherwise it might end into bss section.
+         * We really want to avoid false sharing on this variable, and catch
+         * any writes on it.
+         */
+        [RTAX_MAX] = 0xdeadbeef,
+};
+
 
 void *dst_alloc(struct dst_ops *ops, struct net_device *dev,
                 int initial_ref, int initial_obsolete, unsigned short flags)
@@ -366,7 +374,7 @@ static int dst_dev_event(struct notifier_block *this, unsigned long event,
         struct dst_entry *dst, *last = NULL;
 
         switch (event) {
-        case NETDEV_UNREGISTER:
+        case NETDEV_UNREGISTER_FINAL:
         case NETDEV_DOWN:
                 mutex_lock(&dst_gc_mutex);
                 for (dst = dst_busy_list; dst; dst = dst->next) {
diff --git a/net/core/link_watch.c b/net/core/link_watch.c
index c3519c6d1b16..a01922219a23 100644
--- a/net/core/link_watch.c
+++ b/net/core/link_watch.c
@@ -76,6 +76,14 @@ static void rfc2863_policy(struct net_device *dev)
 }
 
 
+void linkwatch_init_dev(struct net_device *dev)
+{
+        /* Handle pre-registration link state changes */
+        if (!netif_carrier_ok(dev) || netif_dormant(dev))
+                rfc2863_policy(dev);
+}
+
+
 static bool linkwatch_urgent_event(struct net_device *dev)
 {
         if (!netif_running(dev))
diff --git a/net/core/netpoll.c b/net/core/netpoll.c
index b4c90e42b443..dd67818025d1 100644
--- a/net/core/netpoll.c
+++ b/net/core/netpoll.c
@@ -26,6 +26,7 @@
 #include <linux/workqueue.h>
 #include <linux/slab.h>
 #include <linux/export.h>
+#include <linux/if_vlan.h>
 #include <net/tcp.h>
 #include <net/udp.h>
 #include <asm/unaligned.h>
@@ -54,7 +55,7 @@ static atomic_t trapped;
          MAX_UDP_CHUNK)
 
 static void zap_completion_queue(void);
-static void arp_reply(struct sk_buff *skb);
+static void netpoll_arp_reply(struct sk_buff *skb, struct netpoll_info *npinfo);
 
 static unsigned int carrier_timeout = 4;
 module_param(carrier_timeout, uint, 0644);
@@ -170,7 +171,8 @@ static void poll_napi(struct net_device *dev)
         list_for_each_entry(napi, &dev->napi_list, dev_list) {
                 if (napi->poll_owner != smp_processor_id() &&
                     spin_trylock(&napi->poll_lock)) {
-                        budget = poll_one_napi(dev->npinfo, napi, budget);
+                        budget = poll_one_napi(rcu_dereference_bh(dev->npinfo),
+                                               napi, budget);
                         spin_unlock(&napi->poll_lock);
 
                         if (!budget)
@@ -185,13 +187,14 @@ static void service_arp_queue(struct netpoll_info *npi)
                 struct sk_buff *skb;
 
                 while ((skb = skb_dequeue(&npi->arp_tx)))
-                        arp_reply(skb);
+                        netpoll_arp_reply(skb, npi);
         }
 }
 
 static void netpoll_poll_dev(struct net_device *dev)
 {
         const struct net_device_ops *ops;
+        struct netpoll_info *ni = rcu_dereference_bh(dev->npinfo);
 
         if (!dev || !netif_running(dev))
                 return;
@@ -206,17 +209,18 @@ static void netpoll_poll_dev(struct net_device *dev)
         poll_napi(dev);
 
         if (dev->flags & IFF_SLAVE) {
-                if (dev->npinfo) {
+                if (ni) {
                         struct net_device *bond_dev = dev->master;
                         struct sk_buff *skb;
-                        while ((skb = skb_dequeue(&dev->npinfo->arp_tx))) {
+                        struct netpoll_info *bond_ni = rcu_dereference_bh(bond_dev->npinfo);
+                        while ((skb = skb_dequeue(&ni->arp_tx))) {
                                 skb->dev = bond_dev;
-                                skb_queue_tail(&bond_dev->npinfo->arp_tx, skb);
+                                skb_queue_tail(&bond_ni->arp_tx, skb);
                         }
                 }
         }
 
-        service_arp_queue(dev->npinfo);
+        service_arp_queue(ni);
 
         zap_completion_queue();
 }
@@ -302,6 +306,7 @@ static int netpoll_owner_active(struct net_device *dev)
         return 0;
 }
 
+/* call with IRQ disabled */
 void netpoll_send_skb_on_dev(struct netpoll *np, struct sk_buff *skb,
                              struct net_device *dev)
 {
@@ -309,8 +314,11 @@ void netpoll_send_skb_on_dev(struct netpoll *np, struct sk_buff *skb,
         unsigned long tries;
         const struct net_device_ops *ops = dev->netdev_ops;
         /* It is up to the caller to keep npinfo alive. */
-        struct netpoll_info *npinfo = np->dev->npinfo;
+        struct netpoll_info *npinfo;
+
+        WARN_ON_ONCE(!irqs_disabled());
 
+        npinfo = rcu_dereference_bh(np->dev->npinfo);
         if (!npinfo || !netif_running(dev) || !netif_device_present(dev)) {
                 __kfree_skb(skb);
                 return;
@@ -319,16 +327,22 @@ void netpoll_send_skb_on_dev(struct netpoll *np, struct sk_buff *skb,
         /* don't get messages out of order, and no recursion */
         if (skb_queue_len(&npinfo->txq) == 0 && !netpoll_owner_active(dev)) {
                 struct netdev_queue *txq;
-                unsigned long flags;
 
                 txq = netdev_get_tx_queue(dev, skb_get_queue_mapping(skb));
 
-                local_irq_save(flags);
                 /* try until next clock tick */
                 for (tries = jiffies_to_usecs(1)/USEC_PER_POLL;
                      tries > 0; --tries) {
                         if (__netif_tx_trylock(txq)) {
                                 if (!netif_xmit_stopped(txq)) {
+                                        if (vlan_tx_tag_present(skb) &&
+                                            !(netif_skb_features(skb) & NETIF_F_HW_VLAN_TX)) {
+                                                skb = __vlan_put_tag(skb, vlan_tx_tag_get(skb));
+                                                if (unlikely(!skb))
+                                                        break;
+                                                skb->vlan_tci = 0;
+                                        }
+
                                         status = ops->ndo_start_xmit(skb, dev);
                                         if (status == NETDEV_TX_OK)
                                                 txq_trans_update(txq);
@@ -347,10 +361,9 @@ void netpoll_send_skb_on_dev(struct netpoll *np, struct sk_buff *skb,
                 }
 
                 WARN_ONCE(!irqs_disabled(),
-                        "netpoll_send_skb(): %s enabled interrupts in poll (%pF)\n",
+                        "netpoll_send_skb_on_dev(): %s enabled interrupts in poll (%pF)\n",
                         dev->name, ops->ndo_start_xmit);
 
-                local_irq_restore(flags);
         }
 
         if (status != NETDEV_TX_OK) {
@@ -367,6 +380,7 @@ void netpoll_send_udp(struct netpoll *np, const char *msg, int len)
         struct udphdr *udph;
         struct iphdr *iph;
         struct ethhdr *eth;
+        static atomic_t ip_ident;
 
         udp_len = len + sizeof(*udph);
         ip_len = udp_len + sizeof(*iph);
@@ -402,7 +416,7 @@ void netpoll_send_udp(struct netpoll *np, const char *msg, int len)
         put_unaligned(0x45, (unsigned char *)iph);
         iph->tos      = 0;
         put_unaligned(htons(ip_len), &(iph->tot_len));
-        iph->id       = 0;
+        iph->id       = htons(atomic_inc_return(&ip_ident));
         iph->frag_off = 0;
         iph->ttl      = 64;
         iph->protocol = IPPROTO_UDP;
@@ -423,9 +437,8 @@ void netpoll_send_udp(struct netpoll *np, const char *msg, int len)
 }
 EXPORT_SYMBOL(netpoll_send_udp);
 
-static void arp_reply(struct sk_buff *skb)
+static void netpoll_arp_reply(struct sk_buff *skb, struct netpoll_info *npinfo)
 {
-        struct netpoll_info *npinfo = skb->dev->npinfo;
         struct arphdr *arp;
         unsigned char *arp_ptr;
         int size, type = ARPOP_REPLY, ptype = ETH_P_ARP;
@@ -543,13 +556,12 @@ static void arp_reply(struct sk_buff *skb)
         spin_unlock_irqrestore(&npinfo->rx_lock, flags);
 }
 
-int __netpoll_rx(struct sk_buff *skb)
+int __netpoll_rx(struct sk_buff *skb, struct netpoll_info *npinfo)
 {
         int proto, len, ulen;
         int hits = 0;
         const struct iphdr *iph;
         struct udphdr *uh;
-        struct netpoll_info *npinfo = skb->dev->npinfo;
         struct netpoll *np, *tmp;
 
         if (list_empty(&npinfo->rx_np))
@@ -565,6 +577,12 @@ int __netpoll_rx(struct sk_buff *skb)
                 return 1;
         }
 
+        if (skb->protocol == cpu_to_be16(ETH_P_8021Q)) {
+                skb = vlan_untag(skb);
+                if (unlikely(!skb))
+                        goto out;
+        }
+
         proto = ntohs(eth_hdr(skb)->h_proto);
         if (proto != ETH_P_IP)
                 goto out;
@@ -715,7 +733,7 @@ int netpoll_parse_options(struct netpoll *np, char *opt)
 }
 EXPORT_SYMBOL(netpoll_parse_options);
 
-int __netpoll_setup(struct netpoll *np, struct net_device *ndev)
+int __netpoll_setup(struct netpoll *np, struct net_device *ndev, gfp_t gfp)
 {
         struct netpoll_info *npinfo;
         const struct net_device_ops *ops;
@@ -734,7 +752,7 @@ int __netpoll_setup(struct netpoll *np, struct net_device *ndev)
         }
 
         if (!ndev->npinfo) {
-                npinfo = kmalloc(sizeof(*npinfo), GFP_KERNEL);
+                npinfo = kmalloc(sizeof(*npinfo), gfp);
                 if (!npinfo) {
                         err = -ENOMEM;
                         goto out;
@@ -752,7 +770,7 @@ int __netpoll_setup(struct netpoll *np, struct net_device *ndev)
 
                 ops = np->dev->netdev_ops;
                 if (ops->ndo_netpoll_setup) {
-                        err = ops->ndo_netpoll_setup(ndev, npinfo);
+                        err = ops->ndo_netpoll_setup(ndev, npinfo, gfp);
                         if (err)
                                 goto free_npinfo;
                 }
@@ -857,7 +875,7 @@ int netpoll_setup(struct netpoll *np)
         refill_skbs();
 
         rtnl_lock();
-        err = __netpoll_setup(np, ndev);
+        err = __netpoll_setup(np, ndev, GFP_KERNEL);
         rtnl_unlock();
 
         if (err)
@@ -878,6 +896,24 @@ static int __init netpoll_init(void)
 }
 core_initcall(netpoll_init);
 
+static void rcu_cleanup_netpoll_info(struct rcu_head *rcu_head)
+{
+        struct netpoll_info *npinfo =
+                        container_of(rcu_head, struct netpoll_info, rcu);
+
+        skb_queue_purge(&npinfo->arp_tx);
+        skb_queue_purge(&npinfo->txq);
+
+        /* we can't call cancel_delayed_work_sync here, as we are in softirq */
+        cancel_delayed_work(&npinfo->tx_work);
+
+        /* clean after last, unfinished work */
+        __skb_queue_purge(&npinfo->txq);
+        /* now cancel it again */
+        cancel_delayed_work(&npinfo->tx_work);
+        kfree(npinfo);
+}
+
 void __netpoll_cleanup(struct netpoll *np)
 {
         struct netpoll_info *npinfo;
@@ -903,20 +939,24 @@ void __netpoll_cleanup(struct netpoll *np)
                         ops->ndo_netpoll_cleanup(np->dev);
 
                 RCU_INIT_POINTER(np->dev->npinfo, NULL);
+                call_rcu_bh(&npinfo->rcu, rcu_cleanup_netpoll_info);
+        }
+}
+EXPORT_SYMBOL_GPL(__netpoll_cleanup);
 
-                /* avoid racing with NAPI reading npinfo */
-                synchronize_rcu_bh();
+static void rcu_cleanup_netpoll(struct rcu_head *rcu_head)
+{
+        struct netpoll *np = container_of(rcu_head, struct netpoll, rcu);
 
-                skb_queue_purge(&npinfo->arp_tx);
-                skb_queue_purge(&npinfo->txq);
-                cancel_delayed_work_sync(&npinfo->tx_work);
+        __netpoll_cleanup(np);
+        kfree(np);
+}
 
-                /* clean after last, unfinished work */
-                __skb_queue_purge(&npinfo->txq);
-                kfree(npinfo);
-        }
+void __netpoll_free_rcu(struct netpoll *np)
+{
+        call_rcu_bh(&np->rcu, rcu_cleanup_netpoll);
 }
-EXPORT_SYMBOL_GPL(__netpoll_cleanup);
+EXPORT_SYMBOL_GPL(__netpoll_free_rcu);
 
 void netpoll_cleanup(struct netpoll *np)
 {
diff --git a/net/core/netprio_cgroup.c b/net/core/netprio_cgroup.c
index ed0c0431fcd8..c75e3f9d060f 100644
--- a/net/core/netprio_cgroup.c
+++ b/net/core/netprio_cgroup.c
@@ -101,12 +101,10 @@ static int write_update_netdev_table(struct net_device *dev)
         u32 max_len;
         struct netprio_map *map;
 
-        rtnl_lock();
         max_len = atomic_read(&max_prioidx) + 1;
         map = rtnl_dereference(dev->priomap);
         if (!map || map->priomap_len < max_len)
                 ret = extend_netdev_table(dev, max_len);
-        rtnl_unlock();
 
         return ret;
 }
@@ -256,17 +254,17 @@ static int write_priomap(struct cgroup *cgrp, struct cftype *cft,
         if (!dev)
                 goto out_free_devname;
 
+        rtnl_lock();
         ret = write_update_netdev_table(dev);
         if (ret < 0)
                 goto out_put_dev;
 
-        rcu_read_lock();
-        map = rcu_dereference(dev->priomap);
+        map = rtnl_dereference(dev->priomap);
         if (map)
                 map->priomap[prioidx] = priority;
-        rcu_read_unlock();
 
 out_put_dev:
+        rtnl_unlock();
         dev_put(dev);
 
 out_free_devname:
@@ -277,12 +275,6 @@ out_free_devname:
 void net_prio_attach(struct cgroup *cgrp, struct cgroup_taskset *tset)
 {
         struct task_struct *p;
-        char *tmp = kzalloc(sizeof(char) * PATH_MAX, GFP_KERNEL);
-
-        if (!tmp) {
-                pr_warn("Unable to attach cgrp due to alloc failure!\n");
-                return;
-        }
 
         cgroup_taskset_for_each(p, cgrp, tset) {
                 unsigned int fd;
@@ -296,32 +288,24 @@ void net_prio_attach(struct cgroup *cgrp, struct cgroup_taskset *tset)
                         continue;
                 }
 
-                rcu_read_lock();
+                spin_lock(&files->file_lock);
                 fdt = files_fdtable(files);
                 for (fd = 0; fd < fdt->max_fds; fd++) {
-                        char *path;
                         struct file *file;
                         struct socket *sock;
-                        unsigned long s;
-                        int rv, err = 0;
+                        int err;
 
                         file = fcheck_files(files, fd);
                         if (!file)
                                 continue;
 
-                        path = d_path(&file->f_path, tmp, PAGE_SIZE);
-                        rv = sscanf(path, "socket:[%lu]", &s);
-                        if (rv <= 0)
-                                continue;
-
                         sock = sock_from_file(file, &err);
-                        if (!err)
+                        if (sock)
                                 sock_update_netprioidx(sock->sk, p);
                 }
-                rcu_read_unlock();
+                spin_unlock(&files->file_lock);
                 task_unlock(p);
         }
-        kfree(tmp);
 }
 
 static struct cftype ss_files[] = {
diff --git a/net/core/request_sock.c b/net/core/request_sock.c
index 9b570a6a33c5..c31d9e8668c3 100644
--- a/net/core/request_sock.c
+++ b/net/core/request_sock.c
@@ -15,6 +15,7 @@
 #include <linux/random.h>
 #include <linux/slab.h>
 #include <linux/string.h>
+#include <linux/tcp.h>
 #include <linux/vmalloc.h>
 
 #include <net/request_sock.h>
@@ -130,3 +131,97 @@ void reqsk_queue_destroy(struct request_sock_queue *queue)
                 kfree(lopt);
 }
 
+/*
+ * This function is called to set a Fast Open socket's "fastopen_rsk" field
+ * to NULL when a TFO socket no longer needs to access the request_sock.
+ * This happens only after 3WHS has been either completed or aborted (e.g.,
+ * RST is received).
+ *
+ * Before TFO, a child socket is created only after 3WHS is completed,
+ * hence it never needs to access the request_sock. things get a lot more
+ * complex with TFO. A child socket, accepted or not, has to access its
+ * request_sock for 3WHS processing, e.g., to retransmit SYN-ACK pkts,
+ * until 3WHS is either completed or aborted. Afterwards the req will stay
+ * until either the child socket is accepted, or in the rare case when the
+ * listener is closed before the child is accepted.
+ *
+ * In short, a request socket is only freed after BOTH 3WHS has completed
+ * (or aborted) and the child socket has been accepted (or listener closed).
+ * When a child socket is accepted, its corresponding req->sk is set to
+ * NULL since it's no longer needed. More importantly, "req->sk == NULL"
+ * will be used by the code below to determine if a child socket has been
+ * accepted or not, and the check is protected by the fastopenq->lock
+ * described below.
+ *
+ * Note that fastopen_rsk is only accessed from the child socket's context
+ * with its socket lock held. But a request_sock (req) can be accessed by
+ * both its child socket through fastopen_rsk, and a listener socket through
+ * icsk_accept_queue.rskq_accept_head. To protect the access a simple spin
+ * lock per listener "icsk->icsk_accept_queue.fastopenq->lock" is created.
+ * only in the rare case when both the listener and the child locks are held,
+ * e.g., in inet_csk_listen_stop() do we not need to acquire the lock.
+ * The lock also protects other fields such as fastopenq->qlen, which is
+ * decremented by this function when fastopen_rsk is no longer needed.
+ *
+ * Note that another solution was to simply use the existing socket lock
+ * from the listener. But first socket lock is difficult to use. It is not
+ * a simple spin lock - one must consider sock_owned_by_user() and arrange
+ * to use sk_add_backlog() stuff. But what really makes it infeasible is the
+ * locking hierarchy violation. E.g., inet_csk_listen_stop() may try to
+ * acquire a child's lock while holding listener's socket lock. A corner
+ * case might also exist in tcp_v4_hnd_req() that will trigger this locking
+ * order.
+ *
+ * When a TFO req is created, it needs to sock_hold its listener to prevent
+ * the latter data structure from going away.
+ *
+ * This function also sets "treq->listener" to NULL and unreference listener
+ * socket. treq->listener is used by the listener so it is protected by the
+ * fastopenq->lock in this function.
+ */
+void reqsk_fastopen_remove(struct sock *sk, struct request_sock *req,
+                           bool reset)
+{
+        struct sock *lsk = tcp_rsk(req)->listener;
+        struct fastopen_queue *fastopenq =
+            inet_csk(lsk)->icsk_accept_queue.fastopenq;
+
+        BUG_ON(!spin_is_locked(&sk->sk_lock.slock) && !sock_owned_by_user(sk));
+
+        tcp_sk(sk)->fastopen_rsk = NULL;
+        spin_lock_bh(&fastopenq->lock);
+        fastopenq->qlen--;
+        tcp_rsk(req)->listener = NULL;
+        if (req->sk)    /* the child socket hasn't been accepted yet */
+                goto out;
+
+        if (!reset || lsk->sk_state != TCP_LISTEN) {
+                /* If the listener has been closed don't bother with the
+                 * special RST handling below.
+                 */
+                spin_unlock_bh(&fastopenq->lock);
+                sock_put(lsk);
+                reqsk_free(req);
+                return;
+        }
+        /* Wait for 60secs before removing a req that has triggered RST.
+         * This is a simple defense against TFO spoofing attack - by
+         * counting the req against fastopen.max_qlen, and disabling
+         * TFO when the qlen exceeds max_qlen.
+         *
+         * For more details see CoNext'11 "TCP Fast Open" paper.
+         */
+        req->expires = jiffies + 60*HZ;
+        if (fastopenq->rskq_rst_head == NULL)
+                fastopenq->rskq_rst_head = req;
+        else
+                fastopenq->rskq_rst_tail->dl_next = req;
+
+        req->dl_next = NULL;
+        fastopenq->rskq_rst_tail = req;
+        fastopenq->qlen++;
+out:
+        spin_unlock_bh(&fastopenq->lock);
+        sock_put(lsk);
+        return;
+}
diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
index 2c5a0a06c4ce..c64efcff8078 100644
--- a/net/core/rtnetlink.c
+++ b/net/core/rtnetlink.c
@@ -618,7 +618,7 @@ int rtnl_put_cacheinfo(struct sk_buff *skb, struct dst_entry *dst, u32 id,
                        long expires, u32 error)
 {
         struct rta_cacheinfo ci = {
-                .rta_lastuse = jiffies_to_clock_t(jiffies - dst->lastuse),
+                .rta_lastuse = jiffies_delta_to_clock_t(jiffies - dst->lastuse),
                 .rta_used = dst->__use,
                 .rta_clntref = atomic_read(&(dst->__refcnt)),
                 .rta_error = error,
@@ -1812,8 +1812,6 @@ replay:
                         return -ENODEV;
                 }
 
-                if (ifm->ifi_index)
-                        return -EOPNOTSUPP;
                 if (tb[IFLA_MAP] || tb[IFLA_MASTER] || tb[IFLA_PROTINFO])
                         return -EOPNOTSUPP;
 
@@ -1839,10 +1837,14 @@ replay:
                         return PTR_ERR(dest_net);
 
                 dev = rtnl_create_link(net, dest_net, ifname, ops, tb);
-
-                if (IS_ERR(dev))
+                if (IS_ERR(dev)) {
                         err = PTR_ERR(dev);
-                else if (ops->newlink)
+                        goto out;
+                }
+
+                dev->ifindex = ifm->ifi_index;
+
+                if (ops->newlink)
                         err = ops->newlink(net, dev, tb, data);
                 else
                         err = register_netdevice(dev);
@@ -2356,7 +2358,7 @@ static int rtnetlink_event(struct notifier_block *this, unsigned long event, voi
         case NETDEV_PRE_TYPE_CHANGE:
         case NETDEV_GOING_DOWN:
         case NETDEV_UNREGISTER:
-        case NETDEV_UNREGISTER_BATCH:
+        case NETDEV_UNREGISTER_FINAL:
         case NETDEV_RELEASE:
         case NETDEV_JOIN:
                 break;
diff --git a/net/core/scm.c b/net/core/scm.c
index 8f6ccfd68ef4..6ab491d6c26f 100644
--- a/net/core/scm.c
+++ b/net/core/scm.c
@@ -45,12 +45,17 @@
 static __inline__ int scm_check_creds(struct ucred *creds)
 {
         const struct cred *cred = current_cred();
+        kuid_t uid = make_kuid(cred->user_ns, creds->uid);
+        kgid_t gid = make_kgid(cred->user_ns, creds->gid);
+
+        if (!uid_valid(uid) || !gid_valid(gid))
+                return -EINVAL;
 
         if ((creds->pid == task_tgid_vnr(current) || capable(CAP_SYS_ADMIN)) &&
-            ((creds->uid == cred->uid   || creds->uid == cred->euid ||
-              creds->uid == cred->suid) || capable(CAP_SETUID)) &&
-            ((creds->gid == cred->gid   || creds->gid == cred->egid ||
-              creds->gid == cred->sgid) || capable(CAP_SETGID))) {
+            ((uid_eq(uid, cred->uid)   || uid_eq(uid, cred->euid) ||
+              uid_eq(uid, cred->suid)) || capable(CAP_SETUID)) &&
+            ((gid_eq(gid, cred->gid)   || gid_eq(gid, cred->egid) ||
+              gid_eq(gid, cred->sgid)) || capable(CAP_SETGID))) {
                return 0;
         }
         return -EPERM;
@@ -149,6 +154,9 @@ int __scm_send(struct socket *sock, struct msghdr *msg, struct scm_cookie *p)
                                 goto error;
                         break;
                 case SCM_CREDENTIALS:
+                {
+                        kuid_t uid;
+                        kgid_t gid;
                         if (cmsg->cmsg_len != CMSG_LEN(sizeof(struct ucred)))
                                 goto error;
                         memcpy(&p->creds, CMSG_DATA(cmsg), sizeof(struct ucred));
@@ -166,22 +174,29 @@ int __scm_send(struct socket *sock, struct msghdr *msg, struct scm_cookie *p)
                                 p->pid = pid;
                         }
 
+                        err = -EINVAL;
+                        uid = make_kuid(current_user_ns(), p->creds.uid);
+                        gid = make_kgid(current_user_ns(), p->creds.gid);
+                        if (!uid_valid(uid) || !gid_valid(gid))
+                                goto error;
+
                         if (!p->cred ||
-                            (p->cred->euid != p->creds.uid) ||
-                            (p->cred->egid != p->creds.gid)) {
+                            !uid_eq(p->cred->euid, uid) ||
+                            !gid_eq(p->cred->egid, gid)) {
                                 struct cred *cred;
                                 err = -ENOMEM;
                                 cred = prepare_creds();
                                 if (!cred)
                                         goto error;
 
-                                cred->uid = cred->euid = p->creds.uid;
-                                cred->gid = cred->egid = p->creds.gid;
+                                cred->uid = cred->euid = uid;
+                                cred->gid = cred->egid = gid;
                                 if (p->cred)
                                         put_cred(p->cred);
                                 p->cred = cred;
                         }
                         break;
+                }
                 default:
                         goto error;
                 }
@@ -265,6 +280,7 @@ void scm_detach_fds(struct msghdr *msg, struct scm_cookie *scm)
         for (i=0, cmfptr=(__force int __user *)CMSG_DATA(cm); i<fdmax;
              i++, cmfptr++)
         {
+                struct socket *sock;
                 int new_fd;
                 err = security_file_receive(fp[i]);
                 if (err)
@@ -281,6 +297,9 @@ void scm_detach_fds(struct msghdr *msg, struct scm_cookie *scm)
                 }
                 /* Bump the usage count and install the file. */
                 get_file(fp[i]);
+                sock = sock_from_file(fp[i], &err);
+                if (sock)
+                        sock_update_netprioidx(sock->sk, current);
                 fd_install(new_fd, fp[i]);
         }
 
diff --git a/net/core/secure_seq.c b/net/core/secure_seq.c
index 99b2596531bb..e61a8bb7fce7 100644
--- a/net/core/secure_seq.c
+++ b/net/core/secure_seq.c
@@ -76,6 +76,7 @@ u32 secure_ipv6_port_ephemeral(const __be32 *saddr, const __be32 *daddr,
 
         return hash[0];
 }
+EXPORT_SYMBOL(secure_ipv6_port_ephemeral);
 #endif
 
 #ifdef CONFIG_INET
diff --git a/net/core/sock.c b/net/core/sock.c
index 6b654b3ddfda..d765156eab65 100644
--- a/net/core/sock.c
+++ b/net/core/sock.c
@@ -868,8 +868,8 @@ void cred_to_ucred(struct pid *pid, const struct cred *cred,
         if (cred) {
                 struct user_namespace *current_ns = current_user_ns();
 
-                ucred->uid = from_kuid(current_ns, cred->euid);
-                ucred->gid = from_kgid(current_ns, cred->egid);
+                ucred->uid = from_kuid_munged(current_ns, cred->euid);
+                ucred->gid = from_kgid_munged(current_ns, cred->egid);
         }
 }
 EXPORT_SYMBOL_GPL(cred_to_ucred);
@@ -1230,7 +1230,7 @@ void sock_update_classid(struct sock *sk)
         rcu_read_lock();  /* doing current task, which cannot vanish. */
         classid = task_cls_classid(current);
         rcu_read_unlock();
-        if (classid && classid != sk->sk_classid)
+        if (classid != sk->sk_classid)
                 sk->sk_classid = classid;
 }
 EXPORT_SYMBOL(sock_update_classid);
@@ -1458,6 +1458,7 @@ void sk_setup_caps(struct sock *sk, struct dst_entry *dst)
                 } else {
                         sk->sk_route_caps |= NETIF_F_SG | NETIF_F_HW_CSUM;
                         sk->sk_gso_max_size = dst->dev->gso_max_size;
+                        sk->sk_gso_max_segs = dst->dev->gso_max_segs;
                 }
         }
 }
@@ -1526,12 +1527,12 @@ void sock_edemux(struct sk_buff *skb)
 }
 EXPORT_SYMBOL(sock_edemux);
 
-int sock_i_uid(struct sock *sk)
+kuid_t sock_i_uid(struct sock *sk)
 {
-        int uid;
+        kuid_t uid;
 
         read_lock_bh(&sk->sk_callback_lock);
-        uid = sk->sk_socket ? SOCK_INODE(sk->sk_socket)->i_uid : 0;
+        uid = sk->sk_socket ? SOCK_INODE(sk->sk_socket)->i_uid : GLOBAL_ROOT_UID;
         read_unlock_bh(&sk->sk_callback_lock);
         return uid;
 }
diff --git a/net/core/utils.c b/net/core/utils.c
index 39895a65e54a..f5613d569c23 100644
--- a/net/core/utils.c
+++ b/net/core/utils.c
@@ -294,6 +294,26 @@ void inet_proto_csum_replace4(__sum16 *sum, struct sk_buff *skb,
 }
 EXPORT_SYMBOL(inet_proto_csum_replace4);
 
+void inet_proto_csum_replace16(__sum16 *sum, struct sk_buff *skb,
+                               const __be32 *from, const __be32 *to,
+                               int pseudohdr)
+{
+        __be32 diff[] = {
+                ~from[0], ~from[1], ~from[2], ~from[3],
+                to[0], to[1], to[2], to[3],
+        };
+        if (skb->ip_summed != CHECKSUM_PARTIAL) {
+                *sum = csum_fold(csum_partial(diff, sizeof(diff),
+                                 ~csum_unfold(*sum)));
+                if (skb->ip_summed == CHECKSUM_COMPLETE && pseudohdr)
+                        skb->csum = ~csum_partial(diff, sizeof(diff),
+                                                  ~skb->csum);
+        } else if (pseudohdr)
+                *sum = ~csum_fold(csum_partial(diff, sizeof(diff),
+                                  csum_unfold(*sum)));
+}
+EXPORT_SYMBOL(inet_proto_csum_replace16);
+
 int mac_pton(const char *s, u8 *mac)
 {
         int i;
diff --git a/net/dccp/ccid.h b/net/dccp/ccid.h
index 75c3582a7678..fb85d371a8de 100644
--- a/net/dccp/ccid.h
+++ b/net/dccp/ccid.h
@@ -246,7 +246,7 @@ static inline int ccid_hc_rx_getsockopt(struct ccid *ccid, struct sock *sk,
                                         u32 __user *optval, int __user *optlen)
 {
         int rc = -ENOPROTOOPT;
-        if (ccid->ccid_ops->ccid_hc_rx_getsockopt != NULL)
+        if (ccid != NULL && ccid->ccid_ops->ccid_hc_rx_getsockopt != NULL)
                 rc = ccid->ccid_ops->ccid_hc_rx_getsockopt(sk, optname, len,
                                                  optval, optlen);
         return rc;
@@ -257,7 +257,7 @@ static inline int ccid_hc_tx_getsockopt(struct ccid *ccid, struct sock *sk,
                                         u32 __user *optval, int __user *optlen)
 {
         int rc = -ENOPROTOOPT;
-        if (ccid->ccid_ops->ccid_hc_tx_getsockopt != NULL)
+        if (ccid != NULL && ccid->ccid_ops->ccid_hc_tx_getsockopt != NULL)
                 rc = ccid->ccid_ops->ccid_hc_tx_getsockopt(sk, optname, len,
                                                  optval, optlen);
         return rc;
diff --git a/net/dccp/ccids/ccid3.c b/net/dccp/ccids/ccid3.c
index d65e98798eca..119c04317d48 100644
--- a/net/dccp/ccids/ccid3.c
+++ b/net/dccp/ccids/ccid3.c
@@ -535,6 +535,7 @@ static int ccid3_hc_tx_getsockopt(struct sock *sk, const int optname, int len,
         case DCCP_SOCKOPT_CCID_TX_INFO:
                 if (len < sizeof(tfrc))
                         return -EINVAL;
+                memset(&tfrc, 0, sizeof(tfrc));
                 tfrc.tfrctx_x      = hc->tx_x;
                 tfrc.tfrctx_x_recv = hc->tx_x_recv;
                 tfrc.tfrctx_x_calc = hc->tx_x_calc;
diff --git a/net/decnet/af_decnet.c b/net/decnet/af_decnet.c
index 2ba1a2814c24..307c322d53bb 100644
--- a/net/decnet/af_decnet.c
+++ b/net/decnet/af_decnet.c
@@ -1313,10 +1313,10 @@ static int dn_shutdown(struct socket *sock, int how)
         if (scp->state == DN_O)
                 goto out;
 
-        if (how != SHUTDOWN_MASK)
+        if (how != SHUT_RDWR)
                 goto out;
 
-        sk->sk_shutdown = how;
+        sk->sk_shutdown = SHUTDOWN_MASK;
         dn_destroy_sock(sk);
         err = 0;
 
diff --git a/net/decnet/dn_route.c b/net/decnet/dn_route.c
index 85a3604c87c8..c855e8d0738f 100644
--- a/net/decnet/dn_route.c
+++ b/net/decnet/dn_route.c
@@ -961,7 +961,7 @@ static int dn_route_output_slow(struct dst_entry **pprt, const struct flowidn *o
                 .saddr = oldflp->saddr,
                 .flowidn_scope = RT_SCOPE_UNIVERSE,
                 .flowidn_mark = oldflp->flowidn_mark,
-                .flowidn_iif = init_net.loopback_dev->ifindex,
+                .flowidn_iif = LOOPBACK_IFINDEX,
                 .flowidn_oif = oldflp->flowidn_oif,
         };
         struct dn_route *rt = NULL;
@@ -979,7 +979,7 @@ static int dn_route_output_slow(struct dst_entry **pprt, const struct flowidn *o
                        "dn_route_output_slow: dst=%04x src=%04x mark=%d"
                        " iif=%d oif=%d\n", le16_to_cpu(oldflp->daddr),
                        le16_to_cpu(oldflp->saddr),
-                       oldflp->flowidn_mark, init_net.loopback_dev->ifindex,
+                       oldflp->flowidn_mark, LOOPBACK_IFINDEX,
                        oldflp->flowidn_oif);
 
         /* If we have an output interface, verify its a DECnet device */
@@ -1042,7 +1042,7 @@ source_ok:
                         if (!fld.daddr)
                                 goto out;
                 }
-                fld.flowidn_oif = init_net.loopback_dev->ifindex;
+                fld.flowidn_oif = LOOPBACK_IFINDEX;
                 res.type = RTN_LOCAL;
                 goto make_route;
         }
diff --git a/net/ieee802154/6lowpan.c b/net/ieee802154/6lowpan.c
index 6a095225148e..d5291113584f 100644
--- a/net/ieee802154/6lowpan.c
+++ b/net/ieee802154/6lowpan.c
@@ -1063,12 +1063,6 @@ out:
         return (err < 0 ? NETDEV_TX_BUSY : NETDEV_TX_OK);
 }
 
-static void lowpan_dev_free(struct net_device *dev)
-{
-        dev_put(lowpan_dev_info(dev)->real_dev);
-        free_netdev(dev);
-}
-
 static struct wpan_phy *lowpan_get_phy(const struct net_device *dev)
 {
         struct net_device *real_dev = lowpan_dev_info(dev)->real_dev;
@@ -1118,7 +1112,7 @@ static void lowpan_setup(struct net_device *dev)
         dev->netdev_ops         = &lowpan_netdev_ops;
         dev->header_ops         = &lowpan_header_ops;
         dev->ml_priv            = &lowpan_mlme;
-        dev->destructor         = lowpan_dev_free;
+        dev->destructor         = free_netdev;
 }
 
 static int lowpan_validate(struct nlattr *tb[], struct nlattr *data[])
@@ -1133,6 +1127,8 @@ static int lowpan_validate(struct nlattr *tb[], struct nlattr *data[])
 static int lowpan_rcv(struct sk_buff *skb, struct net_device *dev,
         struct packet_type *pt, struct net_device *orig_dev)
 {
+        struct sk_buff *local_skb;
+
         if (!netif_running(dev))
                 goto drop;
 
@@ -1144,7 +1140,12 @@ static int lowpan_rcv(struct sk_buff *skb, struct net_device *dev,
         case LOWPAN_DISPATCH_IPHC:      /* ipv6 datagram */
         case LOWPAN_DISPATCH_FRAG1:     /* first fragment header */
         case LOWPAN_DISPATCH_FRAGN:     /* next fragments headers */
-                lowpan_process_data(skb);
+                local_skb = skb_clone(skb, GFP_ATOMIC);
+                if (!local_skb)
+                        goto drop;
+                lowpan_process_data(local_skb);
+
+                kfree_skb(skb);
                 break;
         default:
                 break;
@@ -1237,6 +1238,34 @@ static inline void __init lowpan_netlink_fini(void)
         rtnl_link_unregister(&lowpan_link_ops);
 }
 
+static int lowpan_device_event(struct notifier_block *unused,
+                                unsigned long event,
+                                void *ptr)
+{
+        struct net_device *dev = ptr;
+        LIST_HEAD(del_list);
+        struct lowpan_dev_record *entry, *tmp;
+
+        if (dev->type != ARPHRD_IEEE802154)
+                goto out;
+
+        if (event == NETDEV_UNREGISTER) {
+                list_for_each_entry_safe(entry, tmp, &lowpan_devices, list) {
+                        if (lowpan_dev_info(entry->ldev)->real_dev == dev)
+                                lowpan_dellink(entry->ldev, &del_list);
+                }
+
+                unregister_netdevice_many(&del_list);
+        };
+
+out:
+        return NOTIFY_DONE;
+}
+
+static struct notifier_block lowpan_dev_notifier = {
+        .notifier_call = lowpan_device_event,
+};
+
 static struct packet_type lowpan_packet_type = {
         .type = __constant_htons(ETH_P_IEEE802154),
         .func = lowpan_rcv,
@@ -1251,6 +1280,12 @@ static int __init lowpan_init_module(void)
                 goto out;
 
         dev_add_pack(&lowpan_packet_type);
+
+        err = register_netdevice_notifier(&lowpan_dev_notifier);
+        if (err < 0) {
+                dev_remove_pack(&lowpan_packet_type);
+                lowpan_netlink_fini();
+        }
 out:
         return err;
 }
@@ -1263,6 +1298,8 @@ static void __exit lowpan_cleanup_module(void)
 
         dev_remove_pack(&lowpan_packet_type);
 
+        unregister_netdevice_notifier(&lowpan_dev_notifier);
+
         /* Now 6lowpan packet_type is removed, so no new fragments are
          * expected on RX, therefore that's the time to clean incomplete
          * fragments.
diff --git a/net/ipv4/af_inet.c b/net/ipv4/af_inet.c
index fe4582ca969a..4f70ef0b946d 100644
--- a/net/ipv4/af_inet.c
+++ b/net/ipv4/af_inet.c
@@ -149,6 +149,11 @@ void inet_sock_destruct(struct sock *sk)
                 pr_err("Attempt to release alive inet socket %p\n", sk);
                 return;
         }
+        if (sk->sk_type == SOCK_STREAM) {
+                struct fastopen_queue *fastopenq =
+                        inet_csk(sk)->icsk_accept_queue.fastopenq;
+                kfree(fastopenq);
+        }
 
         WARN_ON(atomic_read(&sk->sk_rmem_alloc));
         WARN_ON(atomic_read(&sk->sk_wmem_alloc));
@@ -212,6 +217,26 @@ int inet_listen(struct socket *sock, int backlog)
          * we can only allow the backlog to be adjusted.
          */
         if (old_state != TCP_LISTEN) {
+                /* Check special setups for testing purpose to enable TFO w/o
+                 * requiring TCP_FASTOPEN sockopt.
+                 * Note that only TCP sockets (SOCK_STREAM) will reach here.
+                 * Also fastopenq may already been allocated because this
+                 * socket was in TCP_LISTEN state previously but was
+                 * shutdown() (rather than close()).
+                 */
+                if ((sysctl_tcp_fastopen & TFO_SERVER_ENABLE) != 0 &&
+                    inet_csk(sk)->icsk_accept_queue.fastopenq == NULL) {
+                        if ((sysctl_tcp_fastopen & TFO_SERVER_WO_SOCKOPT1) != 0)
+                                err = fastopen_init_queue(sk, backlog);
+                        else if ((sysctl_tcp_fastopen &
+                                  TFO_SERVER_WO_SOCKOPT2) != 0)
+                                err = fastopen_init_queue(sk,
+                                    ((uint)sysctl_tcp_fastopen) >> 16);
+                        else
+                                err = 0;
+                        if (err)
+                                goto out;
+                }
                 err = inet_csk_listen_start(sk, backlog);
                 if (err)
                         goto out;
@@ -701,7 +726,8 @@ int inet_accept(struct socket *sock, struct socket *newsock, int flags)
 
         sock_rps_record_flow(sk2);
         WARN_ON(!((1 << sk2->sk_state) &
-                  (TCPF_ESTABLISHED | TCPF_CLOSE_WAIT | TCPF_CLOSE)));
+                  (TCPF_ESTABLISHED | TCPF_SYN_RECV |
+                  TCPF_CLOSE_WAIT | TCPF_CLOSE)));
 
         sock_graft(sk2, newsock);
 
@@ -1364,7 +1390,7 @@ static struct sk_buff **inet_gro_receive(struct sk_buff **head,
         if (*(u8 *)iph != 0x45)
                 goto out_unlock;
 
-        if (unlikely(ip_fast_csum((u8 *)iph, iph->ihl)))
+        if (unlikely(ip_fast_csum((u8 *)iph, 5)))
                 goto out_unlock;
 
         id = ntohl(*(__be32 *)&iph->id);
@@ -1380,7 +1406,6 @@ static struct sk_buff **inet_gro_receive(struct sk_buff **head,
                 iph2 = ip_hdr(p);
 
                 if ((iph->protocol ^ iph2->protocol) |
-                    (iph->tos ^ iph2->tos) |
                     ((__force u32)iph->saddr ^ (__force u32)iph2->saddr) |
                     ((__force u32)iph->daddr ^ (__force u32)iph2->daddr)) {
                         NAPI_GRO_CB(p)->same_flow = 0;
@@ -1390,6 +1415,7 @@ static struct sk_buff **inet_gro_receive(struct sk_buff **head,
                 /* All fields must match except length and checksum. */
                 NAPI_GRO_CB(p)->flush |=
                         (iph->ttl ^ iph2->ttl) |
+                        (iph->tos ^ iph2->tos) |
                         ((u16)(ntohs(iph2->id) + NAPI_GRO_CB(p)->count) ^ id);
 
                 NAPI_GRO_CB(p)->flush |= flush;
diff --git a/net/ipv4/devinet.c b/net/ipv4/devinet.c
index 44bf82e3aef7..adf273f8ad2e 100644
--- a/net/ipv4/devinet.c
+++ b/net/ipv4/devinet.c
@@ -94,25 +94,22 @@ static const struct nla_policy ifa_ipv4_policy[IFA_MAX+1] = {
         [IFA_LABEL]             = { .type = NLA_STRING, .len = IFNAMSIZ - 1 },
 };
 
-/* inet_addr_hash's shifting is dependent upon this IN4_ADDR_HSIZE
- * value.  So if you change this define, make appropriate changes to
- * inet_addr_hash as well.
- */
-#define IN4_ADDR_HSIZE  256
+#define IN4_ADDR_HSIZE_SHIFT    8
+#define IN4_ADDR_HSIZE          (1U << IN4_ADDR_HSIZE_SHIFT)
+
 static struct hlist_head inet_addr_lst[IN4_ADDR_HSIZE];
 static DEFINE_SPINLOCK(inet_addr_hash_lock);
 
-static inline unsigned int inet_addr_hash(struct net *net, __be32 addr)
+static u32 inet_addr_hash(struct net *net, __be32 addr)
 {
-        u32 val = (__force u32) addr ^ hash_ptr(net, 8);
+        u32 val = (__force u32) addr ^ net_hash_mix(net);
 
-        return ((val ^ (val >> 8) ^ (val >> 16) ^ (val >> 24)) &
-                (IN4_ADDR_HSIZE - 1));
+        return hash_32(val, IN4_ADDR_HSIZE_SHIFT);
 }
 
 static void inet_hash_insert(struct net *net, struct in_ifaddr *ifa)
 {
-        unsigned int hash = inet_addr_hash(net, ifa->ifa_local);
+        u32 hash = inet_addr_hash(net, ifa->ifa_local);
 
         spin_lock(&inet_addr_hash_lock);
         hlist_add_head_rcu(&ifa->hash, &inet_addr_lst[hash]);
@@ -136,18 +133,18 @@ static void inet_hash_remove(struct in_ifaddr *ifa)
  */
 struct net_device *__ip_dev_find(struct net *net, __be32 addr, bool devref)
 {
-        unsigned int hash = inet_addr_hash(net, addr);
+        u32 hash = inet_addr_hash(net, addr);
         struct net_device *result = NULL;
         struct in_ifaddr *ifa;
         struct hlist_node *node;
 
         rcu_read_lock();
         hlist_for_each_entry_rcu(ifa, node, &inet_addr_lst[hash], hash) {
-                struct net_device *dev = ifa->ifa_dev->dev;
-
-                if (!net_eq(dev_net(dev), net))
-                        continue;
                 if (ifa->ifa_local == addr) {
+                        struct net_device *dev = ifa->ifa_dev->dev;
+
+                        if (!net_eq(dev_net(dev), net))
+                                continue;
                         result = dev;
                         break;
                 }
@@ -182,10 +179,10 @@ static void inet_del_ifa(struct in_device *in_dev, struct in_ifaddr **ifap,
 static void devinet_sysctl_register(struct in_device *idev);
 static void devinet_sysctl_unregister(struct in_device *idev);
 #else
-static inline void devinet_sysctl_register(struct in_device *idev)
+static void devinet_sysctl_register(struct in_device *idev)
 {
 }
-static inline void devinet_sysctl_unregister(struct in_device *idev)
+static void devinet_sysctl_unregister(struct in_device *idev)
 {
 }
 #endif
@@ -205,7 +202,7 @@ static void inet_rcu_free_ifa(struct rcu_head *head)
         kfree(ifa);
 }
 
-static inline void inet_free_ifa(struct in_ifaddr *ifa)
+static void inet_free_ifa(struct in_ifaddr *ifa)
 {
         call_rcu(&ifa->rcu_head, inet_rcu_free_ifa);
 }
@@ -659,7 +656,7 @@ static int inet_rtm_newaddr(struct sk_buff *skb, struct nlmsghdr *nlh, void *arg
  *      Determine a default network mask, based on the IP address.
  */
 
-static inline int inet_abc_len(__be32 addr)
+static int inet_abc_len(__be32 addr)
 {
         int rc = -1;    /* Something else, probably a multicast. */
 
@@ -1124,7 +1121,7 @@ skip:
         }
 }
 
-static inline bool inetdev_valid_mtu(unsigned int mtu)
+static bool inetdev_valid_mtu(unsigned int mtu)
 {
         return mtu >= 68;
 }
@@ -1239,7 +1236,7 @@ static struct notifier_block ip_netdev_notifier = {
         .notifier_call = inetdev_event,
 };
 
-static inline size_t inet_nlmsg_size(void)
+static size_t inet_nlmsg_size(void)
 {
         return NLMSG_ALIGN(sizeof(struct ifaddrmsg))
                + nla_total_size(4) /* IFA_ADDRESS */
diff --git a/net/ipv4/fib_frontend.c b/net/ipv4/fib_frontend.c
index c43ae3fba792..acdee325d972 100644
--- a/net/ipv4/fib_frontend.c
+++ b/net/ipv4/fib_frontend.c
@@ -218,7 +218,7 @@ __be32 fib_compute_spec_dst(struct sk_buff *skb)
         scope = RT_SCOPE_UNIVERSE;
         if (!ipv4_is_zeronet(ip_hdr(skb)->saddr)) {
                 fl4.flowi4_oif = 0;
-                fl4.flowi4_iif = net->loopback_dev->ifindex;
+                fl4.flowi4_iif = LOOPBACK_IFINDEX;
                 fl4.daddr = ip_hdr(skb)->saddr;
                 fl4.saddr = 0;
                 fl4.flowi4_tos = RT_TOS(ip_hdr(skb)->tos);
@@ -1041,7 +1041,7 @@ static int fib_inetaddr_event(struct notifier_block *this, unsigned long event,
 static int fib_netdev_event(struct notifier_block *this, unsigned long event, void *ptr)
 {
         struct net_device *dev = ptr;
-        struct in_device *in_dev = __in_dev_get_rtnl(dev);
+        struct in_device *in_dev;
         struct net *net = dev_net(dev);
 
         if (event == NETDEV_UNREGISTER) {
@@ -1050,8 +1050,7 @@ static int fib_netdev_event(struct notifier_block *this, unsigned long event, vo
                 return NOTIFY_DONE;
         }
 
-        if (!in_dev)
-                return NOTIFY_DONE;
+        in_dev = __in_dev_get_rtnl(dev);
 
         switch (event) {
         case NETDEV_UP:
@@ -1062,16 +1061,14 @@ static int fib_netdev_event(struct notifier_block *this, unsigned long event, vo
                 fib_sync_up(dev);
 #endif
                 atomic_inc(&net->ipv4.dev_addr_genid);
-                rt_cache_flush(dev_net(dev), -1);
+                rt_cache_flush(net, -1);
                 break;
         case NETDEV_DOWN:
                 fib_disable_ip(dev, 0, 0);
                 break;
         case NETDEV_CHANGEMTU:
         case NETDEV_CHANGE:
-                rt_cache_flush(dev_net(dev), 0);
-                break;
-        case NETDEV_UNREGISTER_BATCH:
+                rt_cache_flush(net, 0);
                 break;
         }
         return NOTIFY_DONE;
diff --git a/net/ipv4/fib_trie.c b/net/ipv4/fib_trie.c
index f0cdb30921c0..3c820dae235e 100644
--- a/net/ipv4/fib_trie.c
+++ b/net/ipv4/fib_trie.c
@@ -367,7 +367,7 @@ static void __leaf_free_rcu(struct rcu_head *head)
 
 static inline void free_leaf(struct leaf *l)
 {
-        call_rcu_bh(&l->rcu, __leaf_free_rcu);
+        call_rcu(&l->rcu, __leaf_free_rcu);
 }
 
 static inline void free_leaf_info(struct leaf_info *leaf)
@@ -1550,7 +1550,8 @@ int fib_table_lookup(struct fib_table *tb, const struct flowi4 *flp,
                  * state.directly.
                  */
                 if (pref_mismatch) {
-                        int mp = KEYLENGTH - fls(pref_mismatch);
+                        /* fls(x) = __fls(x) + 1 */
+                        int mp = KEYLENGTH - __fls(pref_mismatch) - 1;
 
                         if (tkey_extract_bits(cn->key, mp, cn->pos - mp) != 0)
                                 goto backtrace;
@@ -1655,7 +1656,12 @@ int fib_table_delete(struct fib_table *tb, struct fib_config *cfg)
         if (!l)
                 return -ESRCH;
 
-        fa_head = get_fa_head(l, plen);
+        li = find_leaf_info(l, plen);
+
+        if (!li)
+                return -ESRCH;
+
+        fa_head = &li->falh;
         fa = fib_find_alias(fa_head, tos, 0);
 
         if (!fa)
@@ -1691,9 +1697,6 @@ int fib_table_delete(struct fib_table *tb, struct fib_config *cfg)
         rtmsg_fib(RTM_DELROUTE, htonl(key), fa, plen, tb->tb_id,
                   &cfg->fc_nlinfo, 0);
 
-        l = fib_find_node(t, key);
-        li = find_leaf_info(l, plen);
-
         list_del_rcu(&fa->fa_list);
 
         if (!plen)
diff --git a/net/ipv4/igmp.c b/net/ipv4/igmp.c
index 6699f23e6f55..0b5580c69f2d 100644
--- a/net/ipv4/igmp.c
+++ b/net/ipv4/igmp.c
@@ -2435,6 +2435,8 @@ static int igmp_mc_seq_show(struct seq_file *seq, void *v)
                 struct ip_mc_list *im = (struct ip_mc_list *)v;
                 struct igmp_mc_iter_state *state = igmp_mc_seq_private(seq);
                 char   *querier;
+                long delta;
+
 #ifdef CONFIG_IP_MULTICAST
                 querier = IGMP_V1_SEEN(state->in_dev) ? "V1" :
                           IGMP_V2_SEEN(state->in_dev) ? "V2" :
@@ -2448,11 +2450,12 @@ static int igmp_mc_seq_show(struct seq_file *seq, void *v)
                                    state->dev->ifindex, state->dev->name, state->in_dev->mc_count, querier);
                 }
 
+                delta = im->timer.expires - jiffies;
                 seq_printf(seq,
                            "\t\t\t\t%08X %5d %d:%08lX\t\t%d\n",
                            im->multiaddr, im->users,
-                           im->tm_running, im->tm_running ?
-                           jiffies_to_clock_t(im->timer.expires-jiffies) : 0,
+                           im->tm_running,
+                           im->tm_running ? jiffies_delta_to_clock_t(delta) : 0,
                            im->reporter);
         }
         return 0;
diff --git a/net/ipv4/inet_connection_sock.c b/net/ipv4/inet_connection_sock.c
index db0cf17c00f7..8464b79c493f 100644
--- a/net/ipv4/inet_connection_sock.c
+++ b/net/ipv4/inet_connection_sock.c
@@ -283,7 +283,9 @@ static int inet_csk_wait_for_connect(struct sock *sk, long timeo)
 struct sock *inet_csk_accept(struct sock *sk, int flags, int *err)
 {
         struct inet_connection_sock *icsk = inet_csk(sk);
+        struct request_sock_queue *queue = &icsk->icsk_accept_queue;
         struct sock *newsk;
+        struct request_sock *req;
         int error;
 
         lock_sock(sk);
@@ -296,7 +298,7 @@ struct sock *inet_csk_accept(struct sock *sk, int flags, int *err)
                 goto out_err;
 
         /* Find already established connection */
-        if (reqsk_queue_empty(&icsk->icsk_accept_queue)) {
+        if (reqsk_queue_empty(queue)) {
                 long timeo = sock_rcvtimeo(sk, flags & O_NONBLOCK);
 
                 /* If this is a non blocking socket don't sleep */
@@ -308,14 +310,32 @@ struct sock *inet_csk_accept(struct sock *sk, int flags, int *err)
                 if (error)
                         goto out_err;
         }
-
-        newsk = reqsk_queue_get_child(&icsk->icsk_accept_queue, sk);
-        WARN_ON(newsk->sk_state == TCP_SYN_RECV);
+        req = reqsk_queue_remove(queue);
+        newsk = req->sk;
+
+        sk_acceptq_removed(sk);
+        if (sk->sk_type == SOCK_STREAM && queue->fastopenq != NULL) {
+                spin_lock_bh(&queue->fastopenq->lock);
+                if (tcp_rsk(req)->listener) {
+                        /* We are still waiting for the final ACK from 3WHS
+                         * so can't free req now. Instead, we set req->sk to
+                         * NULL to signify that the child socket is taken
+                         * so reqsk_fastopen_remove() will free the req
+                         * when 3WHS finishes (or is aborted).
+                         */
+                        req->sk = NULL;
+                        req = NULL;
+                }
+                spin_unlock_bh(&queue->fastopenq->lock);
+        }
 out:
         release_sock(sk);
+        if (req)
+                __reqsk_free(req);
         return newsk;
 out_err:
         newsk = NULL;
+        req = NULL;
         *err = error;
         goto out;
 }
@@ -404,12 +424,15 @@ struct dst_entry *inet_csk_route_child_sock(struct sock *sk,
 {
         const struct inet_request_sock *ireq = inet_rsk(req);
         struct inet_sock *newinet = inet_sk(newsk);
-        struct ip_options_rcu *opt = ireq->opt;
+        struct ip_options_rcu *opt;
         struct net *net = sock_net(sk);
         struct flowi4 *fl4;
         struct rtable *rt;
 
         fl4 = &newinet->cork.fl.u.ip4;
+
+        rcu_read_lock();
+        opt = rcu_dereference(newinet->inet_opt);
         flowi4_init_output(fl4, sk->sk_bound_dev_if, sk->sk_mark,
                            RT_CONN_FLAGS(sk), RT_SCOPE_UNIVERSE,
                            sk->sk_protocol, inet_sk_flowi_flags(sk),
@@ -421,11 +444,13 @@ struct dst_entry *inet_csk_route_child_sock(struct sock *sk,
                 goto no_route;
         if (opt && opt->opt.is_strictroute && rt->rt_gateway)
                 goto route_err;
+        rcu_read_unlock();
         return &rt->dst;
 
 route_err:
         ip_rt_put(rt);
 no_route:
+        rcu_read_unlock();
         IP_INC_STATS_BH(net, IPSTATS_MIB_OUTNOROUTES);
         return NULL;
 }
@@ -715,13 +740,14 @@ EXPORT_SYMBOL_GPL(inet_csk_listen_start);
 void inet_csk_listen_stop(struct sock *sk)
 {
         struct inet_connection_sock *icsk = inet_csk(sk);
+        struct request_sock_queue *queue = &icsk->icsk_accept_queue;
         struct request_sock *acc_req;
         struct request_sock *req;
 
         inet_csk_delete_keepalive_timer(sk);
 
         /* make all the listen_opt local to us */
-        acc_req = reqsk_queue_yank_acceptq(&icsk->icsk_accept_queue);
+        acc_req = reqsk_queue_yank_acceptq(queue);
 
         /* Following specs, it would be better either to send FIN
          * (and enter FIN-WAIT-1, it is normal close)
@@ -731,7 +757,7 @@ void inet_csk_listen_stop(struct sock *sk)
          * To be honest, we are not able to make either
          * of the variants now.                 --ANK
          */
-        reqsk_queue_destroy(&icsk->icsk_accept_queue);
+        reqsk_queue_destroy(queue);
 
         while ((req = acc_req) != NULL) {
                 struct sock *child = req->sk;
@@ -749,6 +775,19 @@ void inet_csk_listen_stop(struct sock *sk)
 
                 percpu_counter_inc(sk->sk_prot->orphan_count);
 
+                if (sk->sk_type == SOCK_STREAM && tcp_rsk(req)->listener) {
+                        BUG_ON(tcp_sk(child)->fastopen_rsk != req);
+                        BUG_ON(sk != tcp_rsk(req)->listener);
+
+                        /* Paranoid, to prevent race condition if
+                         * an inbound pkt destined for child is
+                         * blocked by sock lock in tcp_v4_rcv().
+                         * Also to satisfy an assertion in
+                         * tcp_v4_destroy_sock().
+                         */
+                        tcp_sk(child)->fastopen_rsk = NULL;
+                        sock_put(sk);
+                }
                 inet_csk_destroy_sock(child);
 
                 bh_unlock_sock(child);
@@ -758,6 +797,17 @@ void inet_csk_listen_stop(struct sock *sk)
                 sk_acceptq_removed(sk);
                 __reqsk_free(req);
         }
+        if (queue->fastopenq != NULL) {
+                /* Free all the reqs queued in rskq_rst_head. */
+                spin_lock_bh(&queue->fastopenq->lock);
+                acc_req = queue->fastopenq->rskq_rst_head;
+                queue->fastopenq->rskq_rst_head = NULL;
+                spin_unlock_bh(&queue->fastopenq->lock);
+                while ((req = acc_req) != NULL) {
+                        acc_req = req->dl_next;
+                        __reqsk_free(req);
+                }
+        }
         WARN_ON(sk->sk_ack_backlog);
 }
 EXPORT_SYMBOL_GPL(inet_csk_listen_stop);
diff --git a/net/ipv4/inet_diag.c b/net/ipv4/inet_diag.c
index 570e61f9611f..8bc005b1435f 100644
--- a/net/ipv4/inet_diag.c
+++ b/net/ipv4/inet_diag.c
@@ -69,6 +69,7 @@ static inline void inet_diag_unlock_handler(
 
 int inet_sk_diag_fill(struct sock *sk, struct inet_connection_sock *icsk,
                               struct sk_buff *skb, struct inet_diag_req_v2 *req,
+                              struct user_namespace *user_ns,                   
                               u32 pid, u32 seq, u16 nlmsg_flags,
                               const struct nlmsghdr *unlh)
 {
@@ -124,7 +125,7 @@ int inet_sk_diag_fill(struct sock *sk, struct inet_connection_sock *icsk,
         }
 #endif
 
-        r->idiag_uid = sock_i_uid(sk);
+        r->idiag_uid = from_kuid_munged(user_ns, sock_i_uid(sk));
         r->idiag_inode = sock_i_ino(sk);
 
         if (ext & (1 << (INET_DIAG_MEMINFO - 1))) {
@@ -199,11 +200,12 @@ EXPORT_SYMBOL_GPL(inet_sk_diag_fill);
 
 static int inet_csk_diag_fill(struct sock *sk,
                               struct sk_buff *skb, struct inet_diag_req_v2 *req,
+                              struct user_namespace *user_ns,
                               u32 pid, u32 seq, u16 nlmsg_flags,
                               const struct nlmsghdr *unlh)
 {
         return inet_sk_diag_fill(sk, inet_csk(sk),
-                        skb, req, pid, seq, nlmsg_flags, unlh);
+                        skb, req, user_ns, pid, seq, nlmsg_flags, unlh);
 }
 
 static int inet_twsk_diag_fill(struct inet_timewait_sock *tw,
@@ -256,14 +258,16 @@ static int inet_twsk_diag_fill(struct inet_timewait_sock *tw,
 }
 
 static int sk_diag_fill(struct sock *sk, struct sk_buff *skb,
-                        struct inet_diag_req_v2 *r, u32 pid, u32 seq, u16 nlmsg_flags,
+                        struct inet_diag_req_v2 *r,
+                        struct user_namespace *user_ns,
+                        u32 pid, u32 seq, u16 nlmsg_flags,
                         const struct nlmsghdr *unlh)
 {
         if (sk->sk_state == TCP_TIME_WAIT)
                 return inet_twsk_diag_fill((struct inet_timewait_sock *)sk,
                                            skb, r, pid, seq, nlmsg_flags,
                                            unlh);
-        return inet_csk_diag_fill(sk, skb, r, pid, seq, nlmsg_flags, unlh);
+        return inet_csk_diag_fill(sk, skb, r, user_ns, pid, seq, nlmsg_flags, unlh);
 }
 
 int inet_diag_dump_one_icsk(struct inet_hashinfo *hashinfo, struct sk_buff *in_skb,
@@ -311,6 +315,7 @@ int inet_diag_dump_one_icsk(struct inet_hashinfo *hashinfo, struct sk_buff *in_s
         }
 
         err = sk_diag_fill(sk, rep, req,
+                           sk_user_ns(NETLINK_CB(in_skb).ssk),
                            NETLINK_CB(in_skb).pid,
                            nlh->nlmsg_seq, 0, nlh);
         if (err < 0) {
@@ -551,6 +556,7 @@ static int inet_csk_diag_dump(struct sock *sk,
                 return 0;
 
         return inet_csk_diag_fill(sk, skb, r,
+                                  sk_user_ns(NETLINK_CB(cb->skb).ssk),
                                   NETLINK_CB(cb->skb).pid,
                                   cb->nlh->nlmsg_seq, NLM_F_MULTI, cb->nlh);
 }
@@ -591,7 +597,9 @@ static int inet_twsk_diag_dump(struct inet_timewait_sock *tw,
 }
 
 static int inet_diag_fill_req(struct sk_buff *skb, struct sock *sk,
-                              struct request_sock *req, u32 pid, u32 seq,
+                              struct request_sock *req,
+                              struct user_namespace *user_ns,
+                              u32 pid, u32 seq,
                               const struct nlmsghdr *unlh)
 {
         const struct inet_request_sock *ireq = inet_rsk(req);
@@ -625,7 +633,7 @@ static int inet_diag_fill_req(struct sk_buff *skb, struct sock *sk,
         r->idiag_expires = jiffies_to_msecs(tmo);
         r->idiag_rqueue = 0;
         r->idiag_wqueue = 0;
-        r->idiag_uid = sock_i_uid(sk);
+        r->idiag_uid = from_kuid_munged(user_ns, sock_i_uid(sk));
         r->idiag_inode = 0;
 #if IS_ENABLED(CONFIG_IPV6)
         if (r->idiag_family == AF_INET6) {
@@ -702,6 +710,7 @@ static int inet_diag_dump_reqs(struct sk_buff *skb, struct sock *sk,
                         }
 
                         err = inet_diag_fill_req(skb, sk, req,
+                                               sk_user_ns(NETLINK_CB(cb->skb).ssk),
                                                NETLINK_CB(cb->skb).pid,
                                                cb->nlh->nlmsg_seq, cb->nlh);
                         if (err < 0) {
diff --git a/net/ipv4/ip_fragment.c b/net/ipv4/ip_fragment.c
index 8d07c973409c..fa6a12c51066 100644
--- a/net/ipv4/ip_fragment.c
+++ b/net/ipv4/ip_fragment.c
@@ -523,6 +523,10 @@ found:
         if (offset == 0)
                 qp->q.last_in |= INET_FRAG_FIRST_IN;
 
+        if (ip_hdr(skb)->frag_off & htons(IP_DF) &&
+            skb->len + ihl > qp->q.max_size)
+                qp->q.max_size = skb->len + ihl;
+
         if (qp->q.last_in == (INET_FRAG_FIRST_IN | INET_FRAG_LAST_IN) &&
             qp->q.meat == qp->q.len)
                 return ip_frag_reasm(qp, prev, dev);
@@ -646,9 +650,11 @@ static int ip_frag_reasm(struct ipq *qp, struct sk_buff *prev,
         head->next = NULL;
         head->dev = dev;
         head->tstamp = qp->q.stamp;
+        IPCB(head)->frag_max_size = qp->q.max_size;
 
         iph = ip_hdr(head);
-        iph->frag_off = 0;
+        /* max_size != 0 implies at least one fragment had IP_DF set */
+        iph->frag_off = qp->q.max_size ? htons(IP_DF) : 0;
         iph->tot_len = htons(len);
         iph->tos |= ecn;
         IP_INC_STATS_BH(net, IPSTATS_MIB_REASMOKS);
diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c
index ba39a52d18c1..a5beab1dc958 100644
--- a/net/ipv4/ip_output.c
+++ b/net/ipv4/ip_output.c
@@ -197,7 +197,7 @@ static inline int ip_finish_output2(struct sk_buff *skb)
         neigh = __ipv4_neigh_lookup_noref(dev, nexthop);
         if (unlikely(!neigh))
                 neigh = __neigh_create(&arp_tbl, &nexthop, dev, false);
-        if (neigh) {
+        if (!IS_ERR(neigh)) {
                 int res = dst_neigh_output(dst, neigh, skb);
 
                 rcu_read_unlock_bh();
@@ -467,7 +467,9 @@ int ip_fragment(struct sk_buff *skb, int (*output)(struct sk_buff *))
 
         iph = ip_hdr(skb);
 
-        if (unlikely((iph->frag_off & htons(IP_DF)) && !skb->local_df)) {
+        if (unlikely(((iph->frag_off & htons(IP_DF)) && !skb->local_df) ||
+                     (IPCB(skb)->frag_max_size &&
+                      IPCB(skb)->frag_max_size > dst_mtu(&rt->dst)))) {
                 IP_INC_STATS(dev_net(dev), IPSTATS_MIB_FRAGFAILS);
                 icmp_send(skb, ICMP_DEST_UNREACH, ICMP_FRAG_NEEDED,
                           htonl(ip_skb_dst_mtu(skb)));
@@ -1338,10 +1340,10 @@ struct sk_buff *__ip_make_skb(struct sock *sk,
         iph->ihl = 5;
         iph->tos = inet->tos;
         iph->frag_off = df;
-        ip_select_ident(iph, &rt->dst, sk);
         iph->ttl = ttl;
         iph->protocol = sk->sk_protocol;
         ip_copy_addrs(iph, fl4);
+        ip_select_ident(iph, &rt->dst, sk);
 
         if (opt) {
                 iph->ihl += opt->optlen>>2;
@@ -1366,9 +1368,8 @@ out:
         return skb;
 }
 
-int ip_send_skb(struct sk_buff *skb)
+int ip_send_skb(struct net *net, struct sk_buff *skb)
 {
-        struct net *net = sock_net(skb->sk);
         int err;
 
         err = ip_local_out(skb);
@@ -1391,7 +1392,7 @@ int ip_push_pending_frames(struct sock *sk, struct flowi4 *fl4)
                 return 0;
 
         /* Netfilter gets whole the not fragmented skb. */
-        return ip_send_skb(skb);
+        return ip_send_skb(sock_net(sk), skb);
 }
 
 /*
@@ -1536,6 +1537,7 @@ void ip_send_unicast_reply(struct net *net, struct sk_buff *skb, __be32 daddr,
                           arg->csumoffset) = csum_fold(csum_add(nskb->csum,
                                                                 arg->csum));
                 nskb->ip_summed = CHECKSUM_NONE;
+                skb_orphan(nskb);
                 skb_set_queue_mapping(nskb, skb_get_queue_mapping(skb));
                 ip_push_pending_frames(sk, &fl4);
         }
diff --git a/net/ipv4/ipmr.c b/net/ipv4/ipmr.c
index 8eec8f4a0536..8aa7a4cf9139 100644
--- a/net/ipv4/ipmr.c
+++ b/net/ipv4/ipmr.c
@@ -124,6 +124,8 @@ static DEFINE_SPINLOCK(mfc_unres_lock);
 static struct kmem_cache *mrt_cachep __read_mostly;
 
 static struct mr_table *ipmr_new_table(struct net *net, u32 id);
+static void ipmr_free_table(struct mr_table *mrt);
+
 static int ip_mr_forward(struct net *net, struct mr_table *mrt,
                          struct sk_buff *skb, struct mfc_cache *cache,
                          int local);
@@ -131,6 +133,7 @@ static int ipmr_cache_report(struct mr_table *mrt,
                              struct sk_buff *pkt, vifi_t vifi, int assert);
 static int __ipmr_fill_mroute(struct mr_table *mrt, struct sk_buff *skb,
                               struct mfc_cache *c, struct rtmsg *rtm);
+static void mroute_clean_tables(struct mr_table *mrt);
 static void ipmr_expire_process(unsigned long arg);
 
 #ifdef CONFIG_IP_MROUTE_MULTIPLE_TABLES
@@ -271,7 +274,7 @@ static void __net_exit ipmr_rules_exit(struct net *net)
 
         list_for_each_entry_safe(mrt, next, &net->ipv4.mr_tables, list) {
                 list_del(&mrt->list);
-                kfree(mrt);
+                ipmr_free_table(mrt);
         }
         fib_rules_unregister(net->ipv4.mr_rules_ops);
 }
@@ -299,7 +302,7 @@ static int __net_init ipmr_rules_init(struct net *net)
 
 static void __net_exit ipmr_rules_exit(struct net *net)
 {
-        kfree(net->ipv4.mrt);
+        ipmr_free_table(net->ipv4.mrt);
 }
 #endif
 
@@ -336,6 +339,13 @@ static struct mr_table *ipmr_new_table(struct net *net, u32 id)
         return mrt;
 }
 
+static void ipmr_free_table(struct mr_table *mrt)
+{
+        del_timer_sync(&mrt->ipmr_expire_timer);
+        mroute_clean_tables(mrt);
+        kfree(mrt);
+}
+
 /* Service routines creating virtual interfaces: DVMRP tunnels and PIMREG */
 
 static void ipmr_del_tunnel(struct net_device *dev, struct vifctl *v)
@@ -1798,7 +1808,7 @@ static struct mr_table *ipmr_rt_fib_lookup(struct net *net, struct sk_buff *skb)
                 .flowi4_oif = (rt_is_output_route(rt) ?
                                skb->dev->ifindex : 0),
                 .flowi4_iif = (rt_is_output_route(rt) ?
-                               net->loopback_dev->ifindex :
+                               LOOPBACK_IFINDEX :
                                skb->dev->ifindex),
                 .flowi4_mark = skb->mark,
         };
diff --git a/net/ipv4/netfilter.c b/net/ipv4/netfilter.c
index ed1b36783192..4c0cf63dd92e 100644
--- a/net/ipv4/netfilter.c
+++ b/net/ipv4/netfilter.c
@@ -72,43 +72,6 @@ int ip_route_me_harder(struct sk_buff *skb, unsigned int addr_type)
 }
 EXPORT_SYMBOL(ip_route_me_harder);
 
-#ifdef CONFIG_XFRM
-int ip_xfrm_me_harder(struct sk_buff *skb)
-{
-        struct flowi fl;
-        unsigned int hh_len;
-        struct dst_entry *dst;
-
-        if (IPCB(skb)->flags & IPSKB_XFRM_TRANSFORMED)
-                return 0;
-        if (xfrm_decode_session(skb, &fl, AF_INET) < 0)
-                return -1;
-
-        dst = skb_dst(skb);
-        if (dst->xfrm)
-                dst = ((struct xfrm_dst *)dst)->route;
-        dst_hold(dst);
-
-        dst = xfrm_lookup(dev_net(dst->dev), dst, &fl, skb->sk, 0);
-        if (IS_ERR(dst))
-                return -1;
-
-        skb_dst_drop(skb);
-        skb_dst_set(skb, dst);
-
-        /* Change in oif may mean change in hh_len. */
-        hh_len = skb_dst(skb)->dev->hard_header_len;
-        if (skb_headroom(skb) < hh_len &&
-            pskb_expand_head(skb, hh_len - skb_headroom(skb), 0, GFP_ATOMIC))
-                return -1;
-        return 0;
-}
-EXPORT_SYMBOL(ip_xfrm_me_harder);
-#endif
-
-void (*ip_nat_decode_session)(struct sk_buff *, struct flowi *);
-EXPORT_SYMBOL(ip_nat_decode_session);
-
 /*
  * Extra routing may needed on local out, as the QUEUE target never
  * returns control to the table.
@@ -225,12 +188,12 @@ static const struct nf_afinfo nf_ip_afinfo = {
         .route_key_size         = sizeof(struct ip_rt_info),
 };
 
-static int ipv4_netfilter_init(void)
+static int __init ipv4_netfilter_init(void)
 {
         return nf_register_afinfo(&nf_ip_afinfo);
 }
 
-static void ipv4_netfilter_fini(void)
+static void __exit ipv4_netfilter_fini(void)
 {
         nf_unregister_afinfo(&nf_ip_afinfo);
 }
diff --git a/net/ipv4/netfilter/Kconfig b/net/ipv4/netfilter/Kconfig
index fcc543cd987a..131e53702e77 100644
--- a/net/ipv4/netfilter/Kconfig
+++ b/net/ipv4/netfilter/Kconfig
@@ -143,25 +143,22 @@ config IP_NF_TARGET_ULOG
           To compile it as a module, choose M here.  If unsure, say N.
 
 # NAT + specific targets: nf_conntrack
-config NF_NAT
-        tristate "Full NAT"
+config NF_NAT_IPV4
+        tristate "IPv4 NAT"
         depends on NF_CONNTRACK_IPV4
         default m if NETFILTER_ADVANCED=n
+        select NF_NAT
         help
-          The Full NAT option allows masquerading, port forwarding and other
+          The IPv4 NAT option allows masquerading, port forwarding and other
           forms of full Network Address Port Translation.  It is controlled by
           the `nat' table in iptables: see the man page for iptables(8).
 
           To compile it as a module, choose M here.  If unsure, say N.
 
-config NF_NAT_NEEDED
-        bool
-        depends on NF_NAT
-        default y
+if NF_NAT_IPV4
 
 config IP_NF_TARGET_MASQUERADE
         tristate "MASQUERADE target support"
-        depends on NF_NAT
         default m if NETFILTER_ADVANCED=n
         help
           Masquerading is a special case of NAT: all outgoing connections are
@@ -174,7 +171,6 @@ config IP_NF_TARGET_MASQUERADE
 
 config IP_NF_TARGET_NETMAP
         tristate "NETMAP target support"
-        depends on NF_NAT
         depends on NETFILTER_ADVANCED
         help
           NETMAP is an implementation of static 1:1 NAT mapping of network
@@ -185,7 +181,6 @@ config IP_NF_TARGET_NETMAP
 
 config IP_NF_TARGET_REDIRECT
         tristate "REDIRECT target support"
-        depends on NF_NAT
         depends on NETFILTER_ADVANCED
         help
           REDIRECT is a special case of NAT: all incoming connections are
@@ -195,9 +190,11 @@ config IP_NF_TARGET_REDIRECT
 
           To compile it as a module, choose M here.  If unsure, say N.
 
+endif
+
 config NF_NAT_SNMP_BASIC
         tristate "Basic SNMP-ALG support"
-        depends on NF_CONNTRACK_SNMP && NF_NAT
+        depends on NF_CONNTRACK_SNMP && NF_NAT_IPV4
         depends on NETFILTER_ADVANCED
         default NF_NAT && NF_CONNTRACK_SNMP
         ---help---
@@ -219,61 +216,21 @@ config NF_NAT_SNMP_BASIC
 #           <expr> '&&' <expr>                   (6)
 #
 # (6) Returns the result of min(/expr/, /expr/).
-config NF_NAT_PROTO_DCCP
-        tristate
-        depends on NF_NAT && NF_CT_PROTO_DCCP
-        default NF_NAT && NF_CT_PROTO_DCCP
 
 config NF_NAT_PROTO_GRE
         tristate
-        depends on NF_NAT && NF_CT_PROTO_GRE
-
-config NF_NAT_PROTO_UDPLITE
-        tristate
-        depends on NF_NAT && NF_CT_PROTO_UDPLITE
-        default NF_NAT && NF_CT_PROTO_UDPLITE
-
-config NF_NAT_PROTO_SCTP
-        tristate
-        default NF_NAT && NF_CT_PROTO_SCTP
-        depends on NF_NAT && NF_CT_PROTO_SCTP
-        select LIBCRC32C
-
-config NF_NAT_FTP
-        tristate
-        depends on NF_CONNTRACK && NF_NAT
-        default NF_NAT && NF_CONNTRACK_FTP
-
-config NF_NAT_IRC
-        tristate
-        depends on NF_CONNTRACK && NF_NAT
-        default NF_NAT && NF_CONNTRACK_IRC
-
-config NF_NAT_TFTP
-        tristate
-        depends on NF_CONNTRACK && NF_NAT
-        default NF_NAT && NF_CONNTRACK_TFTP
-
-config NF_NAT_AMANDA
-        tristate
-        depends on NF_CONNTRACK && NF_NAT
-        default NF_NAT && NF_CONNTRACK_AMANDA
+        depends on NF_NAT_IPV4 && NF_CT_PROTO_GRE
 
 config NF_NAT_PPTP
         tristate
-        depends on NF_CONNTRACK && NF_NAT
-        default NF_NAT && NF_CONNTRACK_PPTP
+        depends on NF_CONNTRACK && NF_NAT_IPV4
+        default NF_NAT_IPV4 && NF_CONNTRACK_PPTP
         select NF_NAT_PROTO_GRE
 
 config NF_NAT_H323
         tristate
-        depends on NF_CONNTRACK && NF_NAT
-        default NF_NAT && NF_CONNTRACK_H323
-
-config NF_NAT_SIP
-        tristate
-        depends on NF_CONNTRACK && NF_NAT
-        default NF_NAT && NF_CONNTRACK_SIP
+        depends on NF_CONNTRACK && NF_NAT_IPV4
+        default NF_NAT_IPV4 && NF_CONNTRACK_H323
 
 # mangle + specific targets
 config IP_NF_MANGLE
diff --git a/net/ipv4/netfilter/Makefile b/net/ipv4/netfilter/Makefile
index c20674dc9452..b7dd18987237 100644
--- a/net/ipv4/netfilter/Makefile
+++ b/net/ipv4/netfilter/Makefile
@@ -10,32 +10,22 @@ nf_conntrack_ipv4-objs	+= nf_conntrack_l3proto_ipv4_compat.o
 endif
 endif
 
-nf_nat-y                := nf_nat_core.o nf_nat_helper.o nf_nat_proto_unknown.o nf_nat_proto_common.o nf_nat_proto_tcp.o nf_nat_proto_udp.o nf_nat_proto_icmp.o
-iptable_nat-y   := nf_nat_rule.o nf_nat_standalone.o
-
 # connection tracking
 obj-$(CONFIG_NF_CONNTRACK_IPV4) += nf_conntrack_ipv4.o
 
-obj-$(CONFIG_NF_NAT) += nf_nat.o
+nf_nat_ipv4-y           := nf_nat_l3proto_ipv4.o nf_nat_proto_icmp.o
+obj-$(CONFIG_NF_NAT_IPV4) += nf_nat_ipv4.o
 
 # defrag
 obj-$(CONFIG_NF_DEFRAG_IPV4) += nf_defrag_ipv4.o
 
 # NAT helpers (nf_conntrack)
-obj-$(CONFIG_NF_NAT_AMANDA) += nf_nat_amanda.o
-obj-$(CONFIG_NF_NAT_FTP) += nf_nat_ftp.o
 obj-$(CONFIG_NF_NAT_H323) += nf_nat_h323.o
-obj-$(CONFIG_NF_NAT_IRC) += nf_nat_irc.o
 obj-$(CONFIG_NF_NAT_PPTP) += nf_nat_pptp.o
-obj-$(CONFIG_NF_NAT_SIP) += nf_nat_sip.o
 obj-$(CONFIG_NF_NAT_SNMP_BASIC) += nf_nat_snmp_basic.o
-obj-$(CONFIG_NF_NAT_TFTP) += nf_nat_tftp.o
 
 # NAT protocols (nf_nat)
-obj-$(CONFIG_NF_NAT_PROTO_DCCP) += nf_nat_proto_dccp.o
 obj-$(CONFIG_NF_NAT_PROTO_GRE) += nf_nat_proto_gre.o
-obj-$(CONFIG_NF_NAT_PROTO_UDPLITE) += nf_nat_proto_udplite.o
-obj-$(CONFIG_NF_NAT_PROTO_SCTP) += nf_nat_proto_sctp.o
 
 # generic IP tables 
 obj-$(CONFIG_IP_NF_IPTABLES) += ip_tables.o
@@ -43,7 +33,7 @@ obj-$(CONFIG_IP_NF_IPTABLES) += ip_tables.o
 # the three instances of ip_tables
 obj-$(CONFIG_IP_NF_FILTER) += iptable_filter.o
 obj-$(CONFIG_IP_NF_MANGLE) += iptable_mangle.o
-obj-$(CONFIG_NF_NAT) += iptable_nat.o
+obj-$(CONFIG_NF_NAT_IPV4) += iptable_nat.o
 obj-$(CONFIG_IP_NF_RAW) += iptable_raw.o
 obj-$(CONFIG_IP_NF_SECURITY) += iptable_security.o
 
diff --git a/net/ipv4/netfilter/ipt_MASQUERADE.c b/net/ipv4/netfilter/ipt_MASQUERADE.c
index cbb6a1a6f6f7..5d5d4d1be9c2 100644
--- a/net/ipv4/netfilter/ipt_MASQUERADE.c
+++ b/net/ipv4/netfilter/ipt_MASQUERADE.c
@@ -19,9 +19,9 @@
 #include <net/ip.h>
 #include <net/checksum.h>
 #include <net/route.h>
-#include <net/netfilter/nf_nat_rule.h>
 #include <linux/netfilter_ipv4.h>
 #include <linux/netfilter/x_tables.h>
+#include <net/netfilter/nf_nat.h>
 
 MODULE_LICENSE("GPL");
 MODULE_AUTHOR("Netfilter Core Team <coreteam@netfilter.org>");
@@ -49,7 +49,7 @@ masquerade_tg(struct sk_buff *skb, const struct xt_action_param *par)
         struct nf_conn *ct;
         struct nf_conn_nat *nat;
         enum ip_conntrack_info ctinfo;
-        struct nf_nat_ipv4_range newrange;
+        struct nf_nat_range newrange;
         const struct nf_nat_ipv4_multi_range_compat *mr;
         const struct rtable *rt;
         __be32 newsrc, nh;
@@ -80,10 +80,13 @@ masquerade_tg(struct sk_buff *skb, const struct xt_action_param *par)
         nat->masq_index = par->out->ifindex;
 
         /* Transfer from original range. */
-        newrange = ((struct nf_nat_ipv4_range)
-                { mr->range[0].flags | NF_NAT_RANGE_MAP_IPS,
-                  newsrc, newsrc,
-                  mr->range[0].min, mr->range[0].max });
+        memset(&newrange.min_addr, 0, sizeof(newrange.min_addr));
+        memset(&newrange.max_addr, 0, sizeof(newrange.max_addr));
+        newrange.flags       = mr->range[0].flags | NF_NAT_RANGE_MAP_IPS;
+        newrange.min_addr.ip = newsrc;
+        newrange.max_addr.ip = newsrc;
+        newrange.min_proto   = mr->range[0].min;
+        newrange.max_proto   = mr->range[0].max;
 
         /* Hand modified range to generic setup. */
         return nf_nat_setup_info(ct, &newrange, NF_NAT_MANIP_SRC);
@@ -96,7 +99,8 @@ device_cmp(struct nf_conn *i, void *ifindex)
 
         if (!nat)
                 return 0;
-
+        if (nf_ct_l3num(i) != NFPROTO_IPV4)
+                return 0;
         return nat->masq_index == (int)(long)ifindex;
 }
 
diff --git a/net/ipv4/netfilter/ipt_NETMAP.c b/net/ipv4/netfilter/ipt_NETMAP.c
index b5bfbbabf70d..85028dc0425d 100644
--- a/net/ipv4/netfilter/ipt_NETMAP.c
+++ b/net/ipv4/netfilter/ipt_NETMAP.c
@@ -16,7 +16,7 @@
 #include <linux/netfilter.h>
 #include <linux/netfilter_ipv4.h>
 #include <linux/netfilter/x_tables.h>
-#include <net/netfilter/nf_nat_rule.h>
+#include <net/netfilter/nf_nat.h>
 
 MODULE_LICENSE("GPL");
 MODULE_AUTHOR("Svenning Soerensen <svenning@post5.tele.dk>");
@@ -44,7 +44,7 @@ netmap_tg(struct sk_buff *skb, const struct xt_action_param *par)
         enum ip_conntrack_info ctinfo;
         __be32 new_ip, netmask;
         const struct nf_nat_ipv4_multi_range_compat *mr = par->targinfo;
-        struct nf_nat_ipv4_range newrange;
+        struct nf_nat_range newrange;
 
         NF_CT_ASSERT(par->hooknum == NF_INET_PRE_ROUTING ||
                      par->hooknum == NF_INET_POST_ROUTING ||
@@ -61,10 +61,13 @@ netmap_tg(struct sk_buff *skb, const struct xt_action_param *par)
                 new_ip = ip_hdr(skb)->saddr & ~netmask;
         new_ip |= mr->range[0].min_ip & netmask;
 
-        newrange = ((struct nf_nat_ipv4_range)
-                { mr->range[0].flags | NF_NAT_RANGE_MAP_IPS,
-                  new_ip, new_ip,
-                  mr->range[0].min, mr->range[0].max });
+        memset(&newrange.min_addr, 0, sizeof(newrange.min_addr));
+        memset(&newrange.max_addr, 0, sizeof(newrange.max_addr));
+        newrange.flags       = mr->range[0].flags | NF_NAT_RANGE_MAP_IPS;
+        newrange.min_addr.ip = new_ip;
+        newrange.max_addr.ip = new_ip;
+        newrange.min_proto   = mr->range[0].min;
+        newrange.max_proto   = mr->range[0].max;
 
         /* Hand modified range to generic setup. */
         return nf_nat_setup_info(ct, &newrange, HOOK2MANIP(par->hooknum));
diff --git a/net/ipv4/netfilter/ipt_REDIRECT.c b/net/ipv4/netfilter/ipt_REDIRECT.c
index 7c0103a5203e..11407d7d2472 100644
--- a/net/ipv4/netfilter/ipt_REDIRECT.c
+++ b/net/ipv4/netfilter/ipt_REDIRECT.c
@@ -19,7 +19,7 @@
 #include <net/checksum.h>
 #include <linux/netfilter_ipv4.h>
 #include <linux/netfilter/x_tables.h>
-#include <net/netfilter/nf_nat_rule.h>
+#include <net/netfilter/nf_nat.h>
 
 MODULE_LICENSE("GPL");
 MODULE_AUTHOR("Netfilter Core Team <coreteam@netfilter.org>");
@@ -48,7 +48,7 @@ redirect_tg(struct sk_buff *skb, const struct xt_action_param *par)
         enum ip_conntrack_info ctinfo;
         __be32 newdst;
         const struct nf_nat_ipv4_multi_range_compat *mr = par->targinfo;
-        struct nf_nat_ipv4_range newrange;
+        struct nf_nat_range newrange;
 
         NF_CT_ASSERT(par->hooknum == NF_INET_PRE_ROUTING ||
                      par->hooknum == NF_INET_LOCAL_OUT);
@@ -76,10 +76,13 @@ redirect_tg(struct sk_buff *skb, const struct xt_action_param *par)
         }
 
         /* Transfer from original range. */
-        newrange = ((struct nf_nat_ipv4_range)
-                { mr->range[0].flags | NF_NAT_RANGE_MAP_IPS,
-                  newdst, newdst,
-                  mr->range[0].min, mr->range[0].max });
+        memset(&newrange.min_addr, 0, sizeof(newrange.min_addr));
+        memset(&newrange.max_addr, 0, sizeof(newrange.max_addr));
+        newrange.flags       = mr->range[0].flags | NF_NAT_RANGE_MAP_IPS;
+        newrange.min_addr.ip = newdst;
+        newrange.max_addr.ip = newdst;
+        newrange.min_proto   = mr->range[0].min;
+        newrange.max_proto   = mr->range[0].max;
 
         /* Hand modified range to generic setup. */
         return nf_nat_setup_info(ct, &newrange, NF_NAT_MANIP_DST);
diff --git a/net/ipv4/netfilter/ipt_rpfilter.c b/net/ipv4/netfilter/ipt_rpfilter.c
index 31371be8174b..c30130062cd6 100644
--- a/net/ipv4/netfilter/ipt_rpfilter.c
+++ b/net/ipv4/netfilter/ipt_rpfilter.c
@@ -85,7 +85,7 @@ static bool rpfilter_mt(const struct sk_buff *skb, struct xt_action_param *par)
                         return ipv4_is_local_multicast(iph->daddr) ^ invert;
                 flow.flowi4_iif = 0;
         } else {
-                flow.flowi4_iif = dev_net(par->in)->loopback_dev->ifindex;
+                flow.flowi4_iif = LOOPBACK_IFINDEX;
         }
 
         flow.daddr = iph->saddr;
diff --git a/net/ipv4/netfilter/iptable_filter.c b/net/ipv4/netfilter/iptable_filter.c
index 851acec852d2..6b3da5cf54e9 100644
--- a/net/ipv4/netfilter/iptable_filter.c
+++ b/net/ipv4/netfilter/iptable_filter.c
@@ -69,9 +69,7 @@ static int __net_init iptable_filter_net_init(struct net *net)
         net->ipv4.iptable_filter =
                 ipt_register_table(net, &packet_filter, repl);
         kfree(repl);
-        if (IS_ERR(net->ipv4.iptable_filter))
-                return PTR_ERR(net->ipv4.iptable_filter);
-        return 0;
+        return PTR_RET(net->ipv4.iptable_filter);
 }
 
 static void __net_exit iptable_filter_net_exit(struct net *net)
@@ -96,14 +94,10 @@ static int __init iptable_filter_init(void)
         filter_ops = xt_hook_link(&packet_filter, iptable_filter_hook);
         if (IS_ERR(filter_ops)) {
                 ret = PTR_ERR(filter_ops);
-                goto cleanup_table;
+                unregister_pernet_subsys(&iptable_filter_net_ops);
         }
 
         return ret;
-
- cleanup_table:
-        unregister_pernet_subsys(&iptable_filter_net_ops);
-        return ret;
 }
 
 static void __exit iptable_filter_fini(void)
diff --git a/net/ipv4/netfilter/iptable_mangle.c b/net/ipv4/netfilter/iptable_mangle.c
index aef5d1fbe77d..85d88f206447 100644
--- a/net/ipv4/netfilter/iptable_mangle.c
+++ b/net/ipv4/netfilter/iptable_mangle.c
@@ -104,9 +104,7 @@ static int __net_init iptable_mangle_net_init(struct net *net)
         net->ipv4.iptable_mangle =
                 ipt_register_table(net, &packet_mangler, repl);
         kfree(repl);
-        if (IS_ERR(net->ipv4.iptable_mangle))
-                return PTR_ERR(net->ipv4.iptable_mangle);
-        return 0;
+        return PTR_RET(net->ipv4.iptable_mangle);
 }
 
 static void __net_exit iptable_mangle_net_exit(struct net *net)
@@ -131,14 +129,10 @@ static int __init iptable_mangle_init(void)
         mangle_ops = xt_hook_link(&packet_mangler, iptable_mangle_hook);
         if (IS_ERR(mangle_ops)) {
                 ret = PTR_ERR(mangle_ops);
-                goto cleanup_table;
+                unregister_pernet_subsys(&iptable_mangle_net_ops);
         }
 
         return ret;
-
- cleanup_table:
-        unregister_pernet_subsys(&iptable_mangle_net_ops);
-        return ret;
 }
 
 static void __exit iptable_mangle_fini(void)
diff --git a/net/ipv4/netfilter/nf_nat_standalone.c b/net/ipv4/netfilter/iptable_nat.c
index 3828a4229822..9e0ffaf1d942 100644
--- a/net/ipv4/netfilter/nf_nat_standalone.c
+++ b/net/ipv4/netfilter/iptable_nat.c
@@ -1,84 +1,71 @@
 /* (C) 1999-2001 Paul `Rusty' Russell
  * (C) 2002-2006 Netfilter Core Team <coreteam@netfilter.org>
+ * (C) 2011 Patrick McHardy <kaber@trash.net>
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License version 2 as
  * published by the Free Software Foundation.
  */
-#include <linux/types.h>
-#include <linux/icmp.h>
-#include <linux/gfp.h>
-#include <linux/ip.h>
+
+#include <linux/module.h>
 #include <linux/netfilter.h>
 #include <linux/netfilter_ipv4.h>
-#include <linux/module.h>
-#include <linux/skbuff.h>
-#include <linux/proc_fs.h>
+#include <linux/netfilter_ipv4/ip_tables.h>
+#include <linux/ip.h>
 #include <net/ip.h>
-#include <net/checksum.h>
-#include <linux/spinlock.h>
 
-#include <net/netfilter/nf_conntrack.h>
-#include <net/netfilter/nf_conntrack_core.h>
-#include <net/netfilter/nf_conntrack_extend.h>
 #include <net/netfilter/nf_nat.h>
-#include <net/netfilter/nf_nat_rule.h>
-#include <net/netfilter/nf_nat_protocol.h>
 #include <net/netfilter/nf_nat_core.h>
-#include <net/netfilter/nf_nat_helper.h>
-#include <linux/netfilter_ipv4/ip_tables.h>
+#include <net/netfilter/nf_nat_l3proto.h>
+
+static const struct xt_table nf_nat_ipv4_table = {
+        .name           = "nat",
+        .valid_hooks    = (1 << NF_INET_PRE_ROUTING) |
+                          (1 << NF_INET_POST_ROUTING) |
+                          (1 << NF_INET_LOCAL_OUT) |
+                          (1 << NF_INET_LOCAL_IN),
+        .me             = THIS_MODULE,
+        .af             = NFPROTO_IPV4,
+};
 
-#ifdef CONFIG_XFRM
-static void nat_decode_session(struct sk_buff *skb, struct flowi *fl)
+static unsigned int alloc_null_binding(struct nf_conn *ct, unsigned int hooknum)
 {
-        struct flowi4 *fl4 = &fl->u.ip4;
-        const struct nf_conn *ct;
-        const struct nf_conntrack_tuple *t;
-        enum ip_conntrack_info ctinfo;
-        enum ip_conntrack_dir dir;
-        unsigned long statusbit;
-
-        ct = nf_ct_get(skb, &ctinfo);
-        if (ct == NULL)
-                return;
-        dir = CTINFO2DIR(ctinfo);
-        t = &ct->tuplehash[dir].tuple;
-
-        if (dir == IP_CT_DIR_ORIGINAL)
-                statusbit = IPS_DST_NAT;
-        else
-                statusbit = IPS_SRC_NAT;
-
-        if (ct->status & statusbit) {
-                fl4->daddr = t->dst.u3.ip;
-                if (t->dst.protonum == IPPROTO_TCP ||
-                    t->dst.protonum == IPPROTO_UDP ||
-                    t->dst.protonum == IPPROTO_UDPLITE ||
-                    t->dst.protonum == IPPROTO_DCCP ||
-                    t->dst.protonum == IPPROTO_SCTP)
-                        fl4->fl4_dport = t->dst.u.tcp.port;
-        }
+        /* Force range to this IP; let proto decide mapping for
+         * per-proto parts (hence not IP_NAT_RANGE_PROTO_SPECIFIED).
+         */
+        struct nf_nat_range range;
+
+        range.flags = 0;
+        pr_debug("Allocating NULL binding for %p (%pI4)\n", ct,
+                 HOOK2MANIP(hooknum) == NF_NAT_MANIP_SRC ?
+                 &ct->tuplehash[IP_CT_DIR_REPLY].tuple.dst.u3.ip :
+                 &ct->tuplehash[IP_CT_DIR_REPLY].tuple.src.u3.ip);
+
+        return nf_nat_setup_info(ct, &range, HOOK2MANIP(hooknum));
+}
 
-        statusbit ^= IPS_NAT_MASK;
+static unsigned int nf_nat_rule_find(struct sk_buff *skb, unsigned int hooknum,
+                                     const struct net_device *in,
+                                     const struct net_device *out,
+                                     struct nf_conn *ct)
+{
+        struct net *net = nf_ct_net(ct);
+        unsigned int ret;
 
-        if (ct->status & statusbit) {
-                fl4->saddr = t->src.u3.ip;
-                if (t->dst.protonum == IPPROTO_TCP ||
-                    t->dst.protonum == IPPROTO_UDP ||
-                    t->dst.protonum == IPPROTO_UDPLITE ||
-                    t->dst.protonum == IPPROTO_DCCP ||
-                    t->dst.protonum == IPPROTO_SCTP)
-                        fl4->fl4_sport = t->src.u.tcp.port;
+        ret = ipt_do_table(skb, hooknum, in, out, net->ipv4.nat_table);
+        if (ret == NF_ACCEPT) {
+                if (!nf_nat_initialized(ct, HOOK2MANIP(hooknum)))
+                        ret = alloc_null_binding(ct, hooknum);
         }
+        return ret;
 }
-#endif
 
 static unsigned int
-nf_nat_fn(unsigned int hooknum,
-          struct sk_buff *skb,
-          const struct net_device *in,
-          const struct net_device *out,
-          int (*okfn)(struct sk_buff *))
+nf_nat_ipv4_fn(unsigned int hooknum,
+               struct sk_buff *skb,
+               const struct net_device *in,
+               const struct net_device *out,
+               int (*okfn)(struct sk_buff *))
 {
         struct nf_conn *ct;
         enum ip_conntrack_info ctinfo;
@@ -87,14 +74,16 @@ nf_nat_fn(unsigned int hooknum,
         enum nf_nat_manip_type maniptype = HOOK2MANIP(hooknum);
 
         /* We never see fragments: conntrack defrags on pre-routing
-           and local-out, and nf_nat_out protects post-routing. */
+         * and local-out, and nf_nat_out protects post-routing.
+         */
         NF_CT_ASSERT(!ip_is_fragment(ip_hdr(skb)));
 
         ct = nf_ct_get(skb, &ctinfo);
         /* Can't track?  It's not due to stress, or conntrack would
-           have dropped it.  Hence it's the user's responsibilty to
-           packet filter it out, or implement conntrack/NAT for that
-           protocol. 8) --RR */
+         * have dropped it.  Hence it's the user's responsibilty to
+         * packet filter it out, or implement conntrack/NAT for that
+         * protocol. 8) --RR
+         */
         if (!ct)
                 return NF_ACCEPT;
 
@@ -118,17 +107,17 @@ nf_nat_fn(unsigned int hooknum,
         case IP_CT_RELATED:
         case IP_CT_RELATED_REPLY:
                 if (ip_hdr(skb)->protocol == IPPROTO_ICMP) {
-                        if (!nf_nat_icmp_reply_translation(ct, ctinfo,
-                                                           hooknum, skb))
+                        if (!nf_nat_icmp_reply_translation(skb, ct, ctinfo,
+                                                           hooknum))
                                 return NF_DROP;
                         else
                                 return NF_ACCEPT;
                 }
                 /* Fall thru... (Only ICMPs can be IP_CT_IS_REPLY) */
         case IP_CT_NEW:
-
                 /* Seen it before?  This can happen for loopback, retrans,
-                   or local packets.. */
+                 * or local packets.
+                 */
                 if (!nf_nat_initialized(ct, maniptype)) {
                         unsigned int ret;
 
@@ -151,16 +140,16 @@ nf_nat_fn(unsigned int hooknum,
 }
 
 static unsigned int
-nf_nat_in(unsigned int hooknum,
-          struct sk_buff *skb,
-          const struct net_device *in,
-          const struct net_device *out,
-          int (*okfn)(struct sk_buff *))
+nf_nat_ipv4_in(unsigned int hooknum,
+               struct sk_buff *skb,
+               const struct net_device *in,
+               const struct net_device *out,
+               int (*okfn)(struct sk_buff *))
 {
         unsigned int ret;
         __be32 daddr = ip_hdr(skb)->daddr;
 
-        ret = nf_nat_fn(hooknum, skb, in, out, okfn);
+        ret = nf_nat_ipv4_fn(hooknum, skb, in, out, okfn);
         if (ret != NF_DROP && ret != NF_STOLEN &&
             daddr != ip_hdr(skb)->daddr)
                 skb_dst_drop(skb);
@@ -169,11 +158,11 @@ nf_nat_in(unsigned int hooknum,
 }
 
 static unsigned int
-nf_nat_out(unsigned int hooknum,
-           struct sk_buff *skb,
-           const struct net_device *in,
-           const struct net_device *out,
-           int (*okfn)(struct sk_buff *))
+nf_nat_ipv4_out(unsigned int hooknum,
+                struct sk_buff *skb,
+                const struct net_device *in,
+                const struct net_device *out,
+                int (*okfn)(struct sk_buff *))
 {
 #ifdef CONFIG_XFRM
         const struct nf_conn *ct;
@@ -186,29 +175,30 @@ nf_nat_out(unsigned int hooknum,
             ip_hdrlen(skb) < sizeof(struct iphdr))
                 return NF_ACCEPT;
 
-        ret = nf_nat_fn(hooknum, skb, in, out, okfn);
+        ret = nf_nat_ipv4_fn(hooknum, skb, in, out, okfn);
 #ifdef CONFIG_XFRM
         if (ret != NF_DROP && ret != NF_STOLEN &&
+            !(IPCB(skb)->flags & IPSKB_XFRM_TRANSFORMED) &&
             (ct = nf_ct_get(skb, &ctinfo)) != NULL) {
                 enum ip_conntrack_dir dir = CTINFO2DIR(ctinfo);
 
                 if ((ct->tuplehash[dir].tuple.src.u3.ip !=
                      ct->tuplehash[!dir].tuple.dst.u3.ip) ||
                     (ct->tuplehash[dir].tuple.src.u.all !=
-                     ct->tuplehash[!dir].tuple.dst.u.all)
-                   )
-                        return ip_xfrm_me_harder(skb) == 0 ? ret : NF_DROP;
+                     ct->tuplehash[!dir].tuple.dst.u.all))
+                        if (nf_xfrm_me_harder(skb, AF_INET) < 0)
+                                ret = NF_DROP;
         }
 #endif
         return ret;
 }
 
 static unsigned int
-nf_nat_local_fn(unsigned int hooknum,
-                struct sk_buff *skb,
-                const struct net_device *in,
-                const struct net_device *out,
-                int (*okfn)(struct sk_buff *))
+nf_nat_ipv4_local_fn(unsigned int hooknum,
+                     struct sk_buff *skb,
+                     const struct net_device *in,
+                     const struct net_device *out,
+                     int (*okfn)(struct sk_buff *))
 {
         const struct nf_conn *ct;
         enum ip_conntrack_info ctinfo;
@@ -219,7 +209,7 @@ nf_nat_local_fn(unsigned int hooknum,
             ip_hdrlen(skb) < sizeof(struct iphdr))
                 return NF_ACCEPT;
 
-        ret = nf_nat_fn(hooknum, skb, in, out, okfn);
+        ret = nf_nat_ipv4_fn(hooknum, skb, in, out, okfn);
         if (ret != NF_DROP && ret != NF_STOLEN &&
             (ct = nf_ct_get(skb, &ctinfo)) != NULL) {
                 enum ip_conntrack_dir dir = CTINFO2DIR(ctinfo);
@@ -230,21 +220,20 @@ nf_nat_local_fn(unsigned int hooknum,
                                 ret = NF_DROP;
                 }
 #ifdef CONFIG_XFRM
-                else if (ct->tuplehash[dir].tuple.dst.u.all !=
+                else if (!(IPCB(skb)->flags & IPSKB_XFRM_TRANSFORMED) &&
+                         ct->tuplehash[dir].tuple.dst.u.all !=
                          ct->tuplehash[!dir].tuple.src.u.all)
-                        if (ip_xfrm_me_harder(skb))
+                        if (nf_xfrm_me_harder(skb, AF_INET) < 0)
                                 ret = NF_DROP;
 #endif
         }
         return ret;
 }
 
-/* We must be after connection tracking and before packet filtering. */
-
-static struct nf_hook_ops nf_nat_ops[] __read_mostly = {
+static struct nf_hook_ops nf_nat_ipv4_ops[] __read_mostly = {
         /* Before packet filtering, change destination */
         {
-                .hook           = nf_nat_in,
+                .hook           = nf_nat_ipv4_in,
                 .owner          = THIS_MODULE,
                 .pf             = NFPROTO_IPV4,
                 .hooknum        = NF_INET_PRE_ROUTING,
@@ -252,7 +241,7 @@ static struct nf_hook_ops nf_nat_ops[] __read_mostly = {
         },
         /* After packet filtering, change source */
         {
-                .hook           = nf_nat_out,
+                .hook           = nf_nat_ipv4_out,
                 .owner          = THIS_MODULE,
                 .pf             = NFPROTO_IPV4,
                 .hooknum        = NF_INET_POST_ROUTING,
@@ -260,7 +249,7 @@ static struct nf_hook_ops nf_nat_ops[] __read_mostly = {
         },
         /* Before packet filtering, change destination */
         {
-                .hook           = nf_nat_local_fn,
+                .hook           = nf_nat_ipv4_local_fn,
                 .owner          = THIS_MODULE,
                 .pf             = NFPROTO_IPV4,
                 .hooknum        = NF_INET_LOCAL_OUT,
@@ -268,7 +257,7 @@ static struct nf_hook_ops nf_nat_ops[] __read_mostly = {
         },
         /* After packet filtering, change source */
         {
-                .hook           = nf_nat_fn,
+                .hook           = nf_nat_ipv4_fn,
                 .owner          = THIS_MODULE,
                 .pf             = NFPROTO_IPV4,
                 .hooknum        = NF_INET_LOCAL_IN,
@@ -276,51 +265,56 @@ static struct nf_hook_ops nf_nat_ops[] __read_mostly = {
         },
 };
 
-static int __init nf_nat_standalone_init(void)
+static int __net_init iptable_nat_net_init(struct net *net)
 {
-        int ret = 0;
+        struct ipt_replace *repl;
+
+        repl = ipt_alloc_initial_table(&nf_nat_ipv4_table);
+        if (repl == NULL)
+                return -ENOMEM;
+        net->ipv4.nat_table = ipt_register_table(net, &nf_nat_ipv4_table, repl);
+        kfree(repl);
+        if (IS_ERR(net->ipv4.nat_table))
+                return PTR_ERR(net->ipv4.nat_table);
+        return 0;
+}
 
-        need_ipv4_conntrack();
+static void __net_exit iptable_nat_net_exit(struct net *net)
+{
+        ipt_unregister_table(net, net->ipv4.nat_table);
+}
 
-#ifdef CONFIG_XFRM
-        BUG_ON(ip_nat_decode_session != NULL);
-        RCU_INIT_POINTER(ip_nat_decode_session, nat_decode_session);
-#endif
-        ret = nf_nat_rule_init();
-        if (ret < 0) {
-                pr_err("nf_nat_init: can't setup rules.\n");
-                goto cleanup_decode_session;
-        }
-        ret = nf_register_hooks(nf_nat_ops, ARRAY_SIZE(nf_nat_ops));
-        if (ret < 0) {
-                pr_err("nf_nat_init: can't register hooks.\n");
-                goto cleanup_rule_init;
-        }
-        return ret;
+static struct pernet_operations iptable_nat_net_ops = {
+        .init   = iptable_nat_net_init,
+        .exit   = iptable_nat_net_exit,
+};
 
- cleanup_rule_init:
-        nf_nat_rule_cleanup();
- cleanup_decode_session:
-#ifdef CONFIG_XFRM
-        RCU_INIT_POINTER(ip_nat_decode_session, NULL);
-        synchronize_net();
-#endif
-        return ret;
+static int __init iptable_nat_init(void)
+{
+        int err;
+
+        err = register_pernet_subsys(&iptable_nat_net_ops);
+        if (err < 0)
+                goto err1;
+
+        err = nf_register_hooks(nf_nat_ipv4_ops, ARRAY_SIZE(nf_nat_ipv4_ops));
+        if (err < 0)
+                goto err2;
+        return 0;
+
+err2:
+        unregister_pernet_subsys(&iptable_nat_net_ops);
+err1:
+        return err;
 }
 
-static void __exit nf_nat_standalone_fini(void)
+static void __exit iptable_nat_exit(void)
 {
-        nf_unregister_hooks(nf_nat_ops, ARRAY_SIZE(nf_nat_ops));
-        nf_nat_rule_cleanup();
-#ifdef CONFIG_XFRM
-        RCU_INIT_POINTER(ip_nat_decode_session, NULL);
-        synchronize_net();
-#endif
-        /* Conntrack caches are unregistered in nf_conntrack_cleanup */
+        nf_unregister_hooks(nf_nat_ipv4_ops, ARRAY_SIZE(nf_nat_ipv4_ops));
+        unregister_pernet_subsys(&iptable_nat_net_ops);
 }
 
-module_init(nf_nat_standalone_init);
-module_exit(nf_nat_standalone_fini);
+module_init(iptable_nat_init);
+module_exit(iptable_nat_exit);
 
 MODULE_LICENSE("GPL");
-MODULE_ALIAS("ip_nat");
diff --git a/net/ipv4/netfilter/iptable_raw.c b/net/ipv4/netfilter/iptable_raw.c
index 07fb710cd722..03d9696d3c6e 100644
--- a/net/ipv4/netfilter/iptable_raw.c
+++ b/net/ipv4/netfilter/iptable_raw.c
@@ -48,9 +48,7 @@ static int __net_init iptable_raw_net_init(struct net *net)
         net->ipv4.iptable_raw =
                 ipt_register_table(net, &packet_raw, repl);
         kfree(repl);
-        if (IS_ERR(net->ipv4.iptable_raw))
-                return PTR_ERR(net->ipv4.iptable_raw);
-        return 0;
+        return PTR_RET(net->ipv4.iptable_raw);
 }
 
 static void __net_exit iptable_raw_net_exit(struct net *net)
@@ -75,14 +73,10 @@ static int __init iptable_raw_init(void)
         rawtable_ops = xt_hook_link(&packet_raw, iptable_raw_hook);
         if (IS_ERR(rawtable_ops)) {
                 ret = PTR_ERR(rawtable_ops);
-                goto cleanup_table;
+                unregister_pernet_subsys(&iptable_raw_net_ops);
         }
 
         return ret;
-
- cleanup_table:
-        unregister_pernet_subsys(&iptable_raw_net_ops);
-        return ret;
 }
 
 static void __exit iptable_raw_fini(void)
diff --git a/net/ipv4/netfilter/iptable_security.c b/net/ipv4/netfilter/iptable_security.c
index be45bdc4c602..b283d8e2601a 100644
--- a/net/ipv4/netfilter/iptable_security.c
+++ b/net/ipv4/netfilter/iptable_security.c
@@ -66,10 +66,7 @@ static int __net_init iptable_security_net_init(struct net *net)
         net->ipv4.iptable_security =
                 ipt_register_table(net, &security_table, repl);
         kfree(repl);
-        if (IS_ERR(net->ipv4.iptable_security))
-                return PTR_ERR(net->ipv4.iptable_security);
-
-        return 0;
+        return PTR_RET(net->ipv4.iptable_security);
 }
 
 static void __net_exit iptable_security_net_exit(struct net *net)
diff --git a/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c b/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c
index e7ff2dcab6ce..fcdd0c2406e6 100644
--- a/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c
+++ b/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c
@@ -29,11 +29,6 @@
 #include <net/netfilter/ipv4/nf_defrag_ipv4.h>
 #include <net/netfilter/nf_log.h>
 
-int (*nf_nat_seq_adjust_hook)(struct sk_buff *skb,
-                              struct nf_conn *ct,
-                              enum ip_conntrack_info ctinfo);
-EXPORT_SYMBOL_GPL(nf_nat_seq_adjust_hook);
-
 static bool ipv4_pkt_to_tuple(const struct sk_buff *skb, unsigned int nhoff,
                               struct nf_conntrack_tuple *tuple)
 {
@@ -149,7 +144,8 @@ static unsigned int ipv4_confirm(unsigned int hooknum,
                 typeof(nf_nat_seq_adjust_hook) seq_adjust;
 
                 seq_adjust = rcu_dereference(nf_nat_seq_adjust_hook);
-                if (!seq_adjust || !seq_adjust(skb, ct, ctinfo)) {
+                if (!seq_adjust ||
+                    !seq_adjust(skb, ct, ctinfo, ip_hdrlen(skb))) {
                         NF_CT_STAT_INC_ATOMIC(nf_ct_net(ct), drop);
                         return NF_DROP;
                 }
diff --git a/net/ipv4/netfilter/nf_nat_h323.c b/net/ipv4/netfilter/nf_nat_h323.c
index c6784a18c1c4..9c3db10b22d3 100644
--- a/net/ipv4/netfilter/nf_nat_h323.c
+++ b/net/ipv4/netfilter/nf_nat_h323.c
@@ -15,13 +15,12 @@
 
 #include <net/netfilter/nf_nat.h>
 #include <net/netfilter/nf_nat_helper.h>
-#include <net/netfilter/nf_nat_rule.h>
 #include <net/netfilter/nf_conntrack_helper.h>
 #include <net/netfilter/nf_conntrack_expect.h>
 #include <linux/netfilter/nf_conntrack_h323.h>
 
 /****************************************************************************/
-static int set_addr(struct sk_buff *skb,
+static int set_addr(struct sk_buff *skb, unsigned int protoff,
                     unsigned char **data, int dataoff,
                     unsigned int addroff, __be32 ip, __be16 port)
 {
@@ -40,7 +39,7 @@ static int set_addr(struct sk_buff *skb,
 
         if (ip_hdr(skb)->protocol == IPPROTO_TCP) {
                 if (!nf_nat_mangle_tcp_packet(skb, ct, ctinfo,
-                                              addroff, sizeof(buf),
+                                              protoff, addroff, sizeof(buf),
                                               (char *) &buf, sizeof(buf))) {
                         net_notice_ratelimited("nf_nat_h323: nf_nat_mangle_tcp_packet error\n");
                         return -1;
@@ -54,7 +53,7 @@ static int set_addr(struct sk_buff *skb,
                 *data = skb->data + ip_hdrlen(skb) + th->doff * 4 + dataoff;
         } else {
                 if (!nf_nat_mangle_udp_packet(skb, ct, ctinfo,
-                                              addroff, sizeof(buf),
+                                              protoff, addroff, sizeof(buf),
                                               (char *) &buf, sizeof(buf))) {
                         net_notice_ratelimited("nf_nat_h323: nf_nat_mangle_udp_packet error\n");
                         return -1;
@@ -69,22 +68,22 @@ static int set_addr(struct sk_buff *skb,
 }
 
 /****************************************************************************/
-static int set_h225_addr(struct sk_buff *skb,
+static int set_h225_addr(struct sk_buff *skb, unsigned int protoff,
                          unsigned char **data, int dataoff,
                          TransportAddress *taddr,
                          union nf_inet_addr *addr, __be16 port)
 {
-        return set_addr(skb, data, dataoff, taddr->ipAddress.ip,
+        return set_addr(skb, protoff, data, dataoff, taddr->ipAddress.ip,
                         addr->ip, port);
 }
 
 /****************************************************************************/
-static int set_h245_addr(struct sk_buff *skb,
+static int set_h245_addr(struct sk_buff *skb, unsigned protoff,
                          unsigned char **data, int dataoff,
                          H245_TransportAddress *taddr,
                          union nf_inet_addr *addr, __be16 port)
 {
-        return set_addr(skb, data, dataoff,
+        return set_addr(skb, protoff, data, dataoff,
                         taddr->unicastAddress.iPAddress.network,
                         addr->ip, port);
 }
@@ -92,7 +91,7 @@ static int set_h245_addr(struct sk_buff *skb,
 /****************************************************************************/
 static int set_sig_addr(struct sk_buff *skb, struct nf_conn *ct,
                         enum ip_conntrack_info ctinfo,
-                        unsigned char **data,
+                        unsigned int protoff, unsigned char **data,
                         TransportAddress *taddr, int count)
 {
         const struct nf_ct_h323_master *info = nfct_help_data(ct);
@@ -118,7 +117,8 @@ static int set_sig_addr(struct sk_buff *skb, struct nf_conn *ct,
                                          &addr.ip, port,
                                          &ct->tuplehash[!dir].tuple.dst.u3.ip,
                                          info->sig_port[!dir]);
-                                return set_h225_addr(skb, data, 0, &taddr[i],
+                                return set_h225_addr(skb, protoff, data, 0,
+                                                     &taddr[i],
                                                      &ct->tuplehash[!dir].
                                                      tuple.dst.u3,
                                                      info->sig_port[!dir]);
@@ -129,7 +129,8 @@ static int set_sig_addr(struct sk_buff *skb, struct nf_conn *ct,
                                          &addr.ip, port,
                                          &ct->tuplehash[!dir].tuple.src.u3.ip,
                                          info->sig_port[!dir]);
-                                return set_h225_addr(skb, data, 0, &taddr[i],
+                                return set_h225_addr(skb, protoff, data, 0,
+                                                     &taddr[i],
                                                      &ct->tuplehash[!dir].
                                                      tuple.src.u3,
                                                      info->sig_port[!dir]);
@@ -143,7 +144,7 @@ static int set_sig_addr(struct sk_buff *skb, struct nf_conn *ct,
 /****************************************************************************/
 static int set_ras_addr(struct sk_buff *skb, struct nf_conn *ct,
                         enum ip_conntrack_info ctinfo,
-                        unsigned char **data,
+                        unsigned int protoff, unsigned char **data,
                         TransportAddress *taddr, int count)
 {
         int dir = CTINFO2DIR(ctinfo);
@@ -159,7 +160,7 @@ static int set_ras_addr(struct sk_buff *skb, struct nf_conn *ct,
                                  &addr.ip, ntohs(port),
                                  &ct->tuplehash[!dir].tuple.dst.u3.ip,
                                  ntohs(ct->tuplehash[!dir].tuple.dst.u.udp.port));
-                        return set_h225_addr(skb, data, 0, &taddr[i],
+                        return set_h225_addr(skb, protoff, data, 0, &taddr[i],
                                              &ct->tuplehash[!dir].tuple.dst.u3,
                                              ct->tuplehash[!dir].tuple.
                                                                 dst.u.udp.port);
@@ -172,7 +173,7 @@ static int set_ras_addr(struct sk_buff *skb, struct nf_conn *ct,
 /****************************************************************************/
 static int nat_rtp_rtcp(struct sk_buff *skb, struct nf_conn *ct,
                         enum ip_conntrack_info ctinfo,
-                        unsigned char **data, int dataoff,
+                        unsigned int protoff, unsigned char **data, int dataoff,
                         H245_TransportAddress *taddr,
                         __be16 port, __be16 rtp_port,
                         struct nf_conntrack_expect *rtp_exp,
@@ -244,7 +245,7 @@ static int nat_rtp_rtcp(struct sk_buff *skb, struct nf_conn *ct,
         }
 
         /* Modify signal */
-        if (set_h245_addr(skb, data, dataoff, taddr,
+        if (set_h245_addr(skb, protoff, data, dataoff, taddr,
                           &ct->tuplehash[!dir].tuple.dst.u3,
                           htons((port & htons(1)) ? nated_port + 1 :
                                                     nated_port)) == 0) {
@@ -275,7 +276,7 @@ static int nat_rtp_rtcp(struct sk_buff *skb, struct nf_conn *ct,
 /****************************************************************************/
 static int nat_t120(struct sk_buff *skb, struct nf_conn *ct,
                     enum ip_conntrack_info ctinfo,
-                    unsigned char **data, int dataoff,
+                    unsigned int protoff, unsigned char **data, int dataoff,
                     H245_TransportAddress *taddr, __be16 port,
                     struct nf_conntrack_expect *exp)
 {
@@ -307,7 +308,7 @@ static int nat_t120(struct sk_buff *skb, struct nf_conn *ct,
         }
 
         /* Modify signal */
-        if (set_h245_addr(skb, data, dataoff, taddr,
+        if (set_h245_addr(skb, protoff, data, dataoff, taddr,
                           &ct->tuplehash[!dir].tuple.dst.u3,
                           htons(nated_port)) < 0) {
                 nf_ct_unexpect_related(exp);
@@ -326,7 +327,7 @@ static int nat_t120(struct sk_buff *skb, struct nf_conn *ct,
 /****************************************************************************/
 static int nat_h245(struct sk_buff *skb, struct nf_conn *ct,
                     enum ip_conntrack_info ctinfo,
-                    unsigned char **data, int dataoff,
+                    unsigned int protoff, unsigned char **data, int dataoff,
                     TransportAddress *taddr, __be16 port,
                     struct nf_conntrack_expect *exp)
 {
@@ -363,7 +364,7 @@ static int nat_h245(struct sk_buff *skb, struct nf_conn *ct,
         }
 
         /* Modify signal */
-        if (set_h225_addr(skb, data, dataoff, taddr,
+        if (set_h225_addr(skb, protoff, data, dataoff, taddr,
                           &ct->tuplehash[!dir].tuple.dst.u3,
                           htons(nated_port)) == 0) {
                 /* Save ports */
@@ -390,7 +391,7 @@ static int nat_h245(struct sk_buff *skb, struct nf_conn *ct,
 static void ip_nat_q931_expect(struct nf_conn *new,
                                struct nf_conntrack_expect *this)
 {
-        struct nf_nat_ipv4_range range;
+        struct nf_nat_range range;
 
         if (this->tuple.src.u3.ip != 0) {       /* Only accept calls from GK */
                 nf_nat_follow_master(new, this);
@@ -402,21 +403,23 @@ static void ip_nat_q931_expect(struct nf_conn *new,
 
         /* Change src to where master sends to */
         range.flags = NF_NAT_RANGE_MAP_IPS;
-        range.min_ip = range.max_ip = new->tuplehash[!this->dir].tuple.src.u3.ip;
+        range.min_addr = range.max_addr =
+            new->tuplehash[!this->dir].tuple.src.u3;
         nf_nat_setup_info(new, &range, NF_NAT_MANIP_SRC);
 
         /* For DST manip, map port here to where it's expected. */
         range.flags = (NF_NAT_RANGE_MAP_IPS | NF_NAT_RANGE_PROTO_SPECIFIED);
-        range.min = range.max = this->saved_proto;
-        range.min_ip = range.max_ip =
-            new->master->tuplehash[!this->dir].tuple.src.u3.ip;
+        range.min_proto = range.max_proto = this->saved_proto;
+        range.min_addr = range.max_addr =
+            new->master->tuplehash[!this->dir].tuple.src.u3;
         nf_nat_setup_info(new, &range, NF_NAT_MANIP_DST);
 }
 
 /****************************************************************************/
 static int nat_q931(struct sk_buff *skb, struct nf_conn *ct,
                     enum ip_conntrack_info ctinfo,
-                    unsigned char **data, TransportAddress *taddr, int idx,
+                    unsigned int protoff, unsigned char **data,
+                    TransportAddress *taddr, int idx,
                     __be16 port, struct nf_conntrack_expect *exp)
 {
         struct nf_ct_h323_master *info = nfct_help_data(ct);
@@ -453,7 +456,7 @@ static int nat_q931(struct sk_buff *skb, struct nf_conn *ct,
         }
 
         /* Modify signal */
-        if (set_h225_addr(skb, data, 0, &taddr[idx],
+        if (set_h225_addr(skb, protoff, data, 0, &taddr[idx],
                           &ct->tuplehash[!dir].tuple.dst.u3,
                           htons(nated_port)) == 0) {
                 /* Save ports */
@@ -464,7 +467,7 @@ static int nat_q931(struct sk_buff *skb, struct nf_conn *ct,
                 if (idx > 0 &&
                     get_h225_addr(ct, *data, &taddr[0], &addr, &port) &&
                     (ntohl(addr.ip) & 0xff000000) == 0x7f000000) {
-                        set_h225_addr(skb, data, 0, &taddr[0],
+                        set_h225_addr(skb, protoff, data, 0, &taddr[0],
                                       &ct->tuplehash[!dir].tuple.dst.u3,
                                       info->sig_port[!dir]);
                 }
@@ -487,26 +490,28 @@ static int nat_q931(struct sk_buff *skb, struct nf_conn *ct,
 static void ip_nat_callforwarding_expect(struct nf_conn *new,
                                          struct nf_conntrack_expect *this)
 {
-        struct nf_nat_ipv4_range range;
+        struct nf_nat_range range;
 
         /* This must be a fresh one. */
         BUG_ON(new->status & IPS_NAT_DONE_MASK);
 
         /* Change src to where master sends to */
         range.flags = NF_NAT_RANGE_MAP_IPS;
-        range.min_ip = range.max_ip = new->tuplehash[!this->dir].tuple.src.u3.ip;
+        range.min_addr = range.max_addr =
+            new->tuplehash[!this->dir].tuple.src.u3;
         nf_nat_setup_info(new, &range, NF_NAT_MANIP_SRC);
 
         /* For DST manip, map port here to where it's expected. */
         range.flags = (NF_NAT_RANGE_MAP_IPS | NF_NAT_RANGE_PROTO_SPECIFIED);
-        range.min = range.max = this->saved_proto;
-        range.min_ip = range.max_ip = this->saved_ip;
+        range.min_proto = range.max_proto = this->saved_proto;
+        range.min_addr = range.max_addr = this->saved_addr;
         nf_nat_setup_info(new, &range, NF_NAT_MANIP_DST);
 }
 
 /****************************************************************************/
 static int nat_callforwarding(struct sk_buff *skb, struct nf_conn *ct,
                               enum ip_conntrack_info ctinfo,
+                              unsigned int protoff,
                               unsigned char **data, int dataoff,
                               TransportAddress *taddr, __be16 port,
                               struct nf_conntrack_expect *exp)
@@ -515,7 +520,7 @@ static int nat_callforwarding(struct sk_buff *skb, struct nf_conn *ct,
         u_int16_t nated_port;
 
         /* Set expectations for NAT */
-        exp->saved_ip = exp->tuple.dst.u3.ip;
+        exp->saved_addr = exp->tuple.dst.u3;
         exp->tuple.dst.u3.ip = ct->tuplehash[!dir].tuple.dst.u3.ip;
         exp->saved_proto.tcp.port = exp->tuple.dst.u.tcp.port;
         exp->expectfn = ip_nat_callforwarding_expect;
@@ -541,7 +546,7 @@ static int nat_callforwarding(struct sk_buff *skb, struct nf_conn *ct,
         }
 
         /* Modify signal */
-        if (!set_h225_addr(skb, data, dataoff, taddr,
+        if (!set_h225_addr(skb, protoff, data, dataoff, taddr,
                            &ct->tuplehash[!dir].tuple.dst.u3,
                            htons(nated_port)) == 0) {
                 nf_ct_unexpect_related(exp);
diff --git a/net/ipv4/netfilter/nf_nat_l3proto_ipv4.c b/net/ipv4/netfilter/nf_nat_l3proto_ipv4.c
new file mode 100644
index 000000000000..d8b2e14efddc
--- /dev/null
+++ b/net/ipv4/netfilter/nf_nat_l3proto_ipv4.c
@@ -0,0 +1,281 @@
+/*
+ * (C) 1999-2001 Paul `Rusty' Russell
+ * (C) 2002-2006 Netfilter Core Team <coreteam@netfilter.org>
+ * (C) 2011 Patrick McHardy <kaber@trash.net>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+
+#include <linux/types.h>
+#include <linux/module.h>
+#include <linux/skbuff.h>
+#include <linux/ip.h>
+#include <linux/icmp.h>
+#include <linux/netfilter.h>
+#include <linux/netfilter_ipv4.h>
+#include <net/secure_seq.h>
+#include <net/checksum.h>
+#include <net/route.h>
+#include <net/ip.h>
+
+#include <net/netfilter/nf_conntrack_core.h>
+#include <net/netfilter/nf_conntrack.h>
+#include <net/netfilter/nf_nat_core.h>
+#include <net/netfilter/nf_nat_l3proto.h>
+#include <net/netfilter/nf_nat_l4proto.h>
+
+static const struct nf_nat_l3proto nf_nat_l3proto_ipv4;
+
+#ifdef CONFIG_XFRM
+static void nf_nat_ipv4_decode_session(struct sk_buff *skb,
+                                       const struct nf_conn *ct,
+                                       enum ip_conntrack_dir dir,
+                                       unsigned long statusbit,
+                                       struct flowi *fl)
+{
+        const struct nf_conntrack_tuple *t = &ct->tuplehash[dir].tuple;
+        struct flowi4 *fl4 = &fl->u.ip4;
+
+        if (ct->status & statusbit) {
+                fl4->daddr = t->dst.u3.ip;
+                if (t->dst.protonum == IPPROTO_TCP ||
+                    t->dst.protonum == IPPROTO_UDP ||
+                    t->dst.protonum == IPPROTO_UDPLITE ||
+                    t->dst.protonum == IPPROTO_DCCP ||
+                    t->dst.protonum == IPPROTO_SCTP)
+                        fl4->fl4_dport = t->dst.u.all;
+        }
+
+        statusbit ^= IPS_NAT_MASK;
+
+        if (ct->status & statusbit) {
+                fl4->saddr = t->src.u3.ip;
+                if (t->dst.protonum == IPPROTO_TCP ||
+                    t->dst.protonum == IPPROTO_UDP ||
+                    t->dst.protonum == IPPROTO_UDPLITE ||
+                    t->dst.protonum == IPPROTO_DCCP ||
+                    t->dst.protonum == IPPROTO_SCTP)
+                        fl4->fl4_sport = t->src.u.all;
+        }
+}
+#endif /* CONFIG_XFRM */
+
+static bool nf_nat_ipv4_in_range(const struct nf_conntrack_tuple *t,
+                                 const struct nf_nat_range *range)
+{
+        return ntohl(t->src.u3.ip) >= ntohl(range->min_addr.ip) &&
+               ntohl(t->src.u3.ip) <= ntohl(range->max_addr.ip);
+}
+
+static u32 nf_nat_ipv4_secure_port(const struct nf_conntrack_tuple *t,
+                                   __be16 dport)
+{
+        return secure_ipv4_port_ephemeral(t->src.u3.ip, t->dst.u3.ip, dport);
+}
+
+static bool nf_nat_ipv4_manip_pkt(struct sk_buff *skb,
+                                  unsigned int iphdroff,
+                                  const struct nf_nat_l4proto *l4proto,
+                                  const struct nf_conntrack_tuple *target,
+                                  enum nf_nat_manip_type maniptype)
+{
+        struct iphdr *iph;
+        unsigned int hdroff;
+
+        if (!skb_make_writable(skb, iphdroff + sizeof(*iph)))
+                return false;
+
+        iph = (void *)skb->data + iphdroff;
+        hdroff = iphdroff + iph->ihl * 4;
+
+        if (!l4proto->manip_pkt(skb, &nf_nat_l3proto_ipv4, iphdroff, hdroff,
+                                target, maniptype))
+                return false;
+        iph = (void *)skb->data + iphdroff;
+
+        if (maniptype == NF_NAT_MANIP_SRC) {
+                csum_replace4(&iph->check, iph->saddr, target->src.u3.ip);
+                iph->saddr = target->src.u3.ip;
+        } else {
+                csum_replace4(&iph->check, iph->daddr, target->dst.u3.ip);
+                iph->daddr = target->dst.u3.ip;
+        }
+        return true;
+}
+
+static void nf_nat_ipv4_csum_update(struct sk_buff *skb,
+                                    unsigned int iphdroff, __sum16 *check,
+                                    const struct nf_conntrack_tuple *t,
+                                    enum nf_nat_manip_type maniptype)
+{
+        struct iphdr *iph = (struct iphdr *)(skb->data + iphdroff);
+        __be32 oldip, newip;
+
+        if (maniptype == NF_NAT_MANIP_SRC) {
+                oldip = iph->saddr;
+                newip = t->src.u3.ip;
+        } else {
+                oldip = iph->daddr;
+                newip = t->dst.u3.ip;
+        }
+        inet_proto_csum_replace4(check, skb, oldip, newip, 1);
+}
+
+static void nf_nat_ipv4_csum_recalc(struct sk_buff *skb,
+                                    u8 proto, void *data, __sum16 *check,
+                                    int datalen, int oldlen)
+{
+        const struct iphdr *iph = ip_hdr(skb);
+        struct rtable *rt = skb_rtable(skb);
+
+        if (skb->ip_summed != CHECKSUM_PARTIAL) {
+                if (!(rt->rt_flags & RTCF_LOCAL) &&
+                    (!skb->dev || skb->dev->features & NETIF_F_V4_CSUM)) {
+                        skb->ip_summed = CHECKSUM_PARTIAL;
+                        skb->csum_start = skb_headroom(skb) +
+                                          skb_network_offset(skb) +
+                                          ip_hdrlen(skb);
+                        skb->csum_offset = (void *)check - data;
+                        *check = ~csum_tcpudp_magic(iph->saddr, iph->daddr,
+                                                    datalen, proto, 0);
+                } else {
+                        *check = 0;
+                        *check = csum_tcpudp_magic(iph->saddr, iph->daddr,
+                                                   datalen, proto,
+                                                   csum_partial(data, datalen,
+                                                                0));
+                        if (proto == IPPROTO_UDP && !*check)
+                                *check = CSUM_MANGLED_0;
+                }
+        } else
+                inet_proto_csum_replace2(check, skb,
+                                         htons(oldlen), htons(datalen), 1);
+}
+
+static int nf_nat_ipv4_nlattr_to_range(struct nlattr *tb[],
+                                       struct nf_nat_range *range)
+{
+        if (tb[CTA_NAT_V4_MINIP]) {
+                range->min_addr.ip = nla_get_be32(tb[CTA_NAT_V4_MINIP]);
+                range->flags |= NF_NAT_RANGE_MAP_IPS;
+        }
+
+        if (tb[CTA_NAT_V4_MAXIP])
+                range->max_addr.ip = nla_get_be32(tb[CTA_NAT_V4_MAXIP]);
+        else
+                range->max_addr.ip = range->min_addr.ip;
+
+        return 0;
+}
+
+static const struct nf_nat_l3proto nf_nat_l3proto_ipv4 = {
+        .l3proto                = NFPROTO_IPV4,
+        .in_range               = nf_nat_ipv4_in_range,
+        .secure_port            = nf_nat_ipv4_secure_port,
+        .manip_pkt              = nf_nat_ipv4_manip_pkt,
+        .csum_update            = nf_nat_ipv4_csum_update,
+        .csum_recalc            = nf_nat_ipv4_csum_recalc,
+        .nlattr_to_range        = nf_nat_ipv4_nlattr_to_range,
+#ifdef CONFIG_XFRM
+        .decode_session         = nf_nat_ipv4_decode_session,
+#endif
+};
+
+int nf_nat_icmp_reply_translation(struct sk_buff *skb,
+                                  struct nf_conn *ct,
+                                  enum ip_conntrack_info ctinfo,
+                                  unsigned int hooknum)
+{
+        struct {
+                struct icmphdr  icmp;
+                struct iphdr    ip;
+        } *inside;
+        enum ip_conntrack_dir dir = CTINFO2DIR(ctinfo);
+        enum nf_nat_manip_type manip = HOOK2MANIP(hooknum);
+        unsigned int hdrlen = ip_hdrlen(skb);
+        const struct nf_nat_l4proto *l4proto;
+        struct nf_conntrack_tuple target;
+        unsigned long statusbit;
+
+        NF_CT_ASSERT(ctinfo == IP_CT_RELATED || ctinfo == IP_CT_RELATED_REPLY);
+
+        if (!skb_make_writable(skb, hdrlen + sizeof(*inside)))
+                return 0;
+        if (nf_ip_checksum(skb, hooknum, hdrlen, 0))
+                return 0;
+
+        inside = (void *)skb->data + hdrlen;
+        if (inside->icmp.type == ICMP_REDIRECT) {
+                if ((ct->status & IPS_NAT_DONE_MASK) != IPS_NAT_DONE_MASK)
+                        return 0;
+                if (ct->status & IPS_NAT_MASK)
+                        return 0;
+        }
+
+        if (manip == NF_NAT_MANIP_SRC)
+                statusbit = IPS_SRC_NAT;
+        else
+                statusbit = IPS_DST_NAT;
+
+        /* Invert if this is reply direction */
+        if (dir == IP_CT_DIR_REPLY)
+                statusbit ^= IPS_NAT_MASK;
+
+        if (!(ct->status & statusbit))
+                return 1;
+
+        l4proto = __nf_nat_l4proto_find(NFPROTO_IPV4, inside->ip.protocol);
+        if (!nf_nat_ipv4_manip_pkt(skb, hdrlen + sizeof(inside->icmp),
+                                   l4proto, &ct->tuplehash[!dir].tuple, !manip))
+                return 0;
+
+        if (skb->ip_summed != CHECKSUM_PARTIAL) {
+                /* Reloading "inside" here since manip_pkt may reallocate */
+                inside = (void *)skb->data + hdrlen;
+                inside->icmp.checksum = 0;
+                inside->icmp.checksum =
+                        csum_fold(skb_checksum(skb, hdrlen,
+                                               skb->len - hdrlen, 0));
+        }
+
+        /* Change outer to look like the reply to an incoming packet */
+        nf_ct_invert_tuplepr(&target, &ct->tuplehash[!dir].tuple);
+        l4proto = __nf_nat_l4proto_find(NFPROTO_IPV4, 0);
+        if (!nf_nat_ipv4_manip_pkt(skb, 0, l4proto, &target, manip))
+                return 0;
+
+        return 1;
+}
+EXPORT_SYMBOL_GPL(nf_nat_icmp_reply_translation);
+
+static int __init nf_nat_l3proto_ipv4_init(void)
+{
+        int err;
+
+        err = nf_nat_l4proto_register(NFPROTO_IPV4, &nf_nat_l4proto_icmp);
+        if (err < 0)
+                goto err1;
+        err = nf_nat_l3proto_register(&nf_nat_l3proto_ipv4);
+        if (err < 0)
+                goto err2;
+        return err;
+
+err2:
+        nf_nat_l4proto_unregister(NFPROTO_IPV4, &nf_nat_l4proto_icmp);
+err1:
+        return err;
+}
+
+static void __exit nf_nat_l3proto_ipv4_exit(void)
+{
+        nf_nat_l3proto_unregister(&nf_nat_l3proto_ipv4);
+        nf_nat_l4proto_unregister(NFPROTO_IPV4, &nf_nat_l4proto_icmp);
+}
+
+MODULE_LICENSE("GPL");
+MODULE_ALIAS("nf-nat-" __stringify(AF_INET));
+
+module_init(nf_nat_l3proto_ipv4_init);
+module_exit(nf_nat_l3proto_ipv4_exit);
diff --git a/net/ipv4/netfilter/nf_nat_pptp.c b/net/ipv4/netfilter/nf_nat_pptp.c
index 388140881ebe..a06d7d74817d 100644
--- a/net/ipv4/netfilter/nf_nat_pptp.c
+++ b/net/ipv4/netfilter/nf_nat_pptp.c
@@ -22,7 +22,6 @@
 
 #include <net/netfilter/nf_nat.h>
 #include <net/netfilter/nf_nat_helper.h>
-#include <net/netfilter/nf_nat_rule.h>
 #include <net/netfilter/nf_conntrack_helper.h>
 #include <net/netfilter/nf_conntrack_expect.h>
 #include <net/netfilter/nf_conntrack_zones.h>
@@ -47,7 +46,7 @@ static void pptp_nat_expected(struct nf_conn *ct,
         struct nf_conntrack_tuple t;
         const struct nf_ct_pptp_master *ct_pptp_info;
         const struct nf_nat_pptp *nat_pptp_info;
-        struct nf_nat_ipv4_range range;
+        struct nf_nat_range range;
 
         ct_pptp_info = nfct_help_data(master);
         nat_pptp_info = &nfct_nat(master)->help.nat_pptp_info;
@@ -89,21 +88,21 @@ static void pptp_nat_expected(struct nf_conn *ct,
 
         /* Change src to where master sends to */
         range.flags = NF_NAT_RANGE_MAP_IPS;
-        range.min_ip = range.max_ip
-                = ct->master->tuplehash[!exp->dir].tuple.dst.u3.ip;
+        range.min_addr = range.max_addr
+                = ct->master->tuplehash[!exp->dir].tuple.dst.u3;
         if (exp->dir == IP_CT_DIR_ORIGINAL) {
                 range.flags |= NF_NAT_RANGE_PROTO_SPECIFIED;
-                range.min = range.max = exp->saved_proto;
+                range.min_proto = range.max_proto = exp->saved_proto;
         }
         nf_nat_setup_info(ct, &range, NF_NAT_MANIP_SRC);
 
         /* For DST manip, map port here to where it's expected. */
         range.flags = NF_NAT_RANGE_MAP_IPS;
-        range.min_ip = range.max_ip
-                = ct->master->tuplehash[!exp->dir].tuple.src.u3.ip;
+        range.min_addr = range.max_addr
+                = ct->master->tuplehash[!exp->dir].tuple.src.u3;
         if (exp->dir == IP_CT_DIR_REPLY) {
                 range.flags |= NF_NAT_RANGE_PROTO_SPECIFIED;
-                range.min = range.max = exp->saved_proto;
+                range.min_proto = range.max_proto = exp->saved_proto;
         }
         nf_nat_setup_info(ct, &range, NF_NAT_MANIP_DST);
 }
@@ -113,6 +112,7 @@ static int
 pptp_outbound_pkt(struct sk_buff *skb,
                   struct nf_conn *ct,
                   enum ip_conntrack_info ctinfo,
+                  unsigned int protoff,
                   struct PptpControlHeader *ctlh,
                   union pptp_ctrl_union *pptpReq)
 
@@ -175,7 +175,7 @@ pptp_outbound_pkt(struct sk_buff *skb,
                  ntohs(REQ_CID(pptpReq, cid_off)), ntohs(new_callid));
 
         /* mangle packet */
-        if (nf_nat_mangle_tcp_packet(skb, ct, ctinfo,
+        if (nf_nat_mangle_tcp_packet(skb, ct, ctinfo, protoff,
                                      cid_off + sizeof(struct pptp_pkt_hdr) +
                                      sizeof(struct PptpControlHeader),
                                      sizeof(new_callid), (char *)&new_callid,
@@ -216,6 +216,7 @@ static int
 pptp_inbound_pkt(struct sk_buff *skb,
                  struct nf_conn *ct,
                  enum ip_conntrack_info ctinfo,
+                 unsigned int protoff,
                  struct PptpControlHeader *ctlh,
                  union pptp_ctrl_union *pptpReq)
 {
@@ -268,7 +269,7 @@ pptp_inbound_pkt(struct sk_buff *skb,
         pr_debug("altering peer call id from 0x%04x to 0x%04x\n",
                  ntohs(REQ_CID(pptpReq, pcid_off)), ntohs(new_pcid));
 
-        if (nf_nat_mangle_tcp_packet(skb, ct, ctinfo,
+        if (nf_nat_mangle_tcp_packet(skb, ct, ctinfo, protoff,
                                      pcid_off + sizeof(struct pptp_pkt_hdr) +
                                      sizeof(struct PptpControlHeader),
                                      sizeof(new_pcid), (char *)&new_pcid,
diff --git a/net/ipv4/netfilter/nf_nat_proto_gre.c b/net/ipv4/netfilter/nf_nat_proto_gre.c
index 46ba0b9ab985..ea44f02563b5 100644
--- a/net/ipv4/netfilter/nf_nat_proto_gre.c
+++ b/net/ipv4/netfilter/nf_nat_proto_gre.c
@@ -28,8 +28,7 @@
 #include <linux/ip.h>
 
 #include <net/netfilter/nf_nat.h>
-#include <net/netfilter/nf_nat_rule.h>
-#include <net/netfilter/nf_nat_protocol.h>
+#include <net/netfilter/nf_nat_l4proto.h>
 #include <linux/netfilter/nf_conntrack_proto_gre.h>
 
 MODULE_LICENSE("GPL");
@@ -38,8 +37,9 @@ MODULE_DESCRIPTION("Netfilter NAT protocol helper module for GRE");
 
 /* generate unique tuple ... */
 static void
-gre_unique_tuple(struct nf_conntrack_tuple *tuple,
-                 const struct nf_nat_ipv4_range *range,
+gre_unique_tuple(const struct nf_nat_l3proto *l3proto,
+                 struct nf_conntrack_tuple *tuple,
+                 const struct nf_nat_range *range,
                  enum nf_nat_manip_type maniptype,
                  const struct nf_conn *ct)
 {
@@ -62,8 +62,8 @@ gre_unique_tuple(struct nf_conntrack_tuple *tuple,
                 min = 1;
                 range_size = 0xffff;
         } else {
-                min = ntohs(range->min.gre.key);
-                range_size = ntohs(range->max.gre.key) - min + 1;
+                min = ntohs(range->min_proto.gre.key);
+                range_size = ntohs(range->max_proto.gre.key) - min + 1;
         }
 
         pr_debug("min = %u, range_size = %u\n", min, range_size);
@@ -80,14 +80,14 @@ gre_unique_tuple(struct nf_conntrack_tuple *tuple,
 
 /* manipulate a GRE packet according to maniptype */
 static bool
-gre_manip_pkt(struct sk_buff *skb, unsigned int iphdroff,
+gre_manip_pkt(struct sk_buff *skb,
+              const struct nf_nat_l3proto *l3proto,
+              unsigned int iphdroff, unsigned int hdroff,
               const struct nf_conntrack_tuple *tuple,
               enum nf_nat_manip_type maniptype)
 {
         const struct gre_hdr *greh;
         struct gre_hdr_pptp *pgreh;
-        const struct iphdr *iph = (struct iphdr *)(skb->data + iphdroff);
-        unsigned int hdroff = iphdroff + iph->ihl * 4;
 
         /* pgreh includes two optional 32bit fields which are not required
          * to be there.  That's where the magic '8' comes from */
@@ -117,24 +117,24 @@ gre_manip_pkt(struct sk_buff *skb, unsigned int iphdroff,
         return true;
 }
 
-static const struct nf_nat_protocol gre = {
-        .protonum               = IPPROTO_GRE,
+static const struct nf_nat_l4proto gre = {
+        .l4proto                = IPPROTO_GRE,
         .manip_pkt              = gre_manip_pkt,
-        .in_range               = nf_nat_proto_in_range,
+        .in_range               = nf_nat_l4proto_in_range,
         .unique_tuple           = gre_unique_tuple,
 #if defined(CONFIG_NF_CT_NETLINK) || defined(CONFIG_NF_CT_NETLINK_MODULE)
-        .nlattr_to_range        = nf_nat_proto_nlattr_to_range,
+        .nlattr_to_range        = nf_nat_l4proto_nlattr_to_range,
 #endif
 };
 
 static int __init nf_nat_proto_gre_init(void)
 {
-        return nf_nat_protocol_register(&gre);
+        return nf_nat_l4proto_register(NFPROTO_IPV4, &gre);
 }
 
 static void __exit nf_nat_proto_gre_fini(void)
 {
-        nf_nat_protocol_unregister(&gre);
+        nf_nat_l4proto_unregister(NFPROTO_IPV4, &gre);
 }
 
 module_init(nf_nat_proto_gre_init);
diff --git a/net/ipv4/netfilter/nf_nat_proto_icmp.c b/net/ipv4/netfilter/nf_nat_proto_icmp.c
index b35172851bae..eb303471bcf6 100644
--- a/net/ipv4/netfilter/nf_nat_proto_icmp.c
+++ b/net/ipv4/netfilter/nf_nat_proto_icmp.c
@@ -15,8 +15,7 @@
 #include <linux/netfilter.h>
 #include <net/netfilter/nf_nat.h>
 #include <net/netfilter/nf_nat_core.h>
-#include <net/netfilter/nf_nat_rule.h>
-#include <net/netfilter/nf_nat_protocol.h>
+#include <net/netfilter/nf_nat_l4proto.h>
 
 static bool
 icmp_in_range(const struct nf_conntrack_tuple *tuple,
@@ -29,8 +28,9 @@ icmp_in_range(const struct nf_conntrack_tuple *tuple,
 }
 
 static void
-icmp_unique_tuple(struct nf_conntrack_tuple *tuple,
-                  const struct nf_nat_ipv4_range *range,
+icmp_unique_tuple(const struct nf_nat_l3proto *l3proto,
+                  struct nf_conntrack_tuple *tuple,
+                  const struct nf_nat_range *range,
                   enum nf_nat_manip_type maniptype,
                   const struct nf_conn *ct)
 {
@@ -38,13 +38,14 @@ icmp_unique_tuple(struct nf_conntrack_tuple *tuple,
         unsigned int range_size;
         unsigned int i;
 
-        range_size = ntohs(range->max.icmp.id) - ntohs(range->min.icmp.id) + 1;
+        range_size = ntohs(range->max_proto.icmp.id) -
+                     ntohs(range->min_proto.icmp.id) + 1;
         /* If no range specified... */
         if (!(range->flags & NF_NAT_RANGE_PROTO_SPECIFIED))
                 range_size = 0xFFFF;
 
         for (i = 0; ; ++id) {
-                tuple->src.u.icmp.id = htons(ntohs(range->min.icmp.id) +
+                tuple->src.u.icmp.id = htons(ntohs(range->min_proto.icmp.id) +
                                              (id % range_size));
                 if (++i == range_size || !nf_nat_used_tuple(tuple, ct))
                         return;
@@ -54,13 +55,12 @@ icmp_unique_tuple(struct nf_conntrack_tuple *tuple,
 
 static bool
 icmp_manip_pkt(struct sk_buff *skb,
-               unsigned int iphdroff,
+               const struct nf_nat_l3proto *l3proto,
+               unsigned int iphdroff, unsigned int hdroff,
                const struct nf_conntrack_tuple *tuple,
                enum nf_nat_manip_type maniptype)
 {
-        const struct iphdr *iph = (struct iphdr *)(skb->data + iphdroff);
         struct icmphdr *hdr;
-        unsigned int hdroff = iphdroff + iph->ihl*4;
 
         if (!skb_make_writable(skb, hdroff + sizeof(*hdr)))
                 return false;
@@ -72,12 +72,12 @@ icmp_manip_pkt(struct sk_buff *skb,
         return true;
 }
 
-const struct nf_nat_protocol nf_nat_protocol_icmp = {
-        .protonum               = IPPROTO_ICMP,
+const struct nf_nat_l4proto nf_nat_l4proto_icmp = {
+        .l4proto                = IPPROTO_ICMP,
         .manip_pkt              = icmp_manip_pkt,
         .in_range               = icmp_in_range,
         .unique_tuple           = icmp_unique_tuple,
 #if defined(CONFIG_NF_CT_NETLINK) || defined(CONFIG_NF_CT_NETLINK_MODULE)
-        .nlattr_to_range        = nf_nat_proto_nlattr_to_range,
+        .nlattr_to_range        = nf_nat_l4proto_nlattr_to_range,
 #endif
 };
diff --git a/net/ipv4/netfilter/nf_nat_rule.c b/net/ipv4/netfilter/nf_nat_rule.c
deleted file mode 100644
index d2a9dc314e0e..000000000000
--- a/net/ipv4/netfilter/nf_nat_rule.c
+++ /dev/null
@@ -1,214 +0,0 @@
-/* (C) 1999-2001 Paul `Rusty' Russell
- * (C) 2002-2006 Netfilter Core Team <coreteam@netfilter.org>
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 2 as
- * published by the Free Software Foundation.
- */
-
-/* Everything about the rules for NAT. */
-#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
-#include <linux/types.h>
-#include <linux/ip.h>
-#include <linux/netfilter.h>
-#include <linux/netfilter_ipv4.h>
-#include <linux/module.h>
-#include <linux/kmod.h>
-#include <linux/skbuff.h>
-#include <linux/proc_fs.h>
-#include <linux/slab.h>
-#include <net/checksum.h>
-#include <net/route.h>
-#include <linux/bitops.h>
-
-#include <linux/netfilter_ipv4/ip_tables.h>
-#include <net/netfilter/nf_nat.h>
-#include <net/netfilter/nf_nat_core.h>
-#include <net/netfilter/nf_nat_rule.h>
-
-#define NAT_VALID_HOOKS ((1 << NF_INET_PRE_ROUTING) | \
-                         (1 << NF_INET_POST_ROUTING) | \
-                         (1 << NF_INET_LOCAL_OUT) | \
-                         (1 << NF_INET_LOCAL_IN))
-
-static const struct xt_table nat_table = {
-        .name           = "nat",
-        .valid_hooks    = NAT_VALID_HOOKS,
-        .me             = THIS_MODULE,
-        .af             = NFPROTO_IPV4,
-};
-
-/* Source NAT */
-static unsigned int
-ipt_snat_target(struct sk_buff *skb, const struct xt_action_param *par)
-{
-        struct nf_conn *ct;
-        enum ip_conntrack_info ctinfo;
-        const struct nf_nat_ipv4_multi_range_compat *mr = par->targinfo;
-
-        NF_CT_ASSERT(par->hooknum == NF_INET_POST_ROUTING ||
-                     par->hooknum == NF_INET_LOCAL_IN);
-
-        ct = nf_ct_get(skb, &ctinfo);
-
-        /* Connection must be valid and new. */
-        NF_CT_ASSERT(ct && (ctinfo == IP_CT_NEW || ctinfo == IP_CT_RELATED ||
-                            ctinfo == IP_CT_RELATED_REPLY));
-        NF_CT_ASSERT(par->out != NULL);
-
-        return nf_nat_setup_info(ct, &mr->range[0], NF_NAT_MANIP_SRC);
-}
-
-static unsigned int
-ipt_dnat_target(struct sk_buff *skb, const struct xt_action_param *par)
-{
-        struct nf_conn *ct;
-        enum ip_conntrack_info ctinfo;
-        const struct nf_nat_ipv4_multi_range_compat *mr = par->targinfo;
-
-        NF_CT_ASSERT(par->hooknum == NF_INET_PRE_ROUTING ||
-                     par->hooknum == NF_INET_LOCAL_OUT);
-
-        ct = nf_ct_get(skb, &ctinfo);
-
-        /* Connection must be valid and new. */
-        NF_CT_ASSERT(ct && (ctinfo == IP_CT_NEW || ctinfo == IP_CT_RELATED));
-
-        return nf_nat_setup_info(ct, &mr->range[0], NF_NAT_MANIP_DST);
-}
-
-static int ipt_snat_checkentry(const struct xt_tgchk_param *par)
-{
-        const struct nf_nat_ipv4_multi_range_compat *mr = par->targinfo;
-
-        /* Must be a valid range */
-        if (mr->rangesize != 1) {
-                pr_info("SNAT: multiple ranges no longer supported\n");
-                return -EINVAL;
-        }
-        return 0;
-}
-
-static int ipt_dnat_checkentry(const struct xt_tgchk_param *par)
-{
-        const struct nf_nat_ipv4_multi_range_compat *mr = par->targinfo;
-
-        /* Must be a valid range */
-        if (mr->rangesize != 1) {
-                pr_info("DNAT: multiple ranges no longer supported\n");
-                return -EINVAL;
-        }
-        return 0;
-}
-
-static unsigned int
-alloc_null_binding(struct nf_conn *ct, unsigned int hooknum)
-{
-        /* Force range to this IP; let proto decide mapping for
-           per-proto parts (hence not NF_NAT_RANGE_PROTO_SPECIFIED).
-        */
-        struct nf_nat_ipv4_range range;
-
-        range.flags = 0;
-        pr_debug("Allocating NULL binding for %p (%pI4)\n", ct,
-                 HOOK2MANIP(hooknum) == NF_NAT_MANIP_SRC ?
-                 &ct->tuplehash[IP_CT_DIR_REPLY].tuple.dst.u3.ip :
-                 &ct->tuplehash[IP_CT_DIR_REPLY].tuple.src.u3.ip);
-
-        return nf_nat_setup_info(ct, &range, HOOK2MANIP(hooknum));
-}
-
-int nf_nat_rule_find(struct sk_buff *skb,
-                     unsigned int hooknum,
-                     const struct net_device *in,
-                     const struct net_device *out,
-                     struct nf_conn *ct)
-{
-        struct net *net = nf_ct_net(ct);
-        int ret;
-
-        ret = ipt_do_table(skb, hooknum, in, out, net->ipv4.nat_table);
-
-        if (ret == NF_ACCEPT) {
-                if (!nf_nat_initialized(ct, HOOK2MANIP(hooknum)))
-                        /* NUL mapping */
-                        ret = alloc_null_binding(ct, hooknum);
-        }
-        return ret;
-}
-
-static struct xt_target ipt_snat_reg __read_mostly = {
-        .name           = "SNAT",
-        .target         = ipt_snat_target,
-        .targetsize     = sizeof(struct nf_nat_ipv4_multi_range_compat),
-        .table          = "nat",
-        .hooks          = (1 << NF_INET_POST_ROUTING) | (1 << NF_INET_LOCAL_IN),
-        .checkentry     = ipt_snat_checkentry,
-        .family         = AF_INET,
-};
-
-static struct xt_target ipt_dnat_reg __read_mostly = {
-        .name           = "DNAT",
-        .target         = ipt_dnat_target,
-        .targetsize     = sizeof(struct nf_nat_ipv4_multi_range_compat),
-        .table          = "nat",
-        .hooks          = (1 << NF_INET_PRE_ROUTING) | (1 << NF_INET_LOCAL_OUT),
-        .checkentry     = ipt_dnat_checkentry,
-        .family         = AF_INET,
-};
-
-static int __net_init nf_nat_rule_net_init(struct net *net)
-{
-        struct ipt_replace *repl;
-
-        repl = ipt_alloc_initial_table(&nat_table);
-        if (repl == NULL)
-                return -ENOMEM;
-        net->ipv4.nat_table = ipt_register_table(net, &nat_table, repl);
-        kfree(repl);
-        if (IS_ERR(net->ipv4.nat_table))
-                return PTR_ERR(net->ipv4.nat_table);
-        return 0;
-}
-
-static void __net_exit nf_nat_rule_net_exit(struct net *net)
-{
-        ipt_unregister_table(net, net->ipv4.nat_table);
-}
-
-static struct pernet_operations nf_nat_rule_net_ops = {
-        .init = nf_nat_rule_net_init,
-        .exit = nf_nat_rule_net_exit,
-};
-
-int __init nf_nat_rule_init(void)
-{
-        int ret;
-
-        ret = register_pernet_subsys(&nf_nat_rule_net_ops);
-        if (ret != 0)
-                goto out;
-        ret = xt_register_target(&ipt_snat_reg);
-        if (ret != 0)
-                goto unregister_table;
-
-        ret = xt_register_target(&ipt_dnat_reg);
-        if (ret != 0)
-                goto unregister_snat;
-
-        return ret;
-
- unregister_snat:
-        xt_unregister_target(&ipt_snat_reg);
- unregister_table:
-        unregister_pernet_subsys(&nf_nat_rule_net_ops);
- out:
-        return ret;
-}
-
-void nf_nat_rule_cleanup(void)
-{
-        xt_unregister_target(&ipt_dnat_reg);
-        xt_unregister_target(&ipt_snat_reg);
-        unregister_pernet_subsys(&nf_nat_rule_net_ops);
-}
diff --git a/net/ipv4/ping.c b/net/ipv4/ping.c
index 6232d476f37e..8f3d05424a3e 100644
--- a/net/ipv4/ping.c
+++ b/net/ipv4/ping.c
@@ -185,10 +185,10 @@ exit:
         return sk;
 }
 
-static void inet_get_ping_group_range_net(struct net *net, gid_t *low,
-                                          gid_t *high)
+static void inet_get_ping_group_range_net(struct net *net, kgid_t *low,
+                                          kgid_t *high)
 {
-        gid_t *data = net->ipv4.sysctl_ping_group_range;
+        kgid_t *data = net->ipv4.sysctl_ping_group_range;
         unsigned int seq;
 
         do {
@@ -203,19 +203,13 @@ static void inet_get_ping_group_range_net(struct net *net, gid_t *low,
 static int ping_init_sock(struct sock *sk)
 {
         struct net *net = sock_net(sk);
-        gid_t group = current_egid();
-        gid_t range[2];
+        kgid_t group = current_egid();
         struct group_info *group_info = get_current_groups();
         int i, j, count = group_info->ngroups;
         kgid_t low, high;
 
-        inet_get_ping_group_range_net(net, range, range+1);
-        low = make_kgid(&init_user_ns, range[0]);
-        high = make_kgid(&init_user_ns, range[1]);
-        if (!gid_valid(low) || !gid_valid(high) || gid_lt(high, low))
-                return -EACCES;
-
-        if (range[0] <= group && group <= range[1])
+        inet_get_ping_group_range_net(net, &low, &high);
+        if (gid_lte(low, group) && gid_lte(group, high))
                 return 0;
 
         for (i = 0; i < group_info->nblocks; i++) {
@@ -845,7 +839,9 @@ static void ping_format_sock(struct sock *sp, struct seq_file *f,
                 bucket, src, srcp, dest, destp, sp->sk_state,
                 sk_wmem_alloc_get(sp),
                 sk_rmem_alloc_get(sp),
-                0, 0L, 0, sock_i_uid(sp), 0, sock_i_ino(sp),
+                0, 0L, 0,
+                from_kuid_munged(seq_user_ns(f), sock_i_uid(sp)),
+                0, sock_i_ino(sp),
                 atomic_read(&sp->sk_refcnt), sp,
                 atomic_read(&sp->sk_drops), len);
 }
diff --git a/net/ipv4/proc.c b/net/ipv4/proc.c
index 957acd12250b..8de53e1ddd54 100644
--- a/net/ipv4/proc.c
+++ b/net/ipv4/proc.c
@@ -263,6 +263,10 @@ static const struct snmp_mib snmp4_net_list[] = {
         SNMP_MIB_ITEM("TCPChallengeACK", LINUX_MIB_TCPCHALLENGEACK),
         SNMP_MIB_ITEM("TCPSYNChallenge", LINUX_MIB_TCPSYNCHALLENGE),
         SNMP_MIB_ITEM("TCPFastOpenActive", LINUX_MIB_TCPFASTOPENACTIVE),
+        SNMP_MIB_ITEM("TCPFastOpenPassive", LINUX_MIB_TCPFASTOPENPASSIVE),
+        SNMP_MIB_ITEM("TCPFastOpenPassiveFail", LINUX_MIB_TCPFASTOPENPASSIVEFAIL),
+        SNMP_MIB_ITEM("TCPFastOpenListenOverflow", LINUX_MIB_TCPFASTOPENLISTENOVERFLOW),
+        SNMP_MIB_ITEM("TCPFastOpenCookieReqd", LINUX_MIB_TCPFASTOPENCOOKIEREQD),
         SNMP_MIB_SENTINEL
 };
 
diff --git a/net/ipv4/raw.c b/net/ipv4/raw.c
index ff0f071969ea..f2425785d40a 100644
--- a/net/ipv4/raw.c
+++ b/net/ipv4/raw.c
@@ -992,7 +992,9 @@ static void raw_sock_seq_show(struct seq_file *seq, struct sock *sp, int i)
                 i, src, srcp, dest, destp, sp->sk_state,
                 sk_wmem_alloc_get(sp),
                 sk_rmem_alloc_get(sp),
-                0, 0L, 0, sock_i_uid(sp), 0, sock_i_ino(sp),
+                0, 0L, 0,
+                from_kuid_munged(seq_user_ns(seq), sock_i_uid(sp)),
+                0, sock_i_ino(sp),
                 atomic_read(&sp->sk_refcnt), sp, atomic_read(&sp->sk_drops));
 }
 
diff --git a/net/ipv4/route.c b/net/ipv4/route.c
index c035251beb07..dc9549b5eb1c 100644
--- a/net/ipv4/route.c
+++ b/net/ipv4/route.c
@@ -70,7 +70,6 @@
 #include <linux/types.h>
 #include <linux/kernel.h>
 #include <linux/mm.h>
-#include <linux/bootmem.h>
 #include <linux/string.h>
 #include <linux/socket.h>
 #include <linux/sockios.h>
@@ -80,7 +79,6 @@
 #include <linux/netdevice.h>
 #include <linux/proc_fs.h>
 #include <linux/init.h>
-#include <linux/workqueue.h>
 #include <linux/skbuff.h>
 #include <linux/inetdevice.h>
 #include <linux/igmp.h>
@@ -88,11 +86,9 @@
 #include <linux/mroute.h>
 #include <linux/netfilter_ipv4.h>
 #include <linux/random.h>
-#include <linux/jhash.h>
 #include <linux/rcupdate.h>
 #include <linux/times.h>
 #include <linux/slab.h>
-#include <linux/prefetch.h>
 #include <net/dst.h>
 #include <net/net_namespace.h>
 #include <net/protocol.h>
@@ -938,12 +934,14 @@ static u32 __ip_rt_update_pmtu(struct rtable *rt, struct flowi4 *fl4, u32 mtu)
         if (mtu < ip_rt_min_pmtu)
                 mtu = ip_rt_min_pmtu;
 
+        rcu_read_lock();
         if (fib_lookup(dev_net(rt->dst.dev), fl4, &res) == 0) {
                 struct fib_nh *nh = &FIB_RES_NH(res);
 
                 update_or_create_fnhe(nh, fl4->daddr, 0, mtu,
                                       jiffies + ip_rt_mtu_expires);
         }
+        rcu_read_unlock();
         return mtu;
 }
 
@@ -960,7 +958,7 @@ static void ip_rt_update_pmtu(struct dst_entry *dst, struct sock *sk,
                 dst->obsolete = DST_OBSOLETE_KILL;
         } else {
                 rt->rt_pmtu = mtu;
-                dst_set_expires(&rt->dst, ip_rt_mtu_expires);
+                rt->dst.expires = max(1UL, jiffies + ip_rt_mtu_expires);
         }
 }
 
@@ -1136,10 +1134,7 @@ static unsigned int ipv4_mtu(const struct dst_entry *dst)
         const struct rtable *rt = (const struct rtable *) dst;
         unsigned int mtu = rt->rt_pmtu;
 
-        if (mtu && time_after_eq(jiffies, rt->dst.expires))
-                mtu = 0;
-
-        if (!mtu)
+        if (!mtu || time_after_eq(jiffies, rt->dst.expires))
                 mtu = dst_metric_raw(dst, RTAX_MTU);
 
         if (mtu && rt_is_output_route(rt))
@@ -1267,7 +1262,7 @@ static void ipv4_dst_destroy(struct dst_entry *dst)
 {
         struct rtable *rt = (struct rtable *) dst;
 
-        if (dst->flags & DST_NOCACHE) {
+        if (!list_empty(&rt->rt_uncached)) {
                 spin_lock_bh(&rt_uncached_lock);
                 list_del(&rt->rt_uncached);
                 spin_unlock_bh(&rt_uncached_lock);
@@ -1591,11 +1586,14 @@ static int ip_route_input_slow(struct sk_buff *skb, __be32 daddr, __be32 saddr,
         if (ipv4_is_zeronet(daddr))
                 goto martian_destination;
 
-        if (likely(!IN_DEV_ROUTE_LOCALNET(in_dev))) {
-                if (ipv4_is_loopback(daddr))
+        /* Following code try to avoid calling IN_DEV_NET_ROUTE_LOCALNET(),
+         * and call it once if daddr or/and saddr are loopback addresses
+         */
+        if (ipv4_is_loopback(daddr)) {
+                if (!IN_DEV_NET_ROUTE_LOCALNET(in_dev, net))
                         goto martian_destination;
-
-                if (ipv4_is_loopback(saddr))
+        } else if (ipv4_is_loopback(saddr)) {
+                if (!IN_DEV_NET_ROUTE_LOCALNET(in_dev, net))
                         goto martian_source;
         }
 
@@ -1620,7 +1618,7 @@ static int ip_route_input_slow(struct sk_buff *skb, __be32 daddr, __be32 saddr,
 
         if (res.type == RTN_LOCAL) {
                 err = fib_validate_source(skb, saddr, daddr, tos,
-                                          net->loopback_dev->ifindex,
+                                          LOOPBACK_IFINDEX,
                                           dev, in_dev, &itag);
                 if (err < 0)
                         goto martian_source_keep_err;
@@ -1896,7 +1894,7 @@ struct rtable *__ip_route_output_key(struct net *net, struct flowi4 *fl4)
 
         orig_oif = fl4->flowi4_oif;
 
-        fl4->flowi4_iif = net->loopback_dev->ifindex;
+        fl4->flowi4_iif = LOOPBACK_IFINDEX;
         fl4->flowi4_tos = tos & IPTOS_RT_MASK;
         fl4->flowi4_scope = ((tos & RTO_ONLINK) ?
                          RT_SCOPE_LINK : RT_SCOPE_UNIVERSE);
@@ -1985,7 +1983,7 @@ struct rtable *__ip_route_output_key(struct net *net, struct flowi4 *fl4)
                 if (!fl4->daddr)
                         fl4->daddr = fl4->saddr = htonl(INADDR_LOOPBACK);
                 dev_out = net->loopback_dev;
-                fl4->flowi4_oif = net->loopback_dev->ifindex;
+                fl4->flowi4_oif = LOOPBACK_IFINDEX;
                 res.type = RTN_LOCAL;
                 flags |= RTCF_LOCAL;
                 goto make_route;
@@ -2032,7 +2030,6 @@ struct rtable *__ip_route_output_key(struct net *net, struct flowi4 *fl4)
                 }
                 dev_out = net->loopback_dev;
                 fl4->flowi4_oif = dev_out->ifindex;
-                res.fi = NULL;
                 flags |= RTCF_LOCAL;
                 goto make_route;
         }
diff --git a/net/ipv4/syncookies.c b/net/ipv4/syncookies.c
index 650e1528e1e6..ba48e799b031 100644
--- a/net/ipv4/syncookies.c
+++ b/net/ipv4/syncookies.c
@@ -319,6 +319,7 @@ struct sock *cookie_v4_check(struct sock *sk, struct sk_buff *skb,
         ireq->tstamp_ok         = tcp_opt.saw_tstamp;
         req->ts_recent          = tcp_opt.saw_tstamp ? tcp_opt.rcv_tsval : 0;
         treq->snt_synack        = tcp_opt.saw_tstamp ? tcp_opt.rcv_tsecr : 0;
+        treq->listener          = NULL;
 
         /* We throwed the options of the initial SYN away, so we hope
          * the ACK carries the same options again (see RFC1122 4.2.3.8)
diff --git a/net/ipv4/sysctl_net_ipv4.c b/net/ipv4/sysctl_net_ipv4.c
index 1b5ce96707a3..9205e492dc9d 100644
--- a/net/ipv4/sysctl_net_ipv4.c
+++ b/net/ipv4/sysctl_net_ipv4.c
@@ -76,9 +76,9 @@ static int ipv4_local_port_range(ctl_table *table, int write,
 }
 
 
-static void inet_get_ping_group_range_table(struct ctl_table *table, gid_t *low, gid_t *high)
+static void inet_get_ping_group_range_table(struct ctl_table *table, kgid_t *low, kgid_t *high)
 {
-        gid_t *data = table->data;
+        kgid_t *data = table->data;
         unsigned int seq;
         do {
                 seq = read_seqbegin(&sysctl_local_ports.lock);
@@ -89,12 +89,12 @@ static void inet_get_ping_group_range_table(struct ctl_table *table, gid_t *low,
 }
 
 /* Update system visible IP port range */
-static void set_ping_group_range(struct ctl_table *table, gid_t range[2])
+static void set_ping_group_range(struct ctl_table *table, kgid_t low, kgid_t high)
 {
-        gid_t *data = table->data;
+        kgid_t *data = table->data;
         write_seqlock(&sysctl_local_ports.lock);
-        data[0] = range[0];
-        data[1] = range[1];
+        data[0] = low;
+        data[1] = high;
         write_sequnlock(&sysctl_local_ports.lock);
 }
 
@@ -103,21 +103,33 @@ static int ipv4_ping_group_range(ctl_table *table, int write,
                                  void __user *buffer,
                                  size_t *lenp, loff_t *ppos)
 {
+        struct user_namespace *user_ns = current_user_ns();
         int ret;
-        gid_t range[2];
+        gid_t urange[2];
+        kgid_t low, high;
         ctl_table tmp = {
-                .data = &range,
-                .maxlen = sizeof(range),
+                .data = &urange,
+                .maxlen = sizeof(urange),
                 .mode = table->mode,
                 .extra1 = &ip_ping_group_range_min,
                 .extra2 = &ip_ping_group_range_max,
         };
 
-        inet_get_ping_group_range_table(table, range, range + 1);
+        inet_get_ping_group_range_table(table, &low, &high);
+        urange[0] = from_kgid_munged(user_ns, low);
+        urange[1] = from_kgid_munged(user_ns, high);
         ret = proc_dointvec_minmax(&tmp, write, buffer, lenp, ppos);
 
-        if (write && ret == 0)
-                set_ping_group_range(table, range);
+        if (write && ret == 0) {
+                low = make_kgid(user_ns, urange[0]);
+                high = make_kgid(user_ns, urange[1]);
+                if (!gid_valid(low) || !gid_valid(high) ||
+                    (urange[1] < urange[0]) || gid_lt(high, low)) {
+                        low = make_kgid(&init_user_ns, 1);
+                        high = make_kgid(&init_user_ns, 0);
+                }
+                set_ping_group_range(table, low, high);
+        }
 
         return ret;
 }
@@ -220,6 +232,45 @@ static int ipv4_tcp_mem(ctl_table *ctl, int write,
         return 0;
 }
 
+int proc_tcp_fastopen_key(ctl_table *ctl, int write, void __user *buffer,
+                          size_t *lenp, loff_t *ppos)
+{
+        ctl_table tbl = { .maxlen = (TCP_FASTOPEN_KEY_LENGTH * 2 + 10) };
+        struct tcp_fastopen_context *ctxt;
+        int ret;
+        u32  user_key[4]; /* 16 bytes, matching TCP_FASTOPEN_KEY_LENGTH */
+
+        tbl.data = kmalloc(tbl.maxlen, GFP_KERNEL);
+        if (!tbl.data)
+                return -ENOMEM;
+
+        rcu_read_lock();
+        ctxt = rcu_dereference(tcp_fastopen_ctx);
+        if (ctxt)
+                memcpy(user_key, ctxt->key, TCP_FASTOPEN_KEY_LENGTH);
+        rcu_read_unlock();
+
+        snprintf(tbl.data, tbl.maxlen, "%08x-%08x-%08x-%08x",
+                user_key[0], user_key[1], user_key[2], user_key[3]);
+        ret = proc_dostring(&tbl, write, buffer, lenp, ppos);
+
+        if (write && ret == 0) {
+                if (sscanf(tbl.data, "%x-%x-%x-%x", user_key, user_key + 1,
+                           user_key + 2, user_key + 3) != 4) {
+                        ret = -EINVAL;
+                        goto bad_key;
+                }
+                tcp_fastopen_reset_cipher(user_key, TCP_FASTOPEN_KEY_LENGTH);
+        }
+
+bad_key:
+        pr_debug("proc FO key set 0x%x-%x-%x-%x <- 0x%s: %u\n",
+               user_key[0], user_key[1], user_key[2], user_key[3],
+               (char *)tbl.data, ret);
+        kfree(tbl.data);
+        return ret;
+}
+
 static struct ctl_table ipv4_table[] = {
         {
                 .procname       = "tcp_timestamps",
@@ -374,6 +425,12 @@ static struct ctl_table ipv4_table[] = {
                 .proc_handler   = proc_dointvec,
         },
         {
+                .procname       = "tcp_fastopen_key",
+                .mode           = 0600,
+                .maxlen         = ((TCP_FASTOPEN_KEY_LENGTH * 2) + 10),
+                .proc_handler   = proc_tcp_fastopen_key,
+        },
+        {
                 .procname       = "tcp_tw_recycle",
                 .data           = &tcp_death_row.sysctl_tw_recycle,
                 .maxlen         = sizeof(int),
@@ -786,7 +843,7 @@ static struct ctl_table ipv4_net_table[] = {
         {
                 .procname       = "ping_group_range",
                 .data           = &init_net.ipv4.sysctl_ping_group_range,
-                .maxlen         = sizeof(init_net.ipv4.sysctl_ping_group_range),
+                .maxlen         = sizeof(gid_t)*2,
                 .mode           = 0644,
                 .proc_handler   = ipv4_ping_group_range,
         },
@@ -830,8 +887,8 @@ static __net_init int ipv4_sysctl_init_net(struct net *net)
          * Sane defaults - nobody may create ping sockets.
          * Boot scripts should set this to distro-specific group.
          */
-        net->ipv4.sysctl_ping_group_range[0] = 1;
-        net->ipv4.sysctl_ping_group_range[1] = 0;
+        net->ipv4.sysctl_ping_group_range[0] = make_kgid(&init_user_ns, 1);
+        net->ipv4.sysctl_ping_group_range[1] = make_kgid(&init_user_ns, 0);
 
         tcp_init_mem(net);
 
diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
index e7e6eeae49c0..df83d744e380 100644
--- a/net/ipv4/tcp.c
+++ b/net/ipv4/tcp.c
@@ -486,8 +486,9 @@ unsigned int tcp_poll(struct file *file, struct socket *sock, poll_table *wait)
         if (sk->sk_shutdown & RCV_SHUTDOWN)
                 mask |= POLLIN | POLLRDNORM | POLLRDHUP;
 
-        /* Connected? */
-        if ((1 << sk->sk_state) & ~(TCPF_SYN_SENT | TCPF_SYN_RECV)) {
+        /* Connected or passive Fast Open socket? */
+        if (sk->sk_state != TCP_SYN_SENT &&
+            (sk->sk_state != TCP_SYN_RECV || tp->fastopen_rsk != NULL)) {
                 int target = sock_rcvlowat(sk, 0, INT_MAX);
 
                 if (tp->urg_seq == tp->copied_seq &&
@@ -811,7 +812,9 @@ static unsigned int tcp_xmit_size_goal(struct sock *sk, u32 mss_now,
                            old_size_goal + mss_now > xmit_size_goal)) {
                         xmit_size_goal = old_size_goal;
                 } else {
-                        tp->xmit_size_goal_segs = xmit_size_goal / mss_now;
+                        tp->xmit_size_goal_segs =
+                                min_t(u16, xmit_size_goal / mss_now,
+                                      sk->sk_gso_max_segs);
                         xmit_size_goal = tp->xmit_size_goal_segs * mss_now;
                 }
         }
@@ -838,10 +841,15 @@ static ssize_t do_tcp_sendpages(struct sock *sk, struct page **pages, int poffse
         ssize_t copied;
         long timeo = sock_sndtimeo(sk, flags & MSG_DONTWAIT);
 
-        /* Wait for a connection to finish. */
-        if ((1 << sk->sk_state) & ~(TCPF_ESTABLISHED | TCPF_CLOSE_WAIT))
+        /* Wait for a connection to finish. One exception is TCP Fast Open
+         * (passive side) where data is allowed to be sent before a connection
+         * is fully established.
+         */
+        if (((1 << sk->sk_state) & ~(TCPF_ESTABLISHED | TCPF_CLOSE_WAIT)) &&
+            !tcp_passive_fastopen(sk)) {
                 if ((err = sk_stream_wait_connect(sk, &timeo)) != 0)
                         goto out_err;
+        }
 
         clear_bit(SOCK_ASYNC_NOSPACE, &sk->sk_socket->flags);
 
@@ -1040,10 +1048,15 @@ int tcp_sendmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
 
         timeo = sock_sndtimeo(sk, flags & MSG_DONTWAIT);
 
-        /* Wait for a connection to finish. */
-        if ((1 << sk->sk_state) & ~(TCPF_ESTABLISHED | TCPF_CLOSE_WAIT))
+        /* Wait for a connection to finish. One exception is TCP Fast Open
+         * (passive side) where data is allowed to be sent before a connection
+         * is fully established.
+         */
+        if (((1 << sk->sk_state) & ~(TCPF_ESTABLISHED | TCPF_CLOSE_WAIT)) &&
+            !tcp_passive_fastopen(sk)) {
                 if ((err = sk_stream_wait_connect(sk, &timeo)) != 0)
                         goto do_error;
+        }
 
         if (unlikely(tp->repair)) {
                 if (tp->repair_queue == TCP_RECV_QUEUE) {
@@ -2142,6 +2155,10 @@ void tcp_close(struct sock *sk, long timeout)
                  * they look as CLOSING or LAST_ACK for Linux)
                  * Probably, I missed some more holelets.
                  *                                              --ANK
+                 * XXX (TFO) - To start off we don't support SYN+ACK+FIN
+                 * in a single packet! (May consider it later but will
+                 * probably need API support or TCP_CORK SYN-ACK until
+                 * data is written and socket is closed.)
                  */
                 tcp_send_fin(sk);
         }
@@ -2213,8 +2230,16 @@ adjudge_to_death:
                 }
         }
 
-        if (sk->sk_state == TCP_CLOSE)
+        if (sk->sk_state == TCP_CLOSE) {
+                struct request_sock *req = tcp_sk(sk)->fastopen_rsk;
+                /* We could get here with a non-NULL req if the socket is
+                 * aborted (e.g., closed with unread data) before 3WHS
+                 * finishes.
+                 */
+                if (req != NULL)
+                        reqsk_fastopen_remove(sk, req, false);
                 inet_csk_destroy_sock(sk);
+        }
         /* Otherwise, socket is reprieved until protocol close. */
 
 out:
@@ -2686,6 +2711,14 @@ static int do_tcp_setsockopt(struct sock *sk, int level,
                 else
                         icsk->icsk_user_timeout = msecs_to_jiffies(val);
                 break;
+
+        case TCP_FASTOPEN:
+                if (val >= 0 && ((1 << sk->sk_state) & (TCPF_CLOSE |
+                    TCPF_LISTEN)))
+                        err = fastopen_init_queue(sk, val);
+                else
+                        err = -EINVAL;
+                break;
         default:
                 err = -ENOPROTOOPT;
                 break;
@@ -3499,11 +3532,15 @@ EXPORT_SYMBOL(tcp_cookie_generator);
 
 void tcp_done(struct sock *sk)
 {
+        struct request_sock *req = tcp_sk(sk)->fastopen_rsk;
+
         if (sk->sk_state == TCP_SYN_SENT || sk->sk_state == TCP_SYN_RECV)
                 TCP_INC_STATS_BH(sock_net(sk), TCP_MIB_ATTEMPTFAILS);
 
         tcp_set_state(sk, TCP_CLOSE);
         tcp_clear_xmit_timers(sk);
+        if (req != NULL)
+                reqsk_fastopen_remove(sk, req, false);
 
         sk->sk_shutdown = SHUTDOWN_MASK;
 
diff --git a/net/ipv4/tcp_cong.c b/net/ipv4/tcp_cong.c
index 4d4db16e336e..1432cdb0644c 100644
--- a/net/ipv4/tcp_cong.c
+++ b/net/ipv4/tcp_cong.c
@@ -291,7 +291,8 @@ bool tcp_is_cwnd_limited(const struct sock *sk, u32 in_flight)
         left = tp->snd_cwnd - in_flight;
         if (sk_can_gso(sk) &&
             left * sysctl_tcp_tso_win_divisor < tp->snd_cwnd &&
-            left * tp->mss_cache < sk->sk_gso_max_size)
+            left * tp->mss_cache < sk->sk_gso_max_size &&
+            left < sk->sk_gso_max_segs)
                 return true;
         return left <= tcp_max_tso_deferred_mss(tp);
 }
diff --git a/net/ipv4/tcp_fastopen.c b/net/ipv4/tcp_fastopen.c
index a7f729c409d7..8f7ef0ad80e5 100644
--- a/net/ipv4/tcp_fastopen.c
+++ b/net/ipv4/tcp_fastopen.c
@@ -1,10 +1,91 @@
+#include <linux/err.h>
 #include <linux/init.h>
 #include <linux/kernel.h>
+#include <linux/list.h>
+#include <linux/tcp.h>
+#include <linux/rcupdate.h>
+#include <linux/rculist.h>
+#include <net/inetpeer.h>
+#include <net/tcp.h>
 
-int sysctl_tcp_fastopen;
+int sysctl_tcp_fastopen __read_mostly;
+
+struct tcp_fastopen_context __rcu *tcp_fastopen_ctx;
+
+static DEFINE_SPINLOCK(tcp_fastopen_ctx_lock);
+
+static void tcp_fastopen_ctx_free(struct rcu_head *head)
+{
+        struct tcp_fastopen_context *ctx =
+            container_of(head, struct tcp_fastopen_context, rcu);
+        crypto_free_cipher(ctx->tfm);
+        kfree(ctx);
+}
+
+int tcp_fastopen_reset_cipher(void *key, unsigned int len)
+{
+        int err;
+        struct tcp_fastopen_context *ctx, *octx;
+
+        ctx = kmalloc(sizeof(*ctx), GFP_KERNEL);
+        if (!ctx)
+                return -ENOMEM;
+        ctx->tfm = crypto_alloc_cipher("aes", 0, 0);
+
+        if (IS_ERR(ctx->tfm)) {
+                err = PTR_ERR(ctx->tfm);
+error:          kfree(ctx);
+                pr_err("TCP: TFO aes cipher alloc error: %d\n", err);
+                return err;
+        }
+        err = crypto_cipher_setkey(ctx->tfm, key, len);
+        if (err) {
+                pr_err("TCP: TFO cipher key error: %d\n", err);
+                crypto_free_cipher(ctx->tfm);
+                goto error;
+        }
+        memcpy(ctx->key, key, len);
+
+        spin_lock(&tcp_fastopen_ctx_lock);
+
+        octx = rcu_dereference_protected(tcp_fastopen_ctx,
+                                lockdep_is_held(&tcp_fastopen_ctx_lock));
+        rcu_assign_pointer(tcp_fastopen_ctx, ctx);
+        spin_unlock(&tcp_fastopen_ctx_lock);
+
+        if (octx)
+                call_rcu(&octx->rcu, tcp_fastopen_ctx_free);
+        return err;
+}
+
+/* Computes the fastopen cookie for the peer.
+ * The peer address is a 128 bits long (pad with zeros for IPv4).
+ *
+ * The caller must check foc->len to determine if a valid cookie
+ * has been generated successfully.
+*/
+void tcp_fastopen_cookie_gen(__be32 addr, struct tcp_fastopen_cookie *foc)
+{
+        __be32 peer_addr[4] = { addr, 0, 0, 0 };
+        struct tcp_fastopen_context *ctx;
+
+        rcu_read_lock();
+        ctx = rcu_dereference(tcp_fastopen_ctx);
+        if (ctx) {
+                crypto_cipher_encrypt_one(ctx->tfm,
+                                          foc->val,
+                                          (__u8 *)peer_addr);
+                foc->len = TCP_FASTOPEN_COOKIE_SIZE;
+        }
+        rcu_read_unlock();
+}
 
 static int __init tcp_fastopen_init(void)
 {
+        __u8 key[TCP_FASTOPEN_KEY_LENGTH];
+
+        get_random_bytes(key, sizeof(key));
+        tcp_fastopen_reset_cipher(key, sizeof(key));
         return 0;
 }
 
diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
index 2fd2bc9e3c64..e2bec815ff23 100644
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -237,7 +237,11 @@ static inline void TCP_ECN_check_ce(struct tcp_sock *tp, const struct sk_buff *s
                         tcp_enter_quickack_mode((struct sock *)tp);
                 break;
         case INET_ECN_CE:
-                tp->ecn_flags |= TCP_ECN_DEMAND_CWR;
+                if (!(tp->ecn_flags & TCP_ECN_DEMAND_CWR)) {
+                        /* Better not delay acks, sender can have a very low cwnd */
+                        tcp_enter_quickack_mode((struct sock *)tp);
+                        tp->ecn_flags |= TCP_ECN_DEMAND_CWR;
+                }
                 /* fallinto */
         default:
                 tp->ecn_flags |= TCP_ECN_SEEN;
@@ -374,7 +378,7 @@ static void tcp_fixup_rcvbuf(struct sock *sk)
 /* 4. Try to fixup all. It is made immediately after connection enters
  *    established state.
  */
-static void tcp_init_buffer_space(struct sock *sk)
+void tcp_init_buffer_space(struct sock *sk)
 {
         struct tcp_sock *tp = tcp_sk(sk);
         int maxwin;
@@ -739,29 +743,6 @@ __u32 tcp_init_cwnd(const struct tcp_sock *tp, const struct dst_entry *dst)
         return min_t(__u32, cwnd, tp->snd_cwnd_clamp);
 }
 
-/* Set slow start threshold and cwnd not falling to slow start */
-void tcp_enter_cwr(struct sock *sk, const int set_ssthresh)
-{
-        struct tcp_sock *tp = tcp_sk(sk);
-        const struct inet_connection_sock *icsk = inet_csk(sk);
-
-        tp->prior_ssthresh = 0;
-        tp->bytes_acked = 0;
-        if (icsk->icsk_ca_state < TCP_CA_CWR) {
-                tp->undo_marker = 0;
-                if (set_ssthresh)
-                        tp->snd_ssthresh = icsk->icsk_ca_ops->ssthresh(sk);
-                tp->snd_cwnd = min(tp->snd_cwnd,
-                                   tcp_packets_in_flight(tp) + 1U);
-                tp->snd_cwnd_cnt = 0;
-                tp->high_seq = tp->snd_nxt;
-                tp->snd_cwnd_stamp = tcp_time_stamp;
-                TCP_ECN_queue_cwr(tp);
-
-                tcp_set_ca_state(sk, TCP_CA_CWR);
-        }
-}
-
 /*
  * Packet counting of FACK is based on in-order assumptions, therefore TCP
  * disables it when reordering is detected
@@ -2489,35 +2470,6 @@ static inline void tcp_moderate_cwnd(struct tcp_sock *tp)
         tp->snd_cwnd_stamp = tcp_time_stamp;
 }
 
-/* Lower bound on congestion window is slow start threshold
- * unless congestion avoidance choice decides to overide it.
- */
-static inline u32 tcp_cwnd_min(const struct sock *sk)
-{
-        const struct tcp_congestion_ops *ca_ops = inet_csk(sk)->icsk_ca_ops;
-
-        return ca_ops->min_cwnd ? ca_ops->min_cwnd(sk) : tcp_sk(sk)->snd_ssthresh;
-}
-
-/* Decrease cwnd each second ack. */
-static void tcp_cwnd_down(struct sock *sk, int flag)
-{
-        struct tcp_sock *tp = tcp_sk(sk);
-        int decr = tp->snd_cwnd_cnt + 1;
-
-        if ((flag & (FLAG_ANY_PROGRESS | FLAG_DSACKING_ACK)) ||
-            (tcp_is_reno(tp) && !(flag & FLAG_NOT_DUP))) {
-                tp->snd_cwnd_cnt = decr & 1;
-                decr >>= 1;
-
-                if (decr && tp->snd_cwnd > tcp_cwnd_min(sk))
-                        tp->snd_cwnd -= decr;
-
-                tp->snd_cwnd = min(tp->snd_cwnd, tcp_packets_in_flight(tp) + 1);
-                tp->snd_cwnd_stamp = tcp_time_stamp;
-        }
-}
-
 /* Nothing was retransmitted or returned timestamp is less
  * than timestamp of the first retransmission.
  */
@@ -2719,24 +2671,80 @@ static bool tcp_try_undo_loss(struct sock *sk)
         return false;
 }
 
-static inline void tcp_complete_cwr(struct sock *sk)
+/* The cwnd reduction in CWR and Recovery use the PRR algorithm
+ * https://datatracker.ietf.org/doc/draft-ietf-tcpm-proportional-rate-reduction/
+ * It computes the number of packets to send (sndcnt) based on packets newly
+ * delivered:
+ *   1) If the packets in flight is larger than ssthresh, PRR spreads the
+ *      cwnd reductions across a full RTT.
+ *   2) If packets in flight is lower than ssthresh (such as due to excess
+ *      losses and/or application stalls), do not perform any further cwnd
+ *      reductions, but instead slow start up to ssthresh.
+ */
+static void tcp_init_cwnd_reduction(struct sock *sk, const bool set_ssthresh)
 {
         struct tcp_sock *tp = tcp_sk(sk);
 
-        /* Do not moderate cwnd if it's already undone in cwr or recovery. */
-        if (tp->undo_marker) {
-                if (inet_csk(sk)->icsk_ca_state == TCP_CA_CWR) {
-                        tp->snd_cwnd = min(tp->snd_cwnd, tp->snd_ssthresh);
-                        tp->snd_cwnd_stamp = tcp_time_stamp;
-                } else if (tp->snd_ssthresh < TCP_INFINITE_SSTHRESH) {
-                        /* PRR algorithm. */
-                        tp->snd_cwnd = tp->snd_ssthresh;
-                        tp->snd_cwnd_stamp = tcp_time_stamp;
-                }
+        tp->high_seq = tp->snd_nxt;
+        tp->bytes_acked = 0;
+        tp->snd_cwnd_cnt = 0;
+        tp->prior_cwnd = tp->snd_cwnd;
+        tp->prr_delivered = 0;
+        tp->prr_out = 0;
+        if (set_ssthresh)
+                tp->snd_ssthresh = inet_csk(sk)->icsk_ca_ops->ssthresh(sk);
+        TCP_ECN_queue_cwr(tp);
+}
+
+static void tcp_cwnd_reduction(struct sock *sk, int newly_acked_sacked,
+                               int fast_rexmit)
+{
+        struct tcp_sock *tp = tcp_sk(sk);
+        int sndcnt = 0;
+        int delta = tp->snd_ssthresh - tcp_packets_in_flight(tp);
+
+        tp->prr_delivered += newly_acked_sacked;
+        if (tcp_packets_in_flight(tp) > tp->snd_ssthresh) {
+                u64 dividend = (u64)tp->snd_ssthresh * tp->prr_delivered +
+                               tp->prior_cwnd - 1;
+                sndcnt = div_u64(dividend, tp->prior_cwnd) - tp->prr_out;
+        } else {
+                sndcnt = min_t(int, delta,
+                               max_t(int, tp->prr_delivered - tp->prr_out,
+                                     newly_acked_sacked) + 1);
+        }
+
+        sndcnt = max(sndcnt, (fast_rexmit ? 1 : 0));
+        tp->snd_cwnd = tcp_packets_in_flight(tp) + sndcnt;
+}
+
+static inline void tcp_end_cwnd_reduction(struct sock *sk)
+{
+        struct tcp_sock *tp = tcp_sk(sk);
+
+        /* Reset cwnd to ssthresh in CWR or Recovery (unless it's undone) */
+        if (inet_csk(sk)->icsk_ca_state == TCP_CA_CWR ||
+            (tp->undo_marker && tp->snd_ssthresh < TCP_INFINITE_SSTHRESH)) {
+                tp->snd_cwnd = tp->snd_ssthresh;
+                tp->snd_cwnd_stamp = tcp_time_stamp;
         }
         tcp_ca_event(sk, CA_EVENT_COMPLETE_CWR);
 }
 
+/* Enter CWR state. Disable cwnd undo since congestion is proven with ECN */
+void tcp_enter_cwr(struct sock *sk, const int set_ssthresh)
+{
+        struct tcp_sock *tp = tcp_sk(sk);
+
+        tp->prior_ssthresh = 0;
+        tp->bytes_acked = 0;
+        if (inet_csk(sk)->icsk_ca_state < TCP_CA_CWR) {
+                tp->undo_marker = 0;
+                tcp_init_cwnd_reduction(sk, set_ssthresh);
+                tcp_set_ca_state(sk, TCP_CA_CWR);
+        }
+}
+
 static void tcp_try_keep_open(struct sock *sk)
 {
         struct tcp_sock *tp = tcp_sk(sk);
@@ -2751,7 +2759,7 @@ static void tcp_try_keep_open(struct sock *sk)
         }
 }
 
-static void tcp_try_to_open(struct sock *sk, int flag)
+static void tcp_try_to_open(struct sock *sk, int flag, int newly_acked_sacked)
 {
         struct tcp_sock *tp = tcp_sk(sk);
 
@@ -2768,7 +2776,7 @@ static void tcp_try_to_open(struct sock *sk, int flag)
                 if (inet_csk(sk)->icsk_ca_state != TCP_CA_Open)
                         tcp_moderate_cwnd(tp);
         } else {
-                tcp_cwnd_down(sk, flag);
+                tcp_cwnd_reduction(sk, newly_acked_sacked, 0);
         }
 }
 
@@ -2850,38 +2858,6 @@ void tcp_simple_retransmit(struct sock *sk)
 }
 EXPORT_SYMBOL(tcp_simple_retransmit);
 
-/* This function implements the PRR algorithm, specifcally the PRR-SSRB
- * (proportional rate reduction with slow start reduction bound) as described in
- * http://www.ietf.org/id/draft-mathis-tcpm-proportional-rate-reduction-01.txt.
- * It computes the number of packets to send (sndcnt) based on packets newly
- * delivered:
- *   1) If the packets in flight is larger than ssthresh, PRR spreads the
- *      cwnd reductions across a full RTT.
- *   2) If packets in flight is lower than ssthresh (such as due to excess
- *      losses and/or application stalls), do not perform any further cwnd
- *      reductions, but instead slow start up to ssthresh.
- */
-static void tcp_update_cwnd_in_recovery(struct sock *sk, int newly_acked_sacked,
-                                        int fast_rexmit, int flag)
-{
-        struct tcp_sock *tp = tcp_sk(sk);
-        int sndcnt = 0;
-        int delta = tp->snd_ssthresh - tcp_packets_in_flight(tp);
-
-        if (tcp_packets_in_flight(tp) > tp->snd_ssthresh) {
-                u64 dividend = (u64)tp->snd_ssthresh * tp->prr_delivered +
-                               tp->prior_cwnd - 1;
-                sndcnt = div_u64(dividend, tp->prior_cwnd) - tp->prr_out;
-        } else {
-                sndcnt = min_t(int, delta,
-                               max_t(int, tp->prr_delivered - tp->prr_out,
-                                     newly_acked_sacked) + 1);
-        }
-
-        sndcnt = max(sndcnt, (fast_rexmit ? 1 : 0));
-        tp->snd_cwnd = tcp_packets_in_flight(tp) + sndcnt;
-}
-
 static void tcp_enter_recovery(struct sock *sk, bool ece_ack)
 {
         struct tcp_sock *tp = tcp_sk(sk);
@@ -2894,7 +2870,6 @@ static void tcp_enter_recovery(struct sock *sk, bool ece_ack)
 
         NET_INC_STATS_BH(sock_net(sk), mib_idx);
 
-        tp->high_seq = tp->snd_nxt;
         tp->prior_ssthresh = 0;
         tp->undo_marker = tp->snd_una;
         tp->undo_retrans = tp->retrans_out;
@@ -2902,15 +2877,8 @@ static void tcp_enter_recovery(struct sock *sk, bool ece_ack)
         if (inet_csk(sk)->icsk_ca_state < TCP_CA_CWR) {
                 if (!ece_ack)
                         tp->prior_ssthresh = tcp_current_ssthresh(sk);
-                tp->snd_ssthresh = inet_csk(sk)->icsk_ca_ops->ssthresh(sk);
-                TCP_ECN_queue_cwr(tp);
+                tcp_init_cwnd_reduction(sk, true);
         }
-
-        tp->bytes_acked = 0;
-        tp->snd_cwnd_cnt = 0;
-        tp->prior_cwnd = tp->snd_cwnd;
-        tp->prr_delivered = 0;
-        tp->prr_out = 0;
         tcp_set_ca_state(sk, TCP_CA_Recovery);
 }
 
@@ -2926,13 +2894,14 @@ static void tcp_enter_recovery(struct sock *sk, bool ece_ack)
  * tcp_xmit_retransmit_queue().
  */
 static void tcp_fastretrans_alert(struct sock *sk, int pkts_acked,
-                                  int newly_acked_sacked, bool is_dupack,
+                                  int prior_sacked, bool is_dupack,
                                   int flag)
 {
         struct inet_connection_sock *icsk = inet_csk(sk);
         struct tcp_sock *tp = tcp_sk(sk);
         int do_lost = is_dupack || ((flag & FLAG_DATA_SACKED) &&
                                     (tcp_fackets_out(tp) > tp->reordering));
+        int newly_acked_sacked = 0;
         int fast_rexmit = 0;
 
         if (WARN_ON(!tp->packets_out && tp->sacked_out))
@@ -2969,7 +2938,7 @@ static void tcp_fastretrans_alert(struct sock *sk, int pkts_acked,
                         /* CWR is to be held something *above* high_seq
                          * is ACKed for CWR bit to reach receiver. */
                         if (tp->snd_una != tp->high_seq) {
-                                tcp_complete_cwr(sk);
+                                tcp_end_cwnd_reduction(sk);
                                 tcp_set_ca_state(sk, TCP_CA_Open);
                         }
                         break;
@@ -2979,7 +2948,7 @@ static void tcp_fastretrans_alert(struct sock *sk, int pkts_acked,
                                 tcp_reset_reno_sack(tp);
                         if (tcp_try_undo_recovery(sk))
                                 return;
-                        tcp_complete_cwr(sk);
+                        tcp_end_cwnd_reduction(sk);
                         break;
                 }
         }
@@ -2992,6 +2961,7 @@ static void tcp_fastretrans_alert(struct sock *sk, int pkts_acked,
                                 tcp_add_reno_sack(sk);
                 } else
                         do_lost = tcp_try_undo_partial(sk, pkts_acked);
+                newly_acked_sacked = pkts_acked + tp->sacked_out - prior_sacked;
                 break;
         case TCP_CA_Loss:
                 if (flag & FLAG_DATA_ACKED)
@@ -3013,12 +2983,13 @@ static void tcp_fastretrans_alert(struct sock *sk, int pkts_acked,
                         if (is_dupack)
                                 tcp_add_reno_sack(sk);
                 }
+                newly_acked_sacked = pkts_acked + tp->sacked_out - prior_sacked;
 
                 if (icsk->icsk_ca_state <= TCP_CA_Disorder)
                         tcp_try_undo_dsack(sk);
 
                 if (!tcp_time_to_recover(sk, flag)) {
-                        tcp_try_to_open(sk, flag);
+                        tcp_try_to_open(sk, flag, newly_acked_sacked);
                         return;
                 }
 
@@ -3040,8 +3011,7 @@ static void tcp_fastretrans_alert(struct sock *sk, int pkts_acked,
 
         if (do_lost || (tcp_is_fack(tp) && tcp_head_timedout(sk)))
                 tcp_update_scoreboard(sk, fast_rexmit);
-        tp->prr_delivered += newly_acked_sacked;
-        tcp_update_cwnd_in_recovery(sk, newly_acked_sacked, fast_rexmit, flag);
+        tcp_cwnd_reduction(sk, newly_acked_sacked, fast_rexmit);
         tcp_xmit_retransmit_queue(sk);
 }
 
@@ -3120,6 +3090,12 @@ void tcp_rearm_rto(struct sock *sk)
 {
         struct tcp_sock *tp = tcp_sk(sk);
 
+        /* If the retrans timer is currently being used by Fast Open
+         * for SYN-ACK retrans purpose, stay put.
+         */
+        if (tp->fastopen_rsk)
+                return;
+
         if (!tp->packets_out) {
                 inet_csk_clear_xmit_timer(sk, ICSK_TIME_RETRANS);
         } else {
@@ -3381,7 +3357,7 @@ static inline bool tcp_may_raise_cwnd(const struct sock *sk, const int flag)
 {
         const struct tcp_sock *tp = tcp_sk(sk);
         return (!(flag & FLAG_ECE) || tp->snd_cwnd < tp->snd_ssthresh) &&
-                !((1 << inet_csk(sk)->icsk_ca_state) & (TCPF_CA_Recovery | TCPF_CA_CWR));
+                !tcp_in_cwnd_reduction(sk);
 }
 
 /* Check that window update is acceptable.
@@ -3449,9 +3425,9 @@ static void tcp_conservative_spur_to_response(struct tcp_sock *tp)
 }
 
 /* A conservative spurious RTO response algorithm: reduce cwnd using
- * rate halving and continue in congestion avoidance.
+ * PRR and continue in congestion avoidance.
  */
-static void tcp_ratehalving_spur_to_response(struct sock *sk)
+static void tcp_cwr_spur_to_response(struct sock *sk)
 {
         tcp_enter_cwr(sk, 0);
 }
@@ -3459,7 +3435,7 @@ static void tcp_ratehalving_spur_to_response(struct sock *sk)
 static void tcp_undo_spur_to_response(struct sock *sk, int flag)
 {
         if (flag & FLAG_ECE)
-                tcp_ratehalving_spur_to_response(sk);
+                tcp_cwr_spur_to_response(sk);
         else
                 tcp_undo_cwr(sk, true);
 }
@@ -3566,7 +3542,7 @@ static bool tcp_process_frto(struct sock *sk, int flag)
                         tcp_conservative_spur_to_response(tp);
                         break;
                 default:
-                        tcp_ratehalving_spur_to_response(sk);
+                        tcp_cwr_spur_to_response(sk);
                         break;
                 }
                 tp->frto_counter = 0;
@@ -3590,7 +3566,6 @@ static int tcp_ack(struct sock *sk, const struct sk_buff *skb, int flag)
         int prior_packets;
         int prior_sacked = tp->sacked_out;
         int pkts_acked = 0;
-        int newly_acked_sacked = 0;
         bool frto_cwnd = false;
 
         /* If the ack is older than previous acks
@@ -3666,8 +3641,6 @@ static int tcp_ack(struct sock *sk, const struct sk_buff *skb, int flag)
         flag |= tcp_clean_rtx_queue(sk, prior_fackets, prior_snd_una);
 
         pkts_acked = prior_packets - tp->packets_out;
-        newly_acked_sacked = (prior_packets - prior_sacked) -
-                             (tp->packets_out - tp->sacked_out);
 
         if (tp->frto_counter)
                 frto_cwnd = tcp_process_frto(sk, flag);
@@ -3681,7 +3654,7 @@ static int tcp_ack(struct sock *sk, const struct sk_buff *skb, int flag)
                     tcp_may_raise_cwnd(sk, flag))
                         tcp_cong_avoid(sk, ack, prior_in_flight);
                 is_dupack = !(flag & (FLAG_SND_UNA_ADVANCED | FLAG_NOT_DUP));
-                tcp_fastretrans_alert(sk, pkts_acked, newly_acked_sacked,
+                tcp_fastretrans_alert(sk, pkts_acked, prior_sacked,
                                       is_dupack, flag);
         } else {
                 if ((flag & FLAG_DATA_ACKED) && !frto_cwnd)
@@ -3698,7 +3671,7 @@ static int tcp_ack(struct sock *sk, const struct sk_buff *skb, int flag)
 no_queue:
         /* If data was DSACKed, see if we can undo a cwnd reduction. */
         if (flag & FLAG_DSACKING_ACK)
-                tcp_fastretrans_alert(sk, pkts_acked, newly_acked_sacked,
+                tcp_fastretrans_alert(sk, pkts_acked, prior_sacked,
                                       is_dupack, flag);
         /* If this ack opens up a zero window, clear backoff.  It was
          * being used to time the probes, and is probably far higher than
@@ -3718,8 +3691,7 @@ old_ack:
          */
         if (TCP_SKB_CB(skb)->sacked) {
                 flag |= tcp_sacktag_write_queue(sk, skb, prior_snd_una);
-                newly_acked_sacked = tp->sacked_out - prior_sacked;
-                tcp_fastretrans_alert(sk, pkts_acked, newly_acked_sacked,
+                tcp_fastretrans_alert(sk, pkts_acked, prior_sacked,
                                       is_dupack, flag);
         }
 
@@ -4035,7 +4007,7 @@ static inline bool tcp_sequence(const struct tcp_sock *tp, u32 seq, u32 end_seq)
 }
 
 /* When we get a reset we do this. */
-static void tcp_reset(struct sock *sk)
+void tcp_reset(struct sock *sk)
 {
         /* We want the right error as BSD sees it (and indeed as we do). */
         switch (sk->sk_state) {
@@ -5392,6 +5364,8 @@ int tcp_rcv_established(struct sock *sk, struct sk_buff *skb,
 {
         struct tcp_sock *tp = tcp_sk(sk);
 
+        if (unlikely(sk->sk_rx_dst == NULL))
+                inet_csk(sk)->icsk_af_ops->sk_rx_dst_set(sk, skb);
         /*
          *      Header prediction.
          *      The code loosely follows the one in the famous
@@ -5605,7 +5579,7 @@ void tcp_finish_connect(struct sock *sk, struct sk_buff *skb)
         tcp_set_state(sk, TCP_ESTABLISHED);
 
         if (skb != NULL) {
-                inet_sk_rx_dst_set(sk, skb);
+                icsk->icsk_af_ops->sk_rx_dst_set(sk, skb);
                 security_inet_conn_established(sk, skb);
         }
 
@@ -5740,7 +5714,7 @@ static int tcp_rcv_synsent_state_process(struct sock *sk, struct sk_buff *skb,
 
                 TCP_ECN_rcv_synack(tp, th);
 
-                tp->snd_wl1 = TCP_SKB_CB(skb)->seq;
+                tcp_init_wl(tp, TCP_SKB_CB(skb)->seq);
                 tcp_ack(sk, skb, FLAG_SLOWPATH);
 
                 /* Ok.. it's good. Set up sequence numbers and
@@ -5753,7 +5727,6 @@ static int tcp_rcv_synsent_state_process(struct sock *sk, struct sk_buff *skb,
                  * never scaled.
                  */
                 tp->snd_wnd = ntohs(th->window);
-                tcp_init_wl(tp, TCP_SKB_CB(skb)->seq);
 
                 if (!tp->rx_opt.wscale_ok) {
                         tp->rx_opt.snd_wscale = tp->rx_opt.rcv_wscale = 0;
@@ -5891,7 +5864,9 @@ discard:
                 tcp_send_synack(sk);
 #if 0
                 /* Note, we could accept data and URG from this segment.
-                 * There are no obstacles to make this.
+                 * There are no obstacles to make this (except that we must
+                 * either change tcp_recvmsg() to prevent it from returning data
+                 * before 3WHS completes per RFC793, or employ TCP Fast Open).
                  *
                  * However, if we ignore data in ACKless segments sometimes,
                  * we have no reasons to accept it sometimes.
@@ -5931,6 +5906,7 @@ int tcp_rcv_state_process(struct sock *sk, struct sk_buff *skb,
 {
         struct tcp_sock *tp = tcp_sk(sk);
         struct inet_connection_sock *icsk = inet_csk(sk);
+        struct request_sock *req;
         int queued = 0;
 
         tp->rx_opt.saw_tstamp = 0;
@@ -5986,7 +5962,14 @@ int tcp_rcv_state_process(struct sock *sk, struct sk_buff *skb,
                 return 0;
         }
 
-        if (!tcp_validate_incoming(sk, skb, th, 0))
+        req = tp->fastopen_rsk;
+        if (req != NULL) {
+                BUG_ON(sk->sk_state != TCP_SYN_RECV &&
+                    sk->sk_state != TCP_FIN_WAIT1);
+
+                if (tcp_check_req(sk, skb, req, NULL, true) == NULL)
+                        goto discard;
+        } else if (!tcp_validate_incoming(sk, skb, th, 0))
                 return 0;
 
         /* step 5: check the ACK field */
@@ -5996,7 +5979,22 @@ int tcp_rcv_state_process(struct sock *sk, struct sk_buff *skb,
                 switch (sk->sk_state) {
                 case TCP_SYN_RECV:
                         if (acceptable) {
-                                tp->copied_seq = tp->rcv_nxt;
+                                /* Once we leave TCP_SYN_RECV, we no longer
+                                 * need req so release it.
+                                 */
+                                if (req) {
+                                        reqsk_fastopen_remove(sk, req, false);
+                                } else {
+                                        /* Make sure socket is routed, for
+                                         * correct metrics.
+                                         */
+                                        icsk->icsk_af_ops->rebuild_header(sk);
+                                        tcp_init_congestion_control(sk);
+
+                                        tcp_mtup_init(sk);
+                                        tcp_init_buffer_space(sk);
+                                        tp->copied_seq = tp->rcv_nxt;
+                                }
                                 smp_mb();
                                 tcp_set_state(sk, TCP_ESTABLISHED);
                                 sk->sk_state_change(sk);
@@ -6018,23 +6016,27 @@ int tcp_rcv_state_process(struct sock *sk, struct sk_buff *skb,
                                 if (tp->rx_opt.tstamp_ok)
                                         tp->advmss -= TCPOLEN_TSTAMP_ALIGNED;
 
-                                /* Make sure socket is routed, for
-                                 * correct metrics.
-                                 */
-                                icsk->icsk_af_ops->rebuild_header(sk);
-
-                                tcp_init_metrics(sk);
-
-                                tcp_init_congestion_control(sk);
+                                if (req) {
+                                        /* Re-arm the timer because data may
+                                         * have been sent out. This is similar
+                                         * to the regular data transmission case
+                                         * when new data has just been ack'ed.
+                                         *
+                                         * (TFO) - we could try to be more
+                                         * aggressive and retranmitting any data
+                                         * sooner based on when they were sent
+                                         * out.
+                                         */
+                                        tcp_rearm_rto(sk);
+                                } else
+                                        tcp_init_metrics(sk);
 
                                 /* Prevent spurious tcp_cwnd_restart() on
                                  * first data packet.
                                  */
                                 tp->lsndtime = tcp_time_stamp;
 
-                                tcp_mtup_init(sk);
                                 tcp_initialize_rcv_mss(sk);
-                                tcp_init_buffer_space(sk);
                                 tcp_fast_path_on(tp);
                         } else {
                                 return 1;
@@ -6042,6 +6044,16 @@ int tcp_rcv_state_process(struct sock *sk, struct sk_buff *skb,
                         break;
 
                 case TCP_FIN_WAIT1:
+                        /* If we enter the TCP_FIN_WAIT1 state and we are a
+                         * Fast Open socket and this is the first acceptable
+                         * ACK we have received, this would have acknowledged
+                         * our SYNACK so stop the SYNACK timer.
+                         */
+                        if (acceptable && req != NULL) {
+                                /* We no longer need the request sock. */
+                                reqsk_fastopen_remove(sk, req, false);
+                                tcp_rearm_rto(sk);
+                        }
                         if (tp->snd_una == tp->write_seq) {
                                 struct dst_entry *dst;
 
diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
index 42b2a6a73092..e64abed249cc 100644
--- a/net/ipv4/tcp_ipv4.c
+++ b/net/ipv4/tcp_ipv4.c
@@ -352,6 +352,7 @@ void tcp_v4_err(struct sk_buff *icmp_skb, u32 info)
         const int code = icmp_hdr(icmp_skb)->code;
         struct sock *sk;
         struct sk_buff *skb;
+        struct request_sock *req;
         __u32 seq;
         __u32 remaining;
         int err;
@@ -394,9 +395,12 @@ void tcp_v4_err(struct sk_buff *icmp_skb, u32 info)
 
         icsk = inet_csk(sk);
         tp = tcp_sk(sk);
+        req = tp->fastopen_rsk;
         seq = ntohl(th->seq);
         if (sk->sk_state != TCP_LISTEN &&
-            !between(seq, tp->snd_una, tp->snd_nxt)) {
+            !between(seq, tp->snd_una, tp->snd_nxt) &&
+            (req == NULL || seq != tcp_rsk(req)->snt_isn)) {
+                /* For a Fast Open socket, allow seq to be snt_isn. */
                 NET_INC_STATS_BH(net, LINUX_MIB_OUTOFWINDOWICMPS);
                 goto out;
         }
@@ -417,10 +421,12 @@ void tcp_v4_err(struct sk_buff *icmp_skb, u32 info)
 
                 if (code == ICMP_FRAG_NEEDED) { /* PMTU discovery (RFC1191) */
                         tp->mtu_info = info;
-                        if (!sock_owned_by_user(sk))
+                        if (!sock_owned_by_user(sk)) {
                                 tcp_v4_mtu_reduced(sk);
-                        else
-                                set_bit(TCP_MTU_REDUCED_DEFERRED, &tp->tsq_flags);
+                        } else {
+                                if (!test_and_set_bit(TCP_MTU_REDUCED_DEFERRED, &tp->tsq_flags))
+                                        sock_hold(sk);
+                        }
                         goto out;
                 }
 
@@ -433,6 +439,8 @@ void tcp_v4_err(struct sk_buff *icmp_skb, u32 info)
                     !icsk->icsk_backoff)
                         break;
 
+                /* XXX (TFO) - revisit the following logic for TFO */
+
                 if (sock_owned_by_user(sk))
                         break;
 
@@ -464,6 +472,14 @@ void tcp_v4_err(struct sk_buff *icmp_skb, u32 info)
                 goto out;
         }
 
+        /* XXX (TFO) - if it's a TFO socket and has been accepted, rather
+         * than following the TCP_SYN_RECV case and closing the socket,
+         * we ignore the ICMP error and keep trying like a fully established
+         * socket. Is this the right thing to do?
+         */
+        if (req && req->sk == NULL)
+                goto out;
+
         switch (sk->sk_state) {
                 struct request_sock *req, **prev;
         case TCP_LISTEN:
@@ -496,7 +512,8 @@ void tcp_v4_err(struct sk_buff *icmp_skb, u32 info)
 
         case TCP_SYN_SENT:
         case TCP_SYN_RECV:  /* Cannot happen.
-                               It can f.e. if SYNs crossed.
+                               It can f.e. if SYNs crossed,
+                               or Fast Open.
                              */
                 if (!sock_owned_by_user(sk)) {
                         sk->sk_err = err;
@@ -807,8 +824,12 @@ static void tcp_v4_timewait_ack(struct sock *sk, struct sk_buff *skb)
 static void tcp_v4_reqsk_send_ack(struct sock *sk, struct sk_buff *skb,
                                   struct request_sock *req)
 {
-        tcp_v4_send_ack(skb, tcp_rsk(req)->snt_isn + 1,
-                        tcp_rsk(req)->rcv_isn + 1, req->rcv_wnd,
+        /* sk->sk_state == TCP_LISTEN -> for regular TCP_SYN_RECV
+         * sk->sk_state == TCP_SYN_RECV -> for Fast Open.
+         */
+        tcp_v4_send_ack(skb, (sk->sk_state == TCP_LISTEN) ?
+                        tcp_rsk(req)->snt_isn + 1 : tcp_sk(sk)->snd_nxt,
+                        tcp_rsk(req)->rcv_nxt, req->rcv_wnd,
                         req->ts_recent,
                         0,
                         tcp_md5_do_lookup(sk, (union tcp_md5_addr *)&ip_hdr(skb)->daddr,
@@ -837,7 +858,7 @@ static int tcp_v4_send_synack(struct sock *sk, struct dst_entry *dst,
         if (!dst && (dst = inet_csk_route_req(sk, &fl4, req)) == NULL)
                 return -1;
 
-        skb = tcp_make_synack(sk, dst, req, rvp);
+        skb = tcp_make_synack(sk, dst, req, rvp, NULL);
 
         if (skb) {
                 __tcp_v4_send_check(skb, ireq->loc_addr, ireq->rmt_addr);
@@ -1270,6 +1291,178 @@ static const struct tcp_request_sock_ops tcp_request_sock_ipv4_ops = {
 };
 #endif
 
+static bool tcp_fastopen_check(struct sock *sk, struct sk_buff *skb,
+                               struct request_sock *req,
+                               struct tcp_fastopen_cookie *foc,
+                               struct tcp_fastopen_cookie *valid_foc)
+{
+        bool skip_cookie = false;
+        struct fastopen_queue *fastopenq;
+
+        if (likely(!fastopen_cookie_present(foc))) {
+                /* See include/net/tcp.h for the meaning of these knobs */
+                if ((sysctl_tcp_fastopen & TFO_SERVER_ALWAYS) ||
+                    ((sysctl_tcp_fastopen & TFO_SERVER_COOKIE_NOT_REQD) &&
+                    (TCP_SKB_CB(skb)->end_seq != TCP_SKB_CB(skb)->seq + 1)))
+                        skip_cookie = true; /* no cookie to validate */
+                else
+                        return false;
+        }
+        fastopenq = inet_csk(sk)->icsk_accept_queue.fastopenq;
+        /* A FO option is present; bump the counter. */
+        NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_TCPFASTOPENPASSIVE);
+
+        /* Make sure the listener has enabled fastopen, and we don't
+         * exceed the max # of pending TFO requests allowed before trying
+         * to validating the cookie in order to avoid burning CPU cycles
+         * unnecessarily.
+         *
+         * XXX (TFO) - The implication of checking the max_qlen before
+         * processing a cookie request is that clients can't differentiate
+         * between qlen overflow causing Fast Open to be disabled
+         * temporarily vs a server not supporting Fast Open at all.
+         */
+        if ((sysctl_tcp_fastopen & TFO_SERVER_ENABLE) == 0 ||
+            fastopenq == NULL || fastopenq->max_qlen == 0)
+                return false;
+
+        if (fastopenq->qlen >= fastopenq->max_qlen) {
+                struct request_sock *req1;
+                spin_lock(&fastopenq->lock);
+                req1 = fastopenq->rskq_rst_head;
+                if ((req1 == NULL) || time_after(req1->expires, jiffies)) {
+                        spin_unlock(&fastopenq->lock);
+                        NET_INC_STATS_BH(sock_net(sk),
+                            LINUX_MIB_TCPFASTOPENLISTENOVERFLOW);
+                        /* Avoid bumping LINUX_MIB_TCPFASTOPENPASSIVEFAIL*/
+                        foc->len = -1;
+                        return false;
+                }
+                fastopenq->rskq_rst_head = req1->dl_next;
+                fastopenq->qlen--;
+                spin_unlock(&fastopenq->lock);
+                reqsk_free(req1);
+        }
+        if (skip_cookie) {
+                tcp_rsk(req)->rcv_nxt = TCP_SKB_CB(skb)->end_seq;
+                return true;
+        }
+        if (foc->len == TCP_FASTOPEN_COOKIE_SIZE) {
+                if ((sysctl_tcp_fastopen & TFO_SERVER_COOKIE_NOT_CHKED) == 0) {
+                        tcp_fastopen_cookie_gen(ip_hdr(skb)->saddr, valid_foc);
+                        if ((valid_foc->len != TCP_FASTOPEN_COOKIE_SIZE) ||
+                            memcmp(&foc->val[0], &valid_foc->val[0],
+                            TCP_FASTOPEN_COOKIE_SIZE) != 0)
+                                return false;
+                        valid_foc->len = -1;
+                }
+                /* Acknowledge the data received from the peer. */
+                tcp_rsk(req)->rcv_nxt = TCP_SKB_CB(skb)->end_seq;
+                return true;
+        } else if (foc->len == 0) { /* Client requesting a cookie */
+                tcp_fastopen_cookie_gen(ip_hdr(skb)->saddr, valid_foc);
+                NET_INC_STATS_BH(sock_net(sk),
+                    LINUX_MIB_TCPFASTOPENCOOKIEREQD);
+        } else {
+                /* Client sent a cookie with wrong size. Treat it
+                 * the same as invalid and return a valid one.
+                 */
+                tcp_fastopen_cookie_gen(ip_hdr(skb)->saddr, valid_foc);
+        }
+        return false;
+}
+
+static int tcp_v4_conn_req_fastopen(struct sock *sk,
+                                    struct sk_buff *skb,
+                                    struct sk_buff *skb_synack,
+                                    struct request_sock *req,
+                                    struct request_values *rvp)
+{
+        struct tcp_sock *tp = tcp_sk(sk);
+        struct request_sock_queue *queue = &inet_csk(sk)->icsk_accept_queue;
+        const struct inet_request_sock *ireq = inet_rsk(req);
+        struct sock *child;
+
+        req->retrans = 0;
+        req->sk = NULL;
+
+        child = inet_csk(sk)->icsk_af_ops->syn_recv_sock(sk, skb, req, NULL);
+        if (child == NULL) {
+                NET_INC_STATS_BH(sock_net(sk),
+                                 LINUX_MIB_TCPFASTOPENPASSIVEFAIL);
+                kfree_skb(skb_synack);
+                return -1;
+        }
+        ip_build_and_send_pkt(skb_synack, sk, ireq->loc_addr,
+                        ireq->rmt_addr, ireq->opt);
+        /* XXX (TFO) - is it ok to ignore error and continue? */
+
+        spin_lock(&queue->fastopenq->lock);
+        queue->fastopenq->qlen++;
+        spin_unlock(&queue->fastopenq->lock);
+
+        /* Initialize the child socket. Have to fix some values to take
+         * into account the child is a Fast Open socket and is created
+         * only out of the bits carried in the SYN packet.
+         */
+        tp = tcp_sk(child);
+
+        tp->fastopen_rsk = req;
+        /* Do a hold on the listner sk so that if the listener is being
+         * closed, the child that has been accepted can live on and still
+         * access listen_lock.
+         */
+        sock_hold(sk);
+        tcp_rsk(req)->listener = sk;
+
+        /* RFC1323: The window in SYN & SYN/ACK segments is never
+         * scaled. So correct it appropriately.
+         */
+        tp->snd_wnd = ntohs(tcp_hdr(skb)->window);
+
+        /* Activate the retrans timer so that SYNACK can be retransmitted.
+         * The request socket is not added to the SYN table of the parent
+         * because it's been added to the accept queue directly.
+         */
+        inet_csk_reset_xmit_timer(child, ICSK_TIME_RETRANS,
+            TCP_TIMEOUT_INIT, TCP_RTO_MAX);
+
+        /* Add the child socket directly into the accept queue */
+        inet_csk_reqsk_queue_add(sk, req, child);
+
+        /* Now finish processing the fastopen child socket. */
+        inet_csk(child)->icsk_af_ops->rebuild_header(child);
+        tcp_init_congestion_control(child);
+        tcp_mtup_init(child);
+        tcp_init_buffer_space(child);
+        tcp_init_metrics(child);
+
+        /* Queue the data carried in the SYN packet. We need to first
+         * bump skb's refcnt because the caller will attempt to free it.
+         *
+         * XXX (TFO) - we honor a zero-payload TFO request for now.
+         * (Any reason not to?)
+         */
+        if (TCP_SKB_CB(skb)->end_seq == TCP_SKB_CB(skb)->seq + 1) {
+                /* Don't queue the skb if there is no payload in SYN.
+                 * XXX (TFO) - How about SYN+FIN?
+                 */
+                tp->rcv_nxt = TCP_SKB_CB(skb)->end_seq;
+        } else {
+                skb = skb_get(skb);
+                skb_dst_drop(skb);
+                __skb_pull(skb, tcp_hdr(skb)->doff * 4);
+                skb_set_owner_r(skb, child);
+                __skb_queue_tail(&child->sk_receive_queue, skb);
+                tp->rcv_nxt = TCP_SKB_CB(skb)->end_seq;
+        }
+        sk->sk_data_ready(sk, 0);
+        bh_unlock_sock(child);
+        sock_put(child);
+        WARN_ON(req->sk == NULL);
+        return 0;
+}
+
 int tcp_v4_conn_request(struct sock *sk, struct sk_buff *skb)
 {
         struct tcp_extend_values tmp_ext;
@@ -1283,6 +1476,11 @@ int tcp_v4_conn_request(struct sock *sk, struct sk_buff *skb)
         __be32 daddr = ip_hdr(skb)->daddr;
         __u32 isn = TCP_SKB_CB(skb)->when;
         bool want_cookie = false;
+        struct flowi4 fl4;
+        struct tcp_fastopen_cookie foc = { .len = -1 };
+        struct tcp_fastopen_cookie valid_foc = { .len = -1 };
+        struct sk_buff *skb_synack;
+        int do_fastopen;
 
         /* Never answer to SYNs send to broadcast or multicast */
         if (skb_rtable(skb)->rt_flags & (RTCF_BROADCAST | RTCF_MULTICAST))
@@ -1317,7 +1515,8 @@ int tcp_v4_conn_request(struct sock *sk, struct sk_buff *skb)
         tcp_clear_options(&tmp_opt);
         tmp_opt.mss_clamp = TCP_MSS_DEFAULT;
         tmp_opt.user_mss  = tp->rx_opt.user_mss;
-        tcp_parse_options(skb, &tmp_opt, &hash_location, 0, NULL);
+        tcp_parse_options(skb, &tmp_opt, &hash_location, 0,
+            want_cookie ? NULL : &foc);
 
         if (tmp_opt.cookie_plus > 0 &&
             tmp_opt.saw_tstamp &&
@@ -1375,8 +1574,6 @@ int tcp_v4_conn_request(struct sock *sk, struct sk_buff *skb)
                 isn = cookie_v4_init_sequence(sk, skb, &req->mss);
                 req->cookie_ts = tmp_opt.tstamp_ok;
         } else if (!isn) {
-                struct flowi4 fl4;
-
                 /* VJ's idea. We save last timestamp seen
                  * from the destination in peer table, when entering
                  * state TIME-WAIT, and check against it before
@@ -1417,14 +1614,52 @@ int tcp_v4_conn_request(struct sock *sk, struct sk_buff *skb)
         tcp_rsk(req)->snt_isn = isn;
         tcp_rsk(req)->snt_synack = tcp_time_stamp;
 
-        if (tcp_v4_send_synack(sk, dst, req,
-                               (struct request_values *)&tmp_ext,
-                               skb_get_queue_mapping(skb),
-                               want_cookie) ||
-            want_cookie)
+        if (dst == NULL) {
+                dst = inet_csk_route_req(sk, &fl4, req);
+                if (dst == NULL)
+                        goto drop_and_free;
+        }
+        do_fastopen = tcp_fastopen_check(sk, skb, req, &foc, &valid_foc);
+
+        /* We don't call tcp_v4_send_synack() directly because we need
+         * to make sure a child socket can be created successfully before
+         * sending back synack!
+         *
+         * XXX (TFO) - Ideally one would simply call tcp_v4_send_synack()
+         * (or better yet, call tcp_send_synack() in the child context
+         * directly, but will have to fix bunch of other code first)
+         * after syn_recv_sock() except one will need to first fix the
+         * latter to remove its dependency on the current implementation
+         * of tcp_v4_send_synack()->tcp_select_initial_window().
+         */
+        skb_synack = tcp_make_synack(sk, dst, req,
+            (struct request_values *)&tmp_ext,
+            fastopen_cookie_present(&valid_foc) ? &valid_foc : NULL);
+
+        if (skb_synack) {
+                __tcp_v4_send_check(skb_synack, ireq->loc_addr, ireq->rmt_addr);
+                skb_set_queue_mapping(skb_synack, skb_get_queue_mapping(skb));
+        } else
+                goto drop_and_free;
+
+        if (likely(!do_fastopen)) {
+                int err;
+                err = ip_build_and_send_pkt(skb_synack, sk, ireq->loc_addr,
+                     ireq->rmt_addr, ireq->opt);
+                err = net_xmit_eval(err);
+                if (err || want_cookie)
+                        goto drop_and_free;
+
+                tcp_rsk(req)->listener = NULL;
+                /* Add the request_sock to the SYN table */
+                inet_csk_reqsk_queue_hash_add(sk, req, TCP_TIMEOUT_INIT);
+                if (fastopen_cookie_present(&foc) && foc.len != 0)
+                        NET_INC_STATS_BH(sock_net(sk),
+                            LINUX_MIB_TCPFASTOPENPASSIVEFAIL);
+        } else if (tcp_v4_conn_req_fastopen(sk, skb, skb_synack, req,
+            (struct request_values *)&tmp_ext))
                 goto drop_and_free;
 
-        inet_csk_reqsk_queue_hash_add(sk, req, TCP_TIMEOUT_INIT);
         return 0;
 
 drop_and_release:
@@ -1462,6 +1697,7 @@ struct sock *tcp_v4_syn_recv_sock(struct sock *sk, struct sk_buff *skb,
                 goto exit_nonewsk;
 
         newsk->sk_gso_type = SKB_GSO_TCPV4;
+        inet_sk_rx_dst_set(newsk, skb);
 
         newtp                 = tcp_sk(newsk);
         newinet               = inet_sk(newsk);
@@ -1551,7 +1787,7 @@ static struct sock *tcp_v4_hnd_req(struct sock *sk, struct sk_buff *skb)
         struct request_sock *req = inet_csk_search_req(sk, &prev, th->source,
                                                        iph->saddr, iph->daddr);
         if (req)
-                return tcp_check_req(sk, skb, req, prev);
+                return tcp_check_req(sk, skb, req, prev, false);
 
         nsk = inet_lookup_established(sock_net(sk), &tcp_hashinfo, iph->saddr,
                         th->source, iph->daddr, th->dest, inet_iif(skb));
@@ -1627,9 +1863,6 @@ int tcp_v4_do_rcv(struct sock *sk, struct sk_buff *skb)
                                 sk->sk_rx_dst = NULL;
                         }
                 }
-                if (unlikely(sk->sk_rx_dst == NULL))
-                        inet_sk_rx_dst_set(sk, skb);
-
                 if (tcp_rcv_established(sk, skb, tcp_hdr(skb), skb->len)) {
                         rsk = sk;
                         goto reset;
@@ -1872,10 +2105,21 @@ static struct timewait_sock_ops tcp_timewait_sock_ops = {
         .twsk_destructor= tcp_twsk_destructor,
 };
 
+void inet_sk_rx_dst_set(struct sock *sk, const struct sk_buff *skb)
+{
+        struct dst_entry *dst = skb_dst(skb);
+
+        dst_hold(dst);
+        sk->sk_rx_dst = dst;
+        inet_sk(sk)->rx_dst_ifindex = skb->skb_iif;
+}
+EXPORT_SYMBOL(inet_sk_rx_dst_set);
+
 const struct inet_connection_sock_af_ops ipv4_specific = {
         .queue_xmit        = ip_queue_xmit,
         .send_check        = tcp_v4_send_check,
         .rebuild_header    = inet_sk_rebuild_header,
+        .sk_rx_dst_set     = inet_sk_rx_dst_set,
         .conn_request      = tcp_v4_conn_request,
         .syn_recv_sock     = tcp_v4_syn_recv_sock,
         .net_header_len    = sizeof(struct iphdr),
@@ -1966,6 +2210,7 @@ void tcp_v4_destroy_sock(struct sock *sk)
                          tcp_cookie_values_release);
                 tp->cookie_values = NULL;
         }
+        BUG_ON(tp->fastopen_rsk != NULL);
 
         /* If socket is aborted during connect operation */
         tcp_free_fastopen_req(tp);
@@ -2382,10 +2627,10 @@ void tcp_proc_unregister(struct net *net, struct tcp_seq_afinfo *afinfo)
 EXPORT_SYMBOL(tcp_proc_unregister);
 
 static void get_openreq4(const struct sock *sk, const struct request_sock *req,
-                         struct seq_file *f, int i, int uid, int *len)
+                         struct seq_file *f, int i, kuid_t uid, int *len)
 {
         const struct inet_request_sock *ireq = inet_rsk(req);
-        int ttd = req->expires - jiffies;
+        long delta = req->expires - jiffies;
 
         seq_printf(f, "%4d: %08X:%04X %08X:%04X"
                 " %02X %08X:%08X %02X:%08lX %08X %5d %8d %u %d %pK%n",
@@ -2397,9 +2642,9 @@ static void get_openreq4(const struct sock *sk, const struct request_sock *req,
                 TCP_SYN_RECV,
                 0, 0, /* could print option size, but that is af dependent. */
                 1,    /* timers active (only the expire timer) */
-                jiffies_to_clock_t(ttd),
+                jiffies_delta_to_clock_t(delta),
                 req->retrans,
-                uid,
+                from_kuid_munged(seq_user_ns(f), uid),
                 0,  /* non standard timer */
                 0, /* open_requests have no inode */
                 atomic_read(&sk->sk_refcnt),
@@ -2414,6 +2659,7 @@ static void get_tcp4_sock(struct sock *sk, struct seq_file *f, int i, int *len)
         const struct tcp_sock *tp = tcp_sk(sk);
         const struct inet_connection_sock *icsk = inet_csk(sk);
         const struct inet_sock *inet = inet_sk(sk);
+        struct fastopen_queue *fastopenq = icsk->icsk_accept_queue.fastopenq;
         __be32 dest = inet->inet_daddr;
         __be32 src = inet->inet_rcv_saddr;
         __u16 destp = ntohs(inet->inet_dport);
@@ -2448,9 +2694,9 @@ static void get_tcp4_sock(struct sock *sk, struct seq_file *f, int i, int *len)
                 tp->write_seq - tp->snd_una,
                 rx_queue,
                 timer_active,
-                jiffies_to_clock_t(timer_expires - jiffies),
+                jiffies_delta_to_clock_t(timer_expires - jiffies),
                 icsk->icsk_retransmits,
-                sock_i_uid(sk),
+                from_kuid_munged(seq_user_ns(f), sock_i_uid(sk)),
                 icsk->icsk_probes_out,
                 sock_i_ino(sk),
                 atomic_read(&sk->sk_refcnt), sk,
@@ -2458,7 +2704,9 @@ static void get_tcp4_sock(struct sock *sk, struct seq_file *f, int i, int *len)
                 jiffies_to_clock_t(icsk->icsk_ack.ato),
                 (icsk->icsk_ack.quick << 1) | icsk->icsk_ack.pingpong,
                 tp->snd_cwnd,
-                tcp_in_initial_slowstart(tp) ? -1 : tp->snd_ssthresh,
+                sk->sk_state == TCP_LISTEN ?
+                    (fastopenq ? fastopenq->max_qlen : 0) :
+                    (tcp_in_initial_slowstart(tp) ? -1 : tp->snd_ssthresh),
                 len);
 }
 
@@ -2467,10 +2715,7 @@ static void get_timewait4_sock(const struct inet_timewait_sock *tw,
 {
         __be32 dest, src;
         __u16 destp, srcp;
-        int ttd = tw->tw_ttd - jiffies;
-
-        if (ttd < 0)
-                ttd = 0;
+        long delta = tw->tw_ttd - jiffies;
 
         dest  = tw->tw_daddr;
         src   = tw->tw_rcv_saddr;
@@ -2480,7 +2725,7 @@ static void get_timewait4_sock(const struct inet_timewait_sock *tw,
         seq_printf(f, "%4d: %08X:%04X %08X:%04X"
                 " %02X %08X:%08X %02X:%08lX %08X %5d %8d %d %d %pK%n",
                 i, src, srcp, dest, destp, tw->tw_substate, 0, 0,
-                3, jiffies_to_clock_t(ttd), 0, 0, 0, 0,
+                3, jiffies_delta_to_clock_t(delta), 0, 0, 0, 0,
                 atomic_read(&tw->tw_refcnt), tw, len);
 }
 
diff --git a/net/ipv4/tcp_metrics.c b/net/ipv4/tcp_metrics.c
index 2288a6399e1e..0abe67bb4d3a 100644
--- a/net/ipv4/tcp_metrics.c
+++ b/net/ipv4/tcp_metrics.c
@@ -731,6 +731,18 @@ static int __net_init tcp_net_metrics_init(struct net *net)
 
 static void __net_exit tcp_net_metrics_exit(struct net *net)
 {
+        unsigned int i;
+
+        for (i = 0; i < (1U << net->ipv4.tcp_metrics_hash_log) ; i++) {
+                struct tcp_metrics_block *tm, *next;
+
+                tm = rcu_dereference_protected(net->ipv4.tcp_metrics_hash[i].chain, 1);
+                while (tm) {
+                        next = rcu_dereference_protected(tm->tcpm_next, 1);
+                        kfree(tm);
+                        tm = next;
+                }
+        }
         kfree(net->ipv4.tcp_metrics_hash);
 }
 
diff --git a/net/ipv4/tcp_minisocks.c b/net/ipv4/tcp_minisocks.c
index 232a90c3ec86..e965319d610b 100644
--- a/net/ipv4/tcp_minisocks.c
+++ b/net/ipv4/tcp_minisocks.c
@@ -387,8 +387,6 @@ struct sock *tcp_create_openreq_child(struct sock *sk, struct request_sock *req,
                 struct tcp_sock *oldtp = tcp_sk(sk);
                 struct tcp_cookie_values *oldcvp = oldtp->cookie_values;
 
-                inet_sk_rx_dst_set(newsk, skb);
-
                 /* TCP Cookie Transactions require space for the cookie pair,
                  * as it differs for each connection.  There is no need to
                  * copy any s_data_payload stored at the original socket.
@@ -509,6 +507,7 @@ struct sock *tcp_create_openreq_child(struct sock *sk, struct request_sock *req,
                         newicsk->icsk_ack.last_seg_size = skb->len - newtp->tcp_header_len;
                 newtp->rx_opt.mss_clamp = req->mss;
                 TCP_ECN_openreq_child(newtp, req);
+                newtp->fastopen_rsk = NULL;
 
                 TCP_INC_STATS_BH(sock_net(sk), TCP_MIB_PASSIVEOPENS);
         }
@@ -517,13 +516,18 @@ struct sock *tcp_create_openreq_child(struct sock *sk, struct request_sock *req,
 EXPORT_SYMBOL(tcp_create_openreq_child);
 
 /*
- *      Process an incoming packet for SYN_RECV sockets represented
- *      as a request_sock.
+ * Process an incoming packet for SYN_RECV sockets represented as a
+ * request_sock. Normally sk is the listener socket but for TFO it
+ * points to the child socket.
+ *
+ * XXX (TFO) - The current impl contains a special check for ack
+ * validation and inside tcp_v4_reqsk_send_ack(). Can we do better?
  */
 
 struct sock *tcp_check_req(struct sock *sk, struct sk_buff *skb,
                            struct request_sock *req,
-                           struct request_sock **prev)
+                           struct request_sock **prev,
+                           bool fastopen)
 {
         struct tcp_options_received tmp_opt;
         const u8 *hash_location;
@@ -532,6 +536,8 @@ struct sock *tcp_check_req(struct sock *sk, struct sk_buff *skb,
         __be32 flg = tcp_flag_word(th) & (TCP_FLAG_RST|TCP_FLAG_SYN|TCP_FLAG_ACK);
         bool paws_reject = false;
 
+        BUG_ON(fastopen == (sk->sk_state == TCP_LISTEN));
+
         tmp_opt.saw_tstamp = 0;
         if (th->doff > (sizeof(struct tcphdr)>>2)) {
                 tcp_parse_options(skb, &tmp_opt, &hash_location, 0, NULL);
@@ -567,6 +573,9 @@ struct sock *tcp_check_req(struct sock *sk, struct sk_buff *skb,
                  *
                  * Enforce "SYN-ACK" according to figure 8, figure 6
                  * of RFC793, fixed by RFC1122.
+                 *
+                 * Note that even if there is new data in the SYN packet
+                 * they will be thrown away too.
                  */
                 req->rsk_ops->rtx_syn_ack(sk, req, NULL);
                 return NULL;
@@ -624,9 +633,12 @@ struct sock *tcp_check_req(struct sock *sk, struct sk_buff *skb,
          *                  sent (the segment carries an unacceptable ACK) ...
          *                  a reset is sent."
          *
-         * Invalid ACK: reset will be sent by listening socket
+         * Invalid ACK: reset will be sent by listening socket.
+         * Note that the ACK validity check for a Fast Open socket is done
+         * elsewhere and is checked directly against the child socket rather
+         * than req because user data may have been sent out.
          */
-        if ((flg & TCP_FLAG_ACK) &&
+        if ((flg & TCP_FLAG_ACK) && !fastopen &&
             (TCP_SKB_CB(skb)->ack_seq !=
              tcp_rsk(req)->snt_isn + 1 + tcp_s_data_size(tcp_sk(sk))))
                 return sk;
@@ -639,7 +651,7 @@ struct sock *tcp_check_req(struct sock *sk, struct sk_buff *skb,
         /* RFC793: "first check sequence number". */
 
         if (paws_reject || !tcp_in_window(TCP_SKB_CB(skb)->seq, TCP_SKB_CB(skb)->end_seq,
-                                          tcp_rsk(req)->rcv_isn + 1, tcp_rsk(req)->rcv_isn + 1 + req->rcv_wnd)) {
+                                          tcp_rsk(req)->rcv_nxt, tcp_rsk(req)->rcv_nxt + req->rcv_wnd)) {
                 /* Out of window: send ACK and drop. */
                 if (!(flg & TCP_FLAG_RST))
                         req->rsk_ops->send_ack(sk, skb, req);
@@ -650,7 +662,7 @@ struct sock *tcp_check_req(struct sock *sk, struct sk_buff *skb,
 
         /* In sequence, PAWS is OK. */
 
-        if (tmp_opt.saw_tstamp && !after(TCP_SKB_CB(skb)->seq, tcp_rsk(req)->rcv_isn + 1))
+        if (tmp_opt.saw_tstamp && !after(TCP_SKB_CB(skb)->seq, tcp_rsk(req)->rcv_nxt))
                 req->ts_recent = tmp_opt.rcv_tsval;
 
         if (TCP_SKB_CB(skb)->seq == tcp_rsk(req)->rcv_isn) {
@@ -669,10 +681,19 @@ struct sock *tcp_check_req(struct sock *sk, struct sk_buff *skb,
 
         /* ACK sequence verified above, just make sure ACK is
          * set.  If ACK not set, just silently drop the packet.
+         *
+         * XXX (TFO) - if we ever allow "data after SYN", the
+         * following check needs to be removed.
          */
         if (!(flg & TCP_FLAG_ACK))
                 return NULL;
 
+        /* For Fast Open no more processing is needed (sk is the
+         * child socket).
+         */
+        if (fastopen)
+                return sk;
+
         /* While TCP_DEFER_ACCEPT is active, drop bare ACK. */
         if (req->retrans < inet_csk(sk)->icsk_accept_queue.rskq_defer_accept &&
             TCP_SKB_CB(skb)->end_seq == tcp_rsk(req)->rcv_isn + 1) {
@@ -708,11 +729,21 @@ listen_overflow:
         }
 
 embryonic_reset:
-        NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_EMBRYONICRSTS);
-        if (!(flg & TCP_FLAG_RST))
+        if (!(flg & TCP_FLAG_RST)) {
+                /* Received a bad SYN pkt - for TFO We try not to reset
+                 * the local connection unless it's really necessary to
+                 * avoid becoming vulnerable to outside attack aiming at
+                 * resetting legit local connections.
+                 */
                 req->rsk_ops->send_reset(sk, skb);
-
-        inet_csk_reqsk_queue_drop(sk, req, prev);
+        } else if (fastopen) { /* received a valid RST pkt */
+                reqsk_fastopen_remove(sk, req, true);
+                tcp_reset(sk);
+        }
+        if (!fastopen) {
+                inet_csk_reqsk_queue_drop(sk, req, prev);
+                NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_EMBRYONICRSTS);
+        }
         return NULL;
 }
 EXPORT_SYMBOL(tcp_check_req);
@@ -721,6 +752,12 @@ EXPORT_SYMBOL(tcp_check_req);
  * Queue segment on the new socket if the new socket is active,
  * otherwise we just shortcircuit this and continue with
  * the new socket.
+ *
+ * For the vast majority of cases child->sk_state will be TCP_SYN_RECV
+ * when entering. But other states are possible due to a race condition
+ * where after __inet_lookup_established() fails but before the listener
+ * locked is obtained, other packets cause the same connection to
+ * be created.
  */
 
 int tcp_child_process(struct sock *parent, struct sock *child,
diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
index 3f1bcff0b10b..cfe6ffe1c177 100644
--- a/net/ipv4/tcp_output.c
+++ b/net/ipv4/tcp_output.c
@@ -702,7 +702,8 @@ static unsigned int tcp_synack_options(struct sock *sk,
                                    unsigned int mss, struct sk_buff *skb,
                                    struct tcp_out_options *opts,
                                    struct tcp_md5sig_key **md5,
-                                   struct tcp_extend_values *xvp)
+                                   struct tcp_extend_values *xvp,
+                                   struct tcp_fastopen_cookie *foc)
 {
         struct inet_request_sock *ireq = inet_rsk(req);
         unsigned int remaining = MAX_TCP_OPTION_SPACE;
@@ -747,7 +748,15 @@ static unsigned int tcp_synack_options(struct sock *sk,
                 if (unlikely(!ireq->tstamp_ok))
                         remaining -= TCPOLEN_SACKPERM_ALIGNED;
         }
-
+        if (foc != NULL) {
+                u32 need = TCPOLEN_EXP_FASTOPEN_BASE + foc->len;
+                need = (need + 3) & ~3U;  /* Align to 32 bits */
+                if (remaining >= need) {
+                        opts->options |= OPTION_FAST_OPEN_COOKIE;
+                        opts->fastopen_cookie = foc;
+                        remaining -= need;
+                }
+        }
         /* Similar rationale to tcp_syn_options() applies here, too.
          * If the <SYN> options fit, the same options should fit now!
          */
@@ -910,14 +919,18 @@ void tcp_release_cb(struct sock *sk)
         if (flags & (1UL << TCP_TSQ_DEFERRED))
                 tcp_tsq_handler(sk);
 
-        if (flags & (1UL << TCP_WRITE_TIMER_DEFERRED))
+        if (flags & (1UL << TCP_WRITE_TIMER_DEFERRED)) {
                 tcp_write_timer_handler(sk);
-
-        if (flags & (1UL << TCP_DELACK_TIMER_DEFERRED))
+                __sock_put(sk);
+        }
+        if (flags & (1UL << TCP_DELACK_TIMER_DEFERRED)) {
                 tcp_delack_timer_handler(sk);
-
-        if (flags & (1UL << TCP_MTU_REDUCED_DEFERRED))
+                __sock_put(sk);
+        }
+        if (flags & (1UL << TCP_MTU_REDUCED_DEFERRED)) {
                 sk->sk_prot->mtu_reduced(sk);
+                __sock_put(sk);
+        }
 }
 EXPORT_SYMBOL(tcp_release_cb);
 
@@ -940,7 +953,7 @@ void __init tcp_tasklet_init(void)
  * We cant xmit new skbs from this context, as we might already
  * hold qdisc lock.
  */
-void tcp_wfree(struct sk_buff *skb)
+static void tcp_wfree(struct sk_buff *skb)
 {
         struct sock *sk = skb->sk;
         struct tcp_sock *tp = tcp_sk(sk);
@@ -1522,21 +1535,21 @@ static void tcp_cwnd_validate(struct sock *sk)
  * when we would be allowed to send the split-due-to-Nagle skb fully.
  */
 static unsigned int tcp_mss_split_point(const struct sock *sk, const struct sk_buff *skb,
-                                        unsigned int mss_now, unsigned int cwnd)
+                                        unsigned int mss_now, unsigned int max_segs)
 {
         const struct tcp_sock *tp = tcp_sk(sk);
-        u32 needed, window, cwnd_len;
+        u32 needed, window, max_len;
 
         window = tcp_wnd_end(tp) - TCP_SKB_CB(skb)->seq;
-        cwnd_len = mss_now * cwnd;
+        max_len = mss_now * max_segs;
 
-        if (likely(cwnd_len <= window && skb != tcp_write_queue_tail(sk)))
-                return cwnd_len;
+        if (likely(max_len <= window && skb != tcp_write_queue_tail(sk)))
+                return max_len;
 
         needed = min(skb->len, window);
 
-        if (cwnd_len <= needed)
-                return cwnd_len;
+        if (max_len <= needed)
+                return max_len;
 
         return needed - needed % mss_now;
 }
@@ -1765,7 +1778,8 @@ static bool tcp_tso_should_defer(struct sock *sk, struct sk_buff *skb)
         limit = min(send_win, cong_win);
 
         /* If a full-sized TSO skb can be sent, do it. */
-        if (limit >= sk->sk_gso_max_size)
+        if (limit >= min_t(unsigned int, sk->sk_gso_max_size,
+                           sk->sk_gso_max_segs * tp->mss_cache))
                 goto send_now;
 
         /* Middle in queue won't get any more data, full sendable already? */
@@ -1999,7 +2013,9 @@ static bool tcp_write_xmit(struct sock *sk, unsigned int mss_now, int nonagle,
                 limit = mss_now;
                 if (tso_segs > 1 && !tcp_urg_mode(tp))
                         limit = tcp_mss_split_point(sk, skb, mss_now,
-                                                    cwnd_quota);
+                                                    min_t(unsigned int,
+                                                          cwnd_quota,
+                                                          sk->sk_gso_max_segs));
 
                 if (skb->len > limit &&
                     unlikely(tso_fragment(sk, skb, limit, mss_now, gfp)))
@@ -2021,10 +2037,10 @@ static bool tcp_write_xmit(struct sock *sk, unsigned int mss_now, int nonagle,
                 if (push_one)
                         break;
         }
-        if (inet_csk(sk)->icsk_ca_state == TCP_CA_Recovery)
-                tp->prr_out += sent_pkts;
 
         if (likely(sent_pkts)) {
+                if (tcp_in_cwnd_reduction(sk))
+                        tp->prr_out += sent_pkts;
                 tcp_cwnd_validate(sk);
                 return false;
         }
@@ -2526,7 +2542,7 @@ begin_fwd:
                 }
                 NET_INC_STATS_BH(sock_net(sk), mib_idx);
 
-                if (inet_csk(sk)->icsk_ca_state == TCP_CA_Recovery)
+                if (tcp_in_cwnd_reduction(sk))
                         tp->prr_out += tcp_skb_pcount(skb);
 
                 if (skb == tcp_write_queue_head(sk))
@@ -2651,7 +2667,8 @@ int tcp_send_synack(struct sock *sk)
  */
 struct sk_buff *tcp_make_synack(struct sock *sk, struct dst_entry *dst,
                                 struct request_sock *req,
-                                struct request_values *rvp)
+                                struct request_values *rvp,
+                                struct tcp_fastopen_cookie *foc)
 {
         struct tcp_out_options opts;
         struct tcp_extend_values *xvp = tcp_xv(rvp);
@@ -2711,7 +2728,7 @@ struct sk_buff *tcp_make_synack(struct sock *sk, struct dst_entry *dst,
 #endif
         TCP_SKB_CB(skb)->when = tcp_time_stamp;
         tcp_header_size = tcp_synack_options(sk, req, mss,
-                                             skb, &opts, &md5, xvp)
+                                             skb, &opts, &md5, xvp, foc)
                         + sizeof(*th);
 
         skb_push(skb, tcp_header_size);
@@ -2765,7 +2782,8 @@ struct sk_buff *tcp_make_synack(struct sock *sk, struct dst_entry *dst,
         }
 
         th->seq = htonl(TCP_SKB_CB(skb)->seq);
-        th->ack_seq = htonl(tcp_rsk(req)->rcv_isn + 1);
+        /* XXX data is queued and acked as is. No buffer/window check */
+        th->ack_seq = htonl(tcp_rsk(req)->rcv_nxt);
 
         /* RFC1323: The window in SYN & SYN/ACK segments is never scaled. */
         th->window = htons(min(req->rcv_wnd, 65535U));
diff --git a/net/ipv4/tcp_timer.c b/net/ipv4/tcp_timer.c
index 6df36ad55a38..fc04711e80c8 100644
--- a/net/ipv4/tcp_timer.c
+++ b/net/ipv4/tcp_timer.c
@@ -252,7 +252,8 @@ static void tcp_delack_timer(unsigned long data)
                 inet_csk(sk)->icsk_ack.blocked = 1;
                 NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_DELAYEDACKLOCKED);
                 /* deleguate our work to tcp_release_cb() */
-                set_bit(TCP_WRITE_TIMER_DEFERRED, &tcp_sk(sk)->tsq_flags);
+                if (!test_and_set_bit(TCP_DELACK_TIMER_DEFERRED, &tcp_sk(sk)->tsq_flags))
+                        sock_hold(sk);
         }
         bh_unlock_sock(sk);
         sock_put(sk);
@@ -304,6 +305,35 @@ static void tcp_probe_timer(struct sock *sk)
 }
 
 /*
+ *      Timer for Fast Open socket to retransmit SYNACK. Note that the
+ *      sk here is the child socket, not the parent (listener) socket.
+ */
+static void tcp_fastopen_synack_timer(struct sock *sk)
+{
+        struct inet_connection_sock *icsk = inet_csk(sk);
+        int max_retries = icsk->icsk_syn_retries ? :
+            sysctl_tcp_synack_retries + 1; /* add one more retry for fastopen */
+        struct request_sock *req;
+
+        req = tcp_sk(sk)->fastopen_rsk;
+        req->rsk_ops->syn_ack_timeout(sk, req);
+
+        if (req->retrans >= max_retries) {
+                tcp_write_err(sk);
+                return;
+        }
+        /* XXX (TFO) - Unlike regular SYN-ACK retransmit, we ignore error
+         * returned from rtx_syn_ack() to make it more persistent like
+         * regular retransmit because if the child socket has been accepted
+         * it's not good to give up too easily.
+         */
+        req->rsk_ops->rtx_syn_ack(sk, req, NULL);
+        req->retrans++;
+        inet_csk_reset_xmit_timer(sk, ICSK_TIME_RETRANS,
+                          TCP_TIMEOUT_INIT << req->retrans, TCP_RTO_MAX);
+}
+
+/*
  *      The TCP retransmit timer.
  */
 
@@ -316,7 +346,15 @@ void tcp_retransmit_timer(struct sock *sk)
                 tcp_resume_early_retransmit(sk);
                 return;
         }
-
+        if (tp->fastopen_rsk) {
+                BUG_ON(sk->sk_state != TCP_SYN_RECV &&
+                    sk->sk_state != TCP_FIN_WAIT1);
+                tcp_fastopen_synack_timer(sk);
+                /* Before we receive ACK to our SYN-ACK don't retransmit
+                 * anything else (e.g., data or FIN segments).
+                 */
+                return;
+        }
         if (!tp->packets_out)
                 goto out;
 
@@ -481,7 +519,8 @@ static void tcp_write_timer(unsigned long data)
                 tcp_write_timer_handler(sk);
         } else {
                 /* deleguate our work to tcp_release_cb() */
-                set_bit(TCP_WRITE_TIMER_DEFERRED, &tcp_sk(sk)->tsq_flags);
+                if (!test_and_set_bit(TCP_WRITE_TIMER_DEFERRED, &tcp_sk(sk)->tsq_flags))
+                        sock_hold(sk);
         }
         bh_unlock_sock(sk);
         sock_put(sk);
diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
index b4c3582a991f..c4e64328d8ba 100644
--- a/net/ipv4/udp.c
+++ b/net/ipv4/udp.c
@@ -758,7 +758,7 @@ static int udp_send_skb(struct sk_buff *skb, struct flowi4 *fl4)
                 uh->check = CSUM_MANGLED_0;
 
 send:
-        err = ip_send_skb(skb);
+        err = ip_send_skb(sock_net(sk), skb);
         if (err) {
                 if (err == -ENOBUFS && !inet->recverr) {
                         UDP_INC_STATS_USER(sock_net(sk),
@@ -2110,7 +2110,9 @@ static void udp4_format_sock(struct sock *sp, struct seq_file *f,
                 bucket, src, srcp, dest, destp, sp->sk_state,
                 sk_wmem_alloc_get(sp),
                 sk_rmem_alloc_get(sp),
-                0, 0L, 0, sock_i_uid(sp), 0, sock_i_ino(sp),
+                0, 0L, 0,
+                from_kuid_munged(seq_user_ns(f), sock_i_uid(sp)),
+                0, sock_i_ino(sp),
                 atomic_read(&sp->sk_refcnt), sp,
                 atomic_read(&sp->sk_drops), len);
 }
diff --git a/net/ipv4/udp_diag.c b/net/ipv4/udp_diag.c
index 16d0960062be..d2f336ea82ca 100644
--- a/net/ipv4/udp_diag.c
+++ b/net/ipv4/udp_diag.c
@@ -24,7 +24,9 @@ static int sk_diag_dump(struct sock *sk, struct sk_buff *skb,
         if (!inet_diag_bc_sk(bc, sk))
                 return 0;
 
-        return inet_sk_diag_fill(sk, NULL, skb, req, NETLINK_CB(cb->skb).pid,
+        return inet_sk_diag_fill(sk, NULL, skb, req,
+                        sk_user_ns(NETLINK_CB(cb->skb).ssk),
+                        NETLINK_CB(cb->skb).pid,
                         cb->nlh->nlmsg_seq, NLM_F_MULTI, cb->nlh);
 }
 
@@ -69,6 +71,7 @@ static int udp_dump_one(struct udp_table *tbl, struct sk_buff *in_skb,
                 goto out;
 
         err = inet_sk_diag_fill(sk, NULL, rep, req,
+                           sk_user_ns(NETLINK_CB(in_skb).ssk),
                            NETLINK_CB(in_skb).pid,
                            nlh->nlmsg_seq, 0, nlh);
         if (err < 0) {
diff --git a/net/ipv6/Kconfig b/net/ipv6/Kconfig
index 5728695b5449..4f7fe7270e37 100644
--- a/net/ipv6/Kconfig
+++ b/net/ipv6/Kconfig
@@ -201,6 +201,22 @@ config IPV6_TUNNEL
 
           If unsure, say N.
 
+config IPV6_GRE
+        tristate "IPv6: GRE tunnel"
+        select IPV6_TUNNEL
+        ---help---
+          Tunneling means encapsulating data of one protocol type within
+          another protocol and sending it over a channel that understands the
+          encapsulating protocol. This particular tunneling driver implements
+          GRE (Generic Routing Encapsulation) and at this time allows
+          encapsulating of IPv4 or IPv6 over existing IPv6 infrastructure.
+          This driver is useful if the other endpoint is a Cisco router: Cisco
+          likes GRE much better than the other Linux tunneling driver ("IP
+          tunneling" above). In addition, GRE allows multicast redistribution
+          through the tunnel.
+
+          Saying M here will produce a module called ip6_gre. If unsure, say N.
+
 config IPV6_MULTIPLE_TABLES
         bool "IPv6: Multiple Routing Tables"
         depends on EXPERIMENTAL
diff --git a/net/ipv6/Makefile b/net/ipv6/Makefile
index 686934acfac1..b6d3f79151e2 100644
--- a/net/ipv6/Makefile
+++ b/net/ipv6/Makefile
@@ -36,6 +36,7 @@ obj-$(CONFIG_NETFILTER)	+= netfilter/
 
 obj-$(CONFIG_IPV6_SIT) += sit.o
 obj-$(CONFIG_IPV6_TUNNEL) += ip6_tunnel.o
+obj-$(CONFIG_IPV6_GRE) += ip6_gre.o
 
 obj-y += addrconf_core.o exthdrs_core.o
 
diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index 79181819a24f..572cb660837b 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -127,8 +127,8 @@ static inline void addrconf_sysctl_unregister(struct inet6_dev *idev)
 #endif
 
 #ifdef CONFIG_IPV6_PRIVACY
-static int __ipv6_regen_rndid(struct inet6_dev *idev);
-static int __ipv6_try_regen_rndid(struct inet6_dev *idev, struct in6_addr *tmpaddr);
+static void __ipv6_regen_rndid(struct inet6_dev *idev);
+static void __ipv6_try_regen_rndid(struct inet6_dev *idev, struct in6_addr *tmpaddr);
 static void ipv6_regen_rndid(unsigned long data);
 #endif
 
@@ -494,8 +494,7 @@ static void addrconf_forward_change(struct net *net, __s32 newf)
         struct net_device *dev;
         struct inet6_dev *idev;
 
-        rcu_read_lock();
-        for_each_netdev_rcu(net, dev) {
+        for_each_netdev(net, dev) {
                 idev = __in6_dev_get(dev);
                 if (idev) {
                         int changed = (!idev->cnf.forwarding) ^ (!newf);
@@ -504,7 +503,6 @@ static void addrconf_forward_change(struct net *net, __s32 newf)
                                 dev_forward_change(idev);
                 }
         }
-        rcu_read_unlock();
 }
 
 static int addrconf_fixup_forwarding(struct ctl_table *table, int *p, int newf)
@@ -854,16 +852,7 @@ retry:
         }
         in6_ifa_hold(ifp);
         memcpy(addr.s6_addr, ifp->addr.s6_addr, 8);
-        if (__ipv6_try_regen_rndid(idev, tmpaddr) < 0) {
-                spin_unlock_bh(&ifp->lock);
-                write_unlock(&idev->lock);
-                pr_warn("%s: regeneration of randomized interface id failed\n",
-                        __func__);
-                in6_ifa_put(ifp);
-                in6_dev_put(idev);
-                ret = -1;
-                goto out;
-        }
+        __ipv6_try_regen_rndid(idev, tmpaddr);
         memcpy(&addr.s6_addr[8], idev->rndid, 8);
         age = (now - ifp->tstamp) / HZ;
         tmp_valid_lft = min_t(__u32,
@@ -1095,7 +1084,7 @@ out:
         return ret;
 }
 
-int ipv6_dev_get_saddr(struct net *net, struct net_device *dst_dev,
+int ipv6_dev_get_saddr(struct net *net, const struct net_device *dst_dev,
                        const struct in6_addr *daddr, unsigned int prefs,
                        struct in6_addr *saddr)
 {
@@ -1602,7 +1591,7 @@ static int ipv6_inherit_eui64(u8 *eui, struct inet6_dev *idev)
 
 #ifdef CONFIG_IPV6_PRIVACY
 /* (re)generation of randomized interface identifier (RFC 3041 3.2, 3.5) */
-static int __ipv6_regen_rndid(struct inet6_dev *idev)
+static void __ipv6_regen_rndid(struct inet6_dev *idev)
 {
 regen:
         get_random_bytes(idev->rndid, sizeof(idev->rndid));
@@ -1629,8 +1618,6 @@ regen:
                 if ((idev->rndid[2]|idev->rndid[3]|idev->rndid[4]|idev->rndid[5]|idev->rndid[6]|idev->rndid[7]) == 0x00)
                         goto regen;
         }
-
-        return 0;
 }
 
 static void ipv6_regen_rndid(unsigned long data)
@@ -1644,8 +1631,7 @@ static void ipv6_regen_rndid(unsigned long data)
         if (idev->dead)
                 goto out;
 
-        if (__ipv6_regen_rndid(idev) < 0)
-                goto out;
+        __ipv6_regen_rndid(idev);
 
         expires = jiffies +
                 idev->cnf.temp_prefered_lft * HZ -
@@ -1666,13 +1652,10 @@ out:
         in6_dev_put(idev);
 }
 
-static int __ipv6_try_regen_rndid(struct inet6_dev *idev, struct in6_addr *tmpaddr)
+static void  __ipv6_try_regen_rndid(struct inet6_dev *idev, struct in6_addr *tmpaddr)
 {
-        int ret = 0;
-
         if (tmpaddr && memcmp(idev->rndid, &tmpaddr->s6_addr[8], 8) == 0)
-                ret = __ipv6_regen_rndid(idev);
-        return ret;
+                __ipv6_regen_rndid(idev);
 }
 #endif
 
diff --git a/net/ipv6/ip6_flowlabel.c b/net/ipv6/ip6_flowlabel.c
index 9772fbd8a3f5..90bbefb57943 100644
--- a/net/ipv6/ip6_flowlabel.c
+++ b/net/ipv6/ip6_flowlabel.c
@@ -22,6 +22,7 @@
 #include <linux/seq_file.h>
 #include <linux/slab.h>
 #include <linux/export.h>
+#include <linux/pid_namespace.h>
 
 #include <net/net_namespace.h>
 #include <net/sock.h>
@@ -91,6 +92,8 @@ static struct ip6_flowlabel *fl_lookup(struct net *net, __be32 label)
 static void fl_free(struct ip6_flowlabel *fl)
 {
         if (fl) {
+                if (fl->share == IPV6_FL_S_PROCESS)
+                        put_pid(fl->owner.pid);
                 release_net(fl->fl_net);
                 kfree(fl->opt);
         }
@@ -394,10 +397,10 @@ fl_create(struct net *net, struct sock *sk, struct in6_flowlabel_req *freq,
         case IPV6_FL_S_ANY:
                 break;
         case IPV6_FL_S_PROCESS:
-                fl->owner = current->pid;
+                fl->owner.pid = get_task_pid(current, PIDTYPE_PID);
                 break;
         case IPV6_FL_S_USER:
-                fl->owner = current_euid();
+                fl->owner.uid = current_euid();
                 break;
         default:
                 err = -EINVAL;
@@ -561,7 +564,10 @@ recheck:
                                 err = -EPERM;
                                 if (fl1->share == IPV6_FL_S_EXCL ||
                                     fl1->share != fl->share ||
-                                    fl1->owner != fl->owner)
+                                    ((fl1->share == IPV6_FL_S_PROCESS) &&
+                                     (fl1->owner.pid == fl->owner.pid)) ||
+                                    ((fl1->share == IPV6_FL_S_USER) &&
+                                     uid_eq(fl1->owner.uid, fl->owner.uid)))
                                         goto release;
 
                                 err = -EINVAL;
@@ -621,6 +627,7 @@ done:
 
 struct ip6fl_iter_state {
         struct seq_net_private p;
+        struct pid_namespace *pid_ns;
         int bucket;
 };
 
@@ -699,6 +706,7 @@ static void ip6fl_seq_stop(struct seq_file *seq, void *v)
 
 static int ip6fl_seq_show(struct seq_file *seq, void *v)
 {
+        struct ip6fl_iter_state *state = ip6fl_seq_private(seq);
         if (v == SEQ_START_TOKEN)
                 seq_printf(seq, "%-5s %-1s %-6s %-6s %-6s %-8s %-32s %s\n",
                            "Label", "S", "Owner", "Users", "Linger", "Expires", "Dst", "Opt");
@@ -708,7 +716,11 @@ static int ip6fl_seq_show(struct seq_file *seq, void *v)
                            "%05X %-1d %-6d %-6d %-6ld %-8ld %pi6 %-4d\n",
                            (unsigned int)ntohl(fl->label),
                            fl->share,
-                           (int)fl->owner,
+                           ((fl->share == IPV6_FL_S_PROCESS) ?
+                            pid_nr_ns(fl->owner.pid, state->pid_ns) :
+                            ((fl->share == IPV6_FL_S_USER) ?
+                             from_kuid_munged(seq_user_ns(seq), fl->owner.uid) :
+                             0)),
                            atomic_read(&fl->users),
                            fl->linger/HZ,
                            (long)(fl->expires - jiffies)/HZ,
@@ -727,8 +739,29 @@ static const struct seq_operations ip6fl_seq_ops = {
 
 static int ip6fl_seq_open(struct inode *inode, struct file *file)
 {
-        return seq_open_net(inode, file, &ip6fl_seq_ops,
-                            sizeof(struct ip6fl_iter_state));
+        struct seq_file *seq;
+        struct ip6fl_iter_state *state;
+        int err;
+
+        err = seq_open_net(inode, file, &ip6fl_seq_ops,
+                           sizeof(struct ip6fl_iter_state));
+
+        if (!err) {
+                seq = file->private_data;
+                state = ip6fl_seq_private(seq);
+                rcu_read_lock();
+                state->pid_ns = get_pid_ns(task_active_pid_ns(current));
+                rcu_read_unlock();
+        }
+        return err;
+}
+
+static int ip6fl_seq_release(struct inode *inode, struct file *file)
+{
+        struct seq_file *seq = file->private_data;
+        struct ip6fl_iter_state *state = ip6fl_seq_private(seq);
+        put_pid_ns(state->pid_ns);
+        return seq_release_net(inode, file);
 }
 
 static const struct file_operations ip6fl_seq_fops = {
@@ -736,7 +769,7 @@ static const struct file_operations ip6fl_seq_fops = {
         .open           =       ip6fl_seq_open,
         .read           =       seq_read,
         .llseek         =       seq_lseek,
-        .release        =       seq_release_net,
+        .release        =       ip6fl_seq_release,
 };
 
 static int __net_init ip6_flowlabel_proc_init(struct net *net)
diff --git a/net/ipv6/ip6_gre.c b/net/ipv6/ip6_gre.c
new file mode 100644
index 000000000000..424d11a4e7ff
--- /dev/null
+++ b/net/ipv6/ip6_gre.c
@@ -0,0 +1,1792 @@
+/*
+ *      GRE over IPv6 protocol decoder.
+ *
+ *      Authors: Dmitry Kozlov (xeb@mail.ru)
+ *
+ *      This program is free software; you can redistribute it and/or
+ *      modify it under the terms of the GNU General Public License
+ *      as published by the Free Software Foundation; either version
+ *      2 of the License, or (at your option) any later version.
+ *
+ */
+
+#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
+
+#include <linux/capability.h>
+#include <linux/module.h>
+#include <linux/types.h>
+#include <linux/kernel.h>
+#include <linux/slab.h>
+#include <linux/uaccess.h>
+#include <linux/skbuff.h>
+#include <linux/netdevice.h>
+#include <linux/in.h>
+#include <linux/tcp.h>
+#include <linux/udp.h>
+#include <linux/if_arp.h>
+#include <linux/mroute.h>
+#include <linux/init.h>
+#include <linux/in6.h>
+#include <linux/inetdevice.h>
+#include <linux/igmp.h>
+#include <linux/netfilter_ipv4.h>
+#include <linux/etherdevice.h>
+#include <linux/if_ether.h>
+#include <linux/hash.h>
+#include <linux/if_tunnel.h>
+#include <linux/ip6_tunnel.h>
+
+#include <net/sock.h>
+#include <net/ip.h>
+#include <net/icmp.h>
+#include <net/protocol.h>
+#include <net/addrconf.h>
+#include <net/arp.h>
+#include <net/checksum.h>
+#include <net/dsfield.h>
+#include <net/inet_ecn.h>
+#include <net/xfrm.h>
+#include <net/net_namespace.h>
+#include <net/netns/generic.h>
+#include <net/rtnetlink.h>
+
+#include <net/ipv6.h>
+#include <net/ip6_fib.h>
+#include <net/ip6_route.h>
+#include <net/ip6_tunnel.h>
+
+
+#define IPV6_TCLASS_MASK (IPV6_FLOWINFO_MASK & ~IPV6_FLOWLABEL_MASK)
+#define IPV6_TCLASS_SHIFT 20
+
+#define HASH_SIZE_SHIFT  5
+#define HASH_SIZE (1 << HASH_SIZE_SHIFT)
+
+static int ip6gre_net_id __read_mostly;
+struct ip6gre_net {
+        struct ip6_tnl __rcu *tunnels[4][HASH_SIZE];
+
+        struct net_device *fb_tunnel_dev;
+};
+
+static struct rtnl_link_ops ip6gre_link_ops __read_mostly;
+static int ip6gre_tunnel_init(struct net_device *dev);
+static void ip6gre_tunnel_setup(struct net_device *dev);
+static void ip6gre_tunnel_link(struct ip6gre_net *ign, struct ip6_tnl *t);
+static void ip6gre_tnl_link_config(struct ip6_tnl *t, int set_mtu);
+
+/* Tunnel hash table */
+
+/*
+   4 hash tables:
+
+   3: (remote,local)
+   2: (remote,*)
+   1: (*,local)
+   0: (*,*)
+
+   We require exact key match i.e. if a key is present in packet
+   it will match only tunnel with the same key; if it is not present,
+   it will match only keyless tunnel.
+
+   All keysless packets, if not matched configured keyless tunnels
+   will match fallback tunnel.
+ */
+
+#define HASH_KEY(key) (((__force u32)key^((__force u32)key>>4))&(HASH_SIZE - 1))
+static u32 HASH_ADDR(const struct in6_addr *addr)
+{
+        u32 hash = ipv6_addr_hash(addr);
+
+        return hash_32(hash, HASH_SIZE_SHIFT);
+}
+
+#define tunnels_r_l     tunnels[3]
+#define tunnels_r       tunnels[2]
+#define tunnels_l       tunnels[1]
+#define tunnels_wc      tunnels[0]
+/*
+ * Locking : hash tables are protected by RCU and RTNL
+ */
+
+#define for_each_ip_tunnel_rcu(start) \
+        for (t = rcu_dereference(start); t; t = rcu_dereference(t->next))
+
+/* often modified stats are per cpu, other are shared (netdev->stats) */
+struct pcpu_tstats {
+        u64     rx_packets;
+        u64     rx_bytes;
+        u64     tx_packets;
+        u64     tx_bytes;
+        struct u64_stats_sync   syncp;
+};
+
+static struct rtnl_link_stats64 *ip6gre_get_stats64(struct net_device *dev,
+                struct rtnl_link_stats64 *tot)
+{
+        int i;
+
+        for_each_possible_cpu(i) {
+                const struct pcpu_tstats *tstats = per_cpu_ptr(dev->tstats, i);
+                u64 rx_packets, rx_bytes, tx_packets, tx_bytes;
+                unsigned int start;
+
+                do {
+                        start = u64_stats_fetch_begin_bh(&tstats->syncp);
+                        rx_packets = tstats->rx_packets;
+                        tx_packets = tstats->tx_packets;
+                        rx_bytes = tstats->rx_bytes;
+                        tx_bytes = tstats->tx_bytes;
+                } while (u64_stats_fetch_retry_bh(&tstats->syncp, start));
+
+                tot->rx_packets += rx_packets;
+                tot->tx_packets += tx_packets;
+                tot->rx_bytes   += rx_bytes;
+                tot->tx_bytes   += tx_bytes;
+        }
+
+        tot->multicast = dev->stats.multicast;
+        tot->rx_crc_errors = dev->stats.rx_crc_errors;
+        tot->rx_fifo_errors = dev->stats.rx_fifo_errors;
+        tot->rx_length_errors = dev->stats.rx_length_errors;
+        tot->rx_errors = dev->stats.rx_errors;
+        tot->tx_fifo_errors = dev->stats.tx_fifo_errors;
+        tot->tx_carrier_errors = dev->stats.tx_carrier_errors;
+        tot->tx_dropped = dev->stats.tx_dropped;
+        tot->tx_aborted_errors = dev->stats.tx_aborted_errors;
+        tot->tx_errors = dev->stats.tx_errors;
+
+        return tot;
+}
+
+/* Given src, dst and key, find appropriate for input tunnel. */
+
+static struct ip6_tnl *ip6gre_tunnel_lookup(struct net_device *dev,
+                const struct in6_addr *remote, const struct in6_addr *local,
+                __be32 key, __be16 gre_proto)
+{
+        struct net *net = dev_net(dev);
+        int link = dev->ifindex;
+        unsigned int h0 = HASH_ADDR(remote);
+        unsigned int h1 = HASH_KEY(key);
+        struct ip6_tnl *t, *cand = NULL;
+        struct ip6gre_net *ign = net_generic(net, ip6gre_net_id);
+        int dev_type = (gre_proto == htons(ETH_P_TEB)) ?
+                       ARPHRD_ETHER : ARPHRD_IP6GRE;
+        int score, cand_score = 4;
+
+        for_each_ip_tunnel_rcu(ign->tunnels_r_l[h0 ^ h1]) {
+                if (!ipv6_addr_equal(local, &t->parms.laddr) ||
+                    !ipv6_addr_equal(remote, &t->parms.raddr) ||
+                    key != t->parms.i_key ||
+                    !(t->dev->flags & IFF_UP))
+                        continue;
+
+                if (t->dev->type != ARPHRD_IP6GRE &&
+                    t->dev->type != dev_type)
+                        continue;
+
+                score = 0;
+                if (t->parms.link != link)
+                        score |= 1;
+                if (t->dev->type != dev_type)
+                        score |= 2;
+                if (score == 0)
+                        return t;
+
+                if (score < cand_score) {
+                        cand = t;
+                        cand_score = score;
+                }
+        }
+
+        for_each_ip_tunnel_rcu(ign->tunnels_r[h0 ^ h1]) {
+                if (!ipv6_addr_equal(remote, &t->parms.raddr) ||
+                    key != t->parms.i_key ||
+                    !(t->dev->flags & IFF_UP))
+                        continue;
+
+                if (t->dev->type != ARPHRD_IP6GRE &&
+                    t->dev->type != dev_type)
+                        continue;
+
+                score = 0;
+                if (t->parms.link != link)
+                        score |= 1;
+                if (t->dev->type != dev_type)
+                        score |= 2;
+                if (score == 0)
+                        return t;
+
+                if (score < cand_score) {
+                        cand = t;
+                        cand_score = score;
+                }
+        }
+
+        for_each_ip_tunnel_rcu(ign->tunnels_l[h1]) {
+                if ((!ipv6_addr_equal(local, &t->parms.laddr) &&
+                          (!ipv6_addr_equal(local, &t->parms.raddr) ||
+                                 !ipv6_addr_is_multicast(local))) ||
+                    key != t->parms.i_key ||
+                    !(t->dev->flags & IFF_UP))
+                        continue;
+
+                if (t->dev->type != ARPHRD_IP6GRE &&
+                    t->dev->type != dev_type)
+                        continue;
+
+                score = 0;
+                if (t->parms.link != link)
+                        score |= 1;
+                if (t->dev->type != dev_type)
+                        score |= 2;
+                if (score == 0)
+                        return t;
+
+                if (score < cand_score) {
+                        cand = t;
+                        cand_score = score;
+                }
+        }
+
+        for_each_ip_tunnel_rcu(ign->tunnels_wc[h1]) {
+                if (t->parms.i_key != key ||
+                    !(t->dev->flags & IFF_UP))
+                        continue;
+
+                if (t->dev->type != ARPHRD_IP6GRE &&
+                    t->dev->type != dev_type)
+                        continue;
+
+                score = 0;
+                if (t->parms.link != link)
+                        score |= 1;
+                if (t->dev->type != dev_type)
+                        score |= 2;
+                if (score == 0)
+                        return t;
+
+                if (score < cand_score) {
+                        cand = t;
+                        cand_score = score;
+                }
+        }
+
+        if (cand != NULL)
+                return cand;
+
+        dev = ign->fb_tunnel_dev;
+        if (dev->flags & IFF_UP)
+                return netdev_priv(dev);
+
+        return NULL;
+}
+
+static struct ip6_tnl __rcu **__ip6gre_bucket(struct ip6gre_net *ign,
+                const struct __ip6_tnl_parm *p)
+{
+        const struct in6_addr *remote = &p->raddr;
+        const struct in6_addr *local = &p->laddr;
+        unsigned int h = HASH_KEY(p->i_key);
+        int prio = 0;
+
+        if (!ipv6_addr_any(local))
+                prio |= 1;
+        if (!ipv6_addr_any(remote) && !ipv6_addr_is_multicast(remote)) {
+                prio |= 2;
+                h ^= HASH_ADDR(remote);
+        }
+
+        return &ign->tunnels[prio][h];
+}
+
+static inline struct ip6_tnl __rcu **ip6gre_bucket(struct ip6gre_net *ign,
+                const struct ip6_tnl *t)
+{
+        return __ip6gre_bucket(ign, &t->parms);
+}
+
+static void ip6gre_tunnel_link(struct ip6gre_net *ign, struct ip6_tnl *t)
+{
+        struct ip6_tnl __rcu **tp = ip6gre_bucket(ign, t);
+
+        rcu_assign_pointer(t->next, rtnl_dereference(*tp));
+        rcu_assign_pointer(*tp, t);
+}
+
+static void ip6gre_tunnel_unlink(struct ip6gre_net *ign, struct ip6_tnl *t)
+{
+        struct ip6_tnl __rcu **tp;
+        struct ip6_tnl *iter;
+
+        for (tp = ip6gre_bucket(ign, t);
+             (iter = rtnl_dereference(*tp)) != NULL;
+             tp = &iter->next) {
+                if (t == iter) {
+                        rcu_assign_pointer(*tp, t->next);
+                        break;
+                }
+        }
+}
+
+static struct ip6_tnl *ip6gre_tunnel_find(struct net *net,
+                                           const struct __ip6_tnl_parm *parms,
+                                           int type)
+{
+        const struct in6_addr *remote = &parms->raddr;
+        const struct in6_addr *local = &parms->laddr;
+        __be32 key = parms->i_key;
+        int link = parms->link;
+        struct ip6_tnl *t;
+        struct ip6_tnl __rcu **tp;
+        struct ip6gre_net *ign = net_generic(net, ip6gre_net_id);
+
+        for (tp = __ip6gre_bucket(ign, parms);
+             (t = rtnl_dereference(*tp)) != NULL;
+             tp = &t->next)
+                if (ipv6_addr_equal(local, &t->parms.laddr) &&
+                    ipv6_addr_equal(remote, &t->parms.raddr) &&
+                    key == t->parms.i_key &&
+                    link == t->parms.link &&
+                    type == t->dev->type)
+                        break;
+
+        return t;
+}
+
+static struct ip6_tnl *ip6gre_tunnel_locate(struct net *net,
+                const struct __ip6_tnl_parm *parms, int create)
+{
+        struct ip6_tnl *t, *nt;
+        struct net_device *dev;
+        char name[IFNAMSIZ];
+        struct ip6gre_net *ign = net_generic(net, ip6gre_net_id);
+
+        t = ip6gre_tunnel_find(net, parms, ARPHRD_IP6GRE);
+        if (t || !create)
+                return t;
+
+        if (parms->name[0])
+                strlcpy(name, parms->name, IFNAMSIZ);
+        else
+                strcpy(name, "ip6gre%d");
+
+        dev = alloc_netdev(sizeof(*t), name, ip6gre_tunnel_setup);
+        if (!dev)
+                return NULL;
+
+        dev_net_set(dev, net);
+
+        nt = netdev_priv(dev);
+        nt->parms = *parms;
+        dev->rtnl_link_ops = &ip6gre_link_ops;
+
+        nt->dev = dev;
+        ip6gre_tnl_link_config(nt, 1);
+
+        if (register_netdevice(dev) < 0)
+                goto failed_free;
+
+        /* Can use a lockless transmit, unless we generate output sequences */
+        if (!(nt->parms.o_flags & GRE_SEQ))
+                dev->features |= NETIF_F_LLTX;
+
+        dev_hold(dev);
+        ip6gre_tunnel_link(ign, nt);
+        return nt;
+
+failed_free:
+        free_netdev(dev);
+        return NULL;
+}
+
+static void ip6gre_tunnel_uninit(struct net_device *dev)
+{
+        struct net *net = dev_net(dev);
+        struct ip6gre_net *ign = net_generic(net, ip6gre_net_id);
+
+        ip6gre_tunnel_unlink(ign, netdev_priv(dev));
+        dev_put(dev);
+}
+
+
+static void ip6gre_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
+                u8 type, u8 code, int offset, __be32 info)
+{
+        const struct ipv6hdr *ipv6h = (const struct ipv6hdr *)skb->data;
+        __be16 *p = (__be16 *)(skb->data + offset);
+        int grehlen = offset + 4;
+        struct ip6_tnl *t;
+        __be16 flags;
+
+        flags = p[0];
+        if (flags&(GRE_CSUM|GRE_KEY|GRE_SEQ|GRE_ROUTING|GRE_VERSION)) {
+                if (flags&(GRE_VERSION|GRE_ROUTING))
+                        return;
+                if (flags&GRE_KEY) {
+                        grehlen += 4;
+                        if (flags&GRE_CSUM)
+                                grehlen += 4;
+                }
+        }
+
+        /* If only 8 bytes returned, keyed message will be dropped here */
+        if (!pskb_may_pull(skb, grehlen))
+                return;
+        ipv6h = (const struct ipv6hdr *)skb->data;
+        p = (__be16 *)(skb->data + offset);
+
+        rcu_read_lock();
+
+        t = ip6gre_tunnel_lookup(skb->dev, &ipv6h->daddr, &ipv6h->saddr,
+                                flags & GRE_KEY ?
+                                *(((__be32 *)p) + (grehlen / 4) - 1) : 0,
+                                p[1]);
+        if (t == NULL)
+                goto out;
+
+        switch (type) {
+                __u32 teli;
+                struct ipv6_tlv_tnl_enc_lim *tel;
+                __u32 mtu;
+        case ICMPV6_DEST_UNREACH:
+                net_warn_ratelimited("%s: Path to destination invalid or inactive!\n",
+                                     t->parms.name);
+                break;
+        case ICMPV6_TIME_EXCEED:
+                if (code == ICMPV6_EXC_HOPLIMIT) {
+                        net_warn_ratelimited("%s: Too small hop limit or routing loop in tunnel!\n",
+                                             t->parms.name);
+                }
+                break;
+        case ICMPV6_PARAMPROB:
+                teli = 0;
+                if (code == ICMPV6_HDR_FIELD)
+                        teli = ip6_tnl_parse_tlv_enc_lim(skb, skb->data);
+
+                if (teli && teli == info - 2) {
+                        tel = (struct ipv6_tlv_tnl_enc_lim *) &skb->data[teli];
+                        if (tel->encap_limit == 0) {
+                                net_warn_ratelimited("%s: Too small encapsulation limit or routing loop in tunnel!\n",
+                                                     t->parms.name);
+                        }
+                } else {
+                        net_warn_ratelimited("%s: Recipient unable to parse tunneled packet!\n",
+                                             t->parms.name);
+                }
+                break;
+        case ICMPV6_PKT_TOOBIG:
+                mtu = info - offset;
+                if (mtu < IPV6_MIN_MTU)
+                        mtu = IPV6_MIN_MTU;
+                t->dev->mtu = mtu;
+                break;
+        }
+
+        if (time_before(jiffies, t->err_time + IP6TUNNEL_ERR_TIMEO))
+                t->err_count++;
+        else
+                t->err_count = 1;
+        t->err_time = jiffies;
+out:
+        rcu_read_unlock();
+}
+
+static inline void ip6gre_ecn_decapsulate_ipv4(const struct ip6_tnl *t,
+                const struct ipv6hdr *ipv6h, struct sk_buff *skb)
+{
+        __u8 dsfield = ipv6_get_dsfield(ipv6h) & ~INET_ECN_MASK;
+
+        if (t->parms.flags & IP6_TNL_F_RCV_DSCP_COPY)
+                ipv4_change_dsfield(ip_hdr(skb), INET_ECN_MASK, dsfield);
+
+        if (INET_ECN_is_ce(dsfield))
+                IP_ECN_set_ce(ip_hdr(skb));
+}
+
+static inline void ip6gre_ecn_decapsulate_ipv6(const struct ip6_tnl *t,
+                const struct ipv6hdr *ipv6h, struct sk_buff *skb)
+{
+        if (t->parms.flags & IP6_TNL_F_RCV_DSCP_COPY)
+                ipv6_copy_dscp(ipv6_get_dsfield(ipv6h), ipv6_hdr(skb));
+
+        if (INET_ECN_is_ce(ipv6_get_dsfield(ipv6h)))
+                IP6_ECN_set_ce(ipv6_hdr(skb));
+}
+
+static int ip6gre_rcv(struct sk_buff *skb)
+{
+        const struct ipv6hdr *ipv6h;
+        u8     *h;
+        __be16    flags;
+        __sum16   csum = 0;
+        __be32 key = 0;
+        u32    seqno = 0;
+        struct ip6_tnl *tunnel;
+        int    offset = 4;
+        __be16 gre_proto;
+
+        if (!pskb_may_pull(skb, sizeof(struct in6_addr)))
+                goto drop_nolock;
+
+        ipv6h = ipv6_hdr(skb);
+        h = skb->data;
+        flags = *(__be16 *)h;
+
+        if (flags&(GRE_CSUM|GRE_KEY|GRE_ROUTING|GRE_SEQ|GRE_VERSION)) {
+                /* - Version must be 0.
+                   - We do not support routing headers.
+                 */
+                if (flags&(GRE_VERSION|GRE_ROUTING))
+                        goto drop_nolock;
+
+                if (flags&GRE_CSUM) {
+                        switch (skb->ip_summed) {
+                        case CHECKSUM_COMPLETE:
+                                csum = csum_fold(skb->csum);
+                                if (!csum)
+                                        break;
+                                /* fall through */
+                        case CHECKSUM_NONE:
+                                skb->csum = 0;
+                                csum = __skb_checksum_complete(skb);
+                                skb->ip_summed = CHECKSUM_COMPLETE;
+                        }
+                        offset += 4;
+                }
+                if (flags&GRE_KEY) {
+                        key = *(__be32 *)(h + offset);
+                        offset += 4;
+                }
+                if (flags&GRE_SEQ) {
+                        seqno = ntohl(*(__be32 *)(h + offset));
+                        offset += 4;
+                }
+        }
+
+        gre_proto = *(__be16 *)(h + 2);
+
+        rcu_read_lock();
+        tunnel = ip6gre_tunnel_lookup(skb->dev,
+                                          &ipv6h->saddr, &ipv6h->daddr, key,
+                                          gre_proto);
+        if (tunnel) {
+                struct pcpu_tstats *tstats;
+
+                if (!xfrm6_policy_check(NULL, XFRM_POLICY_IN, skb))
+                        goto drop;
+
+                if (!ip6_tnl_rcv_ctl(tunnel, &ipv6h->daddr, &ipv6h->saddr)) {
+                        tunnel->dev->stats.rx_dropped++;
+                        goto drop;
+                }
+
+                secpath_reset(skb);
+
+                skb->protocol = gre_proto;
+                /* WCCP version 1 and 2 protocol decoding.
+                 * - Change protocol to IP
+                 * - When dealing with WCCPv2, Skip extra 4 bytes in GRE header
+                 */
+                if (flags == 0 && gre_proto == htons(ETH_P_WCCP)) {
+                        skb->protocol = htons(ETH_P_IP);
+                        if ((*(h + offset) & 0xF0) != 0x40)
+                                offset += 4;
+                }
+
+                skb->mac_header = skb->network_header;
+                __pskb_pull(skb, offset);
+                skb_postpull_rcsum(skb, skb_transport_header(skb), offset);
+                skb->pkt_type = PACKET_HOST;
+
+                if (((flags&GRE_CSUM) && csum) ||
+                    (!(flags&GRE_CSUM) && tunnel->parms.i_flags&GRE_CSUM)) {
+                        tunnel->dev->stats.rx_crc_errors++;
+                        tunnel->dev->stats.rx_errors++;
+                        goto drop;
+                }
+                if (tunnel->parms.i_flags&GRE_SEQ) {
+                        if (!(flags&GRE_SEQ) ||
+                            (tunnel->i_seqno &&
+                                        (s32)(seqno - tunnel->i_seqno) < 0)) {
+                                tunnel->dev->stats.rx_fifo_errors++;
+                                tunnel->dev->stats.rx_errors++;
+                                goto drop;
+                        }
+                        tunnel->i_seqno = seqno + 1;
+                }
+
+                /* Warning: All skb pointers will be invalidated! */
+                if (tunnel->dev->type == ARPHRD_ETHER) {
+                        if (!pskb_may_pull(skb, ETH_HLEN)) {
+                                tunnel->dev->stats.rx_length_errors++;
+                                tunnel->dev->stats.rx_errors++;
+                                goto drop;
+                        }
+
+                        ipv6h = ipv6_hdr(skb);
+                        skb->protocol = eth_type_trans(skb, tunnel->dev);
+                        skb_postpull_rcsum(skb, eth_hdr(skb), ETH_HLEN);
+                }
+
+                tstats = this_cpu_ptr(tunnel->dev->tstats);
+                u64_stats_update_begin(&tstats->syncp);
+                tstats->rx_packets++;
+                tstats->rx_bytes += skb->len;
+                u64_stats_update_end(&tstats->syncp);
+
+                __skb_tunnel_rx(skb, tunnel->dev);
+
+                skb_reset_network_header(skb);
+                if (skb->protocol == htons(ETH_P_IP))
+                        ip6gre_ecn_decapsulate_ipv4(tunnel, ipv6h, skb);
+                else if (skb->protocol == htons(ETH_P_IPV6))
+                        ip6gre_ecn_decapsulate_ipv6(tunnel, ipv6h, skb);
+
+                netif_rx(skb);
+
+                rcu_read_unlock();
+                return 0;
+        }
+        icmpv6_send(skb, ICMPV6_DEST_UNREACH, ICMPV6_PORT_UNREACH, 0);
+
+drop:
+        rcu_read_unlock();
+drop_nolock:
+        kfree_skb(skb);
+        return 0;
+}
+
+struct ipv6_tel_txoption {
+        struct ipv6_txoptions ops;
+        __u8 dst_opt[8];
+};
+
+static void init_tel_txopt(struct ipv6_tel_txoption *opt, __u8 encap_limit)
+{
+        memset(opt, 0, sizeof(struct ipv6_tel_txoption));
+
+        opt->dst_opt[2] = IPV6_TLV_TNL_ENCAP_LIMIT;
+        opt->dst_opt[3] = 1;
+        opt->dst_opt[4] = encap_limit;
+        opt->dst_opt[5] = IPV6_TLV_PADN;
+        opt->dst_opt[6] = 1;
+
+        opt->ops.dst0opt = (struct ipv6_opt_hdr *) opt->dst_opt;
+        opt->ops.opt_nflen = 8;
+}
+
+static netdev_tx_t ip6gre_xmit2(struct sk_buff *skb,
+                         struct net_device *dev,
+                         __u8 dsfield,
+                         struct flowi6 *fl6,
+                         int encap_limit,
+                         __u32 *pmtu)
+{
+        struct net *net = dev_net(dev);
+        struct ip6_tnl *tunnel = netdev_priv(dev);
+        struct net_device *tdev;    /* Device to other host */
+        struct ipv6hdr  *ipv6h;     /* Our new IP header */
+        unsigned int max_headroom;  /* The extra header space needed */
+        int    gre_hlen;
+        struct ipv6_tel_txoption opt;
+        int    mtu;
+        struct dst_entry *dst = NULL, *ndst = NULL;
+        struct net_device_stats *stats = &tunnel->dev->stats;
+        int err = -1;
+        u8 proto;
+        int pkt_len;
+        struct sk_buff *new_skb;
+
+        if (dev->type == ARPHRD_ETHER)
+                IPCB(skb)->flags = 0;
+
+        if (dev->header_ops && dev->type == ARPHRD_IP6GRE) {
+                gre_hlen = 0;
+                ipv6h = (struct ipv6hdr *)skb->data;
+                fl6->daddr = ipv6h->daddr;
+        } else {
+                gre_hlen = tunnel->hlen;
+                fl6->daddr = tunnel->parms.raddr;
+        }
+
+        if (!fl6->flowi6_mark)
+                dst = ip6_tnl_dst_check(tunnel);
+
+        if (!dst) {
+                ndst = ip6_route_output(net, NULL, fl6);
+
+                if (ndst->error)
+                        goto tx_err_link_failure;
+                ndst = xfrm_lookup(net, ndst, flowi6_to_flowi(fl6), NULL, 0);
+                if (IS_ERR(ndst)) {
+                        err = PTR_ERR(ndst);
+                        ndst = NULL;
+                        goto tx_err_link_failure;
+                }
+                dst = ndst;
+        }
+
+        tdev = dst->dev;
+
+        if (tdev == dev) {
+                stats->collisions++;
+                net_warn_ratelimited("%s: Local routing loop detected!\n",
+                                     tunnel->parms.name);
+                goto tx_err_dst_release;
+        }
+
+        mtu = dst_mtu(dst) - sizeof(*ipv6h);
+        if (encap_limit >= 0) {
+                max_headroom += 8;
+                mtu -= 8;
+        }
+        if (mtu < IPV6_MIN_MTU)
+                mtu = IPV6_MIN_MTU;
+        if (skb_dst(skb))
+                skb_dst(skb)->ops->update_pmtu(skb_dst(skb), NULL, skb, mtu);
+        if (skb->len > mtu) {
+                *pmtu = mtu;
+                err = -EMSGSIZE;
+                goto tx_err_dst_release;
+        }
+
+        if (tunnel->err_count > 0) {
+                if (time_before(jiffies,
+                                tunnel->err_time + IP6TUNNEL_ERR_TIMEO)) {
+                        tunnel->err_count--;
+
+                        dst_link_failure(skb);
+                } else
+                        tunnel->err_count = 0;
+        }
+
+        max_headroom = LL_RESERVED_SPACE(tdev) + gre_hlen + dst->header_len;
+
+        if (skb_headroom(skb) < max_headroom || skb_shared(skb) ||
+            (skb_cloned(skb) && !skb_clone_writable(skb, 0))) {
+                new_skb = skb_realloc_headroom(skb, max_headroom);
+                if (max_headroom > dev->needed_headroom)
+                        dev->needed_headroom = max_headroom;
+                if (!new_skb)
+                        goto tx_err_dst_release;
+
+                if (skb->sk)
+                        skb_set_owner_w(new_skb, skb->sk);
+                consume_skb(skb);
+                skb = new_skb;
+        }
+
+        skb_dst_drop(skb);
+
+        if (fl6->flowi6_mark) {
+                skb_dst_set(skb, dst);
+                ndst = NULL;
+        } else {
+                skb_dst_set_noref(skb, dst);
+        }
+
+        skb->transport_header = skb->network_header;
+
+        proto = NEXTHDR_GRE;
+        if (encap_limit >= 0) {
+                init_tel_txopt(&opt, encap_limit);
+                ipv6_push_nfrag_opts(skb, &opt.ops, &proto, NULL);
+        }
+
+        skb_push(skb, gre_hlen);
+        skb_reset_network_header(skb);
+
+        /*
+         *      Push down and install the IP header.
+         */
+        ipv6h = ipv6_hdr(skb);
+        *(__be32 *)ipv6h = fl6->flowlabel | htonl(0x60000000);
+        dsfield = INET_ECN_encapsulate(0, dsfield);
+        ipv6_change_dsfield(ipv6h, ~INET_ECN_MASK, dsfield);
+        ipv6h->hop_limit = tunnel->parms.hop_limit;
+        ipv6h->nexthdr = proto;
+        ipv6h->saddr = fl6->saddr;
+        ipv6h->daddr = fl6->daddr;
+
+        ((__be16 *)(ipv6h + 1))[0] = tunnel->parms.o_flags;
+        ((__be16 *)(ipv6h + 1))[1] = (dev->type == ARPHRD_ETHER) ?
+                                   htons(ETH_P_TEB) : skb->protocol;
+
+        if (tunnel->parms.o_flags&(GRE_KEY|GRE_CSUM|GRE_SEQ)) {
+                __be32 *ptr = (__be32 *)(((u8 *)ipv6h) + tunnel->hlen - 4);
+
+                if (tunnel->parms.o_flags&GRE_SEQ) {
+                        ++tunnel->o_seqno;
+                        *ptr = htonl(tunnel->o_seqno);
+                        ptr--;
+                }
+                if (tunnel->parms.o_flags&GRE_KEY) {
+                        *ptr = tunnel->parms.o_key;
+                        ptr--;
+                }
+                if (tunnel->parms.o_flags&GRE_CSUM) {
+                        *ptr = 0;
+                        *(__sum16 *)ptr = ip_compute_csum((void *)(ipv6h+1),
+                                skb->len - sizeof(struct ipv6hdr));
+                }
+        }
+
+        nf_reset(skb);
+        pkt_len = skb->len;
+        err = ip6_local_out(skb);
+
+        if (net_xmit_eval(err) == 0) {
+                struct pcpu_tstats *tstats = this_cpu_ptr(tunnel->dev->tstats);
+
+                tstats->tx_bytes += pkt_len;
+                tstats->tx_packets++;
+        } else {
+                stats->tx_errors++;
+                stats->tx_aborted_errors++;
+        }
+
+        if (ndst)
+                ip6_tnl_dst_store(tunnel, ndst);
+
+        return 0;
+tx_err_link_failure:
+        stats->tx_carrier_errors++;
+        dst_link_failure(skb);
+tx_err_dst_release:
+        dst_release(ndst);
+        return err;
+}
+
+static inline int ip6gre_xmit_ipv4(struct sk_buff *skb, struct net_device *dev)
+{
+        struct ip6_tnl *t = netdev_priv(dev);
+        const struct iphdr  *iph = ip_hdr(skb);
+        int encap_limit = -1;
+        struct flowi6 fl6;
+        __u8 dsfield;
+        __u32 mtu;
+        int err;
+
+        if (!(t->parms.flags & IP6_TNL_F_IGN_ENCAP_LIMIT))
+                encap_limit = t->parms.encap_limit;
+
+        memcpy(&fl6, &t->fl.u.ip6, sizeof(fl6));
+        fl6.flowi6_proto = IPPROTO_IPIP;
+
+        dsfield = ipv4_get_dsfield(iph);
+
+        if (t->parms.flags & IP6_TNL_F_USE_ORIG_TCLASS)
+                fl6.flowlabel |= htonl((__u32)iph->tos << IPV6_TCLASS_SHIFT)
+                                          & IPV6_TCLASS_MASK;
+        if (t->parms.flags & IP6_TNL_F_USE_ORIG_FWMARK)
+                fl6.flowi6_mark = skb->mark;
+
+        err = ip6gre_xmit2(skb, dev, dsfield, &fl6, encap_limit, &mtu);
+        if (err != 0) {
+                /* XXX: send ICMP error even if DF is not set. */
+                if (err == -EMSGSIZE)
+                        icmp_send(skb, ICMP_DEST_UNREACH, ICMP_FRAG_NEEDED,
+                                  htonl(mtu));
+                return -1;
+        }
+
+        return 0;
+}
+
+static inline int ip6gre_xmit_ipv6(struct sk_buff *skb, struct net_device *dev)
+{
+        struct ip6_tnl *t = netdev_priv(dev);
+        struct ipv6hdr *ipv6h = ipv6_hdr(skb);
+        int encap_limit = -1;
+        __u16 offset;
+        struct flowi6 fl6;
+        __u8 dsfield;
+        __u32 mtu;
+        int err;
+
+        if (ipv6_addr_equal(&t->parms.raddr, &ipv6h->saddr))
+                return -1;
+
+        offset = ip6_tnl_parse_tlv_enc_lim(skb, skb_network_header(skb));
+        if (offset > 0) {
+                struct ipv6_tlv_tnl_enc_lim *tel;
+                tel = (struct ipv6_tlv_tnl_enc_lim *)&skb_network_header(skb)[offset];
+                if (tel->encap_limit == 0) {
+                        icmpv6_send(skb, ICMPV6_PARAMPROB,
+                                    ICMPV6_HDR_FIELD, offset + 2);
+                        return -1;
+                }
+                encap_limit = tel->encap_limit - 1;
+        } else if (!(t->parms.flags & IP6_TNL_F_IGN_ENCAP_LIMIT))
+                encap_limit = t->parms.encap_limit;
+
+        memcpy(&fl6, &t->fl.u.ip6, sizeof(fl6));
+        fl6.flowi6_proto = IPPROTO_IPV6;
+
+        dsfield = ipv6_get_dsfield(ipv6h);
+        if (t->parms.flags & IP6_TNL_F_USE_ORIG_TCLASS)
+                fl6.flowlabel |= (*(__be32 *) ipv6h & IPV6_TCLASS_MASK);
+        if (t->parms.flags & IP6_TNL_F_USE_ORIG_FLOWLABEL)
+                fl6.flowlabel |= (*(__be32 *) ipv6h & IPV6_FLOWLABEL_MASK);
+        if (t->parms.flags & IP6_TNL_F_USE_ORIG_FWMARK)
+                fl6.flowi6_mark = skb->mark;
+
+        err = ip6gre_xmit2(skb, dev, dsfield, &fl6, encap_limit, &mtu);
+        if (err != 0) {
+                if (err == -EMSGSIZE)
+                        icmpv6_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu);
+                return -1;
+        }
+
+        return 0;
+}
+
+/**
+ * ip6_tnl_addr_conflict - compare packet addresses to tunnel's own
+ *   @t: the outgoing tunnel device
+ *   @hdr: IPv6 header from the incoming packet
+ *
+ * Description:
+ *   Avoid trivial tunneling loop by checking that tunnel exit-point
+ *   doesn't match source of incoming packet.
+ *
+ * Return:
+ *   1 if conflict,
+ *   0 else
+ **/
+
+static inline bool ip6gre_tnl_addr_conflict(const struct ip6_tnl *t,
+        const struct ipv6hdr *hdr)
+{
+        return ipv6_addr_equal(&t->parms.raddr, &hdr->saddr);
+}
+
+static int ip6gre_xmit_other(struct sk_buff *skb, struct net_device *dev)
+{
+        struct ip6_tnl *t = netdev_priv(dev);
+        int encap_limit = -1;
+        struct flowi6 fl6;
+        __u32 mtu;
+        int err;
+
+        if (!(t->parms.flags & IP6_TNL_F_IGN_ENCAP_LIMIT))
+                encap_limit = t->parms.encap_limit;
+
+        memcpy(&fl6, &t->fl.u.ip6, sizeof(fl6));
+        fl6.flowi6_proto = skb->protocol;
+
+        err = ip6gre_xmit2(skb, dev, 0, &fl6, encap_limit, &mtu);
+
+        return err;
+}
+
+static netdev_tx_t ip6gre_tunnel_xmit(struct sk_buff *skb,
+        struct net_device *dev)
+{
+        struct ip6_tnl *t = netdev_priv(dev);
+        struct net_device_stats *stats = &t->dev->stats;
+        int ret;
+
+        if (!ip6_tnl_xmit_ctl(t))
+                return -1;
+
+        switch (skb->protocol) {
+        case htons(ETH_P_IP):
+                ret = ip6gre_xmit_ipv4(skb, dev);
+                break;
+        case htons(ETH_P_IPV6):
+                ret = ip6gre_xmit_ipv6(skb, dev);
+                break;
+        default:
+                ret = ip6gre_xmit_other(skb, dev);
+                break;
+        }
+
+        if (ret < 0)
+                goto tx_err;
+
+        return NETDEV_TX_OK;
+
+tx_err:
+        stats->tx_errors++;
+        stats->tx_dropped++;
+        kfree_skb(skb);
+        return NETDEV_TX_OK;
+}
+
+static void ip6gre_tnl_link_config(struct ip6_tnl *t, int set_mtu)
+{
+        struct net_device *dev = t->dev;
+        struct __ip6_tnl_parm *p = &t->parms;
+        struct flowi6 *fl6 = &t->fl.u.ip6;
+        int addend = sizeof(struct ipv6hdr) + 4;
+
+        if (dev->type != ARPHRD_ETHER) {
+                memcpy(dev->dev_addr, &p->laddr, sizeof(struct in6_addr));
+                memcpy(dev->broadcast, &p->raddr, sizeof(struct in6_addr));
+        }
+
+        /* Set up flowi template */
+        fl6->saddr = p->laddr;
+        fl6->daddr = p->raddr;
+        fl6->flowi6_oif = p->link;
+        fl6->flowlabel = 0;
+
+        if (!(p->flags&IP6_TNL_F_USE_ORIG_TCLASS))
+                fl6->flowlabel |= IPV6_TCLASS_MASK & p->flowinfo;
+        if (!(p->flags&IP6_TNL_F_USE_ORIG_FLOWLABEL))
+                fl6->flowlabel |= IPV6_FLOWLABEL_MASK & p->flowinfo;
+
+        p->flags &= ~(IP6_TNL_F_CAP_XMIT|IP6_TNL_F_CAP_RCV|IP6_TNL_F_CAP_PER_PACKET);
+        p->flags |= ip6_tnl_get_cap(t, &p->laddr, &p->raddr);
+
+        if (p->flags&IP6_TNL_F_CAP_XMIT &&
+                        p->flags&IP6_TNL_F_CAP_RCV && dev->type != ARPHRD_ETHER)
+                dev->flags |= IFF_POINTOPOINT;
+        else
+                dev->flags &= ~IFF_POINTOPOINT;
+
+        dev->iflink = p->link;
+
+        /* Precalculate GRE options length */
+        if (t->parms.o_flags&(GRE_CSUM|GRE_KEY|GRE_SEQ)) {
+                if (t->parms.o_flags&GRE_CSUM)
+                        addend += 4;
+                if (t->parms.o_flags&GRE_KEY)
+                        addend += 4;
+                if (t->parms.o_flags&GRE_SEQ)
+                        addend += 4;
+        }
+
+        if (p->flags & IP6_TNL_F_CAP_XMIT) {
+                int strict = (ipv6_addr_type(&p->raddr) &
+                              (IPV6_ADDR_MULTICAST|IPV6_ADDR_LINKLOCAL));
+
+                struct rt6_info *rt = rt6_lookup(dev_net(dev),
+                                                 &p->raddr, &p->laddr,
+                                                 p->link, strict);
+
+                if (rt == NULL)
+                        return;
+
+                if (rt->dst.dev) {
+                        dev->hard_header_len = rt->dst.dev->hard_header_len + addend;
+
+                        if (set_mtu) {
+                                dev->mtu = rt->dst.dev->mtu - addend;
+                                if (!(t->parms.flags & IP6_TNL_F_IGN_ENCAP_LIMIT))
+                                        dev->mtu -= 8;
+
+                                if (dev->mtu < IPV6_MIN_MTU)
+                                        dev->mtu = IPV6_MIN_MTU;
+                        }
+                }
+                dst_release(&rt->dst);
+        }
+
+        t->hlen = addend;
+}
+
+static int ip6gre_tnl_change(struct ip6_tnl *t,
+        const struct __ip6_tnl_parm *p, int set_mtu)
+{
+        t->parms.laddr = p->laddr;
+        t->parms.raddr = p->raddr;
+        t->parms.flags = p->flags;
+        t->parms.hop_limit = p->hop_limit;
+        t->parms.encap_limit = p->encap_limit;
+        t->parms.flowinfo = p->flowinfo;
+        t->parms.link = p->link;
+        t->parms.proto = p->proto;
+        t->parms.i_key = p->i_key;
+        t->parms.o_key = p->o_key;
+        t->parms.i_flags = p->i_flags;
+        t->parms.o_flags = p->o_flags;
+        ip6_tnl_dst_reset(t);
+        ip6gre_tnl_link_config(t, set_mtu);
+        return 0;
+}
+
+static void ip6gre_tnl_parm_from_user(struct __ip6_tnl_parm *p,
+        const struct ip6_tnl_parm2 *u)
+{
+        p->laddr = u->laddr;
+        p->raddr = u->raddr;
+        p->flags = u->flags;
+        p->hop_limit = u->hop_limit;
+        p->encap_limit = u->encap_limit;
+        p->flowinfo = u->flowinfo;
+        p->link = u->link;
+        p->i_key = u->i_key;
+        p->o_key = u->o_key;
+        p->i_flags = u->i_flags;
+        p->o_flags = u->o_flags;
+        memcpy(p->name, u->name, sizeof(u->name));
+}
+
+static void ip6gre_tnl_parm_to_user(struct ip6_tnl_parm2 *u,
+        const struct __ip6_tnl_parm *p)
+{
+        u->proto = IPPROTO_GRE;
+        u->laddr = p->laddr;
+        u->raddr = p->raddr;
+        u->flags = p->flags;
+        u->hop_limit = p->hop_limit;
+        u->encap_limit = p->encap_limit;
+        u->flowinfo = p->flowinfo;
+        u->link = p->link;
+        u->i_key = p->i_key;
+        u->o_key = p->o_key;
+        u->i_flags = p->i_flags;
+        u->o_flags = p->o_flags;
+        memcpy(u->name, p->name, sizeof(u->name));
+}
+
+static int ip6gre_tunnel_ioctl(struct net_device *dev,
+        struct ifreq *ifr, int cmd)
+{
+        int err = 0;
+        struct ip6_tnl_parm2 p;
+        struct __ip6_tnl_parm p1;
+        struct ip6_tnl *t;
+        struct net *net = dev_net(dev);
+        struct ip6gre_net *ign = net_generic(net, ip6gre_net_id);
+
+        switch (cmd) {
+        case SIOCGETTUNNEL:
+                t = NULL;
+                if (dev == ign->fb_tunnel_dev) {
+                        if (copy_from_user(&p, ifr->ifr_ifru.ifru_data, sizeof(p))) {
+                                err = -EFAULT;
+                                break;
+                        }
+                        ip6gre_tnl_parm_from_user(&p1, &p);
+                        t = ip6gre_tunnel_locate(net, &p1, 0);
+                }
+                if (t == NULL)
+                        t = netdev_priv(dev);
+                ip6gre_tnl_parm_to_user(&p, &t->parms);
+                if (copy_to_user(ifr->ifr_ifru.ifru_data, &p, sizeof(p)))
+                        err = -EFAULT;
+                break;
+
+        case SIOCADDTUNNEL:
+        case SIOCCHGTUNNEL:
+                err = -EPERM;
+                if (!capable(CAP_NET_ADMIN))
+                        goto done;
+
+                err = -EFAULT;
+                if (copy_from_user(&p, ifr->ifr_ifru.ifru_data, sizeof(p)))
+                        goto done;
+
+                err = -EINVAL;
+                if ((p.i_flags|p.o_flags)&(GRE_VERSION|GRE_ROUTING))
+                        goto done;
+
+                if (!(p.i_flags&GRE_KEY))
+                        p.i_key = 0;
+                if (!(p.o_flags&GRE_KEY))
+                        p.o_key = 0;
+
+                ip6gre_tnl_parm_from_user(&p1, &p);
+                t = ip6gre_tunnel_locate(net, &p1, cmd == SIOCADDTUNNEL);
+
+                if (dev != ign->fb_tunnel_dev && cmd == SIOCCHGTUNNEL) {
+                        if (t != NULL) {
+                                if (t->dev != dev) {
+                                        err = -EEXIST;
+                                        break;
+                                }
+                        } else {
+                                t = netdev_priv(dev);
+
+                                ip6gre_tunnel_unlink(ign, t);
+                                synchronize_net();
+                                ip6gre_tnl_change(t, &p1, 1);
+                                ip6gre_tunnel_link(ign, t);
+                                netdev_state_change(dev);
+                        }
+                }
+
+                if (t) {
+                        err = 0;
+
+                        ip6gre_tnl_parm_to_user(&p, &t->parms);
+                        if (copy_to_user(ifr->ifr_ifru.ifru_data, &p, sizeof(p)))
+                                err = -EFAULT;
+                } else
+                        err = (cmd == SIOCADDTUNNEL ? -ENOBUFS : -ENOENT);
+                break;
+
+        case SIOCDELTUNNEL:
+                err = -EPERM;
+                if (!capable(CAP_NET_ADMIN))
+                        goto done;
+
+                if (dev == ign->fb_tunnel_dev) {
+                        err = -EFAULT;
+                        if (copy_from_user(&p, ifr->ifr_ifru.ifru_data, sizeof(p)))
+                                goto done;
+                        err = -ENOENT;
+                        ip6gre_tnl_parm_from_user(&p1, &p);
+                        t = ip6gre_tunnel_locate(net, &p1, 0);
+                        if (t == NULL)
+                                goto done;
+                        err = -EPERM;
+                        if (t == netdev_priv(ign->fb_tunnel_dev))
+                                goto done;
+                        dev = t->dev;
+                }
+                unregister_netdevice(dev);
+                err = 0;
+                break;
+
+        default:
+                err = -EINVAL;
+        }
+
+done:
+        return err;
+}
+
+static int ip6gre_tunnel_change_mtu(struct net_device *dev, int new_mtu)
+{
+        struct ip6_tnl *tunnel = netdev_priv(dev);
+        if (new_mtu < 68 ||
+            new_mtu > 0xFFF8 - dev->hard_header_len - tunnel->hlen)
+                return -EINVAL;
+        dev->mtu = new_mtu;
+        return 0;
+}
+
+static int ip6gre_header(struct sk_buff *skb, struct net_device *dev,
+                        unsigned short type,
+                        const void *daddr, const void *saddr, unsigned int len)
+{
+        struct ip6_tnl *t = netdev_priv(dev);
+        struct ipv6hdr *ipv6h = (struct ipv6hdr *)skb_push(skb, t->hlen);
+        __be16 *p = (__be16 *)(ipv6h+1);
+
+        *(__be32 *)ipv6h = t->fl.u.ip6.flowlabel | htonl(0x60000000);
+        ipv6h->hop_limit = t->parms.hop_limit;
+        ipv6h->nexthdr = NEXTHDR_GRE;
+        ipv6h->saddr = t->parms.laddr;
+        ipv6h->daddr = t->parms.raddr;
+
+        p[0]            = t->parms.o_flags;
+        p[1]            = htons(type);
+
+        /*
+         *      Set the source hardware address.
+         */
+
+        if (saddr)
+                memcpy(&ipv6h->saddr, saddr, sizeof(struct in6_addr));
+        if (daddr)
+                memcpy(&ipv6h->daddr, daddr, sizeof(struct in6_addr));
+        if (!ipv6_addr_any(&ipv6h->daddr))
+                return t->hlen;
+
+        return -t->hlen;
+}
+
+static int ip6gre_header_parse(const struct sk_buff *skb, unsigned char *haddr)
+{
+        const struct ipv6hdr *ipv6h = (const struct ipv6hdr *)skb_mac_header(skb);
+        memcpy(haddr, &ipv6h->saddr, sizeof(struct in6_addr));
+        return sizeof(struct in6_addr);
+}
+
+static const struct header_ops ip6gre_header_ops = {
+        .create = ip6gre_header,
+        .parse  = ip6gre_header_parse,
+};
+
+static const struct net_device_ops ip6gre_netdev_ops = {
+        .ndo_init               = ip6gre_tunnel_init,
+        .ndo_uninit             = ip6gre_tunnel_uninit,
+        .ndo_start_xmit         = ip6gre_tunnel_xmit,
+        .ndo_do_ioctl           = ip6gre_tunnel_ioctl,
+        .ndo_change_mtu         = ip6gre_tunnel_change_mtu,
+        .ndo_get_stats64        = ip6gre_get_stats64,
+};
+
+static void ip6gre_dev_free(struct net_device *dev)
+{
+        free_percpu(dev->tstats);
+        free_netdev(dev);
+}
+
+static void ip6gre_tunnel_setup(struct net_device *dev)
+{
+        struct ip6_tnl *t;
+
+        dev->netdev_ops = &ip6gre_netdev_ops;
+        dev->destructor = ip6gre_dev_free;
+
+        dev->type = ARPHRD_IP6GRE;
+        dev->hard_header_len = LL_MAX_HEADER + sizeof(struct ipv6hdr) + 4;
+        dev->mtu = ETH_DATA_LEN - sizeof(struct ipv6hdr) - 4;
+        t = netdev_priv(dev);
+        if (!(t->parms.flags & IP6_TNL_F_IGN_ENCAP_LIMIT))
+                dev->mtu -= 8;
+        dev->flags |= IFF_NOARP;
+        dev->iflink = 0;
+        dev->addr_len = sizeof(struct in6_addr);
+        dev->features |= NETIF_F_NETNS_LOCAL;
+        dev->priv_flags &= ~IFF_XMIT_DST_RELEASE;
+}
+
+static int ip6gre_tunnel_init(struct net_device *dev)
+{
+        struct ip6_tnl *tunnel;
+
+        tunnel = netdev_priv(dev);
+
+        tunnel->dev = dev;
+        strcpy(tunnel->parms.name, dev->name);
+
+        memcpy(dev->dev_addr, &tunnel->parms.laddr, sizeof(struct in6_addr));
+        memcpy(dev->broadcast, &tunnel->parms.raddr, sizeof(struct in6_addr));
+
+        if (ipv6_addr_any(&tunnel->parms.raddr))
+                dev->header_ops = &ip6gre_header_ops;
+
+        dev->tstats = alloc_percpu(struct pcpu_tstats);
+        if (!dev->tstats)
+                return -ENOMEM;
+
+        return 0;
+}
+
+static void ip6gre_fb_tunnel_init(struct net_device *dev)
+{
+        struct ip6_tnl *tunnel = netdev_priv(dev);
+
+        tunnel->dev = dev;
+        strcpy(tunnel->parms.name, dev->name);
+
+        tunnel->hlen            = sizeof(struct ipv6hdr) + 4;
+
+        dev_hold(dev);
+}
+
+
+static struct inet6_protocol ip6gre_protocol __read_mostly = {
+        .handler     = ip6gre_rcv,
+        .err_handler = ip6gre_err,
+        .flags       = INET6_PROTO_NOPOLICY|INET6_PROTO_FINAL,
+};
+
+static void ip6gre_destroy_tunnels(struct ip6gre_net *ign,
+        struct list_head *head)
+{
+        int prio;
+
+        for (prio = 0; prio < 4; prio++) {
+                int h;
+                for (h = 0; h < HASH_SIZE; h++) {
+                        struct ip6_tnl *t;
+
+                        t = rtnl_dereference(ign->tunnels[prio][h]);
+
+                        while (t != NULL) {
+                                unregister_netdevice_queue(t->dev, head);
+                                t = rtnl_dereference(t->next);
+                        }
+                }
+        }
+}
+
+static int __net_init ip6gre_init_net(struct net *net)
+{
+        struct ip6gre_net *ign = net_generic(net, ip6gre_net_id);
+        int err;
+
+        ign->fb_tunnel_dev = alloc_netdev(sizeof(struct ip6_tnl), "ip6gre0",
+                                           ip6gre_tunnel_setup);
+        if (!ign->fb_tunnel_dev) {
+                err = -ENOMEM;
+                goto err_alloc_dev;
+        }
+        dev_net_set(ign->fb_tunnel_dev, net);
+
+        ip6gre_fb_tunnel_init(ign->fb_tunnel_dev);
+        ign->fb_tunnel_dev->rtnl_link_ops = &ip6gre_link_ops;
+
+        err = register_netdev(ign->fb_tunnel_dev);
+        if (err)
+                goto err_reg_dev;
+
+        rcu_assign_pointer(ign->tunnels_wc[0],
+                           netdev_priv(ign->fb_tunnel_dev));
+        return 0;
+
+err_reg_dev:
+        ip6gre_dev_free(ign->fb_tunnel_dev);
+err_alloc_dev:
+        return err;
+}
+
+static void __net_exit ip6gre_exit_net(struct net *net)
+{
+        struct ip6gre_net *ign;
+        LIST_HEAD(list);
+
+        ign = net_generic(net, ip6gre_net_id);
+        rtnl_lock();
+        ip6gre_destroy_tunnels(ign, &list);
+        unregister_netdevice_many(&list);
+        rtnl_unlock();
+}
+
+static struct pernet_operations ip6gre_net_ops = {
+        .init = ip6gre_init_net,
+        .exit = ip6gre_exit_net,
+        .id   = &ip6gre_net_id,
+        .size = sizeof(struct ip6gre_net),
+};
+
+static int ip6gre_tunnel_validate(struct nlattr *tb[], struct nlattr *data[])
+{
+        __be16 flags;
+
+        if (!data)
+                return 0;
+
+        flags = 0;
+        if (data[IFLA_GRE_IFLAGS])
+                flags |= nla_get_be16(data[IFLA_GRE_IFLAGS]);
+        if (data[IFLA_GRE_OFLAGS])
+                flags |= nla_get_be16(data[IFLA_GRE_OFLAGS]);
+        if (flags & (GRE_VERSION|GRE_ROUTING))
+                return -EINVAL;
+
+        return 0;
+}
+
+static int ip6gre_tap_validate(struct nlattr *tb[], struct nlattr *data[])
+{
+        struct in6_addr daddr;
+
+        if (tb[IFLA_ADDRESS]) {
+                if (nla_len(tb[IFLA_ADDRESS]) != ETH_ALEN)
+                        return -EINVAL;
+                if (!is_valid_ether_addr(nla_data(tb[IFLA_ADDRESS])))
+                        return -EADDRNOTAVAIL;
+        }
+
+        if (!data)
+                goto out;
+
+        if (data[IFLA_GRE_REMOTE]) {
+                nla_memcpy(&daddr, data[IFLA_GRE_REMOTE], sizeof(struct in6_addr));
+                if (ipv6_addr_any(&daddr))
+                        return -EINVAL;
+        }
+
+out:
+        return ip6gre_tunnel_validate(tb, data);
+}
+
+
+static void ip6gre_netlink_parms(struct nlattr *data[],
+                                struct __ip6_tnl_parm *parms)
+{
+        memset(parms, 0, sizeof(*parms));
+
+        if (!data)
+                return;
+
+        if (data[IFLA_GRE_LINK])
+                parms->link = nla_get_u32(data[IFLA_GRE_LINK]);
+
+        if (data[IFLA_GRE_IFLAGS])
+                parms->i_flags = nla_get_be16(data[IFLA_GRE_IFLAGS]);
+
+        if (data[IFLA_GRE_OFLAGS])
+                parms->o_flags = nla_get_be16(data[IFLA_GRE_OFLAGS]);
+
+        if (data[IFLA_GRE_IKEY])
+                parms->i_key = nla_get_be32(data[IFLA_GRE_IKEY]);
+
+        if (data[IFLA_GRE_OKEY])
+                parms->o_key = nla_get_be32(data[IFLA_GRE_OKEY]);
+
+        if (data[IFLA_GRE_LOCAL])
+                nla_memcpy(&parms->laddr, data[IFLA_GRE_LOCAL], sizeof(struct in6_addr));
+
+        if (data[IFLA_GRE_REMOTE])
+                nla_memcpy(&parms->raddr, data[IFLA_GRE_REMOTE], sizeof(struct in6_addr));
+
+        if (data[IFLA_GRE_TTL])
+                parms->hop_limit = nla_get_u8(data[IFLA_GRE_TTL]);
+
+        if (data[IFLA_GRE_ENCAP_LIMIT])
+                parms->encap_limit = nla_get_u8(data[IFLA_GRE_ENCAP_LIMIT]);
+
+        if (data[IFLA_GRE_FLOWINFO])
+                parms->flowinfo = nla_get_u32(data[IFLA_GRE_FLOWINFO]);
+
+        if (data[IFLA_GRE_FLAGS])
+                parms->flags = nla_get_u32(data[IFLA_GRE_FLAGS]);
+}
+
+static int ip6gre_tap_init(struct net_device *dev)
+{
+        struct ip6_tnl *tunnel;
+
+        tunnel = netdev_priv(dev);
+
+        tunnel->dev = dev;
+        strcpy(tunnel->parms.name, dev->name);
+
+        ip6gre_tnl_link_config(tunnel, 1);
+
+        dev->tstats = alloc_percpu(struct pcpu_tstats);
+        if (!dev->tstats)
+                return -ENOMEM;
+
+        return 0;
+}
+
+static const struct net_device_ops ip6gre_tap_netdev_ops = {
+        .ndo_init = ip6gre_tap_init,
+        .ndo_uninit = ip6gre_tunnel_uninit,
+        .ndo_start_xmit = ip6gre_tunnel_xmit,
+        .ndo_set_mac_address = eth_mac_addr,
+        .ndo_validate_addr = eth_validate_addr,
+        .ndo_change_mtu = ip6gre_tunnel_change_mtu,
+        .ndo_get_stats64 = ip6gre_get_stats64,
+};
+
+static void ip6gre_tap_setup(struct net_device *dev)
+{
+
+        ether_setup(dev);
+
+        dev->netdev_ops = &ip6gre_tap_netdev_ops;
+        dev->destructor = ip6gre_dev_free;
+
+        dev->iflink = 0;
+        dev->features |= NETIF_F_NETNS_LOCAL;
+}
+
+static int ip6gre_newlink(struct net *src_net, struct net_device *dev,
+        struct nlattr *tb[], struct nlattr *data[])
+{
+        struct ip6_tnl *nt;
+        struct net *net = dev_net(dev);
+        struct ip6gre_net *ign = net_generic(net, ip6gre_net_id);
+        int err;
+
+        nt = netdev_priv(dev);
+        ip6gre_netlink_parms(data, &nt->parms);
+
+        if (ip6gre_tunnel_find(net, &nt->parms, dev->type))
+                return -EEXIST;
+
+        if (dev->type == ARPHRD_ETHER && !tb[IFLA_ADDRESS])
+                eth_hw_addr_random(dev);
+
+        nt->dev = dev;
+        ip6gre_tnl_link_config(nt, !tb[IFLA_MTU]);
+
+        /* Can use a lockless transmit, unless we generate output sequences */
+        if (!(nt->parms.o_flags & GRE_SEQ))
+                dev->features |= NETIF_F_LLTX;
+
+        err = register_netdevice(dev);
+        if (err)
+                goto out;
+
+        dev_hold(dev);
+        ip6gre_tunnel_link(ign, nt);
+
+out:
+        return err;
+}
+
+static int ip6gre_changelink(struct net_device *dev, struct nlattr *tb[],
+                            struct nlattr *data[])
+{
+        struct ip6_tnl *t, *nt;
+        struct net *net = dev_net(dev);
+        struct ip6gre_net *ign = net_generic(net, ip6gre_net_id);
+        struct __ip6_tnl_parm p;
+
+        if (dev == ign->fb_tunnel_dev)
+                return -EINVAL;
+
+        nt = netdev_priv(dev);
+        ip6gre_netlink_parms(data, &p);
+
+        t = ip6gre_tunnel_locate(net, &p, 0);
+
+        if (t) {
+                if (t->dev != dev)
+                        return -EEXIST;
+        } else {
+                t = nt;
+
+                ip6gre_tunnel_unlink(ign, t);
+                ip6gre_tnl_change(t, &p, !tb[IFLA_MTU]);
+                ip6gre_tunnel_link(ign, t);
+                netdev_state_change(dev);
+        }
+
+        return 0;
+}
+
+static size_t ip6gre_get_size(const struct net_device *dev)
+{
+        return
+                /* IFLA_GRE_LINK */
+                nla_total_size(4) +
+                /* IFLA_GRE_IFLAGS */
+                nla_total_size(2) +
+                /* IFLA_GRE_OFLAGS */
+                nla_total_size(2) +
+                /* IFLA_GRE_IKEY */
+                nla_total_size(4) +
+                /* IFLA_GRE_OKEY */
+                nla_total_size(4) +
+                /* IFLA_GRE_LOCAL */
+                nla_total_size(4) +
+                /* IFLA_GRE_REMOTE */
+                nla_total_size(4) +
+                /* IFLA_GRE_TTL */
+                nla_total_size(1) +
+                /* IFLA_GRE_TOS */
+                nla_total_size(1) +
+                /* IFLA_GRE_ENCAP_LIMIT */
+                nla_total_size(1) +
+                /* IFLA_GRE_FLOWINFO */
+                nla_total_size(4) +
+                /* IFLA_GRE_FLAGS */
+                nla_total_size(4) +
+                0;
+}
+
+static int ip6gre_fill_info(struct sk_buff *skb, const struct net_device *dev)
+{
+        struct ip6_tnl *t = netdev_priv(dev);
+        struct __ip6_tnl_parm *p = &t->parms;
+
+        if (nla_put_u32(skb, IFLA_GRE_LINK, p->link) ||
+            nla_put_be16(skb, IFLA_GRE_IFLAGS, p->i_flags) ||
+            nla_put_be16(skb, IFLA_GRE_OFLAGS, p->o_flags) ||
+            nla_put_be32(skb, IFLA_GRE_IKEY, p->i_key) ||
+            nla_put_be32(skb, IFLA_GRE_OKEY, p->o_key) ||
+            nla_put(skb, IFLA_GRE_LOCAL, sizeof(struct in6_addr), &p->raddr) ||
+            nla_put(skb, IFLA_GRE_REMOTE, sizeof(struct in6_addr), &p->laddr) ||
+            nla_put_u8(skb, IFLA_GRE_TTL, p->hop_limit) ||
+            /*nla_put_u8(skb, IFLA_GRE_TOS, t->priority) ||*/
+            nla_put_u8(skb, IFLA_GRE_ENCAP_LIMIT, p->encap_limit) ||
+            nla_put_be32(skb, IFLA_GRE_FLOWINFO, p->flowinfo) ||
+            nla_put_u32(skb, IFLA_GRE_FLAGS, p->flags))
+                goto nla_put_failure;
+        return 0;
+
+nla_put_failure:
+        return -EMSGSIZE;
+}
+
+static const struct nla_policy ip6gre_policy[IFLA_GRE_MAX + 1] = {
+        [IFLA_GRE_LINK]        = { .type = NLA_U32 },
+        [IFLA_GRE_IFLAGS]      = { .type = NLA_U16 },
+        [IFLA_GRE_OFLAGS]      = { .type = NLA_U16 },
+        [IFLA_GRE_IKEY]        = { .type = NLA_U32 },
+        [IFLA_GRE_OKEY]        = { .type = NLA_U32 },
+        [IFLA_GRE_LOCAL]       = { .len = FIELD_SIZEOF(struct ipv6hdr, saddr) },
+        [IFLA_GRE_REMOTE]      = { .len = FIELD_SIZEOF(struct ipv6hdr, daddr) },
+        [IFLA_GRE_TTL]         = { .type = NLA_U8 },
+        [IFLA_GRE_ENCAP_LIMIT] = { .type = NLA_U8 },
+        [IFLA_GRE_FLOWINFO]    = { .type = NLA_U32 },
+        [IFLA_GRE_FLAGS]       = { .type = NLA_U32 },
+};
+
+static struct rtnl_link_ops ip6gre_link_ops __read_mostly = {
+        .kind           = "ip6gre",
+        .maxtype        = IFLA_GRE_MAX,
+        .policy         = ip6gre_policy,
+        .priv_size      = sizeof(struct ip6_tnl),
+        .setup          = ip6gre_tunnel_setup,
+        .validate       = ip6gre_tunnel_validate,
+        .newlink        = ip6gre_newlink,
+        .changelink     = ip6gre_changelink,
+        .get_size       = ip6gre_get_size,
+        .fill_info      = ip6gre_fill_info,
+};
+
+static struct rtnl_link_ops ip6gre_tap_ops __read_mostly = {
+        .kind           = "ip6gretap",
+        .maxtype        = IFLA_GRE_MAX,
+        .policy         = ip6gre_policy,
+        .priv_size      = sizeof(struct ip6_tnl),
+        .setup          = ip6gre_tap_setup,
+        .validate       = ip6gre_tap_validate,
+        .newlink        = ip6gre_newlink,
+        .changelink     = ip6gre_changelink,
+        .get_size       = ip6gre_get_size,
+        .fill_info      = ip6gre_fill_info,
+};
+
+/*
+ *      And now the modules code and kernel interface.
+ */
+
+static int __init ip6gre_init(void)
+{
+        int err;
+
+        pr_info("GRE over IPv6 tunneling driver\n");
+
+        err = register_pernet_device(&ip6gre_net_ops);
+        if (err < 0)
+                return err;
+
+        err = inet6_add_protocol(&ip6gre_protocol, IPPROTO_GRE);
+        if (err < 0) {
+                pr_info("%s: can't add protocol\n", __func__);
+                goto add_proto_failed;
+        }
+
+        err = rtnl_link_register(&ip6gre_link_ops);
+        if (err < 0)
+                goto rtnl_link_failed;
+
+        err = rtnl_link_register(&ip6gre_tap_ops);
+        if (err < 0)
+                goto tap_ops_failed;
+
+out:
+        return err;
+
+tap_ops_failed:
+        rtnl_link_unregister(&ip6gre_link_ops);
+rtnl_link_failed:
+        inet6_del_protocol(&ip6gre_protocol, IPPROTO_GRE);
+add_proto_failed:
+        unregister_pernet_device(&ip6gre_net_ops);
+        goto out;
+}
+
+static void __exit ip6gre_fini(void)
+{
+        rtnl_link_unregister(&ip6gre_tap_ops);
+        rtnl_link_unregister(&ip6gre_link_ops);
+        inet6_del_protocol(&ip6gre_protocol, IPPROTO_GRE);
+        unregister_pernet_device(&ip6gre_net_ops);
+}
+
+module_init(ip6gre_init);
+module_exit(ip6gre_fini);
+MODULE_LICENSE("GPL");
+MODULE_AUTHOR("D. Kozlov (xeb@mail.ru)");
+MODULE_DESCRIPTION("GRE over IPv6 tunneling device");
+MODULE_ALIAS_RTNL_LINK("ip6gre");
+MODULE_ALIAS_NETDEV("ip6gre0");
diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
index 5b2d63ed793e..a4f6263fddca 100644
--- a/net/ipv6/ip6_output.c
+++ b/net/ipv6/ip6_output.c
@@ -493,7 +493,8 @@ int ip6_forward(struct sk_buff *skb)
         if (mtu < IPV6_MIN_MTU)
                 mtu = IPV6_MIN_MTU;
 
-        if (skb->len > mtu && !skb_is_gso(skb)) {
+        if ((!skb->local_df && skb->len > mtu && !skb_is_gso(skb)) ||
+            (IP6CB(skb)->frag_max_size && IP6CB(skb)->frag_max_size > mtu)) {
                 /* Again, force OUTPUT device used as source address */
                 skb->dev = dst->dev;
                 icmpv6_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu);
@@ -636,7 +637,9 @@ int ip6_fragment(struct sk_buff *skb, int (*output)(struct sk_buff *))
         /* We must not fragment if the socket is set to force MTU discovery
          * or if the skb it not generated by a local socket.
          */
-        if (unlikely(!skb->local_df && skb->len > mtu)) {
+        if (unlikely(!skb->local_df && skb->len > mtu) ||
+                     (IP6CB(skb)->frag_max_size &&
+                      IP6CB(skb)->frag_max_size > mtu)) {
                 if (skb->sk && dst_allfrag(skb_dst(skb)))
                         sk_nocaps_add(skb->sk, NETIF_F_GSO_MASK);
 
diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c
index 9a1d5fe6aef8..cb7e2ded6f08 100644
--- a/net/ipv6/ip6_tunnel.c
+++ b/net/ipv6/ip6_tunnel.c
@@ -126,7 +126,7 @@ static struct net_device_stats *ip6_get_stats(struct net_device *dev)
  * Locking : hash tables are protected by RCU and RTNL
  */
 
-static inline struct dst_entry *ip6_tnl_dst_check(struct ip6_tnl *t)
+struct dst_entry *ip6_tnl_dst_check(struct ip6_tnl *t)
 {
         struct dst_entry *dst = t->dst_cache;
 
@@ -139,20 +139,23 @@ static inline struct dst_entry *ip6_tnl_dst_check(struct ip6_tnl *t)
 
         return dst;
 }
+EXPORT_SYMBOL_GPL(ip6_tnl_dst_check);
 
-static inline void ip6_tnl_dst_reset(struct ip6_tnl *t)
+void ip6_tnl_dst_reset(struct ip6_tnl *t)
 {
         dst_release(t->dst_cache);
         t->dst_cache = NULL;
 }
+EXPORT_SYMBOL_GPL(ip6_tnl_dst_reset);
 
-static inline void ip6_tnl_dst_store(struct ip6_tnl *t, struct dst_entry *dst)
+void ip6_tnl_dst_store(struct ip6_tnl *t, struct dst_entry *dst)
 {
         struct rt6_info *rt = (struct rt6_info *) dst;
         t->dst_cookie = rt->rt6i_node ? rt->rt6i_node->fn_sernum : 0;
         dst_release(t->dst_cache);
         t->dst_cache = dst;
 }
+EXPORT_SYMBOL_GPL(ip6_tnl_dst_store);
 
 /**
  * ip6_tnl_lookup - fetch tunnel matching the end-point addresses
@@ -200,7 +203,7 @@ ip6_tnl_lookup(struct net *net, const struct in6_addr *remote, const struct in6_
  **/
 
 static struct ip6_tnl __rcu **
-ip6_tnl_bucket(struct ip6_tnl_net *ip6n, const struct ip6_tnl_parm *p)
+ip6_tnl_bucket(struct ip6_tnl_net *ip6n, const struct __ip6_tnl_parm *p)
 {
         const struct in6_addr *remote = &p->raddr;
         const struct in6_addr *local = &p->laddr;
@@ -267,7 +270,7 @@ static void ip6_dev_free(struct net_device *dev)
  *   created tunnel or NULL
  **/
 
-static struct ip6_tnl *ip6_tnl_create(struct net *net, struct ip6_tnl_parm *p)
+static struct ip6_tnl *ip6_tnl_create(struct net *net, struct __ip6_tnl_parm *p)
 {
         struct net_device *dev;
         struct ip6_tnl *t;
@@ -322,7 +325,7 @@ failed:
  **/
 
 static struct ip6_tnl *ip6_tnl_locate(struct net *net,
-                struct ip6_tnl_parm *p, int create)
+                struct __ip6_tnl_parm *p, int create)
 {
         const struct in6_addr *remote = &p->raddr;
         const struct in6_addr *local = &p->laddr;
@@ -374,8 +377,7 @@ ip6_tnl_dev_uninit(struct net_device *dev)
  *   else index to encapsulation limit
  **/
 
-static __u16
-parse_tlv_tnl_enc_lim(struct sk_buff *skb, __u8 * raw)
+__u16 ip6_tnl_parse_tlv_enc_lim(struct sk_buff *skb, __u8 *raw)
 {
         const struct ipv6hdr *ipv6h = (const struct ipv6hdr *) raw;
         __u8 nexthdr = ipv6h->nexthdr;
@@ -425,6 +427,7 @@ parse_tlv_tnl_enc_lim(struct sk_buff *skb, __u8 * raw)
         }
         return 0;
 }
+EXPORT_SYMBOL(ip6_tnl_parse_tlv_enc_lim);
 
 /**
  * ip6_tnl_err - tunnel error handler
@@ -480,7 +483,7 @@ ip6_tnl_err(struct sk_buff *skb, __u8 ipproto, struct inet6_skb_parm *opt,
         case ICMPV6_PARAMPROB:
                 teli = 0;
                 if ((*code) == ICMPV6_HDR_FIELD)
-                        teli = parse_tlv_tnl_enc_lim(skb, skb->data);
+                        teli = ip6_tnl_parse_tlv_enc_lim(skb, skb->data);
 
                 if (teli && teli == *info - 2) {
                         tel = (struct ipv6_tlv_tnl_enc_lim *) &skb->data[teli];
@@ -693,11 +696,11 @@ static void ip6ip6_dscp_ecn_decapsulate(const struct ip6_tnl *t,
                 IP6_ECN_set_ce(ipv6_hdr(skb));
 }
 
-static __u32 ip6_tnl_get_cap(struct ip6_tnl *t,
+__u32 ip6_tnl_get_cap(struct ip6_tnl *t,
                              const struct in6_addr *laddr,
                              const struct in6_addr *raddr)
 {
-        struct ip6_tnl_parm *p = &t->parms;
+        struct __ip6_tnl_parm *p = &t->parms;
         int ltype = ipv6_addr_type(laddr);
         int rtype = ipv6_addr_type(raddr);
         __u32 flags = 0;
@@ -715,13 +718,14 @@ static __u32 ip6_tnl_get_cap(struct ip6_tnl *t,
         }
         return flags;
 }
+EXPORT_SYMBOL(ip6_tnl_get_cap);
 
 /* called with rcu_read_lock() */
-static inline int ip6_tnl_rcv_ctl(struct ip6_tnl *t,
+int ip6_tnl_rcv_ctl(struct ip6_tnl *t,
                                   const struct in6_addr *laddr,
                                   const struct in6_addr *raddr)
 {
-        struct ip6_tnl_parm *p = &t->parms;
+        struct __ip6_tnl_parm *p = &t->parms;
         int ret = 0;
         struct net *net = dev_net(t->dev);
 
@@ -740,6 +744,7 @@ static inline int ip6_tnl_rcv_ctl(struct ip6_tnl *t,
         }
         return ret;
 }
+EXPORT_SYMBOL_GPL(ip6_tnl_rcv_ctl);
 
 /**
  * ip6_tnl_rcv - decapsulate IPv6 packet and retransmit it locally
@@ -859,9 +864,9 @@ ip6_tnl_addr_conflict(const struct ip6_tnl *t, const struct ipv6hdr *hdr)
         return ipv6_addr_equal(&t->parms.raddr, &hdr->saddr);
 }
 
-static inline int ip6_tnl_xmit_ctl(struct ip6_tnl *t)
+int ip6_tnl_xmit_ctl(struct ip6_tnl *t)
 {
-        struct ip6_tnl_parm *p = &t->parms;
+        struct __ip6_tnl_parm *p = &t->parms;
         int ret = 0;
         struct net *net = dev_net(t->dev);
 
@@ -885,6 +890,8 @@ static inline int ip6_tnl_xmit_ctl(struct ip6_tnl *t)
         }
         return ret;
 }
+EXPORT_SYMBOL_GPL(ip6_tnl_xmit_ctl);
+
 /**
  * ip6_tnl_xmit2 - encapsulate packet and send
  *   @skb: the outgoing socket buffer
@@ -1085,7 +1092,7 @@ ip6ip6_tnl_xmit(struct sk_buff *skb, struct net_device *dev)
             !ip6_tnl_xmit_ctl(t) || ip6_tnl_addr_conflict(t, ipv6h))
                 return -1;
 
-        offset = parse_tlv_tnl_enc_lim(skb, skb_network_header(skb));
+        offset = ip6_tnl_parse_tlv_enc_lim(skb, skb_network_header(skb));
         if (offset > 0) {
                 struct ipv6_tlv_tnl_enc_lim *tel;
                 tel = (struct ipv6_tlv_tnl_enc_lim *)&skb_network_header(skb)[offset];
@@ -1152,7 +1159,7 @@ tx_err:
 static void ip6_tnl_link_config(struct ip6_tnl *t)
 {
         struct net_device *dev = t->dev;
-        struct ip6_tnl_parm *p = &t->parms;
+        struct __ip6_tnl_parm *p = &t->parms;
         struct flowi6 *fl6 = &t->fl.u.ip6;
 
         memcpy(dev->dev_addr, &p->laddr, sizeof(struct in6_addr));
@@ -1215,7 +1222,7 @@ static void ip6_tnl_link_config(struct ip6_tnl *t)
  **/
 
 static int
-ip6_tnl_change(struct ip6_tnl *t, struct ip6_tnl_parm *p)
+ip6_tnl_change(struct ip6_tnl *t, const struct __ip6_tnl_parm *p)
 {
         t->parms.laddr = p->laddr;
         t->parms.raddr = p->raddr;
@@ -1230,6 +1237,34 @@ ip6_tnl_change(struct ip6_tnl *t, struct ip6_tnl_parm *p)
         return 0;
 }
 
+static void
+ip6_tnl_parm_from_user(struct __ip6_tnl_parm *p, const struct ip6_tnl_parm *u)
+{
+        p->laddr = u->laddr;
+        p->raddr = u->raddr;
+        p->flags = u->flags;
+        p->hop_limit = u->hop_limit;
+        p->encap_limit = u->encap_limit;
+        p->flowinfo = u->flowinfo;
+        p->link = u->link;
+        p->proto = u->proto;
+        memcpy(p->name, u->name, sizeof(u->name));
+}
+
+static void
+ip6_tnl_parm_to_user(struct ip6_tnl_parm *u, const struct __ip6_tnl_parm *p)
+{
+        u->laddr = p->laddr;
+        u->raddr = p->raddr;
+        u->flags = p->flags;
+        u->hop_limit = p->hop_limit;
+        u->encap_limit = p->encap_limit;
+        u->flowinfo = p->flowinfo;
+        u->link = p->link;
+        u->proto = p->proto;
+        memcpy(u->name, p->name, sizeof(u->name));
+}
+
 /**
  * ip6_tnl_ioctl - configure ipv6 tunnels from userspace
  *   @dev: virtual device associated with tunnel
@@ -1263,6 +1298,7 @@ ip6_tnl_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
 {
         int err = 0;
         struct ip6_tnl_parm p;
+        struct __ip6_tnl_parm p1;
         struct ip6_tnl *t = NULL;
         struct net *net = dev_net(dev);
         struct ip6_tnl_net *ip6n = net_generic(net, ip6_tnl_net_id);
@@ -1274,11 +1310,14 @@ ip6_tnl_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
                                 err = -EFAULT;
                                 break;
                         }
-                        t = ip6_tnl_locate(net, &p, 0);
+                        ip6_tnl_parm_from_user(&p1, &p);
+                        t = ip6_tnl_locate(net, &p1, 0);
+                } else {
+                        memset(&p, 0, sizeof(p));
                 }
                 if (t == NULL)
                         t = netdev_priv(dev);
-                memcpy(&p, &t->parms, sizeof (p));
+                ip6_tnl_parm_to_user(&p, &t->parms);
                 if (copy_to_user(ifr->ifr_ifru.ifru_data, &p, sizeof (p))) {
                         err = -EFAULT;
                 }
@@ -1295,7 +1334,8 @@ ip6_tnl_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
                 if (p.proto != IPPROTO_IPV6 && p.proto != IPPROTO_IPIP &&
                     p.proto != 0)
                         break;
-                t = ip6_tnl_locate(net, &p, cmd == SIOCADDTUNNEL);
+                ip6_tnl_parm_from_user(&p1, &p);
+                t = ip6_tnl_locate(net, &p1, cmd == SIOCADDTUNNEL);
                 if (dev != ip6n->fb_tnl_dev && cmd == SIOCCHGTUNNEL) {
                         if (t != NULL) {
                                 if (t->dev != dev) {
@@ -1307,13 +1347,14 @@ ip6_tnl_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
 
                         ip6_tnl_unlink(ip6n, t);
                         synchronize_net();
-                        err = ip6_tnl_change(t, &p);
+                        err = ip6_tnl_change(t, &p1);
                         ip6_tnl_link(ip6n, t);
                         netdev_state_change(dev);
                 }
                 if (t) {
                         err = 0;
-                        if (copy_to_user(ifr->ifr_ifru.ifru_data, &t->parms, sizeof (p)))
+                        ip6_tnl_parm_to_user(&p, &t->parms);
+                        if (copy_to_user(ifr->ifr_ifru.ifru_data, &p, sizeof(p)))
                                 err = -EFAULT;
 
                 } else
@@ -1329,7 +1370,9 @@ ip6_tnl_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
                         if (copy_from_user(&p, ifr->ifr_ifru.ifru_data, sizeof (p)))
                                 break;
                         err = -ENOENT;
-                        if ((t = ip6_tnl_locate(net, &p, 0)) == NULL)
+                        ip6_tnl_parm_from_user(&p1, &p);
+                        t = ip6_tnl_locate(net, &p1, 0);
+                        if (t == NULL)
                                 break;
                         err = -EPERM;
                         if (t->dev == ip6n->fb_tnl_dev)
diff --git a/net/ipv6/netfilter.c b/net/ipv6/netfilter.c
index db31561cc8df..429089cb073d 100644
--- a/net/ipv6/netfilter.c
+++ b/net/ipv6/netfilter.c
@@ -15,6 +15,7 @@ int ip6_route_me_harder(struct sk_buff *skb)
 {
         struct net *net = dev_net(skb_dst(skb)->dev);
         const struct ipv6hdr *iph = ipv6_hdr(skb);
+        unsigned int hh_len;
         struct dst_entry *dst;
         struct flowi6 fl6 = {
                 .flowi6_oif = skb->sk ? skb->sk->sk_bound_dev_if : 0,
@@ -47,6 +48,13 @@ int ip6_route_me_harder(struct sk_buff *skb)
         }
 #endif
 
+        /* Change in oif may mean change in hh_len. */
+        hh_len = skb_dst(skb)->dev->hard_header_len;
+        if (skb_headroom(skb) < hh_len &&
+            pskb_expand_head(skb, HH_DATA_ALIGN(hh_len - skb_headroom(skb)),
+                             0, GFP_ATOMIC))
+                return -1;
+
         return 0;
 }
 EXPORT_SYMBOL(ip6_route_me_harder);
diff --git a/net/ipv6/netfilter/Kconfig b/net/ipv6/netfilter/Kconfig
index 10135342799e..3b73254d7bf1 100644
--- a/net/ipv6/netfilter/Kconfig
+++ b/net/ipv6/netfilter/Kconfig
@@ -25,6 +25,18 @@ config NF_CONNTRACK_IPV6
 
           To compile it as a module, choose M here.  If unsure, say N.
 
+config NF_NAT_IPV6
+        tristate "IPv6 NAT"
+        depends on NF_CONNTRACK_IPV6
+        depends on NETFILTER_ADVANCED
+        select NF_NAT
+        help
+          The IPv6 NAT option allows masquerading, port forwarding and other
+          forms of full Network Address Port Translation. It is controlled by
+          the `nat' table in ip6tables, see the man page for ip6tables(8).
+
+          To compile it as a module, choose M here.  If unsure, say N.
+
 config IP6_NF_IPTABLES
         tristate "IP6 tables support (required for filtering)"
         depends on INET && IPV6
@@ -132,6 +144,48 @@ config IP6_NF_TARGET_HL
         (e.g. when running oldconfig). It selects
         CONFIG_NETFILTER_XT_TARGET_HL.
 
+config IP6_NF_TARGET_MASQUERADE
+        tristate "MASQUERADE target support"
+        depends on NF_NAT_IPV6
+        help
+          Masquerading is a special case of NAT: all outgoing connections are
+          changed to seem to come from a particular interface's address, and
+          if the interface goes down, those connections are lost.  This is
+          only useful for dialup accounts with dynamic IP address (ie. your IP
+          address will be different on next dialup).
+
+          To compile it as a module, choose M here.  If unsure, say N.
+
+config IP6_NF_TARGET_NETMAP
+        tristate "NETMAP target support"
+        depends on NF_NAT_IPV6
+        help
+          NETMAP is an implementation of static 1:1 NAT mapping of network
+          addresses. It maps the network address part, while keeping the host
+          address part intact.
+
+          To compile it as a module, choose M here.  If unsure, say N.
+
+config IP6_NF_TARGET_REDIRECT
+        tristate "REDIRECT target support"
+        depends on NF_NAT_IPV6
+        help
+          REDIRECT is a special case of NAT: all incoming connections are
+          mapped onto the incoming interface's address, causing the packets to
+          come to the local machine instead of passing through.  This is
+          useful for transparent proxies.
+
+          To compile it as a module, choose M here.  If unsure, say N.
+
+config IP6_NF_TARGET_NPT
+        tristate "NPT (Network Prefix translation) target support"
+        depends on NETFILTER_ADVANCED
+        help
+          This option adds the `SNPT' and `DNPT' target, which perform
+          stateless IPv6-to-IPv6 Network Prefix Translation per RFC 6296.
+
+          To compile it as a module, choose M here.  If unsure, say N.
+
 config IP6_NF_FILTER
         tristate "Packet filtering"
         default m if NETFILTER_ADVANCED=n
diff --git a/net/ipv6/netfilter/Makefile b/net/ipv6/netfilter/Makefile
index 534d3f216f7b..5752132ca159 100644
--- a/net/ipv6/netfilter/Makefile
+++ b/net/ipv6/netfilter/Makefile
@@ -8,6 +8,7 @@ obj-$(CONFIG_IP6_NF_FILTER) += ip6table_filter.o
 obj-$(CONFIG_IP6_NF_MANGLE) += ip6table_mangle.o
 obj-$(CONFIG_IP6_NF_RAW) += ip6table_raw.o
 obj-$(CONFIG_IP6_NF_SECURITY) += ip6table_security.o
+obj-$(CONFIG_NF_NAT_IPV6) += ip6table_nat.o
 
 # objects for l3 independent conntrack
 nf_conntrack_ipv6-y  :=  nf_conntrack_l3proto_ipv6.o nf_conntrack_proto_icmpv6.o
@@ -15,6 +16,9 @@ nf_conntrack_ipv6-y  :=  nf_conntrack_l3proto_ipv6.o nf_conntrack_proto_icmpv6.o
 # l3 independent conntrack
 obj-$(CONFIG_NF_CONNTRACK_IPV6) += nf_conntrack_ipv6.o nf_defrag_ipv6.o
 
+nf_nat_ipv6-y           := nf_nat_l3proto_ipv6.o nf_nat_proto_icmpv6.o
+obj-$(CONFIG_NF_NAT_IPV6) += nf_nat_ipv6.o
+
 # defrag
 nf_defrag_ipv6-y := nf_defrag_ipv6_hooks.o nf_conntrack_reasm.o
 obj-$(CONFIG_NF_DEFRAG_IPV6) += nf_defrag_ipv6.o
@@ -30,4 +34,8 @@ obj-$(CONFIG_IP6_NF_MATCH_RPFILTER) += ip6t_rpfilter.o
 obj-$(CONFIG_IP6_NF_MATCH_RT) += ip6t_rt.o
 
 # targets
+obj-$(CONFIG_IP6_NF_TARGET_MASQUERADE) += ip6t_MASQUERADE.o
+obj-$(CONFIG_IP6_NF_TARGET_NETMAP) += ip6t_NETMAP.o
+obj-$(CONFIG_IP6_NF_TARGET_NPT) += ip6t_NPT.o
+obj-$(CONFIG_IP6_NF_TARGET_REDIRECT) += ip6t_REDIRECT.o
 obj-$(CONFIG_IP6_NF_TARGET_REJECT) += ip6t_REJECT.o
diff --git a/net/ipv6/netfilter/ip6t_MASQUERADE.c b/net/ipv6/netfilter/ip6t_MASQUERADE.c
new file mode 100644
index 000000000000..60e9053bab05
--- /dev/null
+++ b/net/ipv6/netfilter/ip6t_MASQUERADE.c
@@ -0,0 +1,135 @@
+/*
+ * Copyright (c) 2011 Patrick McHardy <kaber@trash.net>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ *
+ * Based on Rusty Russell's IPv6 MASQUERADE target. Development of IPv6
+ * NAT funded by Astaro.
+ */
+
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/netdevice.h>
+#include <linux/ipv6.h>
+#include <linux/netfilter.h>
+#include <linux/netfilter_ipv6.h>
+#include <linux/netfilter/x_tables.h>
+#include <net/netfilter/nf_nat.h>
+#include <net/addrconf.h>
+#include <net/ipv6.h>
+
+static unsigned int
+masquerade_tg6(struct sk_buff *skb, const struct xt_action_param *par)
+{
+        const struct nf_nat_range *range = par->targinfo;
+        enum ip_conntrack_info ctinfo;
+        struct in6_addr src;
+        struct nf_conn *ct;
+        struct nf_nat_range newrange;
+
+        ct = nf_ct_get(skb, &ctinfo);
+        NF_CT_ASSERT(ct && (ctinfo == IP_CT_NEW || ctinfo == IP_CT_RELATED ||
+                            ctinfo == IP_CT_RELATED_REPLY));
+
+        if (ipv6_dev_get_saddr(dev_net(par->out), par->out,
+                               &ipv6_hdr(skb)->daddr, 0, &src) < 0)
+                return NF_DROP;
+
+        nfct_nat(ct)->masq_index = par->out->ifindex;
+
+        newrange.flags          = range->flags | NF_NAT_RANGE_MAP_IPS;
+        newrange.min_addr.in6   = src;
+        newrange.max_addr.in6   = src;
+        newrange.min_proto      = range->min_proto;
+        newrange.max_proto      = range->max_proto;
+
+        return nf_nat_setup_info(ct, &newrange, NF_NAT_MANIP_SRC);
+}
+
+static int masquerade_tg6_checkentry(const struct xt_tgchk_param *par)
+{
+        const struct nf_nat_range *range = par->targinfo;
+
+        if (range->flags & NF_NAT_RANGE_MAP_IPS)
+                return -EINVAL;
+        return 0;
+}
+
+static int device_cmp(struct nf_conn *ct, void *ifindex)
+{
+        const struct nf_conn_nat *nat = nfct_nat(ct);
+
+        if (!nat)
+                return 0;
+        if (nf_ct_l3num(ct) != NFPROTO_IPV6)
+                return 0;
+        return nat->masq_index == (int)(long)ifindex;
+}
+
+static int masq_device_event(struct notifier_block *this,
+                             unsigned long event, void *ptr)
+{
+        const struct net_device *dev = ptr;
+        struct net *net = dev_net(dev);
+
+        if (event == NETDEV_DOWN)
+                nf_ct_iterate_cleanup(net, device_cmp,
+                                      (void *)(long)dev->ifindex);
+
+        return NOTIFY_DONE;
+}
+
+static struct notifier_block masq_dev_notifier = {
+        .notifier_call  = masq_device_event,
+};
+
+static int masq_inet_event(struct notifier_block *this,
+                           unsigned long event, void *ptr)
+{
+        struct inet6_ifaddr *ifa = ptr;
+
+        return masq_device_event(this, event, ifa->idev->dev);
+}
+
+static struct notifier_block masq_inet_notifier = {
+        .notifier_call  = masq_inet_event,
+};
+
+static struct xt_target masquerade_tg6_reg __read_mostly = {
+        .name           = "MASQUERADE",
+        .family         = NFPROTO_IPV6,
+        .checkentry     = masquerade_tg6_checkentry,
+        .target         = masquerade_tg6,
+        .targetsize     = sizeof(struct nf_nat_range),
+        .table          = "nat",
+        .hooks          = 1 << NF_INET_POST_ROUTING,
+        .me             = THIS_MODULE,
+};
+
+static int __init masquerade_tg6_init(void)
+{
+        int err;
+
+        err = xt_register_target(&masquerade_tg6_reg);
+        if (err == 0) {
+                register_netdevice_notifier(&masq_dev_notifier);
+                register_inet6addr_notifier(&masq_inet_notifier);
+        }
+
+        return err;
+}
+static void __exit masquerade_tg6_exit(void)
+{
+        unregister_inet6addr_notifier(&masq_inet_notifier);
+        unregister_netdevice_notifier(&masq_dev_notifier);
+        xt_unregister_target(&masquerade_tg6_reg);
+}
+
+module_init(masquerade_tg6_init);
+module_exit(masquerade_tg6_exit);
+
+MODULE_LICENSE("GPL");
+MODULE_AUTHOR("Patrick McHardy <kaber@trash.net>");
+MODULE_DESCRIPTION("Xtables: automatic address SNAT");
diff --git a/net/ipv6/netfilter/ip6t_NETMAP.c b/net/ipv6/netfilter/ip6t_NETMAP.c
new file mode 100644
index 000000000000..4f3bf360e50f
--- /dev/null
+++ b/net/ipv6/netfilter/ip6t_NETMAP.c
@@ -0,0 +1,94 @@
+/*
+ * Copyright (c) 2011 Patrick McHardy <kaber@trash.net>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ *
+ * Based on Svenning Soerensen's IPv4 NETMAP target. Development of IPv6
+ * NAT funded by Astaro.
+ */
+
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/ipv6.h>
+#include <linux/netfilter.h>
+#include <linux/netfilter_ipv6.h>
+#include <linux/netfilter/x_tables.h>
+#include <net/netfilter/nf_nat.h>
+
+static unsigned int
+netmap_tg6(struct sk_buff *skb, const struct xt_action_param *par)
+{
+        const struct nf_nat_range *range = par->targinfo;
+        struct nf_nat_range newrange;
+        struct nf_conn *ct;
+        enum ip_conntrack_info ctinfo;
+        union nf_inet_addr new_addr, netmask;
+        unsigned int i;
+
+        ct = nf_ct_get(skb, &ctinfo);
+        for (i = 0; i < ARRAY_SIZE(range->min_addr.ip6); i++)
+                netmask.ip6[i] = ~(range->min_addr.ip6[i] ^
+                                   range->max_addr.ip6[i]);
+
+        if (par->hooknum == NF_INET_PRE_ROUTING ||
+            par->hooknum == NF_INET_LOCAL_OUT)
+                new_addr.in6 = ipv6_hdr(skb)->daddr;
+        else
+                new_addr.in6 = ipv6_hdr(skb)->saddr;
+
+        for (i = 0; i < ARRAY_SIZE(new_addr.ip6); i++) {
+                new_addr.ip6[i] &= ~netmask.ip6[i];
+                new_addr.ip6[i] |= range->min_addr.ip6[i] &
+                                   netmask.ip6[i];
+        }
+
+        newrange.flags  = range->flags | NF_NAT_RANGE_MAP_IPS;
+        newrange.min_addr       = new_addr;
+        newrange.max_addr       = new_addr;
+        newrange.min_proto      = range->min_proto;
+        newrange.max_proto      = range->max_proto;
+
+        return nf_nat_setup_info(ct, &newrange, HOOK2MANIP(par->hooknum));
+}
+
+static int netmap_tg6_checkentry(const struct xt_tgchk_param *par)
+{
+        const struct nf_nat_range *range = par->targinfo;
+
+        if (!(range->flags & NF_NAT_RANGE_MAP_IPS))
+                return -EINVAL;
+        return 0;
+}
+
+static struct xt_target netmap_tg6_reg __read_mostly = {
+        .name           = "NETMAP",
+        .family         = NFPROTO_IPV6,
+        .target         = netmap_tg6,
+        .targetsize     = sizeof(struct nf_nat_range),
+        .table          = "nat",
+        .hooks          = (1 << NF_INET_PRE_ROUTING) |
+                          (1 << NF_INET_POST_ROUTING) |
+                          (1 << NF_INET_LOCAL_OUT) |
+                          (1 << NF_INET_LOCAL_IN),
+        .checkentry     = netmap_tg6_checkentry,
+        .me             = THIS_MODULE,
+};
+
+static int __init netmap_tg6_init(void)
+{
+        return xt_register_target(&netmap_tg6_reg);
+}
+
+static void netmap_tg6_exit(void)
+{
+        xt_unregister_target(&netmap_tg6_reg);
+}
+
+module_init(netmap_tg6_init);
+module_exit(netmap_tg6_exit);
+
+MODULE_LICENSE("GPL");
+MODULE_DESCRIPTION("Xtables: 1:1 NAT mapping of IPv6 subnets");
+MODULE_AUTHOR("Patrick McHardy <kaber@trash.net>");
diff --git a/net/ipv6/netfilter/ip6t_NPT.c b/net/ipv6/netfilter/ip6t_NPT.c
new file mode 100644
index 000000000000..e9486915eff6
--- /dev/null
+++ b/net/ipv6/netfilter/ip6t_NPT.c
@@ -0,0 +1,165 @@
+/*
+ * Copyright (c) 2011, 2012 Patrick McHardy <kaber@trash.net>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+
+#include <linux/module.h>
+#include <linux/skbuff.h>
+#include <linux/ipv6.h>
+#include <linux/netfilter.h>
+#include <linux/netfilter_ipv6.h>
+#include <linux/netfilter_ipv6/ip6t_NPT.h>
+#include <linux/netfilter/x_tables.h>
+
+static __sum16 csum16_complement(__sum16 a)
+{
+        return (__force __sum16)(0xffff - (__force u16)a);
+}
+
+static __sum16 csum16_add(__sum16 a, __sum16 b)
+{
+        u16 sum;
+
+        sum = (__force u16)a + (__force u16)b;
+        sum += (__force u16)a < (__force u16)b;
+        return (__force __sum16)sum;
+}
+
+static __sum16 csum16_sub(__sum16 a, __sum16 b)
+{
+        return csum16_add(a, csum16_complement(b));
+}
+
+static int ip6t_npt_checkentry(const struct xt_tgchk_param *par)
+{
+        struct ip6t_npt_tginfo *npt = par->targinfo;
+        __sum16 src_sum = 0, dst_sum = 0;
+        unsigned int i;
+
+        if (npt->src_pfx_len > 64 || npt->dst_pfx_len > 64)
+                return -EINVAL;
+
+        for (i = 0; i < ARRAY_SIZE(npt->src_pfx.in6.s6_addr16); i++) {
+                src_sum = csum16_add(src_sum,
+                                (__force __sum16)npt->src_pfx.in6.s6_addr16[i]);
+                dst_sum = csum16_add(dst_sum,
+                                (__force __sum16)npt->dst_pfx.in6.s6_addr16[i]);
+        }
+
+        npt->adjustment = csum16_sub(src_sum, dst_sum);
+        return 0;
+}
+
+static bool ip6t_npt_map_pfx(const struct ip6t_npt_tginfo *npt,
+                             struct in6_addr *addr)
+{
+        unsigned int pfx_len;
+        unsigned int i, idx;
+        __be32 mask;
+        __sum16 sum;
+
+        pfx_len = max(npt->src_pfx_len, npt->dst_pfx_len);
+        for (i = 0; i < pfx_len; i += 32) {
+                if (pfx_len - i >= 32)
+                        mask = 0;
+                else
+                        mask = htonl(~((1 << (pfx_len - i)) - 1));
+
+                idx = i / 32;
+                addr->s6_addr32[idx] &= mask;
+                addr->s6_addr32[idx] |= npt->dst_pfx.in6.s6_addr32[idx];
+        }
+
+        if (pfx_len <= 48)
+                idx = 3;
+        else {
+                for (idx = 4; idx < ARRAY_SIZE(addr->s6_addr16); idx++) {
+                        if ((__force __sum16)addr->s6_addr16[idx] !=
+                            CSUM_MANGLED_0)
+                                break;
+                }
+                if (idx == ARRAY_SIZE(addr->s6_addr16))
+                        return false;
+        }
+
+        sum = csum16_add((__force __sum16)addr->s6_addr16[idx],
+                         npt->adjustment);
+        if (sum == CSUM_MANGLED_0)
+                sum = 0;
+        *(__force __sum16 *)&addr->s6_addr16[idx] = sum;
+
+        return true;
+}
+
+static unsigned int
+ip6t_snpt_tg(struct sk_buff *skb, const struct xt_action_param *par)
+{
+        const struct ip6t_npt_tginfo *npt = par->targinfo;
+
+        if (!ip6t_npt_map_pfx(npt, &ipv6_hdr(skb)->saddr)) {
+                icmpv6_send(skb, ICMPV6_PARAMPROB, ICMPV6_HDR_FIELD,
+                            offsetof(struct ipv6hdr, saddr));
+                return NF_DROP;
+        }
+        return XT_CONTINUE;
+}
+
+static unsigned int
+ip6t_dnpt_tg(struct sk_buff *skb, const struct xt_action_param *par)
+{
+        const struct ip6t_npt_tginfo *npt = par->targinfo;
+
+        if (!ip6t_npt_map_pfx(npt, &ipv6_hdr(skb)->daddr)) {
+                icmpv6_send(skb, ICMPV6_PARAMPROB, ICMPV6_HDR_FIELD,
+                            offsetof(struct ipv6hdr, daddr));
+                return NF_DROP;
+        }
+        return XT_CONTINUE;
+}
+
+static struct xt_target ip6t_npt_target_reg[] __read_mostly = {
+        {
+                .name           = "SNPT",
+                .target         = ip6t_snpt_tg,
+                .targetsize     = sizeof(struct ip6t_npt_tginfo),
+                .checkentry     = ip6t_npt_checkentry,
+                .family         = NFPROTO_IPV6,
+                .hooks          = (1 << NF_INET_LOCAL_IN) |
+                                  (1 << NF_INET_POST_ROUTING),
+                .me             = THIS_MODULE,
+        },
+        {
+                .name           = "DNPT",
+                .target         = ip6t_dnpt_tg,
+                .targetsize     = sizeof(struct ip6t_npt_tginfo),
+                .checkentry     = ip6t_npt_checkentry,
+                .family         = NFPROTO_IPV6,
+                .hooks          = (1 << NF_INET_PRE_ROUTING) |
+                                  (1 << NF_INET_LOCAL_OUT),
+                .me             = THIS_MODULE,
+        },
+};
+
+static int __init ip6t_npt_init(void)
+{
+        return xt_register_targets(ip6t_npt_target_reg,
+                                   ARRAY_SIZE(ip6t_npt_target_reg));
+}
+
+static void __exit ip6t_npt_exit(void)
+{
+        xt_unregister_targets(ip6t_npt_target_reg,
+                              ARRAY_SIZE(ip6t_npt_target_reg));
+}
+
+module_init(ip6t_npt_init);
+module_exit(ip6t_npt_exit);
+
+MODULE_LICENSE("GPL");
+MODULE_DESCRIPTION("IPv6-to-IPv6 Network Prefix Translation (RFC 6296)");
+MODULE_AUTHOR("Patrick McHardy <kaber@trash.net>");
+MODULE_ALIAS("ip6t_SNPT");
+MODULE_ALIAS("ip6t_DNPT");
diff --git a/net/ipv6/netfilter/ip6t_REDIRECT.c b/net/ipv6/netfilter/ip6t_REDIRECT.c
new file mode 100644
index 000000000000..60497a3c6004
--- /dev/null
+++ b/net/ipv6/netfilter/ip6t_REDIRECT.c
@@ -0,0 +1,98 @@
+/*
+ * Copyright (c) 2011 Patrick McHardy <kaber@trash.net>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ *
+ * Based on Rusty Russell's IPv4 REDIRECT target. Development of IPv6
+ * NAT funded by Astaro.
+ */
+
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/netfilter.h>
+#include <linux/netfilter_ipv6.h>
+#include <linux/netfilter/x_tables.h>
+#include <net/addrconf.h>
+#include <net/netfilter/nf_nat.h>
+
+static const struct in6_addr loopback_addr = IN6ADDR_LOOPBACK_INIT;
+
+static unsigned int
+redirect_tg6(struct sk_buff *skb, const struct xt_action_param *par)
+{
+        const struct nf_nat_range *range = par->targinfo;
+        struct nf_nat_range newrange;
+        struct in6_addr newdst;
+        enum ip_conntrack_info ctinfo;
+        struct nf_conn *ct;
+
+        ct = nf_ct_get(skb, &ctinfo);
+        if (par->hooknum == NF_INET_LOCAL_OUT)
+                newdst = loopback_addr;
+        else {
+                struct inet6_dev *idev;
+                struct inet6_ifaddr *ifa;
+                bool addr = false;
+
+                rcu_read_lock();
+                idev = __in6_dev_get(skb->dev);
+                if (idev != NULL) {
+                        list_for_each_entry(ifa, &idev->addr_list, if_list) {
+                                newdst = ifa->addr;
+                                addr = true;
+                                break;
+                        }
+                }
+                rcu_read_unlock();
+
+                if (!addr)
+                        return NF_DROP;
+        }
+
+        newrange.flags          = range->flags | NF_NAT_RANGE_MAP_IPS;
+        newrange.min_addr.in6   = newdst;
+        newrange.max_addr.in6   = newdst;
+        newrange.min_proto      = range->min_proto;
+        newrange.max_proto      = range->max_proto;
+
+        return nf_nat_setup_info(ct, &newrange, NF_NAT_MANIP_DST);
+}
+
+static int redirect_tg6_checkentry(const struct xt_tgchk_param *par)
+{
+        const struct nf_nat_range *range = par->targinfo;
+
+        if (range->flags & NF_NAT_RANGE_MAP_IPS)
+                return -EINVAL;
+        return 0;
+}
+
+static struct xt_target redirect_tg6_reg __read_mostly = {
+        .name           = "REDIRECT",
+        .family         = NFPROTO_IPV6,
+        .checkentry     = redirect_tg6_checkentry,
+        .target         = redirect_tg6,
+        .targetsize     = sizeof(struct nf_nat_range),
+        .table          = "nat",
+        .hooks          = (1 << NF_INET_PRE_ROUTING) | (1 << NF_INET_LOCAL_OUT),
+        .me             = THIS_MODULE,
+};
+
+static int __init redirect_tg6_init(void)
+{
+        return xt_register_target(&redirect_tg6_reg);
+}
+
+static void __exit redirect_tg6_exit(void)
+{
+        xt_unregister_target(&redirect_tg6_reg);
+}
+
+module_init(redirect_tg6_init);
+module_exit(redirect_tg6_exit);
+
+MODULE_LICENSE("GPL");
+MODULE_AUTHOR("Patrick McHardy <kaber@trash.net>");
+MODULE_DESCRIPTION("Xtables: Connection redirection to localhost");
diff --git a/net/ipv6/netfilter/ip6table_filter.c b/net/ipv6/netfilter/ip6table_filter.c
index 325e59a0224f..beb5777d2043 100644
--- a/net/ipv6/netfilter/ip6table_filter.c
+++ b/net/ipv6/netfilter/ip6table_filter.c
@@ -61,9 +61,7 @@ static int __net_init ip6table_filter_net_init(struct net *net)
         net->ipv6.ip6table_filter =
                 ip6t_register_table(net, &packet_filter, repl);
         kfree(repl);
-        if (IS_ERR(net->ipv6.ip6table_filter))
-                return PTR_ERR(net->ipv6.ip6table_filter);
-        return 0;
+        return PTR_RET(net->ipv6.ip6table_filter);
 }
 
 static void __net_exit ip6table_filter_net_exit(struct net *net)
diff --git a/net/ipv6/netfilter/ip6table_mangle.c b/net/ipv6/netfilter/ip6table_mangle.c
index 4d782405f125..7431121b87de 100644
--- a/net/ipv6/netfilter/ip6table_mangle.c
+++ b/net/ipv6/netfilter/ip6table_mangle.c
@@ -97,9 +97,7 @@ static int __net_init ip6table_mangle_net_init(struct net *net)
         net->ipv6.ip6table_mangle =
                 ip6t_register_table(net, &packet_mangler, repl);
         kfree(repl);
-        if (IS_ERR(net->ipv6.ip6table_mangle))
-                return PTR_ERR(net->ipv6.ip6table_mangle);
-        return 0;
+        return PTR_RET(net->ipv6.ip6table_mangle);
 }
 
 static void __net_exit ip6table_mangle_net_exit(struct net *net)
diff --git a/net/ipv6/netfilter/ip6table_nat.c b/net/ipv6/netfilter/ip6table_nat.c
new file mode 100644
index 000000000000..e418bd6350a4
--- /dev/null
+++ b/net/ipv6/netfilter/ip6table_nat.c
@@ -0,0 +1,321 @@
+/*
+ * Copyright (c) 2011 Patrick McHardy <kaber@trash.net>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ *
+ * Based on Rusty Russell's IPv4 NAT code. Development of IPv6 NAT
+ * funded by Astaro.
+ */
+
+#include <linux/module.h>
+#include <linux/netfilter.h>
+#include <linux/netfilter_ipv6.h>
+#include <linux/netfilter_ipv6/ip6_tables.h>
+#include <linux/ipv6.h>
+#include <net/ipv6.h>
+
+#include <net/netfilter/nf_nat.h>
+#include <net/netfilter/nf_nat_core.h>
+#include <net/netfilter/nf_nat_l3proto.h>
+
+static const struct xt_table nf_nat_ipv6_table = {
+        .name           = "nat",
+        .valid_hooks    = (1 << NF_INET_PRE_ROUTING) |
+                          (1 << NF_INET_POST_ROUTING) |
+                          (1 << NF_INET_LOCAL_OUT) |
+                          (1 << NF_INET_LOCAL_IN),
+        .me             = THIS_MODULE,
+        .af             = NFPROTO_IPV6,
+};
+
+static unsigned int alloc_null_binding(struct nf_conn *ct, unsigned int hooknum)
+{
+        /* Force range to this IP; let proto decide mapping for
+         * per-proto parts (hence not IP_NAT_RANGE_PROTO_SPECIFIED).
+         */
+        struct nf_nat_range range;
+
+        range.flags = 0;
+        pr_debug("Allocating NULL binding for %p (%pI6)\n", ct,
+                 HOOK2MANIP(hooknum) == NF_NAT_MANIP_SRC ?
+                 &ct->tuplehash[IP_CT_DIR_REPLY].tuple.dst.u3.ip6 :
+                 &ct->tuplehash[IP_CT_DIR_REPLY].tuple.src.u3.ip6);
+
+        return nf_nat_setup_info(ct, &range, HOOK2MANIP(hooknum));
+}
+
+static unsigned int nf_nat_rule_find(struct sk_buff *skb, unsigned int hooknum,
+                                     const struct net_device *in,
+                                     const struct net_device *out,
+                                     struct nf_conn *ct)
+{
+        struct net *net = nf_ct_net(ct);
+        unsigned int ret;
+
+        ret = ip6t_do_table(skb, hooknum, in, out, net->ipv6.ip6table_nat);
+        if (ret == NF_ACCEPT) {
+                if (!nf_nat_initialized(ct, HOOK2MANIP(hooknum)))
+                        ret = alloc_null_binding(ct, hooknum);
+        }
+        return ret;
+}
+
+static unsigned int
+nf_nat_ipv6_fn(unsigned int hooknum,
+               struct sk_buff *skb,
+               const struct net_device *in,
+               const struct net_device *out,
+               int (*okfn)(struct sk_buff *))
+{
+        struct nf_conn *ct;
+        enum ip_conntrack_info ctinfo;
+        struct nf_conn_nat *nat;
+        enum nf_nat_manip_type maniptype = HOOK2MANIP(hooknum);
+        __be16 frag_off;
+        int hdrlen;
+        u8 nexthdr;
+
+        ct = nf_ct_get(skb, &ctinfo);
+        /* Can't track?  It's not due to stress, or conntrack would
+         * have dropped it.  Hence it's the user's responsibilty to
+         * packet filter it out, or implement conntrack/NAT for that
+         * protocol. 8) --RR
+         */
+        if (!ct)
+                return NF_ACCEPT;
+
+        /* Don't try to NAT if this packet is not conntracked */
+        if (nf_ct_is_untracked(ct))
+                return NF_ACCEPT;
+
+        nat = nfct_nat(ct);
+        if (!nat) {
+                /* NAT module was loaded late. */
+                if (nf_ct_is_confirmed(ct))
+                        return NF_ACCEPT;
+                nat = nf_ct_ext_add(ct, NF_CT_EXT_NAT, GFP_ATOMIC);
+                if (nat == NULL) {
+                        pr_debug("failed to add NAT extension\n");
+                        return NF_ACCEPT;
+                }
+        }
+
+        switch (ctinfo) {
+        case IP_CT_RELATED:
+        case IP_CT_RELATED_REPLY:
+                nexthdr = ipv6_hdr(skb)->nexthdr;
+                hdrlen = ipv6_skip_exthdr(skb, sizeof(struct ipv6hdr),
+                                          &nexthdr, &frag_off);
+
+                if (hdrlen >= 0 && nexthdr == IPPROTO_ICMPV6) {
+                        if (!nf_nat_icmpv6_reply_translation(skb, ct, ctinfo,
+                                                             hooknum, hdrlen))
+                                return NF_DROP;
+                        else
+                                return NF_ACCEPT;
+                }
+                /* Fall thru... (Only ICMPs can be IP_CT_IS_REPLY) */
+        case IP_CT_NEW:
+                /* Seen it before?  This can happen for loopback, retrans,
+                 * or local packets.
+                 */
+                if (!nf_nat_initialized(ct, maniptype)) {
+                        unsigned int ret;
+
+                        ret = nf_nat_rule_find(skb, hooknum, in, out, ct);
+                        if (ret != NF_ACCEPT)
+                                return ret;
+                } else
+                        pr_debug("Already setup manip %s for ct %p\n",
+                                 maniptype == NF_NAT_MANIP_SRC ? "SRC" : "DST",
+                                 ct);
+                break;
+
+        default:
+                /* ESTABLISHED */
+                NF_CT_ASSERT(ctinfo == IP_CT_ESTABLISHED ||
+                             ctinfo == IP_CT_ESTABLISHED_REPLY);
+        }
+
+        return nf_nat_packet(ct, ctinfo, hooknum, skb);
+}
+
+static unsigned int
+nf_nat_ipv6_in(unsigned int hooknum,
+               struct sk_buff *skb,
+               const struct net_device *in,
+               const struct net_device *out,
+               int (*okfn)(struct sk_buff *))
+{
+        unsigned int ret;
+        struct in6_addr daddr = ipv6_hdr(skb)->daddr;
+
+        ret = nf_nat_ipv6_fn(hooknum, skb, in, out, okfn);
+        if (ret != NF_DROP && ret != NF_STOLEN &&
+            ipv6_addr_cmp(&daddr, &ipv6_hdr(skb)->daddr))
+                skb_dst_drop(skb);
+
+        return ret;
+}
+
+static unsigned int
+nf_nat_ipv6_out(unsigned int hooknum,
+                struct sk_buff *skb,
+                const struct net_device *in,
+                const struct net_device *out,
+                int (*okfn)(struct sk_buff *))
+{
+#ifdef CONFIG_XFRM
+        const struct nf_conn *ct;
+        enum ip_conntrack_info ctinfo;
+#endif
+        unsigned int ret;
+
+        /* root is playing with raw sockets. */
+        if (skb->len < sizeof(struct ipv6hdr))
+                return NF_ACCEPT;
+
+        ret = nf_nat_ipv6_fn(hooknum, skb, in, out, okfn);
+#ifdef CONFIG_XFRM
+        if (ret != NF_DROP && ret != NF_STOLEN &&
+            !(IP6CB(skb)->flags & IP6SKB_XFRM_TRANSFORMED) &&
+            (ct = nf_ct_get(skb, &ctinfo)) != NULL) {
+                enum ip_conntrack_dir dir = CTINFO2DIR(ctinfo);
+
+                if (!nf_inet_addr_cmp(&ct->tuplehash[dir].tuple.src.u3,
+                                      &ct->tuplehash[!dir].tuple.dst.u3) ||
+                    (ct->tuplehash[dir].tuple.src.u.all !=
+                     ct->tuplehash[!dir].tuple.dst.u.all))
+                        if (nf_xfrm_me_harder(skb, AF_INET6) < 0)
+                                ret = NF_DROP;
+        }
+#endif
+        return ret;
+}
+
+static unsigned int
+nf_nat_ipv6_local_fn(unsigned int hooknum,
+                     struct sk_buff *skb,
+                     const struct net_device *in,
+                     const struct net_device *out,
+                     int (*okfn)(struct sk_buff *))
+{
+        const struct nf_conn *ct;
+        enum ip_conntrack_info ctinfo;
+        unsigned int ret;
+
+        /* root is playing with raw sockets. */
+        if (skb->len < sizeof(struct ipv6hdr))
+                return NF_ACCEPT;
+
+        ret = nf_nat_ipv6_fn(hooknum, skb, in, out, okfn);
+        if (ret != NF_DROP && ret != NF_STOLEN &&
+            (ct = nf_ct_get(skb, &ctinfo)) != NULL) {
+                enum ip_conntrack_dir dir = CTINFO2DIR(ctinfo);
+
+                if (!nf_inet_addr_cmp(&ct->tuplehash[dir].tuple.dst.u3,
+                                      &ct->tuplehash[!dir].tuple.src.u3)) {
+                        if (ip6_route_me_harder(skb))
+                                ret = NF_DROP;
+                }
+#ifdef CONFIG_XFRM
+                else if (!(IP6CB(skb)->flags & IP6SKB_XFRM_TRANSFORMED) &&
+                         ct->tuplehash[dir].tuple.dst.u.all !=
+                         ct->tuplehash[!dir].tuple.src.u.all)
+                        if (nf_xfrm_me_harder(skb, AF_INET6))
+                                ret = NF_DROP;
+#endif
+        }
+        return ret;
+}
+
+static struct nf_hook_ops nf_nat_ipv6_ops[] __read_mostly = {
+        /* Before packet filtering, change destination */
+        {
+                .hook           = nf_nat_ipv6_in,
+                .owner          = THIS_MODULE,
+                .pf             = NFPROTO_IPV6,
+                .hooknum        = NF_INET_PRE_ROUTING,
+                .priority       = NF_IP6_PRI_NAT_DST,
+        },
+        /* After packet filtering, change source */
+        {
+                .hook           = nf_nat_ipv6_out,
+                .owner          = THIS_MODULE,
+                .pf             = NFPROTO_IPV6,
+                .hooknum        = NF_INET_POST_ROUTING,
+                .priority       = NF_IP6_PRI_NAT_SRC,
+        },
+        /* Before packet filtering, change destination */
+        {
+                .hook           = nf_nat_ipv6_local_fn,
+                .owner          = THIS_MODULE,
+                .pf             = NFPROTO_IPV6,
+                .hooknum        = NF_INET_LOCAL_OUT,
+                .priority       = NF_IP6_PRI_NAT_DST,
+        },
+        /* After packet filtering, change source */
+        {
+                .hook           = nf_nat_ipv6_fn,
+                .owner          = THIS_MODULE,
+                .pf             = NFPROTO_IPV6,
+                .hooknum        = NF_INET_LOCAL_IN,
+                .priority       = NF_IP6_PRI_NAT_SRC,
+        },
+};
+
+static int __net_init ip6table_nat_net_init(struct net *net)
+{
+        struct ip6t_replace *repl;
+
+        repl = ip6t_alloc_initial_table(&nf_nat_ipv6_table);
+        if (repl == NULL)
+                return -ENOMEM;
+        net->ipv6.ip6table_nat = ip6t_register_table(net, &nf_nat_ipv6_table, repl);
+        kfree(repl);
+        if (IS_ERR(net->ipv6.ip6table_nat))
+                return PTR_ERR(net->ipv6.ip6table_nat);
+        return 0;
+}
+
+static void __net_exit ip6table_nat_net_exit(struct net *net)
+{
+        ip6t_unregister_table(net, net->ipv6.ip6table_nat);
+}
+
+static struct pernet_operations ip6table_nat_net_ops = {
+        .init   = ip6table_nat_net_init,
+        .exit   = ip6table_nat_net_exit,
+};
+
+static int __init ip6table_nat_init(void)
+{
+        int err;
+
+        err = register_pernet_subsys(&ip6table_nat_net_ops);
+        if (err < 0)
+                goto err1;
+
+        err = nf_register_hooks(nf_nat_ipv6_ops, ARRAY_SIZE(nf_nat_ipv6_ops));
+        if (err < 0)
+                goto err2;
+        return 0;
+
+err2:
+        unregister_pernet_subsys(&ip6table_nat_net_ops);
+err1:
+        return err;
+}
+
+static void __exit ip6table_nat_exit(void)
+{
+        nf_unregister_hooks(nf_nat_ipv6_ops, ARRAY_SIZE(nf_nat_ipv6_ops));
+        unregister_pernet_subsys(&ip6table_nat_net_ops);
+}
+
+module_init(ip6table_nat_init);
+module_exit(ip6table_nat_exit);
+
+MODULE_LICENSE("GPL");
diff --git a/net/ipv6/netfilter/ip6table_raw.c b/net/ipv6/netfilter/ip6table_raw.c
index 5b9926a011bd..60d1bddff7a0 100644
--- a/net/ipv6/netfilter/ip6table_raw.c
+++ b/net/ipv6/netfilter/ip6table_raw.c
@@ -40,9 +40,7 @@ static int __net_init ip6table_raw_net_init(struct net *net)
         net->ipv6.ip6table_raw =
                 ip6t_register_table(net, &packet_raw, repl);
         kfree(repl);
-        if (IS_ERR(net->ipv6.ip6table_raw))
-                return PTR_ERR(net->ipv6.ip6table_raw);
-        return 0;
+        return PTR_RET(net->ipv6.ip6table_raw);
 }
 
 static void __net_exit ip6table_raw_net_exit(struct net *net)
diff --git a/net/ipv6/netfilter/ip6table_security.c b/net/ipv6/netfilter/ip6table_security.c
index 91aa2b4d83c9..db155351339c 100644
--- a/net/ipv6/netfilter/ip6table_security.c
+++ b/net/ipv6/netfilter/ip6table_security.c
@@ -58,10 +58,7 @@ static int __net_init ip6table_security_net_init(struct net *net)
         net->ipv6.ip6table_security =
                 ip6t_register_table(net, &security_table, repl);
         kfree(repl);
-        if (IS_ERR(net->ipv6.ip6table_security))
-                return PTR_ERR(net->ipv6.ip6table_security);
-
-        return 0;
+        return PTR_RET(net->ipv6.ip6table_security);
 }
 
 static void __net_exit ip6table_security_net_exit(struct net *net)
diff --git a/net/ipv6/netfilter/nf_conntrack_l3proto_ipv6.c b/net/ipv6/netfilter/nf_conntrack_l3proto_ipv6.c
index 4794f96cf2e0..8860d23e61cf 100644
--- a/net/ipv6/netfilter/nf_conntrack_l3proto_ipv6.c
+++ b/net/ipv6/netfilter/nf_conntrack_l3proto_ipv6.c
@@ -28,6 +28,7 @@
 #include <net/netfilter/nf_conntrack_core.h>
 #include <net/netfilter/nf_conntrack_zones.h>
 #include <net/netfilter/ipv6/nf_conntrack_ipv6.h>
+#include <net/netfilter/nf_nat_helper.h>
 #include <net/netfilter/ipv6/nf_defrag_ipv6.h>
 #include <net/netfilter/nf_log.h>
 
@@ -64,82 +65,31 @@ static int ipv6_print_tuple(struct seq_file *s,
                           tuple->src.u3.ip6, tuple->dst.u3.ip6);
 }
 
-/*
- * Based on ipv6_skip_exthdr() in net/ipv6/exthdr.c
- *
- * This function parses (probably truncated) exthdr set "hdr"
- * of length "len". "nexthdrp" initially points to some place,
- * where type of the first header can be found.
- *
- * It skips all well-known exthdrs, and returns pointer to the start
- * of unparsable area i.e. the first header with unknown type.
- * if success, *nexthdr is updated by type/protocol of this header.
- *
- * NOTES: - it may return pointer pointing beyond end of packet,
- *          if the last recognized header is truncated in the middle.
- *        - if packet is truncated, so that all parsed headers are skipped,
- *          it returns -1.
- *        - if packet is fragmented, return pointer of the fragment header.
- *        - ESP is unparsable for now and considered like
- *          normal payload protocol.
- *        - Note also special handling of AUTH header. Thanks to IPsec wizards.
- */
-
-static int nf_ct_ipv6_skip_exthdr(const struct sk_buff *skb, int start,
-                                  u8 *nexthdrp, int len)
-{
-        u8 nexthdr = *nexthdrp;
-
-        while (ipv6_ext_hdr(nexthdr)) {
-                struct ipv6_opt_hdr hdr;
-                int hdrlen;
-
-                if (len < (int)sizeof(struct ipv6_opt_hdr))
-                        return -1;
-                if (nexthdr == NEXTHDR_NONE)
-                        break;
-                if (nexthdr == NEXTHDR_FRAGMENT)
-                        break;
-                if (skb_copy_bits(skb, start, &hdr, sizeof(hdr)))
-                        BUG();
-                if (nexthdr == NEXTHDR_AUTH)
-                        hdrlen = (hdr.hdrlen+2)<<2;
-                else
-                        hdrlen = ipv6_optlen(&hdr);
-
-                nexthdr = hdr.nexthdr;
-                len -= hdrlen;
-                start += hdrlen;
-        }
-
-        *nexthdrp = nexthdr;
-        return start;
-}
-
 static int ipv6_get_l4proto(const struct sk_buff *skb, unsigned int nhoff,
                             unsigned int *dataoff, u_int8_t *protonum)
 {
         unsigned int extoff = nhoff + sizeof(struct ipv6hdr);
-        unsigned char pnum;
+        __be16 frag_off;
         int protoff;
+        u8 nexthdr;
 
         if (skb_copy_bits(skb, nhoff + offsetof(struct ipv6hdr, nexthdr),
-                          &pnum, sizeof(pnum)) != 0) {
+                          &nexthdr, sizeof(nexthdr)) != 0) {
                 pr_debug("ip6_conntrack_core: can't get nexthdr\n");
                 return -NF_ACCEPT;
         }
-        protoff = nf_ct_ipv6_skip_exthdr(skb, extoff, &pnum, skb->len - extoff);
+        protoff = ipv6_skip_exthdr(skb, extoff, &nexthdr, &frag_off);
         /*
          * (protoff == skb->len) mean that the packet doesn't have no data
          * except of IPv6 & ext headers. but it's tracked anyway. - YK
          */
-        if ((protoff < 0) || (protoff > skb->len)) {
+        if (protoff < 0 || (frag_off & htons(~0x7)) != 0) {
                 pr_debug("ip6_conntrack_core: can't find proto in pkt\n");
                 return -NF_ACCEPT;
         }
 
         *dataoff = protoff;
-        *protonum = pnum;
+        *protonum = nexthdr;
         return NF_ACCEPT;
 }
 
@@ -153,10 +103,10 @@ static unsigned int ipv6_helper(unsigned int hooknum,
         const struct nf_conn_help *help;
         const struct nf_conntrack_helper *helper;
         enum ip_conntrack_info ctinfo;
-        unsigned int ret, protoff;
-        unsigned int extoff = (u8 *)(ipv6_hdr(skb) + 1) - skb->data;
-        unsigned char pnum = ipv6_hdr(skb)->nexthdr;
-
+        unsigned int ret;
+        __be16 frag_off;
+        int protoff;
+        u8 nexthdr;
 
         /* This is where we call the helper: as the packet goes out. */
         ct = nf_ct_get(skb, &ctinfo);
@@ -171,9 +121,10 @@ static unsigned int ipv6_helper(unsigned int hooknum,
         if (!helper)
                 return NF_ACCEPT;
 
-        protoff = nf_ct_ipv6_skip_exthdr(skb, extoff, &pnum,
-                                         skb->len - extoff);
-        if (protoff > skb->len || pnum == NEXTHDR_FRAGMENT) {
+        nexthdr = ipv6_hdr(skb)->nexthdr;
+        protoff = ipv6_skip_exthdr(skb, sizeof(struct ipv6hdr), &nexthdr,
+                                   &frag_off);
+        if (protoff < 0 || (frag_off & htons(~0x7)) != 0) {
                 pr_debug("proto header not found\n");
                 return NF_ACCEPT;
         }
@@ -192,6 +143,36 @@ static unsigned int ipv6_confirm(unsigned int hooknum,
                                  const struct net_device *out,
                                  int (*okfn)(struct sk_buff *))
 {
+        struct nf_conn *ct;
+        enum ip_conntrack_info ctinfo;
+        unsigned char pnum = ipv6_hdr(skb)->nexthdr;
+        int protoff;
+        __be16 frag_off;
+
+        ct = nf_ct_get(skb, &ctinfo);
+        if (!ct || ctinfo == IP_CT_RELATED_REPLY)
+                goto out;
+
+        protoff = ipv6_skip_exthdr(skb, sizeof(struct ipv6hdr), &pnum,
+                                   &frag_off);
+        if (protoff < 0 || (frag_off & htons(~0x7)) != 0) {
+                pr_debug("proto header not found\n");
+                goto out;
+        }
+
+        /* adjust seqs for loopback traffic only in outgoing direction */
+        if (test_bit(IPS_SEQ_ADJUST_BIT, &ct->status) &&
+            !nf_is_loopback_packet(skb)) {
+                typeof(nf_nat_seq_adjust_hook) seq_adjust;
+
+                seq_adjust = rcu_dereference(nf_nat_seq_adjust_hook);
+                if (!seq_adjust ||
+                    !seq_adjust(skb, ct, ctinfo, protoff)) {
+                        NF_CT_STAT_INC_ATOMIC(nf_ct_net(ct), drop);
+                        return NF_DROP;
+                }
+        }
+out:
         /* We've seen it coming out the other side: confirm it */
         return nf_conntrack_confirm(skb);
 }
@@ -199,9 +180,14 @@ static unsigned int ipv6_confirm(unsigned int hooknum,
 static unsigned int __ipv6_conntrack_in(struct net *net,
                                         unsigned int hooknum,
                                         struct sk_buff *skb,
+                                        const struct net_device *in,
+                                        const struct net_device *out,
                                         int (*okfn)(struct sk_buff *))
 {
         struct sk_buff *reasm = skb->nfct_reasm;
+        const struct nf_conn_help *help;
+        struct nf_conn *ct;
+        enum ip_conntrack_info ctinfo;
 
         /* This packet is fragmented and has reassembled packet. */
         if (reasm) {
@@ -213,6 +199,25 @@ static unsigned int __ipv6_conntrack_in(struct net *net,
                         if (ret != NF_ACCEPT)
                                 return ret;
                 }
+
+                /* Conntrack helpers need the entire reassembled packet in the
+                 * POST_ROUTING hook. In case of unconfirmed connections NAT
+                 * might reassign a helper, so the entire packet is also
+                 * required.
+                 */
+                ct = nf_ct_get(reasm, &ctinfo);
+                if (ct != NULL && !nf_ct_is_untracked(ct)) {
+                        help = nfct_help(ct);
+                        if ((help && help->helper) || !nf_ct_is_confirmed(ct)) {
+                                nf_conntrack_get_reasm(skb);
+                                NF_HOOK_THRESH(NFPROTO_IPV6, hooknum, reasm,
+                                               (struct net_device *)in,
+                                               (struct net_device *)out,
+                                               okfn, NF_IP6_PRI_CONNTRACK + 1);
+                                return NF_DROP_ERR(-ECANCELED);
+                        }
+                }
+
                 nf_conntrack_get(reasm->nfct);
                 skb->nfct = reasm->nfct;
                 skb->nfctinfo = reasm->nfctinfo;
@@ -228,7 +233,7 @@ static unsigned int ipv6_conntrack_in(unsigned int hooknum,
                                       const struct net_device *out,
                                       int (*okfn)(struct sk_buff *))
 {
-        return __ipv6_conntrack_in(dev_net(in), hooknum, skb, okfn);
+        return __ipv6_conntrack_in(dev_net(in), hooknum, skb, in, out, okfn);
 }
 
 static unsigned int ipv6_conntrack_local(unsigned int hooknum,
@@ -242,7 +247,7 @@ static unsigned int ipv6_conntrack_local(unsigned int hooknum,
                 net_notice_ratelimited("ipv6_conntrack_local: packet too short\n");
                 return NF_ACCEPT;
         }
-        return __ipv6_conntrack_in(dev_net(out), hooknum, skb, okfn);
+        return __ipv6_conntrack_in(dev_net(out), hooknum, skb, in, out, okfn);
 }
 
 static struct nf_hook_ops ipv6_conntrack_ops[] __read_mostly = {
diff --git a/net/ipv6/netfilter/nf_conntrack_reasm.c b/net/ipv6/netfilter/nf_conntrack_reasm.c
index c9c78c2e666b..f94fb3ac2a79 100644
--- a/net/ipv6/netfilter/nf_conntrack_reasm.c
+++ b/net/ipv6/netfilter/nf_conntrack_reasm.c
@@ -190,6 +190,7 @@ static int nf_ct_frag6_queue(struct nf_ct_frag6_queue *fq, struct sk_buff *skb,
                              const struct frag_hdr *fhdr, int nhoff)
 {
         struct sk_buff *prev, *next;
+        unsigned int payload_len;
         int offset, end;
 
         if (fq->q.last_in & INET_FRAG_COMPLETE) {
@@ -197,8 +198,10 @@ static int nf_ct_frag6_queue(struct nf_ct_frag6_queue *fq, struct sk_buff *skb,
                 goto err;
         }
 
+        payload_len = ntohs(ipv6_hdr(skb)->payload_len);
+
         offset = ntohs(fhdr->frag_off) & ~0x7;
-        end = offset + (ntohs(ipv6_hdr(skb)->payload_len) -
+        end = offset + (payload_len -
                         ((u8 *)(fhdr + 1) - (u8 *)(ipv6_hdr(skb) + 1)));
 
         if ((unsigned int)end > IPV6_MAXPLEN) {
@@ -307,6 +310,8 @@ found:
         skb->dev = NULL;
         fq->q.stamp = skb->tstamp;
         fq->q.meat += skb->len;
+        if (payload_len > fq->q.max_size)
+                fq->q.max_size = payload_len;
         atomic_add(skb->truesize, &nf_init_frags.mem);
 
         /* The first fragment.
@@ -412,10 +417,12 @@ nf_ct_frag6_reasm(struct nf_ct_frag6_queue *fq, struct net_device *dev)
         }
         atomic_sub(head->truesize, &nf_init_frags.mem);
 
+        head->local_df = 1;
         head->next = NULL;
         head->dev = dev;
         head->tstamp = fq->q.stamp;
         ipv6_hdr(head)->payload_len = htons(payload_len);
+        IP6CB(head)->frag_max_size = sizeof(struct ipv6hdr) + fq->q.max_size;
 
         /* Yes, and fold redundant checksum back. 8) */
         if (head->ip_summed == CHECKSUM_COMPLETE)
@@ -592,6 +599,7 @@ void nf_ct_frag6_output(unsigned int hooknum, struct sk_buff *skb,
                         int (*okfn)(struct sk_buff *))
 {
         struct sk_buff *s, *s2;
+        unsigned int ret = 0;
 
         for (s = NFCT_FRAG6_CB(skb)->orig; s;) {
                 nf_conntrack_put_reasm(s->nfct_reasm);
@@ -601,8 +609,13 @@ void nf_ct_frag6_output(unsigned int hooknum, struct sk_buff *skb,
                 s2 = s->next;
                 s->next = NULL;
 
-                NF_HOOK_THRESH(NFPROTO_IPV6, hooknum, s, in, out, okfn,
-                               NF_IP6_PRI_CONNTRACK_DEFRAG + 1);
+                if (ret != -ECANCELED)
+                        ret = NF_HOOK_THRESH(NFPROTO_IPV6, hooknum, s,
+                                             in, out, okfn,
+                                             NF_IP6_PRI_CONNTRACK_DEFRAG + 1);
+                else
+                        kfree_skb(s);
+
                 s = s2;
         }
         nf_conntrack_put_reasm(skb);
diff --git a/net/ipv6/netfilter/nf_nat_l3proto_ipv6.c b/net/ipv6/netfilter/nf_nat_l3proto_ipv6.c
new file mode 100644
index 000000000000..81a2d1c3da8e
--- /dev/null
+++ b/net/ipv6/netfilter/nf_nat_l3proto_ipv6.c
@@ -0,0 +1,287 @@
+/*
+ * Copyright (c) 2011 Patrick McHardy <kaber@trash.net>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ *
+ * Development of IPv6 NAT funded by Astaro.
+ */
+#include <linux/types.h>
+#include <linux/module.h>
+#include <linux/skbuff.h>
+#include <linux/ipv6.h>
+#include <linux/netfilter.h>
+#include <linux/netfilter_ipv6.h>
+#include <net/secure_seq.h>
+#include <net/checksum.h>
+#include <net/ip6_route.h>
+#include <net/ipv6.h>
+
+#include <net/netfilter/nf_conntrack_core.h>
+#include <net/netfilter/nf_conntrack.h>
+#include <net/netfilter/nf_nat_core.h>
+#include <net/netfilter/nf_nat_l3proto.h>
+#include <net/netfilter/nf_nat_l4proto.h>
+
+static const struct nf_nat_l3proto nf_nat_l3proto_ipv6;
+
+#ifdef CONFIG_XFRM
+static void nf_nat_ipv6_decode_session(struct sk_buff *skb,
+                                       const struct nf_conn *ct,
+                                       enum ip_conntrack_dir dir,
+                                       unsigned long statusbit,
+                                       struct flowi *fl)
+{
+        const struct nf_conntrack_tuple *t = &ct->tuplehash[dir].tuple;
+        struct flowi6 *fl6 = &fl->u.ip6;
+
+        if (ct->status & statusbit) {
+                fl6->daddr = t->dst.u3.in6;
+                if (t->dst.protonum == IPPROTO_TCP ||
+                    t->dst.protonum == IPPROTO_UDP ||
+                    t->dst.protonum == IPPROTO_UDPLITE ||
+                    t->dst.protonum == IPPROTO_DCCP ||
+                    t->dst.protonum == IPPROTO_SCTP)
+                        fl6->fl6_dport = t->dst.u.all;
+        }
+
+        statusbit ^= IPS_NAT_MASK;
+
+        if (ct->status & statusbit) {
+                fl6->saddr = t->src.u3.in6;
+                if (t->dst.protonum == IPPROTO_TCP ||
+                    t->dst.protonum == IPPROTO_UDP ||
+                    t->dst.protonum == IPPROTO_UDPLITE ||
+                    t->dst.protonum == IPPROTO_DCCP ||
+                    t->dst.protonum == IPPROTO_SCTP)
+                        fl6->fl6_sport = t->src.u.all;
+        }
+}
+#endif
+
+static bool nf_nat_ipv6_in_range(const struct nf_conntrack_tuple *t,
+                                 const struct nf_nat_range *range)
+{
+        return ipv6_addr_cmp(&t->src.u3.in6, &range->min_addr.in6) >= 0 &&
+               ipv6_addr_cmp(&t->src.u3.in6, &range->max_addr.in6) <= 0;
+}
+
+static u32 nf_nat_ipv6_secure_port(const struct nf_conntrack_tuple *t,
+                                   __be16 dport)
+{
+        return secure_ipv6_port_ephemeral(t->src.u3.ip6, t->dst.u3.ip6, dport);
+}
+
+static bool nf_nat_ipv6_manip_pkt(struct sk_buff *skb,
+                                  unsigned int iphdroff,
+                                  const struct nf_nat_l4proto *l4proto,
+                                  const struct nf_conntrack_tuple *target,
+                                  enum nf_nat_manip_type maniptype)
+{
+        struct ipv6hdr *ipv6h;
+        __be16 frag_off;
+        int hdroff;
+        u8 nexthdr;
+
+        if (!skb_make_writable(skb, iphdroff + sizeof(*ipv6h)))
+                return false;
+
+        ipv6h = (void *)skb->data + iphdroff;
+        nexthdr = ipv6h->nexthdr;
+        hdroff = ipv6_skip_exthdr(skb, iphdroff + sizeof(*ipv6h),
+                                  &nexthdr, &frag_off);
+        if (hdroff < 0)
+                goto manip_addr;
+
+        if ((frag_off & htons(~0x7)) == 0 &&
+            !l4proto->manip_pkt(skb, &nf_nat_l3proto_ipv6, iphdroff, hdroff,
+                                target, maniptype))
+                return false;
+manip_addr:
+        if (maniptype == NF_NAT_MANIP_SRC)
+                ipv6h->saddr = target->src.u3.in6;
+        else
+                ipv6h->daddr = target->dst.u3.in6;
+
+        return true;
+}
+
+static void nf_nat_ipv6_csum_update(struct sk_buff *skb,
+                                    unsigned int iphdroff, __sum16 *check,
+                                    const struct nf_conntrack_tuple *t,
+                                    enum nf_nat_manip_type maniptype)
+{
+        const struct ipv6hdr *ipv6h = (struct ipv6hdr *)(skb->data + iphdroff);
+        const struct in6_addr *oldip, *newip;
+
+        if (maniptype == NF_NAT_MANIP_SRC) {
+                oldip = &ipv6h->saddr;
+                newip = &t->src.u3.in6;
+        } else {
+                oldip = &ipv6h->daddr;
+                newip = &t->dst.u3.in6;
+        }
+        inet_proto_csum_replace16(check, skb, oldip->s6_addr32,
+                                  newip->s6_addr32, 1);
+}
+
+static void nf_nat_ipv6_csum_recalc(struct sk_buff *skb,
+                                    u8 proto, void *data, __sum16 *check,
+                                    int datalen, int oldlen)
+{
+        const struct ipv6hdr *ipv6h = ipv6_hdr(skb);
+        struct rt6_info *rt = (struct rt6_info *)skb_dst(skb);
+
+        if (skb->ip_summed != CHECKSUM_PARTIAL) {
+                if (!(rt->rt6i_flags & RTF_LOCAL) &&
+                    (!skb->dev || skb->dev->features & NETIF_F_V6_CSUM)) {
+                        skb->ip_summed = CHECKSUM_PARTIAL;
+                        skb->csum_start = skb_headroom(skb) +
+                                          skb_network_offset(skb) +
+                                          (data - (void *)skb->data);
+                        skb->csum_offset = (void *)check - data;
+                        *check = ~csum_ipv6_magic(&ipv6h->saddr, &ipv6h->daddr,
+                                                  datalen, proto, 0);
+                } else {
+                        *check = 0;
+                        *check = csum_ipv6_magic(&ipv6h->saddr, &ipv6h->daddr,
+                                                 datalen, proto,
+                                                 csum_partial(data, datalen,
+                                                              0));
+                        if (proto == IPPROTO_UDP && !*check)
+                                *check = CSUM_MANGLED_0;
+                }
+        } else
+                inet_proto_csum_replace2(check, skb,
+                                         htons(oldlen), htons(datalen), 1);
+}
+
+static int nf_nat_ipv6_nlattr_to_range(struct nlattr *tb[],
+                                       struct nf_nat_range *range)
+{
+        if (tb[CTA_NAT_V6_MINIP]) {
+                nla_memcpy(&range->min_addr.ip6, tb[CTA_NAT_V6_MINIP],
+                           sizeof(struct in6_addr));
+                range->flags |= NF_NAT_RANGE_MAP_IPS;
+        }
+
+        if (tb[CTA_NAT_V6_MAXIP])
+                nla_memcpy(&range->max_addr.ip6, tb[CTA_NAT_V6_MAXIP],
+                           sizeof(struct in6_addr));
+        else
+                range->max_addr = range->min_addr;
+
+        return 0;
+}
+
+static const struct nf_nat_l3proto nf_nat_l3proto_ipv6 = {
+        .l3proto                = NFPROTO_IPV6,
+        .secure_port            = nf_nat_ipv6_secure_port,
+        .in_range               = nf_nat_ipv6_in_range,
+        .manip_pkt              = nf_nat_ipv6_manip_pkt,
+        .csum_update            = nf_nat_ipv6_csum_update,
+        .csum_recalc            = nf_nat_ipv6_csum_recalc,
+        .nlattr_to_range        = nf_nat_ipv6_nlattr_to_range,
+#ifdef CONFIG_XFRM
+        .decode_session = nf_nat_ipv6_decode_session,
+#endif
+};
+
+int nf_nat_icmpv6_reply_translation(struct sk_buff *skb,
+                                    struct nf_conn *ct,
+                                    enum ip_conntrack_info ctinfo,
+                                    unsigned int hooknum,
+                                    unsigned int hdrlen)
+{
+        struct {
+                struct icmp6hdr icmp6;
+                struct ipv6hdr  ip6;
+        } *inside;
+        enum ip_conntrack_dir dir = CTINFO2DIR(ctinfo);
+        enum nf_nat_manip_type manip = HOOK2MANIP(hooknum);
+        const struct nf_nat_l4proto *l4proto;
+        struct nf_conntrack_tuple target;
+        unsigned long statusbit;
+
+        NF_CT_ASSERT(ctinfo == IP_CT_RELATED || ctinfo == IP_CT_RELATED_REPLY);
+
+        if (!skb_make_writable(skb, hdrlen + sizeof(*inside)))
+                return 0;
+        if (nf_ip6_checksum(skb, hooknum, hdrlen, IPPROTO_ICMPV6))
+                return 0;
+
+        inside = (void *)skb->data + hdrlen;
+        if (inside->icmp6.icmp6_type == NDISC_REDIRECT) {
+                if ((ct->status & IPS_NAT_DONE_MASK) != IPS_NAT_DONE_MASK)
+                        return 0;
+                if (ct->status & IPS_NAT_MASK)
+                        return 0;
+        }
+
+        if (manip == NF_NAT_MANIP_SRC)
+                statusbit = IPS_SRC_NAT;
+        else
+                statusbit = IPS_DST_NAT;
+
+        /* Invert if this is reply direction */
+        if (dir == IP_CT_DIR_REPLY)
+                statusbit ^= IPS_NAT_MASK;
+
+        if (!(ct->status & statusbit))
+                return 1;
+
+        l4proto = __nf_nat_l4proto_find(NFPROTO_IPV6, inside->ip6.nexthdr);
+        if (!nf_nat_ipv6_manip_pkt(skb, hdrlen + sizeof(inside->icmp6),
+                                   l4proto, &ct->tuplehash[!dir].tuple, !manip))
+                return 0;
+
+        if (skb->ip_summed != CHECKSUM_PARTIAL) {
+                struct ipv6hdr *ipv6h = ipv6_hdr(skb);
+                inside = (void *)skb->data + hdrlen;
+                inside->icmp6.icmp6_cksum = 0;
+                inside->icmp6.icmp6_cksum =
+                        csum_ipv6_magic(&ipv6h->saddr, &ipv6h->daddr,
+                                        skb->len - hdrlen, IPPROTO_ICMPV6,
+                                        csum_partial(&inside->icmp6,
+                                                     skb->len - hdrlen, 0));
+        }
+
+        nf_ct_invert_tuplepr(&target, &ct->tuplehash[!dir].tuple);
+        l4proto = __nf_nat_l4proto_find(NFPROTO_IPV6, IPPROTO_ICMPV6);
+        if (!nf_nat_ipv6_manip_pkt(skb, 0, l4proto, &target, manip))
+                return 0;
+
+        return 1;
+}
+EXPORT_SYMBOL_GPL(nf_nat_icmpv6_reply_translation);
+
+static int __init nf_nat_l3proto_ipv6_init(void)
+{
+        int err;
+
+        err = nf_nat_l4proto_register(NFPROTO_IPV6, &nf_nat_l4proto_icmpv6);
+        if (err < 0)
+                goto err1;
+        err = nf_nat_l3proto_register(&nf_nat_l3proto_ipv6);
+        if (err < 0)
+                goto err2;
+        return err;
+
+err2:
+        nf_nat_l4proto_unregister(NFPROTO_IPV6, &nf_nat_l4proto_icmpv6);
+err1:
+        return err;
+}
+
+static void __exit nf_nat_l3proto_ipv6_exit(void)
+{
+        nf_nat_l3proto_unregister(&nf_nat_l3proto_ipv6);
+        nf_nat_l4proto_unregister(NFPROTO_IPV6, &nf_nat_l4proto_icmpv6);
+}
+
+MODULE_LICENSE("GPL");
+MODULE_ALIAS("nf-nat-" __stringify(AF_INET6));
+
+module_init(nf_nat_l3proto_ipv6_init);
+module_exit(nf_nat_l3proto_ipv6_exit);
diff --git a/net/ipv6/netfilter/nf_nat_proto_icmpv6.c b/net/ipv6/netfilter/nf_nat_proto_icmpv6.c
new file mode 100644
index 000000000000..5d6da784305b
--- /dev/null
+++ b/net/ipv6/netfilter/nf_nat_proto_icmpv6.c
@@ -0,0 +1,90 @@
+/*
+ * Copyright (c) 2011 Patrick Mchardy <kaber@trash.net>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ *
+ * Based on Rusty Russell's IPv4 ICMP NAT code. Development of IPv6
+ * NAT funded by Astaro.
+ */
+
+#include <linux/types.h>
+#include <linux/init.h>
+#include <linux/icmpv6.h>
+
+#include <linux/netfilter.h>
+#include <net/netfilter/nf_nat.h>
+#include <net/netfilter/nf_nat_core.h>
+#include <net/netfilter/nf_nat_l3proto.h>
+#include <net/netfilter/nf_nat_l4proto.h>
+
+static bool
+icmpv6_in_range(const struct nf_conntrack_tuple *tuple,
+                enum nf_nat_manip_type maniptype,
+                const union nf_conntrack_man_proto *min,
+                const union nf_conntrack_man_proto *max)
+{
+        return ntohs(tuple->src.u.icmp.id) >= ntohs(min->icmp.id) &&
+               ntohs(tuple->src.u.icmp.id) <= ntohs(max->icmp.id);
+}
+
+static void
+icmpv6_unique_tuple(const struct nf_nat_l3proto *l3proto,
+                    struct nf_conntrack_tuple *tuple,
+                    const struct nf_nat_range *range,
+                    enum nf_nat_manip_type maniptype,
+                    const struct nf_conn *ct)
+{
+        static u16 id;
+        unsigned int range_size;
+        unsigned int i;
+
+        range_size = ntohs(range->max_proto.icmp.id) -
+                     ntohs(range->min_proto.icmp.id) + 1;
+
+        if (!(range->flags & NF_NAT_RANGE_PROTO_SPECIFIED))
+                range_size = 0xffff;
+
+        for (i = 0; ; ++id) {
+                tuple->src.u.icmp.id = htons(ntohs(range->min_proto.icmp.id) +
+                                             (id % range_size));
+                if (++i == range_size || !nf_nat_used_tuple(tuple, ct))
+                        return;
+        }
+}
+
+static bool
+icmpv6_manip_pkt(struct sk_buff *skb,
+                 const struct nf_nat_l3proto *l3proto,
+                 unsigned int iphdroff, unsigned int hdroff,
+                 const struct nf_conntrack_tuple *tuple,
+                 enum nf_nat_manip_type maniptype)
+{
+        struct icmp6hdr *hdr;
+
+        if (!skb_make_writable(skb, hdroff + sizeof(*hdr)))
+                return false;
+
+        hdr = (struct icmp6hdr *)(skb->data + hdroff);
+        l3proto->csum_update(skb, iphdroff, &hdr->icmp6_cksum,
+                             tuple, maniptype);
+        if (hdr->icmp6_code == ICMPV6_ECHO_REQUEST ||
+            hdr->icmp6_code == ICMPV6_ECHO_REPLY) {
+                inet_proto_csum_replace2(&hdr->icmp6_cksum, skb,
+                                         hdr->icmp6_identifier,
+                                         tuple->src.u.icmp.id, 0);
+                hdr->icmp6_identifier = tuple->src.u.icmp.id;
+        }
+        return true;
+}
+
+const struct nf_nat_l4proto nf_nat_l4proto_icmpv6 = {
+        .l4proto                = IPPROTO_ICMPV6,
+        .manip_pkt              = icmpv6_manip_pkt,
+        .in_range               = icmpv6_in_range,
+        .unique_tuple           = icmpv6_unique_tuple,
+#if defined(CONFIG_NF_CT_NETLINK) || defined(CONFIG_NF_CT_NETLINK_MODULE)
+        .nlattr_to_range        = nf_nat_l4proto_nlattr_to_range,
+#endif
+};
diff --git a/net/ipv6/proc.c b/net/ipv6/proc.c
index da2e92d05c15..745a32042950 100644
--- a/net/ipv6/proc.c
+++ b/net/ipv6/proc.c
@@ -307,10 +307,10 @@ static int __net_init ipv6_proc_init_net(struct net *net)
                 goto proc_dev_snmp6_fail;
         return 0;
 
+proc_dev_snmp6_fail:
+        proc_net_remove(net, "snmp6");
 proc_snmp6_fail:
         proc_net_remove(net, "sockstat6");
-proc_dev_snmp6_fail:
-        proc_net_remove(net, "dev_snmp6");
         return -ENOMEM;
 }
 
diff --git a/net/ipv6/raw.c b/net/ipv6/raw.c
index ef0579d5bca6..7af88ef01657 100644
--- a/net/ipv6/raw.c
+++ b/net/ipv6/raw.c
@@ -1251,7 +1251,8 @@ static void raw6_sock_seq_show(struct seq_file *seq, struct sock *sp, int i)
                    sk_wmem_alloc_get(sp),
                    sk_rmem_alloc_get(sp),
                    0, 0L, 0,
-                   sock_i_uid(sp), 0,
+                   from_kuid_munged(seq_user_ns(seq), sock_i_uid(sp)),
+                   0,
                    sock_i_ino(sp),
                    atomic_read(&sp->sk_refcnt), sp, atomic_read(&sp->sk_drops));
 }
diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index 8e80fd279100..0ddf2d132e7f 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -965,7 +965,7 @@ struct dst_entry * ip6_route_output(struct net *net, const struct sock *sk,
 {
         int flags = 0;
 
-        fl6->flowi6_iif = net->loopback_dev->ifindex;
+        fl6->flowi6_iif = LOOPBACK_IFINDEX;
 
         if ((sk && sk->sk_bound_dev_if) || rt6_need_strict(&fl6->daddr))
                 flags |= RT6_LOOKUP_F_IFACE;
diff --git a/net/ipv6/syncookies.c b/net/ipv6/syncookies.c
index bb46061c813a..182ab9a85d6c 100644
--- a/net/ipv6/syncookies.c
+++ b/net/ipv6/syncookies.c
@@ -190,6 +190,7 @@ struct sock *cookie_v6_check(struct sock *sk, struct sk_buff *skb)
         ireq = inet_rsk(req);
         ireq6 = inet6_rsk(req);
         treq = tcp_rsk(req);
+        treq->listener = NULL;
 
         if (security_inet_conn_request(sk, skb, req))
                 goto out_free;
diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
index c66b90f71c9b..09078b9bc6f6 100644
--- a/net/ipv6/tcp_ipv6.c
+++ b/net/ipv6/tcp_ipv6.c
@@ -94,6 +94,18 @@ static struct tcp_md5sig_key *tcp_v6_md5_do_lookup(struct sock *sk,
 }
 #endif
 
+static void inet6_sk_rx_dst_set(struct sock *sk, const struct sk_buff *skb)
+{
+        struct dst_entry *dst = skb_dst(skb);
+        const struct rt6_info *rt = (const struct rt6_info *)dst;
+
+        dst_hold(dst);
+        sk->sk_rx_dst = dst;
+        inet_sk(sk)->rx_dst_ifindex = skb->skb_iif;
+        if (rt->rt6i_node)
+                inet6_sk(sk)->rx_dst_cookie = rt->rt6i_node->fn_sernum;
+}
+
 static void tcp_v6_hash(struct sock *sk)
 {
         if (sk->sk_state != TCP_CLOSE) {
@@ -463,7 +475,7 @@ static int tcp_v6_send_synack(struct sock *sk, struct dst_entry *dst,
         if (!dst && (dst = inet6_csk_route_req(sk, fl6, req)) == NULL)
                 goto done;
 
-        skb = tcp_make_synack(sk, dst, req, rvp);
+        skb = tcp_make_synack(sk, dst, req, rvp, NULL);
 
         if (skb) {
                 __tcp_v6_send_check(skb, &treq->loc_addr, &treq->rmt_addr);
@@ -975,7 +987,7 @@ static struct sock *tcp_v6_hnd_req(struct sock *sk,struct sk_buff *skb)
                                    &ipv6_hdr(skb)->saddr,
                                    &ipv6_hdr(skb)->daddr, inet6_iif(skb));
         if (req)
-                return tcp_check_req(sk, skb, req, prev);
+                return tcp_check_req(sk, skb, req, prev, false);
 
         nsk = __inet6_lookup_established(sock_net(sk), &tcp_hashinfo,
                         &ipv6_hdr(skb)->saddr, th->source,
@@ -1167,6 +1179,7 @@ have_isn:
             want_cookie)
                 goto drop_and_free;
 
+        tcp_rsk(req)->listener = NULL;
         inet6_csk_reqsk_queue_hash_add(sk, req, TCP_TIMEOUT_INIT);
         return 0;
 
@@ -1270,6 +1283,7 @@ static struct sock * tcp_v6_syn_recv_sock(struct sock *sk, struct sk_buff *skb,
 
         newsk->sk_gso_type = SKB_GSO_TCPV6;
         __ip6_dst_store(newsk, dst, NULL, NULL);
+        inet6_sk_rx_dst_set(newsk, skb);
 
         newtcp6sk = (struct tcp6_sock *)newsk;
         inet_sk(newsk)->pinet6 = &newtcp6sk->inet6;
@@ -1447,7 +1461,17 @@ static int tcp_v6_do_rcv(struct sock *sk, struct sk_buff *skb)
                 opt_skb = skb_clone(skb, sk_gfp_atomic(sk, GFP_ATOMIC));
 
         if (sk->sk_state == TCP_ESTABLISHED) { /* Fast path */
+                struct dst_entry *dst = sk->sk_rx_dst;
+
                 sock_rps_save_rxhash(sk, skb);
+                if (dst) {
+                        if (inet_sk(sk)->rx_dst_ifindex != skb->skb_iif ||
+                            dst->ops->check(dst, np->rx_dst_cookie) == NULL) {
+                                dst_release(dst);
+                                sk->sk_rx_dst = NULL;
+                        }
+                }
+
                 if (tcp_rcv_established(sk, skb, tcp_hdr(skb), skb->len))
                         goto reset;
                 if (opt_skb)
@@ -1705,9 +1729,9 @@ static void tcp_v6_early_demux(struct sk_buff *skb)
                         struct dst_entry *dst = sk->sk_rx_dst;
                         struct inet_sock *icsk = inet_sk(sk);
                         if (dst)
-                                dst = dst_check(dst, 0);
+                                dst = dst_check(dst, inet6_sk(sk)->rx_dst_cookie);
                         if (dst &&
-                            icsk->rx_dst_ifindex == inet6_iif(skb))
+                            icsk->rx_dst_ifindex == skb->skb_iif)
                                 skb_dst_set_noref(skb, dst);
                 }
         }
@@ -1723,6 +1747,7 @@ static const struct inet_connection_sock_af_ops ipv6_specific = {
         .queue_xmit        = inet6_csk_xmit,
         .send_check        = tcp_v6_send_check,
         .rebuild_header    = inet6_sk_rebuild_header,
+        .sk_rx_dst_set     = inet6_sk_rx_dst_set,
         .conn_request      = tcp_v6_conn_request,
         .syn_recv_sock     = tcp_v6_syn_recv_sock,
         .net_header_len    = sizeof(struct ipv6hdr),
@@ -1754,6 +1779,7 @@ static const struct inet_connection_sock_af_ops ipv6_mapped = {
         .queue_xmit        = ip_queue_xmit,
         .send_check        = tcp_v4_send_check,
         .rebuild_header    = inet_sk_rebuild_header,
+        .sk_rx_dst_set     = inet_sk_rx_dst_set,
         .conn_request      = tcp_v6_conn_request,
         .syn_recv_sock     = tcp_v6_syn_recv_sock,
         .net_header_len    = sizeof(struct iphdr),
@@ -1803,7 +1829,7 @@ static void tcp_v6_destroy_sock(struct sock *sk)
 #ifdef CONFIG_PROC_FS
 /* Proc filesystem TCPv6 sock list dumping. */
 static void get_openreq6(struct seq_file *seq,
-                         const struct sock *sk, struct request_sock *req, int i, int uid)
+                         const struct sock *sk, struct request_sock *req, int i, kuid_t uid)
 {
         int ttd = req->expires - jiffies;
         const struct in6_addr *src = &inet6_rsk(req)->loc_addr;
@@ -1827,7 +1853,7 @@ static void get_openreq6(struct seq_file *seq,
                    1,   /* timers active (only the expire timer) */
                    jiffies_to_clock_t(ttd),
                    req->retrans,
-                   uid,
+                   from_kuid_munged(seq_user_ns(seq), uid),
                    0,  /* non standard timer */
                    0, /* open_requests have no inode */
                    0, req);
@@ -1875,9 +1901,9 @@ static void get_tcp6_sock(struct seq_file *seq, struct sock *sp, int i)
                    tp->write_seq-tp->snd_una,
                    (sp->sk_state == TCP_LISTEN) ? sp->sk_ack_backlog : (tp->rcv_nxt - tp->copied_seq),
                    timer_active,
-                   jiffies_to_clock_t(timer_expires - jiffies),
+                   jiffies_delta_to_clock_t(timer_expires - jiffies),
                    icsk->icsk_retransmits,
-                   sock_i_uid(sp),
+                   from_kuid_munged(seq_user_ns(seq), sock_i_uid(sp)),
                    icsk->icsk_probes_out,
                    sock_i_ino(sp),
                    atomic_read(&sp->sk_refcnt), sp,
@@ -1895,10 +1921,7 @@ static void get_timewait6_sock(struct seq_file *seq,
         const struct in6_addr *dest, *src;
         __u16 destp, srcp;
         const struct inet6_timewait_sock *tw6 = inet6_twsk((struct sock *)tw);
-        int ttd = tw->tw_ttd - jiffies;
-
-        if (ttd < 0)
-                ttd = 0;
+        long delta = tw->tw_ttd - jiffies;
 
         dest = &tw6->tw_v6_daddr;
         src  = &tw6->tw_v6_rcv_saddr;
@@ -1914,7 +1937,7 @@ static void get_timewait6_sock(struct seq_file *seq,
                    dest->s6_addr32[0], dest->s6_addr32[1],
                    dest->s6_addr32[2], dest->s6_addr32[3], destp,
                    tw->tw_substate, 0, 0,
-                   3, jiffies_to_clock_t(ttd), 0, 0, 0, 0,
+                   3, jiffies_delta_to_clock_t(delta), 0, 0, 0, 0,
                    atomic_read(&tw->tw_refcnt), tw);
 }
 
diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c
index 99d0077b56b8..bbdff07eebe1 100644
--- a/net/ipv6/udp.c
+++ b/net/ipv6/udp.c
@@ -1458,7 +1458,8 @@ static void udp6_sock_seq_show(struct seq_file *seq, struct sock *sp, int bucket
                    sk_wmem_alloc_get(sp),
                    sk_rmem_alloc_get(sp),
                    0, 0L, 0,
-                   sock_i_uid(sp), 0,
+                   from_kuid_munged(seq_user_ns(seq), sock_i_uid(sp)),
+                   0,
                    sock_i_ino(sp),
                    atomic_read(&sp->sk_refcnt), sp,
                    atomic_read(&sp->sk_drops));
diff --git a/net/ipv6/xfrm6_policy.c b/net/ipv6/xfrm6_policy.c
index ef39812107b1..f8c4c08ffb60 100644
--- a/net/ipv6/xfrm6_policy.c
+++ b/net/ipv6/xfrm6_policy.c
@@ -73,6 +73,13 @@ static int xfrm6_get_tos(const struct flowi *fl)
         return 0;
 }
 
+static void xfrm6_init_dst(struct net *net, struct xfrm_dst *xdst)
+{
+        struct rt6_info *rt = (struct rt6_info *)xdst;
+
+        rt6_init_peer(rt, net->ipv6.peers);
+}
+
 static int xfrm6_init_path(struct xfrm_dst *path, struct dst_entry *dst,
                            int nfheader_len)
 {
@@ -286,6 +293,7 @@ static struct xfrm_policy_afinfo xfrm6_policy_afinfo = {
         .get_saddr =            xfrm6_get_saddr,
         .decode_session =       _decode_session6,
         .get_tos =              xfrm6_get_tos,
+        .init_dst =             xfrm6_init_dst,
         .init_path =            xfrm6_init_path,
         .fill_dst =             xfrm6_fill_dst,
         .blackhole_route =      ip6_blackhole_route,
diff --git a/net/ipx/ipx_proc.c b/net/ipx/ipx_proc.c
index f8ba30dfecae..02ff7f2f60d4 100644
--- a/net/ipx/ipx_proc.c
+++ b/net/ipx/ipx_proc.c
@@ -217,7 +217,8 @@ static int ipx_seq_socket_show(struct seq_file *seq, void *v)
         seq_printf(seq, "%08X  %08X  %02X     %03d\n",
                    sk_wmem_alloc_get(s),
                    sk_rmem_alloc_get(s),
-                   s->sk_state, SOCK_INODE(s->sk_socket)->i_uid);
+                   s->sk_state,
+                   from_kuid_munged(seq_user_ns(seq), sock_i_uid(s)));
 out:
         return 0;
 }
diff --git a/net/key/af_key.c b/net/key/af_key.c
index 34e418508a67..334f93b8cfcb 100644
--- a/net/key/af_key.c
+++ b/net/key/af_key.c
@@ -3024,7 +3024,7 @@ static u32 get_acqseq(void)
         return res;
 }
 
-static int pfkey_send_acquire(struct xfrm_state *x, struct xfrm_tmpl *t, struct xfrm_policy *xp, int dir)
+static int pfkey_send_acquire(struct xfrm_state *x, struct xfrm_tmpl *t, struct xfrm_policy *xp)
 {
         struct sk_buff *skb;
         struct sadb_msg *hdr;
@@ -3105,7 +3105,7 @@ static int pfkey_send_acquire(struct xfrm_state *x, struct xfrm_tmpl *t, struct
         pol->sadb_x_policy_len = sizeof(struct sadb_x_policy)/sizeof(uint64_t);
         pol->sadb_x_policy_exttype = SADB_X_EXT_POLICY;
         pol->sadb_x_policy_type = IPSEC_POLICY_IPSEC;
-        pol->sadb_x_policy_dir = dir+1;
+        pol->sadb_x_policy_dir = XFRM_POLICY_OUT + 1;
         pol->sadb_x_policy_id = xp->index;
 
         /* Set sadb_comb's. */
@@ -3661,7 +3661,7 @@ static int pfkey_seq_show(struct seq_file *f, void *v)
                                atomic_read(&s->sk_refcnt),
                                sk_rmem_alloc_get(s),
                                sk_wmem_alloc_get(s),
-                               sock_i_uid(s),
+                               from_kuid_munged(seq_user_ns(f), sock_i_uid(s)),
                                sock_i_ino(s)
                                );
         return 0;
diff --git a/net/l2tp/l2tp_core.c b/net/l2tp/l2tp_core.c
index 393355d37b47..513cab08a986 100644
--- a/net/l2tp/l2tp_core.c
+++ b/net/l2tp/l2tp_core.c
@@ -1347,11 +1347,10 @@ static void l2tp_tunnel_free(struct l2tp_tunnel *tunnel)
         /* Remove from tunnel list */
         spin_lock_bh(&pn->l2tp_tunnel_list_lock);
         list_del_rcu(&tunnel->list);
+        kfree_rcu(tunnel, rcu);
         spin_unlock_bh(&pn->l2tp_tunnel_list_lock);
-        synchronize_rcu();
 
         atomic_dec(&l2tp_tunnel_count);
-        kfree(tunnel);
 }
 
 /* Create a socket for the tunnel, if one isn't set up by
diff --git a/net/l2tp/l2tp_core.h b/net/l2tp/l2tp_core.h
index a38ec6cdeee1..56d583e083a7 100644
--- a/net/l2tp/l2tp_core.h
+++ b/net/l2tp/l2tp_core.h
@@ -163,6 +163,7 @@ struct l2tp_tunnel_cfg {
 
 struct l2tp_tunnel {
         int                     magic;          /* Should be L2TP_TUNNEL_MAGIC */
+        struct rcu_head rcu;
         rwlock_t                hlist_lock;     /* protect session_hlist */
         struct hlist_head       session_hlist[L2TP_HASH_SIZE];
                                                 /* hashed list of sessions,
diff --git a/net/l2tp/l2tp_ip6.c b/net/l2tp/l2tp_ip6.c
index 35e1e4bde587..927547171bc7 100644
--- a/net/l2tp/l2tp_ip6.c
+++ b/net/l2tp/l2tp_ip6.c
@@ -410,6 +410,7 @@ static int l2tp_ip6_getname(struct socket *sock, struct sockaddr *uaddr,
         lsa->l2tp_family = AF_INET6;
         lsa->l2tp_flowinfo = 0;
         lsa->l2tp_scope_id = 0;
+        lsa->l2tp_unused = 0;
         if (peer) {
                 if (!lsk->peer_conn_id)
                         return -ENOTCONN;
diff --git a/net/llc/af_llc.c b/net/llc/af_llc.c
index f6fe4d400502..c2190005a114 100644
--- a/net/llc/af_llc.c
+++ b/net/llc/af_llc.c
@@ -969,14 +969,13 @@ static int llc_ui_getname(struct socket *sock, struct sockaddr *uaddr,
         struct sockaddr_llc sllc;
         struct sock *sk = sock->sk;
         struct llc_sock *llc = llc_sk(sk);
-        int rc = 0;
+        int rc = -EBADF;
 
         memset(&sllc, 0, sizeof(sllc));
         lock_sock(sk);
         if (sock_flag(sk, SOCK_ZAPPED))
                 goto out;
         *uaddrlen = sizeof(sllc);
-        memset(uaddr, 0, *uaddrlen);
         if (peer) {
                 rc = -ENOTCONN;
                 if (sk->sk_state != TCP_ESTABLISHED)
@@ -1206,7 +1205,7 @@ static int __init llc2_init(void)
         rc = llc_proc_init();
         if (rc != 0) {
                 printk(llc_proc_err_msg);
-                goto out_unregister_llc_proto;
+                goto out_station;
         }
         rc = llc_sysctl_init();
         if (rc) {
@@ -1226,7 +1225,8 @@ out_sysctl:
         llc_sysctl_exit();
 out_proc:
         llc_proc_exit();
-out_unregister_llc_proto:
+out_station:
+        llc_station_exit();
         proto_unregister(&llc_proto);
         goto out;
 }
diff --git a/net/llc/llc_input.c b/net/llc/llc_input.c
index e32cab44ea95..dd3e83328ad5 100644
--- a/net/llc/llc_input.c
+++ b/net/llc/llc_input.c
@@ -42,6 +42,7 @@ static void (*llc_type_handlers[2])(struct llc_sap *sap,
 void llc_add_pack(int type, void (*handler)(struct llc_sap *sap,
                                             struct sk_buff *skb))
 {
+        smp_wmb(); /* ensure initialisation is complete before it's called */
         if (type == LLC_DEST_SAP || type == LLC_DEST_CONN)
                 llc_type_handlers[type - 1] = handler;
 }
@@ -50,11 +51,19 @@ void llc_remove_pack(int type)
 {
         if (type == LLC_DEST_SAP || type == LLC_DEST_CONN)
                 llc_type_handlers[type - 1] = NULL;
+        synchronize_net();
 }
 
 void llc_set_station_handler(void (*handler)(struct sk_buff *skb))
 {
+        /* Ensure initialisation is complete before it's called */
+        if (handler)
+                smp_wmb();
+
         llc_station_handler = handler;
+
+        if (!handler)
+                synchronize_net();
 }
 
 /**
@@ -150,6 +159,8 @@ int llc_rcv(struct sk_buff *skb, struct net_device *dev,
         int dest;
         int (*rcv)(struct sk_buff *, struct net_device *,
                    struct packet_type *, struct net_device *);
+        void (*sta_handler)(struct sk_buff *skb);
+        void (*sap_handler)(struct llc_sap *sap, struct sk_buff *skb);
 
         if (!net_eq(dev_net(dev), &init_net))
                 goto drop;
@@ -182,7 +193,8 @@ int llc_rcv(struct sk_buff *skb, struct net_device *dev,
          */
         rcv = rcu_dereference(sap->rcv_func);
         dest = llc_pdu_type(skb);
-        if (unlikely(!dest || !llc_type_handlers[dest - 1])) {
+        sap_handler = dest ? ACCESS_ONCE(llc_type_handlers[dest - 1]) : NULL;
+        if (unlikely(!sap_handler)) {
                 if (rcv)
                         rcv(skb, dev, pt, orig_dev);
                 else
@@ -193,7 +205,7 @@ int llc_rcv(struct sk_buff *skb, struct net_device *dev,
                         if (cskb)
                                 rcv(cskb, dev, pt, orig_dev);
                 }
-                llc_type_handlers[dest - 1](sap, skb);
+                sap_handler(sap, skb);
         }
         llc_sap_put(sap);
 out:
@@ -202,9 +214,10 @@ drop:
         kfree_skb(skb);
         goto out;
 handle_station:
-        if (!llc_station_handler)
+        sta_handler = ACCESS_ONCE(llc_station_handler);
+        if (!sta_handler)
                 goto drop;
-        llc_station_handler(skb);
+        sta_handler(skb);
         goto out;
 }
 
diff --git a/net/llc/llc_proc.c b/net/llc/llc_proc.c
index a1839c004357..7b4799cfbf8d 100644
--- a/net/llc/llc_proc.c
+++ b/net/llc/llc_proc.c
@@ -151,7 +151,7 @@ static int llc_seq_socket_show(struct seq_file *seq, void *v)
                    sk_wmem_alloc_get(sk),
                    sk_rmem_alloc_get(sk) - llc->copied_seq,
                    sk->sk_state,
-                   sk->sk_socket ? SOCK_INODE(sk->sk_socket)->i_uid : -1,
+                   from_kuid_munged(seq_user_ns(seq), sock_i_uid(sk)),
                    llc->link);
 out:
         return 0;
diff --git a/net/llc/llc_station.c b/net/llc/llc_station.c
index 39a8d8924b9c..b2f2bac2c2a2 100644
--- a/net/llc/llc_station.c
+++ b/net/llc/llc_station.c
@@ -268,7 +268,7 @@ static int llc_station_ac_send_null_dsap_xid_c(struct sk_buff *skb)
 out:
         return rc;
 free:
-        kfree_skb(skb);
+        kfree_skb(nskb);
         goto out;
 }
 
@@ -293,7 +293,7 @@ static int llc_station_ac_send_xid_r(struct sk_buff *skb)
 out:
         return rc;
 free:
-        kfree_skb(skb);
+        kfree_skb(nskb);
         goto out;
 }
 
@@ -322,7 +322,7 @@ static int llc_station_ac_send_test_r(struct sk_buff *skb)
 out:
         return rc;
 free:
-        kfree_skb(skb);
+        kfree_skb(nskb);
         goto out;
 }
 
@@ -687,12 +687,8 @@ static void llc_station_rcv(struct sk_buff *skb)
         llc_station_state_process(skb);
 }
 
-int __init llc_station_init(void)
+void __init llc_station_init(void)
 {
-        int rc = -ENOBUFS;
-        struct sk_buff *skb;
-        struct llc_station_state_ev *ev;
-
         skb_queue_head_init(&llc_main_station.mac_pdu_q);
         skb_queue_head_init(&llc_main_station.ev_q.list);
         spin_lock_init(&llc_main_station.ev_q.lock);
@@ -700,23 +696,12 @@ int __init llc_station_init(void)
                         (unsigned long)&llc_main_station);
         llc_main_station.ack_timer.expires  = jiffies +
                                                 sysctl_llc_station_ack_timeout;
-        skb = alloc_skb(0, GFP_ATOMIC);
-        if (!skb)
-                goto out;
-        rc = 0;
-        llc_set_station_handler(llc_station_rcv);
-        ev = llc_station_ev(skb);
-        memset(ev, 0, sizeof(*ev));
         llc_main_station.maximum_retry  = 1;
-        llc_main_station.state          = LLC_STATION_STATE_DOWN;
-        ev->type        = LLC_STATION_EV_TYPE_SIMPLE;
-        ev->prim_type   = LLC_STATION_EV_ENABLE_WITHOUT_DUP_ADDR_CHECK;
-        rc = llc_station_next_state(skb);
-out:
-        return rc;
+        llc_main_station.state          = LLC_STATION_STATE_UP;
+        llc_set_station_handler(llc_station_rcv);
 }
 
-void __exit llc_station_exit(void)
+void llc_station_exit(void)
 {
         llc_set_station_handler(NULL);
 }
diff --git a/net/mac80211/aes_cmac.c b/net/mac80211/aes_cmac.c
index 8dfd70d8fcfb..a04752e91023 100644
--- a/net/mac80211/aes_cmac.c
+++ b/net/mac80211/aes_cmac.c
@@ -38,14 +38,10 @@ static void gf_mulx(u8 *pad)
 static void aes_128_cmac_vector(struct crypto_cipher *tfm, size_t num_elem,
                                 const u8 *addr[], const size_t *len, u8 *mac)
 {
-        u8 scratch[2 * AES_BLOCK_SIZE];
-        u8 *cbc, *pad;
+        u8 cbc[AES_BLOCK_SIZE], pad[AES_BLOCK_SIZE];
         const u8 *pos, *end;
         size_t i, e, left, total_len;
 
-        cbc = scratch;
-        pad = scratch + AES_BLOCK_SIZE;
-
         memset(cbc, 0, AES_BLOCK_SIZE);
 
         total_len = 0;
diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c
index d41974aacf51..929f897a8ded 100644
--- a/net/mac80211/cfg.c
+++ b/net/mac80211/cfg.c
@@ -102,6 +102,18 @@ static int ieee80211_change_iface(struct wiphy *wiphy,
         return 0;
 }
 
+static int ieee80211_start_p2p_device(struct wiphy *wiphy,
+                                      struct wireless_dev *wdev)
+{
+        return ieee80211_do_open(wdev, true);
+}
+
+static void ieee80211_stop_p2p_device(struct wiphy *wiphy,
+                                      struct wireless_dev *wdev)
+{
+        ieee80211_sdata_stop(IEEE80211_WDEV_TO_SUB_IF(wdev));
+}
+
 static int ieee80211_set_noack_map(struct wiphy *wiphy,
                                   struct net_device *dev,
                                   u16 noack_map)
@@ -330,7 +342,7 @@ static void rate_idx_to_bitrate(struct rate_info *rate, struct sta_info *sta, in
         if (!(rate->flags & RATE_INFO_FLAGS_MCS)) {
                 struct ieee80211_supported_band *sband;
                 sband = sta->local->hw.wiphy->bands[
-                                sta->local->hw.conf.channel->band];
+                                sta->local->oper_channel->band];
                 rate->legacy = sband->bitrates[idx].bitrate;
         } else
                 rate->mcs = idx;
@@ -725,25 +737,23 @@ static int ieee80211_set_monitor_channel(struct wiphy *wiphy,
 static int ieee80211_set_probe_resp(struct ieee80211_sub_if_data *sdata,
                                     const u8 *resp, size_t resp_len)
 {
-        struct sk_buff *new, *old;
+        struct probe_resp *new, *old;
 
         if (!resp || !resp_len)
                 return 1;
 
         old = rtnl_dereference(sdata->u.ap.probe_resp);
 
-        new = dev_alloc_skb(resp_len);
+        new = kzalloc(sizeof(struct probe_resp) + resp_len, GFP_KERNEL);
         if (!new)
                 return -ENOMEM;
 
-        memcpy(skb_put(new, resp_len), resp, resp_len);
+        new->len = resp_len;
+        memcpy(new->data, resp, resp_len);
 
         rcu_assign_pointer(sdata->u.ap.probe_resp, new);
-        if (old) {
-                /* TODO: use call_rcu() */
-                synchronize_rcu();
-                dev_kfree_skb(old);
-        }
+        if (old)
+                kfree_rcu(old, rcu_head);
 
         return 0;
 }
@@ -950,7 +960,7 @@ static void ieee80211_send_layer2_update(struct sta_info *sta)
         /* 802.2 Type 1 Logical Link Control (LLC) Exchange Identifier (XID)
          * Update response frame; IEEE Std 802.2-1998, 5.4.1.2.1 */
 
-        memset(msg->da, 0xff, ETH_ALEN);
+        eth_broadcast_addr(msg->da);
         memcpy(msg->sa, sta->sta.addr, ETH_ALEN);
         msg->len = htons(6);
         msg->dsap = 0;
@@ -1285,9 +1295,10 @@ static int ieee80211_change_station(struct wiphy *wiphy,
         mutex_unlock(&local->sta_mtx);
 
         if (sdata->vif.type == NL80211_IFTYPE_STATION &&
-            params->sta_flags_mask & BIT(NL80211_STA_FLAG_AUTHORIZED))
+            params->sta_flags_mask & BIT(NL80211_STA_FLAG_AUTHORIZED)) {
                 ieee80211_recalc_ps(local, -1);
-
+                ieee80211_recalc_ps_vif(sdata);
+        }
         return 0;
 }
 
@@ -1661,7 +1672,7 @@ static int ieee80211_change_bss(struct wiphy *wiphy,
         }
 
         if (!sdata->vif.bss_conf.use_short_slot &&
-            sdata->local->hw.conf.channel->band == IEEE80211_BAND_5GHZ) {
+            sdata->local->oper_channel->band == IEEE80211_BAND_5GHZ) {
                 sdata->vif.bss_conf.use_short_slot = true;
                 changed |= BSS_CHANGED_ERP_SLOT;
         }
@@ -1775,6 +1786,7 @@ static int ieee80211_scan(struct wiphy *wiphy,
         case NL80211_IFTYPE_ADHOC:
         case NL80211_IFTYPE_MESH_POINT:
         case NL80211_IFTYPE_P2P_CLIENT:
+        case NL80211_IFTYPE_P2P_DEVICE:
                 break;
         case NL80211_IFTYPE_P2P_GO:
                 if (sdata->local->ops->hw_scan)
@@ -1927,7 +1939,7 @@ static int ieee80211_set_tx_power(struct wiphy *wiphy,
                                   enum nl80211_tx_power_setting type, int mbm)
 {
         struct ieee80211_local *local = wiphy_priv(wiphy);
-        struct ieee80211_channel *chan = local->hw.conf.channel;
+        struct ieee80211_channel *chan = local->oper_channel;
         u32 changes = 0;
 
         switch (type) {
@@ -2079,6 +2091,7 @@ static int ieee80211_set_power_mgmt(struct wiphy *wiphy, struct net_device *dev,
                 ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_PS);
 
         ieee80211_recalc_ps(local, -1);
+        ieee80211_recalc_ps_vif(sdata);
 
         return 0;
 }
@@ -2461,6 +2474,9 @@ static int ieee80211_mgmt_tx(struct wiphy *wiphy, struct wireless_dev *wdev,
                 if (!sdata->u.mgd.associated)
                         need_offchan = true;
                 break;
+        case NL80211_IFTYPE_P2P_DEVICE:
+                need_offchan = true;
+                break;
         default:
                 return -EOPNOTSUPP;
         }
@@ -2653,6 +2669,7 @@ ieee80211_prep_tdls_encap_data(struct wiphy *wiphy, struct net_device *dev,
                                u16 status_code, struct sk_buff *skb)
 {
         struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
+        struct ieee80211_local *local = sdata->local;
         struct ieee80211_tdls_data *tf;
 
         tf = (void *)skb_put(skb, offsetof(struct ieee80211_tdls_data, u));
@@ -2672,8 +2689,10 @@ ieee80211_prep_tdls_encap_data(struct wiphy *wiphy, struct net_device *dev,
                 tf->u.setup_req.capability =
                         cpu_to_le16(ieee80211_get_tdls_sta_capab(sdata));
 
-                ieee80211_add_srates_ie(sdata, skb, false);
-                ieee80211_add_ext_srates_ie(sdata, skb, false);
+                ieee80211_add_srates_ie(sdata, skb, false,
+                                        local->oper_channel->band);
+                ieee80211_add_ext_srates_ie(sdata, skb, false,
+                                            local->oper_channel->band);
                 ieee80211_tdls_add_ext_capab(skb);
                 break;
         case WLAN_TDLS_SETUP_RESPONSE:
@@ -2686,8 +2705,10 @@ ieee80211_prep_tdls_encap_data(struct wiphy *wiphy, struct net_device *dev,
                 tf->u.setup_resp.capability =
                         cpu_to_le16(ieee80211_get_tdls_sta_capab(sdata));
 
-                ieee80211_add_srates_ie(sdata, skb, false);
-                ieee80211_add_ext_srates_ie(sdata, skb, false);
+                ieee80211_add_srates_ie(sdata, skb, false,
+                                        local->oper_channel->band);
+                ieee80211_add_ext_srates_ie(sdata, skb, false,
+                                            local->oper_channel->band);
                 ieee80211_tdls_add_ext_capab(skb);
                 break;
         case WLAN_TDLS_SETUP_CONFIRM:
@@ -2725,6 +2746,7 @@ ieee80211_prep_tdls_direct(struct wiphy *wiphy, struct net_device *dev,
                            u16 status_code, struct sk_buff *skb)
 {
         struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
+        struct ieee80211_local *local = sdata->local;
         struct ieee80211_mgmt *mgmt;
 
         mgmt = (void *)skb_put(skb, 24);
@@ -2747,8 +2769,10 @@ ieee80211_prep_tdls_direct(struct wiphy *wiphy, struct net_device *dev,
                 mgmt->u.action.u.tdls_discover_resp.capability =
                         cpu_to_le16(ieee80211_get_tdls_sta_capab(sdata));
 
-                ieee80211_add_srates_ie(sdata, skb, false);
-                ieee80211_add_ext_srates_ie(sdata, skb, false);
+                ieee80211_add_srates_ie(sdata, skb, false,
+                                        local->oper_channel->band);
+                ieee80211_add_ext_srates_ie(sdata, skb, false,
+                                            local->oper_channel->band);
                 ieee80211_tdls_add_ext_capab(skb);
                 break;
         default:
@@ -3005,6 +3029,8 @@ struct cfg80211_ops mac80211_config_ops = {
         .add_virtual_intf = ieee80211_add_iface,
         .del_virtual_intf = ieee80211_del_iface,
         .change_virtual_intf = ieee80211_change_iface,
+        .start_p2p_device = ieee80211_start_p2p_device,
+        .stop_p2p_device = ieee80211_stop_p2p_device,
         .add_key = ieee80211_add_key,
         .del_key = ieee80211_del_key,
         .get_key = ieee80211_get_key,
diff --git a/net/mac80211/debugfs.c b/net/mac80211/debugfs.c
index b8dfb440c8ef..97173f8144d4 100644
--- a/net/mac80211/debugfs.c
+++ b/net/mac80211/debugfs.c
@@ -63,8 +63,6 @@ DEBUGFS_READONLY_FILE(user_power, "%d",
                       local->user_power_level);
 DEBUGFS_READONLY_FILE(power, "%d",
                       local->hw.conf.power_level);
-DEBUGFS_READONLY_FILE(frequency, "%d",
-                      local->hw.conf.channel->center_freq);
 DEBUGFS_READONLY_FILE(total_ps_buffered, "%d",
                       local->total_ps_buffered);
 DEBUGFS_READONLY_FILE(wep_iv, "%#08x",
@@ -91,33 +89,6 @@ static const struct file_operations reset_ops = {
         .llseek = noop_llseek,
 };
 
-static ssize_t channel_type_read(struct file *file, char __user *user_buf,
-                       size_t count, loff_t *ppos)
-{
-        struct ieee80211_local *local = file->private_data;
-        const char *buf;
-
-        switch (local->hw.conf.channel_type) {
-        case NL80211_CHAN_NO_HT:
-                buf = "no ht\n";
-                break;
-        case NL80211_CHAN_HT20:
-                buf = "ht20\n";
-                break;
-        case NL80211_CHAN_HT40MINUS:
-                buf = "ht40-\n";
-                break;
-        case NL80211_CHAN_HT40PLUS:
-                buf = "ht40+\n";
-                break;
-        default:
-                buf = "???";
-                break;
-        }
-
-        return simple_read_from_buffer(user_buf, count, ppos, buf, strlen(buf));
-}
-
 static ssize_t hwflags_read(struct file *file, char __user *user_buf,
                             size_t count, loff_t *ppos)
 {
@@ -205,7 +176,6 @@ static ssize_t queues_read(struct file *file, char __user *user_buf,
 }
 
 DEBUGFS_READONLY_FILE_OPS(hwflags);
-DEBUGFS_READONLY_FILE_OPS(channel_type);
 DEBUGFS_READONLY_FILE_OPS(queues);
 
 /* statistics stuff */
@@ -272,12 +242,10 @@ void debugfs_hw_add(struct ieee80211_local *local)
 
         local->debugfs.keys = debugfs_create_dir("keys", phyd);
 
-        DEBUGFS_ADD(frequency);
         DEBUGFS_ADD(total_ps_buffered);
         DEBUGFS_ADD(wep_iv);
         DEBUGFS_ADD(queues);
         DEBUGFS_ADD_MODE(reset, 0200);
-        DEBUGFS_ADD(channel_type);
         DEBUGFS_ADD(hwflags);
         DEBUGFS_ADD(user_power);
         DEBUGFS_ADD(power);
diff --git a/net/mac80211/driver-ops.h b/net/mac80211/driver-ops.h
index df9203199102..da9003b20004 100644
--- a/net/mac80211/driver-ops.h
+++ b/net/mac80211/driver-ops.h
@@ -9,7 +9,7 @@ static inline void check_sdata_in_driver(struct ieee80211_sub_if_data *sdata)
 {
         WARN(!(sdata->flags & IEEE80211_SDATA_IN_DRIVER),
              "%s:  Failed check-sdata-in-driver check, flags: 0x%x\n",
-             sdata->dev->name, sdata->flags);
+             sdata->dev ? sdata->dev->name : sdata->name, sdata->flags);
 }
 
 static inline struct ieee80211_sub_if_data *
@@ -22,9 +22,11 @@ get_bss_sdata(struct ieee80211_sub_if_data *sdata)
         return sdata;
 }
 
-static inline void drv_tx(struct ieee80211_local *local, struct sk_buff *skb)
+static inline void drv_tx(struct ieee80211_local *local,
+                          struct ieee80211_tx_control *control,
+                          struct sk_buff *skb)
 {
-        local->ops->tx(&local->hw, skb);
+        local->ops->tx(&local->hw, control, skb);
 }
 
 static inline void drv_get_et_strings(struct ieee80211_sub_if_data *sdata,
@@ -526,6 +528,9 @@ static inline void drv_sta_rc_update(struct ieee80211_local *local,
         sdata = get_bss_sdata(sdata);
         check_sdata_in_driver(sdata);
 
+        WARN_ON(changed & IEEE80211_RC_SUPP_RATES_CHANGED &&
+                sdata->vif.type != NL80211_IFTYPE_ADHOC);
+
         trace_drv_sta_rc_update(local, sdata, sta, changed);
         if (local->ops->sta_rc_update)
                 local->ops->sta_rc_update(&local->hw, &sdata->vif,
diff --git a/net/mac80211/ibss.c b/net/mac80211/ibss.c
index 5746d62faba1..a9d93285dba7 100644
--- a/net/mac80211/ibss.c
+++ b/net/mac80211/ibss.c
@@ -109,7 +109,7 @@ static void __ieee80211_sta_join_ibss(struct ieee80211_sub_if_data *sdata,
         memset(mgmt, 0, 24 + sizeof(mgmt->u.beacon));
         mgmt->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
                                           IEEE80211_STYPE_PROBE_RESP);
-        memset(mgmt->da, 0xff, ETH_ALEN);
+        eth_broadcast_addr(mgmt->da);
         memcpy(mgmt->sa, sdata->vif.addr, ETH_ALEN);
         memcpy(mgmt->bssid, ifibss->bssid, ETH_ALEN);
         mgmt->u.beacon.beacon_int = cpu_to_le16(beacon_int);
@@ -205,7 +205,7 @@ static void __ieee80211_sta_join_ibss(struct ieee80211_sub_if_data *sdata,
         mod_timer(&ifibss->timer,
                   round_jiffies(jiffies + IEEE80211_IBSS_MERGE_INTERVAL));
 
-        bss = cfg80211_inform_bss_frame(local->hw.wiphy, local->hw.conf.channel,
+        bss = cfg80211_inform_bss_frame(local->hw.wiphy, chan,
                                         mgmt, skb->len, 0, GFP_KERNEL);
         cfg80211_put_bss(bss);
         netif_carrier_on(sdata->dev);
@@ -294,7 +294,7 @@ ieee80211_ibss_add_sta(struct ieee80211_sub_if_data *sdata,
         struct ieee80211_if_ibss *ifibss = &sdata->u.ibss;
         struct ieee80211_local *local = sdata->local;
         struct sta_info *sta;
-        int band = local->hw.conf.channel->band;
+        int band = local->oper_channel->band;
 
         /*
          * XXX: Consider removing the least recently used entry and
@@ -459,8 +459,11 @@ static void ieee80211_rx_bss_info(struct ieee80211_sub_if_data *sdata,
                         }
                 }
 
-                if (sta && rates_updated)
+                if (sta && rates_updated) {
+                        drv_sta_rc_update(local, sdata, &sta->sta,
+                                          IEEE80211_RC_SUPP_RATES_CHANGED);
                         rate_control_rate_init(sta);
+                }
 
                 rcu_read_unlock();
         }
@@ -561,7 +564,7 @@ void ieee80211_ibss_rx_no_sta(struct ieee80211_sub_if_data *sdata,
         struct ieee80211_if_ibss *ifibss = &sdata->u.ibss;
         struct ieee80211_local *local = sdata->local;
         struct sta_info *sta;
-        int band = local->hw.conf.channel->band;
+        int band = local->oper_channel->band;
 
         /*
          * XXX: Consider removing the least recently used entry and
@@ -759,7 +762,7 @@ static void ieee80211_sta_find_ibss(struct ieee80211_sub_if_data *sdata)
                                 return;
                         }
                         sdata_info(sdata, "IBSS not allowed on %d MHz\n",
-                                   local->hw.conf.channel->center_freq);
+                                   local->oper_channel->center_freq);
 
                         /* No IBSS found - decrease scan interval and continue
                          * scanning. */
diff --git a/net/mac80211/ieee80211_i.h b/net/mac80211/ieee80211_i.h
index bb61f7718c4c..204bfedba306 100644
--- a/net/mac80211/ieee80211_i.h
+++ b/net/mac80211/ieee80211_i.h
@@ -193,8 +193,6 @@ struct ieee80211_tx_data {
         struct sta_info *sta;
         struct ieee80211_key *key;
 
-        struct ieee80211_channel *channel;
-
         unsigned int flags;
 };
 
@@ -274,9 +272,15 @@ struct beacon_data {
         struct rcu_head rcu_head;
 };
 
+struct probe_resp {
+        struct rcu_head rcu_head;
+        int len;
+        u8 data[0];
+};
+
 struct ieee80211_if_ap {
         struct beacon_data __rcu *beacon;
-        struct sk_buff __rcu *probe_resp;
+        struct probe_resp __rcu *probe_resp;
 
         struct list_head vlans;
 
@@ -359,6 +363,7 @@ enum ieee80211_sta_flags {
         IEEE80211_STA_NULLFUNC_ACKED    = BIT(8),
         IEEE80211_STA_RESET_SIGNAL_AVE  = BIT(9),
         IEEE80211_STA_DISABLE_40MHZ     = BIT(10),
+        IEEE80211_STA_DISABLE_VHT       = BIT(11),
 };
 
 struct ieee80211_mgd_auth_data {
@@ -1075,6 +1080,8 @@ struct ieee80211_local {
         struct idr ack_status_frames;
         spinlock_t ack_status_lock;
 
+        struct ieee80211_sub_if_data __rcu *p2p_sdata;
+
         /* dummy netdev for use w/ NAPI */
         struct net_device napi_dev;
 
@@ -1131,7 +1138,7 @@ struct ieee802_11_elems {
         u8 *prep;
         u8 *perr;
         struct ieee80211_rann_ie *rann;
-        u8 *ch_switch_elem;
+        struct ieee80211_channel_sw_ie *ch_switch_ie;
         u8 *country_elem;
         u8 *pwr_constr_elem;
         u8 *quiet_elem; /* first quite element */
@@ -1157,7 +1164,6 @@ struct ieee802_11_elems {
         u8 preq_len;
         u8 prep_len;
         u8 perr_len;
-        u8 ch_switch_elem_len;
         u8 country_elem_len;
         u8 pwr_constr_elem_len;
         u8 quiet_elem_len;
@@ -1202,6 +1208,7 @@ int ieee80211_mgd_disassoc(struct ieee80211_sub_if_data *sdata,
 void ieee80211_send_pspoll(struct ieee80211_local *local,
                            struct ieee80211_sub_if_data *sdata);
 void ieee80211_recalc_ps(struct ieee80211_local *local, s32 latency);
+void ieee80211_recalc_ps_vif(struct ieee80211_sub_if_data *sdata);
 int ieee80211_max_network_latency(struct notifier_block *nb,
                                   unsigned long data, void *dummy);
 int ieee80211_set_arp_filter(struct ieee80211_sub_if_data *sdata);
@@ -1291,6 +1298,8 @@ void ieee80211_remove_interfaces(struct ieee80211_local *local);
 void ieee80211_recalc_idle(struct ieee80211_local *local);
 void ieee80211_adjust_monitor_flags(struct ieee80211_sub_if_data *sdata,
                                     const int offset);
+int ieee80211_do_open(struct wireless_dev *wdev, bool coming_up);
+void ieee80211_sdata_stop(struct ieee80211_sub_if_data *sdata);
 
 static inline bool ieee80211_sdata_running(struct ieee80211_sub_if_data *sdata)
 {
@@ -1425,7 +1434,6 @@ void ieee80211_sta_rx_notify(struct ieee80211_sub_if_data *sdata,
                              struct ieee80211_hdr *hdr);
 void ieee80211_sta_tx_notify(struct ieee80211_sub_if_data *sdata,
                              struct ieee80211_hdr *hdr, bool ack);
-void ieee80211_beacon_connection_loss_work(struct work_struct *work);
 
 void ieee80211_wake_queues_by_reason(struct ieee80211_hw *hw,
                                      enum queue_stop_reason reason);
@@ -1457,13 +1465,15 @@ int ieee80211_build_preq_ies(struct ieee80211_local *local, u8 *buffer,
                              u8 channel);
 struct sk_buff *ieee80211_build_probe_req(struct ieee80211_sub_if_data *sdata,
                                           u8 *dst, u32 ratemask,
+                                          struct ieee80211_channel *chan,
                                           const u8 *ssid, size_t ssid_len,
                                           const u8 *ie, size_t ie_len,
                                           bool directed);
 void ieee80211_send_probe_req(struct ieee80211_sub_if_data *sdata, u8 *dst,
                               const u8 *ssid, size_t ssid_len,
                               const u8 *ie, size_t ie_len,
-                              u32 ratemask, bool directed, bool no_cck);
+                              u32 ratemask, bool directed, bool no_cck,
+                              struct ieee80211_channel *channel);
 
 void ieee80211_sta_def_wmm_params(struct ieee80211_sub_if_data *sdata,
                                   const size_t supp_rates_len,
@@ -1487,9 +1497,11 @@ u8 *ieee80211_ie_build_ht_oper(u8 *pos, struct ieee80211_sta_ht_cap *ht_cap,
 u8 *ieee80211_ie_build_vht_cap(u8 *pos, struct ieee80211_sta_vht_cap *vht_cap,
                                u32 cap);
 int ieee80211_add_srates_ie(struct ieee80211_sub_if_data *sdata,
-                            struct sk_buff *skb, bool need_basic);
+                            struct sk_buff *skb, bool need_basic,
+                            enum ieee80211_band band);
 int ieee80211_add_ext_srates_ie(struct ieee80211_sub_if_data *sdata,
-                                struct sk_buff *skb, bool need_basic);
+                                struct sk_buff *skb, bool need_basic,
+                                enum ieee80211_band band);
 
 /* channel management */
 enum ieee80211_chan_mode {
diff --git a/net/mac80211/iface.c b/net/mac80211/iface.c
index bfb57dcc1538..59f8adc2aa5f 100644
--- a/net/mac80211/iface.c
+++ b/net/mac80211/iface.c
@@ -100,6 +100,10 @@ static u32 __ieee80211_recalc_idle(struct ieee80211_local *local)
                         sdata->vif.bss_conf.idle = true;
                         continue;
                 }
+
+                if (sdata->vif.type == NL80211_IFTYPE_P2P_DEVICE)
+                        continue;
+
                 /* count everything else */
                 sdata->vif.bss_conf.idle = false;
                 count++;
@@ -121,7 +125,8 @@ static u32 __ieee80211_recalc_idle(struct ieee80211_local *local)
 
         list_for_each_entry(sdata, &local->interfaces, list) {
                 if (sdata->vif.type == NL80211_IFTYPE_MONITOR ||
-                    sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
+                    sdata->vif.type == NL80211_IFTYPE_AP_VLAN ||
+                    sdata->vif.type == NL80211_IFTYPE_P2P_DEVICE)
                         continue;
                 if (sdata->old_idle == sdata->vif.bss_conf.idle)
                         continue;
@@ -204,6 +209,8 @@ static inline int identical_mac_addr_allowed(int type1, int type2)
 {
         return type1 == NL80211_IFTYPE_MONITOR ||
                 type2 == NL80211_IFTYPE_MONITOR ||
+                type1 == NL80211_IFTYPE_P2P_DEVICE ||
+                type2 == NL80211_IFTYPE_P2P_DEVICE ||
                 (type1 == NL80211_IFTYPE_AP && type2 == NL80211_IFTYPE_WDS) ||
                 (type1 == NL80211_IFTYPE_WDS &&
                         (type2 == NL80211_IFTYPE_WDS ||
@@ -406,9 +413,10 @@ static void ieee80211_del_virtual_monitor(struct ieee80211_local *local)
  * an error on interface type changes that have been pre-checked, so most
  * checks should be in ieee80211_check_concurrent_iface.
  */
-static int ieee80211_do_open(struct net_device *dev, bool coming_up)
+int ieee80211_do_open(struct wireless_dev *wdev, bool coming_up)
 {
-        struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
+        struct ieee80211_sub_if_data *sdata = IEEE80211_WDEV_TO_SUB_IF(wdev);
+        struct net_device *dev = wdev->netdev;
         struct ieee80211_local *local = sdata->local;
         struct sta_info *sta;
         u32 changed = 0;
@@ -443,6 +451,7 @@ static int ieee80211_do_open(struct net_device *dev, bool coming_up)
         case NL80211_IFTYPE_STATION:
         case NL80211_IFTYPE_MONITOR:
         case NL80211_IFTYPE_ADHOC:
+        case NL80211_IFTYPE_P2P_DEVICE:
                 /* no special treatment */
                 break;
         case NL80211_IFTYPE_UNSPECIFIED:
@@ -471,7 +480,7 @@ static int ieee80211_do_open(struct net_device *dev, bool coming_up)
          * Copy the hopefully now-present MAC address to
          * this interface, if it has the special null one.
          */
-        if (is_zero_ether_addr(dev->dev_addr)) {
+        if (dev && is_zero_ether_addr(dev->dev_addr)) {
                 memcpy(dev->dev_addr,
                        local->hw.wiphy->perm_addr,
                        ETH_ALEN);
@@ -536,15 +545,23 @@ static int ieee80211_do_open(struct net_device *dev, bool coming_up)
                         local->fif_probe_req++;
                 }
 
-                changed |= ieee80211_reset_erp_info(sdata);
+                if (sdata->vif.type != NL80211_IFTYPE_P2P_DEVICE)
+                        changed |= ieee80211_reset_erp_info(sdata);
                 ieee80211_bss_info_change_notify(sdata, changed);
 
-                if (sdata->vif.type == NL80211_IFTYPE_STATION ||
-                    sdata->vif.type == NL80211_IFTYPE_ADHOC ||
-                    sdata->vif.type == NL80211_IFTYPE_AP)
+                switch (sdata->vif.type) {
+                case NL80211_IFTYPE_STATION:
+                case NL80211_IFTYPE_ADHOC:
+                case NL80211_IFTYPE_AP:
+                case NL80211_IFTYPE_MESH_POINT:
                         netif_carrier_off(dev);
-                else
+                        break;
+                case NL80211_IFTYPE_WDS:
+                case NL80211_IFTYPE_P2P_DEVICE:
+                        break;
+                default:
                         netif_carrier_on(dev);
+                }
 
                 /*
                  * set default queue parameters so drivers don't
@@ -576,6 +593,9 @@ static int ieee80211_do_open(struct net_device *dev, bool coming_up)
                 }
 
                 rate_control_rate_init(sta);
+                netif_carrier_on(dev);
+        } else if (sdata->vif.type == NL80211_IFTYPE_P2P_DEVICE) {
+                rcu_assign_pointer(local->p2p_sdata, sdata);
         }
 
         /*
@@ -601,7 +621,8 @@ static int ieee80211_do_open(struct net_device *dev, bool coming_up)
 
         ieee80211_recalc_ps(local, -1);
 
-        netif_tx_start_all_queues(dev);
+        if (dev)
+                netif_tx_start_all_queues(dev);
 
         return 0;
  err_del_interface:
@@ -631,7 +652,7 @@ static int ieee80211_open(struct net_device *dev)
         if (err)
                 return err;
 
-        return ieee80211_do_open(dev, true);
+        return ieee80211_do_open(&sdata->wdev, true);
 }
 
 static void ieee80211_do_stop(struct ieee80211_sub_if_data *sdata,
@@ -652,7 +673,8 @@ static void ieee80211_do_stop(struct ieee80211_sub_if_data *sdata,
         /*
          * Stop TX on this interface first.
          */
-        netif_tx_stop_all_queues(sdata->dev);
+        if (sdata->dev)
+                netif_tx_stop_all_queues(sdata->dev);
 
         ieee80211_roc_purge(sdata);
 
@@ -691,14 +713,16 @@ static void ieee80211_do_stop(struct ieee80211_sub_if_data *sdata,
                 local->fif_probe_req--;
         }
 
-        netif_addr_lock_bh(sdata->dev);
-        spin_lock_bh(&local->filter_lock);
-        __hw_addr_unsync(&local->mc_list, &sdata->dev->mc,
-                         sdata->dev->addr_len);
-        spin_unlock_bh(&local->filter_lock);
-        netif_addr_unlock_bh(sdata->dev);
+        if (sdata->dev) {
+                netif_addr_lock_bh(sdata->dev);
+                spin_lock_bh(&local->filter_lock);
+                __hw_addr_unsync(&local->mc_list, &sdata->dev->mc,
+                                 sdata->dev->addr_len);
+                spin_unlock_bh(&local->filter_lock);
+                netif_addr_unlock_bh(sdata->dev);
 
-        ieee80211_configure_filter(local);
+                ieee80211_configure_filter(local);
+        }
 
         del_timer_sync(&local->dynamic_ps_timer);
         cancel_work_sync(&local->dynamic_ps_enable_work);
@@ -708,7 +732,7 @@ static void ieee80211_do_stop(struct ieee80211_sub_if_data *sdata,
                 struct ieee80211_sub_if_data *vlan, *tmpsdata;
                 struct beacon_data *old_beacon =
                         rtnl_dereference(sdata->u.ap.beacon);
-                struct sk_buff *old_probe_resp =
+                struct probe_resp *old_probe_resp =
                         rtnl_dereference(sdata->u.ap.probe_resp);
 
                 /* sdata_running will return false, so this will disable */
@@ -720,7 +744,7 @@ static void ieee80211_do_stop(struct ieee80211_sub_if_data *sdata,
                 RCU_INIT_POINTER(sdata->u.ap.probe_resp, NULL);
                 synchronize_rcu();
                 kfree(old_beacon);
-                kfree_skb(old_probe_resp);
+                kfree(old_probe_resp);
 
                 /* down all dependent devices, that is VLANs */
                 list_for_each_entry_safe(vlan, tmpsdata, &sdata->u.ap.vlans,
@@ -759,6 +783,10 @@ static void ieee80211_do_stop(struct ieee80211_sub_if_data *sdata,
                 ieee80211_adjust_monitor_flags(sdata, -1);
                 ieee80211_configure_filter(local);
                 break;
+        case NL80211_IFTYPE_P2P_DEVICE:
+                /* relies on synchronize_rcu() below */
+                rcu_assign_pointer(local->p2p_sdata, NULL);
+                /* fall through */
         default:
                 flush_work(&sdata->work);
                 /*
@@ -771,14 +799,6 @@ static void ieee80211_do_stop(struct ieee80211_sub_if_data *sdata,
                 skb_queue_purge(&sdata->skb_queue);
 
                 /*
-                 * Disable beaconing here for mesh only, AP and IBSS
-                 * are already taken care of.
-                 */
-                if (sdata->vif.type == NL80211_IFTYPE_MESH_POINT)
-                        ieee80211_bss_info_change_notify(sdata,
-                                BSS_CHANGED_BEACON_ENABLED);
-
-                /*
                  * Free all remaining keys, there shouldn't be any,
                  * except maybe group keys in AP more or WDS?
                  */
@@ -877,9 +897,8 @@ static void ieee80211_set_multicast_list(struct net_device *dev)
  * Called when the netdev is removed or, by the code below, before
  * the interface type changes.
  */
-static void ieee80211_teardown_sdata(struct net_device *dev)
+static void ieee80211_teardown_sdata(struct ieee80211_sub_if_data *sdata)
 {
-        struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
         struct ieee80211_local *local = sdata->local;
         int flushed;
         int i;
@@ -900,6 +919,11 @@ static void ieee80211_teardown_sdata(struct net_device *dev)
         WARN_ON(flushed);
 }
 
+static void ieee80211_uninit(struct net_device *dev)
+{
+        ieee80211_teardown_sdata(IEEE80211_DEV_TO_SUB_IF(dev));
+}
+
 static u16 ieee80211_netdev_select_queue(struct net_device *dev,
                                          struct sk_buff *skb)
 {
@@ -909,7 +933,7 @@ static u16 ieee80211_netdev_select_queue(struct net_device *dev,
 static const struct net_device_ops ieee80211_dataif_ops = {
         .ndo_open               = ieee80211_open,
         .ndo_stop               = ieee80211_stop,
-        .ndo_uninit             = ieee80211_teardown_sdata,
+        .ndo_uninit             = ieee80211_uninit,
         .ndo_start_xmit         = ieee80211_subif_start_xmit,
         .ndo_set_rx_mode        = ieee80211_set_multicast_list,
         .ndo_change_mtu         = ieee80211_change_mtu,
@@ -940,7 +964,7 @@ static u16 ieee80211_monitor_select_queue(struct net_device *dev,
 static const struct net_device_ops ieee80211_monitorif_ops = {
         .ndo_open               = ieee80211_open,
         .ndo_stop               = ieee80211_stop,
-        .ndo_uninit             = ieee80211_teardown_sdata,
+        .ndo_uninit             = ieee80211_uninit,
         .ndo_start_xmit         = ieee80211_monitor_start_xmit,
         .ndo_set_rx_mode        = ieee80211_set_multicast_list,
         .ndo_change_mtu         = ieee80211_change_mtu,
@@ -1099,7 +1123,6 @@ static void ieee80211_setup_sdata(struct ieee80211_sub_if_data *sdata,
         /* and set some type-dependent values */
         sdata->vif.type = type;
         sdata->vif.p2p = false;
-        sdata->dev->netdev_ops = &ieee80211_dataif_ops;
         sdata->wdev.iftype = type;
 
         sdata->control_port_protocol = cpu_to_be16(ETH_P_PAE);
@@ -1107,8 +1130,11 @@ static void ieee80211_setup_sdata(struct ieee80211_sub_if_data *sdata,
 
         sdata->noack_map = 0;
 
-        /* only monitor differs */
-        sdata->dev->type = ARPHRD_ETHER;
+        /* only monitor/p2p-device differ */
+        if (sdata->dev) {
+                sdata->dev->netdev_ops = &ieee80211_dataif_ops;
+                sdata->dev->type = ARPHRD_ETHER;
+        }
 
         skb_queue_head_init(&sdata->skb_queue);
         INIT_WORK(&sdata->work, ieee80211_iface_work);
@@ -1146,6 +1172,7 @@ static void ieee80211_setup_sdata(struct ieee80211_sub_if_data *sdata,
                 break;
         case NL80211_IFTYPE_WDS:
         case NL80211_IFTYPE_AP_VLAN:
+        case NL80211_IFTYPE_P2P_DEVICE:
                 break;
         case NL80211_IFTYPE_UNSPECIFIED:
         case NUM_NL80211_IFTYPES:
@@ -1156,18 +1183,6 @@ static void ieee80211_setup_sdata(struct ieee80211_sub_if_data *sdata,
         ieee80211_debugfs_add_netdev(sdata);
 }
 
-static void ieee80211_clean_sdata(struct ieee80211_sub_if_data *sdata)
-{
-        switch (sdata->vif.type) {
-        case NL80211_IFTYPE_MESH_POINT:
-                mesh_path_flush_by_iface(sdata);
-                break;
-
-        default:
-                break;
-        }
-}
-
 static int ieee80211_runtime_change_iftype(struct ieee80211_sub_if_data *sdata,
                                            enum nl80211_iftype type)
 {
@@ -1225,7 +1240,7 @@ static int ieee80211_runtime_change_iftype(struct ieee80211_sub_if_data *sdata,
 
         ieee80211_do_stop(sdata, false);
 
-        ieee80211_teardown_sdata(sdata->dev);
+        ieee80211_teardown_sdata(sdata);
 
         ret = drv_change_interface(local, sdata, internal_type, p2p);
         if (ret)
@@ -1240,7 +1255,7 @@ static int ieee80211_runtime_change_iftype(struct ieee80211_sub_if_data *sdata,
 
         ieee80211_setup_sdata(sdata, type);
 
-        err = ieee80211_do_open(sdata->dev, false);
+        err = ieee80211_do_open(&sdata->wdev, false);
         WARN(err, "type change: do_open returned %d", err);
 
         return ret;
@@ -1267,14 +1282,14 @@ int ieee80211_if_change_type(struct ieee80211_sub_if_data *sdata,
                         return ret;
         } else {
                 /* Purge and reset type-dependent state. */
-                ieee80211_teardown_sdata(sdata->dev);
+                ieee80211_teardown_sdata(sdata);
                 ieee80211_setup_sdata(sdata, type);
         }
 
         /* reset some values that shouldn't be kept across type changes */
         sdata->vif.bss_conf.basic_rates =
                 ieee80211_mandatory_rates(sdata->local,
-                        sdata->local->hw.conf.channel->band);
+                        sdata->local->oper_channel->band);
         sdata->drop_unencrypted = 0;
         if (type == NL80211_IFTYPE_STATION)
                 sdata->u.mgd.use_4addr = false;
@@ -1283,8 +1298,7 @@ int ieee80211_if_change_type(struct ieee80211_sub_if_data *sdata,
 }
 
 static void ieee80211_assign_perm_addr(struct ieee80211_local *local,
-                                       struct net_device *dev,
-                                       enum nl80211_iftype type)
+                                       u8 *perm_addr, enum nl80211_iftype type)
 {
         struct ieee80211_sub_if_data *sdata;
         u64 mask, start, addr, val, inc;
@@ -1293,13 +1307,12 @@ static void ieee80211_assign_perm_addr(struct ieee80211_local *local,
         int i;
 
         /* default ... something at least */
-        memcpy(dev->perm_addr, local->hw.wiphy->perm_addr, ETH_ALEN);
+        memcpy(perm_addr, local->hw.wiphy->perm_addr, ETH_ALEN);
 
         if (is_zero_ether_addr(local->hw.wiphy->addr_mask) &&
             local->hw.wiphy->n_addresses <= 1)
                 return;
 
-
         mutex_lock(&local->iflist_mtx);
 
         switch (type) {
@@ -1312,11 +1325,24 @@ static void ieee80211_assign_perm_addr(struct ieee80211_local *local,
                 list_for_each_entry(sdata, &local->interfaces, list) {
                         if (sdata->vif.type != NL80211_IFTYPE_AP)
                                 continue;
-                        memcpy(dev->perm_addr, sdata->vif.addr, ETH_ALEN);
+                        memcpy(perm_addr, sdata->vif.addr, ETH_ALEN);
                         break;
                 }
                 /* keep default if no AP interface present */
                 break;
+        case NL80211_IFTYPE_P2P_CLIENT:
+        case NL80211_IFTYPE_P2P_GO:
+                if (local->hw.flags & IEEE80211_HW_P2P_DEV_ADDR_FOR_INTF) {
+                        list_for_each_entry(sdata, &local->interfaces, list) {
+                                if (sdata->vif.type != NL80211_IFTYPE_P2P_DEVICE)
+                                        continue;
+                                if (!ieee80211_sdata_running(sdata))
+                                        continue;
+                                memcpy(perm_addr, sdata->vif.addr, ETH_ALEN);
+                                goto out_unlock;
+                        }
+                }
+                /* otherwise fall through */
         default:
                 /* assign a new address if possible -- try n_addresses first */
                 for (i = 0; i < local->hw.wiphy->n_addresses; i++) {
@@ -1331,7 +1357,7 @@ static void ieee80211_assign_perm_addr(struct ieee80211_local *local,
                         }
 
                         if (!used) {
-                                memcpy(dev->perm_addr,
+                                memcpy(perm_addr,
                                        local->hw.wiphy->addresses[i].addr,
                                        ETH_ALEN);
                                 break;
@@ -1382,7 +1408,7 @@ static void ieee80211_assign_perm_addr(struct ieee80211_local *local,
                         }
 
                         if (!used) {
-                                memcpy(dev->perm_addr, tmp_addr, ETH_ALEN);
+                                memcpy(perm_addr, tmp_addr, ETH_ALEN);
                                 break;
                         }
                         addr = (start & ~mask) | (val & mask);
@@ -1391,6 +1417,7 @@ static void ieee80211_assign_perm_addr(struct ieee80211_local *local,
                 break;
         }
 
+ out_unlock:
         mutex_unlock(&local->iflist_mtx);
 }
 
@@ -1398,49 +1425,68 @@ int ieee80211_if_add(struct ieee80211_local *local, const char *name,
                      struct wireless_dev **new_wdev, enum nl80211_iftype type,
                      struct vif_params *params)
 {
-        struct net_device *ndev;
+        struct net_device *ndev = NULL;
         struct ieee80211_sub_if_data *sdata = NULL;
         int ret, i;
         int txqs = 1;
 
         ASSERT_RTNL();
 
-        if (local->hw.queues >= IEEE80211_NUM_ACS)
-                txqs = IEEE80211_NUM_ACS;
-
-        ndev = alloc_netdev_mqs(sizeof(*sdata) + local->hw.vif_data_size,
-                                name, ieee80211_if_setup, txqs, 1);
-        if (!ndev)
-                return -ENOMEM;
-        dev_net_set(ndev, wiphy_net(local->hw.wiphy));
-
-        ndev->needed_headroom = local->tx_headroom +
-                                4*6 /* four MAC addresses */
-                                + 2 + 2 + 2 + 2 /* ctl, dur, seq, qos */
-                                + 6 /* mesh */
-                                + 8 /* rfc1042/bridge tunnel */
-                                - ETH_HLEN /* ethernet hard_header_len */
-                                + IEEE80211_ENCRYPT_HEADROOM;
-        ndev->needed_tailroom = IEEE80211_ENCRYPT_TAILROOM;
-
-        ret = dev_alloc_name(ndev, ndev->name);
-        if (ret < 0)
-                goto fail;
-
-        ieee80211_assign_perm_addr(local, ndev, type);
-        memcpy(ndev->dev_addr, ndev->perm_addr, ETH_ALEN);
-        SET_NETDEV_DEV(ndev, wiphy_dev(local->hw.wiphy));
-
-        /* don't use IEEE80211_DEV_TO_SUB_IF because it checks too much */
-        sdata = netdev_priv(ndev);
-        ndev->ieee80211_ptr = &sdata->wdev;
-        memcpy(sdata->vif.addr, ndev->dev_addr, ETH_ALEN);
-        memcpy(sdata->name, ndev->name, IFNAMSIZ);
+        if (type == NL80211_IFTYPE_P2P_DEVICE) {
+                struct wireless_dev *wdev;
+
+                sdata = kzalloc(sizeof(*sdata) + local->hw.vif_data_size,
+                                GFP_KERNEL);
+                if (!sdata)
+                        return -ENOMEM;
+                wdev = &sdata->wdev;
+
+                sdata->dev = NULL;
+                strlcpy(sdata->name, name, IFNAMSIZ);
+                ieee80211_assign_perm_addr(local, wdev->address, type);
+                memcpy(sdata->vif.addr, wdev->address, ETH_ALEN);
+        } else {
+                if (local->hw.queues >= IEEE80211_NUM_ACS)
+                        txqs = IEEE80211_NUM_ACS;
+
+                ndev = alloc_netdev_mqs(sizeof(*sdata) +
+                                        local->hw.vif_data_size,
+                                        name, ieee80211_if_setup, txqs, 1);
+                if (!ndev)
+                        return -ENOMEM;
+                dev_net_set(ndev, wiphy_net(local->hw.wiphy));
+
+                ndev->needed_headroom = local->tx_headroom +
+                                        4*6 /* four MAC addresses */
+                                        + 2 + 2 + 2 + 2 /* ctl, dur, seq, qos */
+                                        + 6 /* mesh */
+                                        + 8 /* rfc1042/bridge tunnel */
+                                        - ETH_HLEN /* ethernet hard_header_len */
+                                        + IEEE80211_ENCRYPT_HEADROOM;
+                ndev->needed_tailroom = IEEE80211_ENCRYPT_TAILROOM;
+
+                ret = dev_alloc_name(ndev, ndev->name);
+                if (ret < 0) {
+                        free_netdev(ndev);
+                        return ret;
+                }
+
+                ieee80211_assign_perm_addr(local, ndev->perm_addr, type);
+                memcpy(ndev->dev_addr, ndev->perm_addr, ETH_ALEN);
+                SET_NETDEV_DEV(ndev, wiphy_dev(local->hw.wiphy));
+
+                /* don't use IEEE80211_DEV_TO_SUB_IF -- it checks too much */
+                sdata = netdev_priv(ndev);
+                ndev->ieee80211_ptr = &sdata->wdev;
+                memcpy(sdata->vif.addr, ndev->dev_addr, ETH_ALEN);
+                memcpy(sdata->name, ndev->name, IFNAMSIZ);
+
+                sdata->dev = ndev;
+        }
 
         /* initialise type-independent data */
         sdata->wdev.wiphy = local->hw.wiphy;
         sdata->local = local;
-        sdata->dev = ndev;
 #ifdef CONFIG_INET
         sdata->arp_filter_state = true;
 #endif
@@ -1469,17 +1515,21 @@ int ieee80211_if_add(struct ieee80211_local *local, const char *name,
         /* setup type-dependent data */
         ieee80211_setup_sdata(sdata, type);
 
-        if (params) {
-                ndev->ieee80211_ptr->use_4addr = params->use_4addr;
-                if (type == NL80211_IFTYPE_STATION)
-                        sdata->u.mgd.use_4addr = params->use_4addr;
-        }
+        if (ndev) {
+                if (params) {
+                        ndev->ieee80211_ptr->use_4addr = params->use_4addr;
+                        if (type == NL80211_IFTYPE_STATION)
+                                sdata->u.mgd.use_4addr = params->use_4addr;
+                }
 
-        ndev->features |= local->hw.netdev_features;
+                ndev->features |= local->hw.netdev_features;
 
-        ret = register_netdevice(ndev);
-        if (ret)
-                goto fail;
+                ret = register_netdevice(ndev);
+                if (ret) {
+                        free_netdev(ndev);
+                        return ret;
+                }
+        }
 
         mutex_lock(&local->iflist_mtx);
         list_add_tail_rcu(&sdata->list, &local->interfaces);
@@ -1489,10 +1539,6 @@ int ieee80211_if_add(struct ieee80211_local *local, const char *name,
                 *new_wdev = &sdata->wdev;
 
         return 0;
-
- fail:
-        free_netdev(ndev);
-        return ret;
 }
 
 void ieee80211_if_remove(struct ieee80211_sub_if_data *sdata)
@@ -1503,11 +1549,22 @@ void ieee80211_if_remove(struct ieee80211_sub_if_data *sdata)
         list_del_rcu(&sdata->list);
         mutex_unlock(&sdata->local->iflist_mtx);
 
-        /* clean up type-dependent data */
-        ieee80211_clean_sdata(sdata);
-
         synchronize_rcu();
-        unregister_netdevice(sdata->dev);
+
+        if (sdata->dev) {
+                unregister_netdevice(sdata->dev);
+        } else {
+                cfg80211_unregister_wdev(&sdata->wdev);
+                kfree(sdata);
+        }
+}
+
+void ieee80211_sdata_stop(struct ieee80211_sub_if_data *sdata)
+{
+        if (WARN_ON_ONCE(!test_bit(SDATA_STATE_RUNNING, &sdata->state)))
+                return;
+        ieee80211_do_stop(sdata, true);
+        ieee80211_teardown_sdata(sdata);
 }
 
 /*
@@ -1518,6 +1575,7 @@ void ieee80211_remove_interfaces(struct ieee80211_local *local)
 {
         struct ieee80211_sub_if_data *sdata, *tmp;
         LIST_HEAD(unreg_list);
+        LIST_HEAD(wdev_list);
 
         ASSERT_RTNL();
 
@@ -1525,13 +1583,20 @@ void ieee80211_remove_interfaces(struct ieee80211_local *local)
         list_for_each_entry_safe(sdata, tmp, &local->interfaces, list) {
                 list_del(&sdata->list);
 
-                ieee80211_clean_sdata(sdata);
-
-                unregister_netdevice_queue(sdata->dev, &unreg_list);
+                if (sdata->dev)
+                        unregister_netdevice_queue(sdata->dev, &unreg_list);
+                else
+                        list_add(&sdata->list, &wdev_list);
         }
         mutex_unlock(&local->iflist_mtx);
         unregister_netdevice_many(&unreg_list);
         list_del(&unreg_list);
+
+        list_for_each_entry_safe(sdata, tmp, &wdev_list, list) {
+                list_del(&sdata->list);
+                cfg80211_unregister_wdev(&sdata->wdev);
+                kfree(sdata);
+        }
 }
 
 static int netdev_notify(struct notifier_block *nb,
diff --git a/net/mac80211/main.c b/net/mac80211/main.c
index c26e231c733a..bd7529363193 100644
--- a/net/mac80211/main.c
+++ b/net/mac80211/main.c
@@ -207,6 +207,10 @@ void ieee80211_bss_info_change_notify(struct ieee80211_sub_if_data *sdata,
                 sdata->vif.bss_conf.bssid = NULL;
         else if (ieee80211_vif_is_mesh(&sdata->vif)) {
                 sdata->vif.bss_conf.bssid = zero;
+        } else if (sdata->vif.type == NL80211_IFTYPE_P2P_DEVICE) {
+                sdata->vif.bss_conf.bssid = sdata->vif.addr;
+                WARN_ONCE(changed & ~(BSS_CHANGED_IDLE),
+                          "P2P Device BSS changed %#x", changed);
         } else {
                 WARN_ON(1);
                 return;
@@ -514,6 +518,11 @@ ieee80211_default_mgmt_stypes[NUM_NL80211_IFTYPES] = {
                         BIT(IEEE80211_STYPE_AUTH >> 4) |
                         BIT(IEEE80211_STYPE_DEAUTH >> 4),
         },
+        [NL80211_IFTYPE_P2P_DEVICE] = {
+                .tx = 0xffff,
+                .rx = BIT(IEEE80211_STYPE_ACTION >> 4) |
+                        BIT(IEEE80211_STYPE_PROBE_REQ >> 4),
+        },
 };
 
 static const struct ieee80211_ht_cap mac80211_ht_capa_mod_mask = {
@@ -536,6 +545,11 @@ struct ieee80211_hw *ieee80211_alloc_hw(size_t priv_data_len,
         int priv_size, i;
         struct wiphy *wiphy;
 
+        if (WARN_ON(!ops->tx || !ops->start || !ops->stop || !ops->config ||
+                    !ops->add_interface || !ops->remove_interface ||
+                    !ops->configure_filter))
+                return NULL;
+
         if (WARN_ON(ops->sta_state && (ops->sta_add || ops->sta_remove)))
                 return NULL;
 
@@ -588,13 +602,6 @@ struct ieee80211_hw *ieee80211_alloc_hw(size_t priv_data_len,
 
         local->hw.priv = (char *)local + ALIGN(sizeof(*local), NETDEV_ALIGN);
 
-        BUG_ON(!ops->tx);
-        BUG_ON(!ops->start);
-        BUG_ON(!ops->stop);
-        BUG_ON(!ops->config);
-        BUG_ON(!ops->add_interface);
-        BUG_ON(!ops->remove_interface);
-        BUG_ON(!ops->configure_filter);
         local->ops = ops;
 
         /* set up some defaults */
diff --git a/net/mac80211/mesh.c b/net/mac80211/mesh.c
index 6fac18c0423f..ff0296c7bab8 100644
--- a/net/mac80211/mesh.c
+++ b/net/mac80211/mesh.c
@@ -109,11 +109,11 @@ bool mesh_matches_local(struct ieee80211_sub_if_data *sdata,
 
         /* Disallow HT40+/- mismatch */
         if (ie->ht_operation &&
-            (local->_oper_channel_type == NL80211_CHAN_HT40MINUS ||
-            local->_oper_channel_type == NL80211_CHAN_HT40PLUS) &&
+            (sdata->vif.bss_conf.channel_type == NL80211_CHAN_HT40MINUS ||
+             sdata->vif.bss_conf.channel_type == NL80211_CHAN_HT40PLUS) &&
             (sta_channel_type == NL80211_CHAN_HT40MINUS ||
              sta_channel_type == NL80211_CHAN_HT40PLUS) &&
-            local->_oper_channel_type != sta_channel_type)
+            sdata->vif.bss_conf.channel_type != sta_channel_type)
                 goto mismatch;
 
         return true;
@@ -136,10 +136,13 @@ bool mesh_peer_accepts_plinks(struct ieee802_11_elems *ie)
  * mesh_accept_plinks_update - update accepting_plink in local mesh beacons
  *
  * @sdata: mesh interface in which mesh beacons are going to be updated
+ *
+ * Returns: beacon changed flag if the beacon content changed.
  */
-void mesh_accept_plinks_update(struct ieee80211_sub_if_data *sdata)
+u32 mesh_accept_plinks_update(struct ieee80211_sub_if_data *sdata)
 {
         bool free_plinks;
+        u32 changed = 0;
 
         /* In case mesh_plink_free_count > 0 and mesh_plinktbl_capacity == 0,
          * the mesh interface might be able to establish plinks with peers that
@@ -149,8 +152,12 @@ void mesh_accept_plinks_update(struct ieee80211_sub_if_data *sdata)
          */
         free_plinks = mesh_plink_availables(sdata);
 
-        if (free_plinks != sdata->u.mesh.accepting_plinks)
-                ieee80211_mesh_housekeeping_timer((unsigned long) sdata);
+        if (free_plinks != sdata->u.mesh.accepting_plinks) {
+                sdata->u.mesh.accepting_plinks = free_plinks;
+                changed = BSS_CHANGED_BEACON;
+        }
+
+        return changed;
 }
 
 int mesh_rmc_init(struct ieee80211_sub_if_data *sdata)
@@ -262,7 +269,6 @@ mesh_add_meshconf_ie(struct sk_buff *skb, struct ieee80211_sub_if_data *sdata)
         neighbors = (neighbors > 15) ? 15 : neighbors;
         *pos++ = neighbors << 1;
         /* Mesh capability */
-        ifmsh->accepting_plinks = mesh_plink_availables(sdata);
         *pos = MESHCONF_CAPAB_FORWARDING;
         *pos |= ifmsh->accepting_plinks ?
             MESHCONF_CAPAB_ACCEPT_PLINKS : 0x00;
@@ -349,17 +355,18 @@ int mesh_add_ds_params_ie(struct sk_buff *skb,
 {
         struct ieee80211_local *local = sdata->local;
         struct ieee80211_supported_band *sband;
+        struct ieee80211_channel *chan = local->oper_channel;
         u8 *pos;
 
         if (skb_tailroom(skb) < 3)
                 return -ENOMEM;
 
-        sband = local->hw.wiphy->bands[local->hw.conf.channel->band];
+        sband = local->hw.wiphy->bands[chan->band];
         if (sband->band == IEEE80211_BAND_2GHZ) {
                 pos = skb_put(skb, 2 + 1);
                 *pos++ = WLAN_EID_DS_PARAMS;
                 *pos++ = 1;
-                *pos++ = ieee80211_frequency_to_channel(local->hw.conf.channel->center_freq);
+                *pos++ = ieee80211_frequency_to_channel(chan->center_freq);
         }
 
         return 0;
@@ -374,7 +381,7 @@ int mesh_add_ht_cap_ie(struct sk_buff *skb,
 
         sband = local->hw.wiphy->bands[local->oper_channel->band];
         if (!sband->ht_cap.ht_supported ||
-            local->_oper_channel_type == NL80211_CHAN_NO_HT)
+            sdata->vif.bss_conf.channel_type == NL80211_CHAN_NO_HT)
                 return 0;
 
         if (skb_tailroom(skb) < 2 + sizeof(struct ieee80211_ht_cap))
@@ -391,7 +398,8 @@ int mesh_add_ht_oper_ie(struct sk_buff *skb,
 {
         struct ieee80211_local *local = sdata->local;
         struct ieee80211_channel *channel = local->oper_channel;
-        enum nl80211_channel_type channel_type = local->_oper_channel_type;
+        enum nl80211_channel_type channel_type =
+                                sdata->vif.bss_conf.channel_type;
         struct ieee80211_supported_band *sband =
                                 local->hw.wiphy->bands[channel->band];
         struct ieee80211_sta_ht_cap *ht_cap = &sband->ht_cap;
@@ -521,14 +529,13 @@ int ieee80211_new_mesh_header(struct ieee80211s_hdr *meshhdr,
 static void ieee80211_mesh_housekeeping(struct ieee80211_sub_if_data *sdata,
                            struct ieee80211_if_mesh *ifmsh)
 {
-        bool free_plinks;
+        u32 changed;
 
         ieee80211_sta_expire(sdata, IEEE80211_MESH_PEER_INACTIVITY_LIMIT);
         mesh_path_expire(sdata);
 
-        free_plinks = mesh_plink_availables(sdata);
-        if (free_plinks != sdata->u.mesh.accepting_plinks)
-                ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_BEACON);
+        changed = mesh_accept_plinks_update(sdata);
+        ieee80211_bss_info_change_notify(sdata, changed);
 
         mod_timer(&ifmsh->housekeeping_timer,
                   round_jiffies(jiffies + IEEE80211_MESH_HOUSEKEEPING_INTERVAL));
@@ -603,12 +610,14 @@ void ieee80211_start_mesh(struct ieee80211_sub_if_data *sdata)
         sdata->vif.bss_conf.beacon_int = MESH_DEFAULT_BEACON_INTERVAL;
         sdata->vif.bss_conf.basic_rates =
                 ieee80211_mandatory_rates(sdata->local,
-                                          sdata->local->hw.conf.channel->band);
+                                          sdata->local->oper_channel->band);
         ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_BEACON |
                                                 BSS_CHANGED_BEACON_ENABLED |
                                                 BSS_CHANGED_HT |
                                                 BSS_CHANGED_BASIC_RATES |
                                                 BSS_CHANGED_BEACON_INT);
+
+        netif_carrier_on(sdata->dev);
 }
 
 void ieee80211_stop_mesh(struct ieee80211_sub_if_data *sdata)
@@ -616,12 +625,19 @@ void ieee80211_stop_mesh(struct ieee80211_sub_if_data *sdata)
         struct ieee80211_local *local = sdata->local;
         struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh;
 
+        netif_carrier_off(sdata->dev);
+
+        /* stop the beacon */
         ifmsh->mesh_id_len = 0;
         ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_BEACON_ENABLED);
-        sta_info_flush(local, NULL);
+
+        /* flush STAs and mpaths on this iface */
+        sta_info_flush(sdata->local, sdata);
+        mesh_path_flush_by_iface(sdata);
 
         del_timer_sync(&sdata->u.mesh.housekeeping_timer);
         del_timer_sync(&sdata->u.mesh.mesh_path_root_timer);
+        del_timer_sync(&sdata->u.mesh.mesh_path_timer);
         /*
          * If the timer fired while we waited for it, it will have
          * requeued the work. Now the work will be running again
@@ -634,6 +650,8 @@ void ieee80211_stop_mesh(struct ieee80211_sub_if_data *sdata)
         local->fif_other_bss--;
         atomic_dec(&local->iff_allmultis);
         ieee80211_configure_filter(local);
+
+        sdata->u.mesh.timers_running = 0;
 }
 
 static void ieee80211_mesh_rx_bcn_presp(struct ieee80211_sub_if_data *sdata,
diff --git a/net/mac80211/mesh.h b/net/mac80211/mesh.h
index faaa39bcfd10..25d0f17dec71 100644
--- a/net/mac80211/mesh.h
+++ b/net/mac80211/mesh.h
@@ -215,6 +215,9 @@ struct mesh_rmc {
 /* Maximum number of paths per interface */
 #define MESH_MAX_MPATHS         1024
 
+/* Number of frames buffered per destination for unresolved destinations */
+#define MESH_FRAME_QUEUE_LEN    10
+
 /* Public interfaces */
 /* Various */
 int ieee80211_fill_mesh_addresses(struct ieee80211_hdr *hdr, __le16 *fc,
@@ -282,7 +285,7 @@ void mesh_neighbour_update(struct ieee80211_sub_if_data *sdata,
                            u8 *hw_addr,
                            struct ieee802_11_elems *ie);
 bool mesh_peer_accepts_plinks(struct ieee802_11_elems *ie);
-void mesh_accept_plinks_update(struct ieee80211_sub_if_data *sdata);
+u32 mesh_accept_plinks_update(struct ieee80211_sub_if_data *sdata);
 void mesh_plink_broken(struct sta_info *sta);
 void mesh_plink_deactivate(struct sta_info *sta);
 int mesh_plink_open(struct sta_info *sta);
diff --git a/net/mac80211/mesh_hwmp.c b/net/mac80211/mesh_hwmp.c
index 494bc39f61a4..47aeee2d8db1 100644
--- a/net/mac80211/mesh_hwmp.c
+++ b/net/mac80211/mesh_hwmp.c
@@ -17,8 +17,6 @@
 #define MAX_METRIC      0xffffffff
 #define ARITH_SHIFT     8
 
-/* Number of frames buffered per destination for unresolved destinations */
-#define MESH_FRAME_QUEUE_LEN    10
 #define MAX_PREQ_QUEUE_LEN      64
 
 /* Destination only */
diff --git a/net/mac80211/mesh_pathtbl.c b/net/mac80211/mesh_pathtbl.c
index 075bc535c601..aa749818860e 100644
--- a/net/mac80211/mesh_pathtbl.c
+++ b/net/mac80211/mesh_pathtbl.c
@@ -203,23 +203,17 @@ void mesh_path_assign_nexthop(struct mesh_path *mpath, struct sta_info *sta)
 {
         struct sk_buff *skb;
         struct ieee80211_hdr *hdr;
-        struct sk_buff_head tmpq;
         unsigned long flags;
 
         rcu_assign_pointer(mpath->next_hop, sta);
 
-        __skb_queue_head_init(&tmpq);
-
         spin_lock_irqsave(&mpath->frame_queue.lock, flags);
-
-        while ((skb = __skb_dequeue(&mpath->frame_queue)) != NULL) {
+        skb_queue_walk(&mpath->frame_queue, skb) {
                 hdr = (struct ieee80211_hdr *) skb->data;
                 memcpy(hdr->addr1, sta->sta.addr, ETH_ALEN);
                 memcpy(hdr->addr2, mpath->sdata->vif.addr, ETH_ALEN);
-                __skb_queue_tail(&tmpq, skb);
         }
 
-        skb_queue_splice(&tmpq, &mpath->frame_queue);
         spin_unlock_irqrestore(&mpath->frame_queue.lock, flags);
 }
 
@@ -285,40 +279,42 @@ static void mesh_path_move_to_queue(struct mesh_path *gate_mpath,
                                     struct mesh_path *from_mpath,
                                     bool copy)
 {
-        struct sk_buff *skb, *cp_skb = NULL;
-        struct sk_buff_head gateq, failq;
+        struct sk_buff *skb, *fskb, *tmp;
+        struct sk_buff_head failq;
         unsigned long flags;
-        int num_skbs;
 
         BUG_ON(gate_mpath == from_mpath);
         BUG_ON(!gate_mpath->next_hop);
 
-        __skb_queue_head_init(&gateq);
         __skb_queue_head_init(&failq);
 
         spin_lock_irqsave(&from_mpath->frame_queue.lock, flags);
         skb_queue_splice_init(&from_mpath->frame_queue, &failq);
         spin_unlock_irqrestore(&from_mpath->frame_queue.lock, flags);
 
-        num_skbs = skb_queue_len(&failq);
-
-        while (num_skbs--) {
-                skb = __skb_dequeue(&failq);
-                if (copy) {
-                        cp_skb = skb_copy(skb, GFP_ATOMIC);
-                        if (cp_skb)
-                                __skb_queue_tail(&failq, cp_skb);
+        skb_queue_walk_safe(&failq, fskb, tmp) {
+                if (skb_queue_len(&gate_mpath->frame_queue) >=
+                                  MESH_FRAME_QUEUE_LEN) {
+                        mpath_dbg(gate_mpath->sdata, "mpath queue full!\n");
+                        break;
                 }
 
+                skb = skb_copy(fskb, GFP_ATOMIC);
+                if (WARN_ON(!skb))
+                        break;
+
                 prepare_for_gate(skb, gate_mpath->dst, gate_mpath);
-                __skb_queue_tail(&gateq, skb);
+                skb_queue_tail(&gate_mpath->frame_queue, skb);
+
+                if (copy)
+                        continue;
+
+                __skb_unlink(fskb, &failq);
+                kfree_skb(fskb);
         }
 
-        spin_lock_irqsave(&gate_mpath->frame_queue.lock, flags);
-        skb_queue_splice(&gateq, &gate_mpath->frame_queue);
         mpath_dbg(gate_mpath->sdata, "Mpath queue for gate %pM has %d frames\n",
                   gate_mpath->dst, skb_queue_len(&gate_mpath->frame_queue));
-        spin_unlock_irqrestore(&gate_mpath->frame_queue.lock, flags);
 
         if (!copy)
                 return;
@@ -531,7 +527,7 @@ int mesh_path_add(u8 *dst, struct ieee80211_sub_if_data *sdata)
 
         read_lock_bh(&pathtbl_resize_lock);
         memcpy(new_mpath->dst, dst, ETH_ALEN);
-        memset(new_mpath->rann_snd_addr, 0xff, ETH_ALEN);
+        eth_broadcast_addr(new_mpath->rann_snd_addr);
         new_mpath->is_root = false;
         new_mpath->sdata = sdata;
         new_mpath->flags = 0;
diff --git a/net/mac80211/mesh_plink.c b/net/mac80211/mesh_plink.c
index af671b984df3..9d7ad366ef09 100644
--- a/net/mac80211/mesh_plink.c
+++ b/net/mac80211/mesh_plink.c
@@ -48,17 +48,17 @@ static int mesh_plink_frame_tx(struct ieee80211_sub_if_data *sdata,
                 u8 *da, __le16 llid, __le16 plid, __le16 reason);
 
 static inline
-void mesh_plink_inc_estab_count(struct ieee80211_sub_if_data *sdata)
+u32 mesh_plink_inc_estab_count(struct ieee80211_sub_if_data *sdata)
 {
         atomic_inc(&sdata->u.mesh.mshstats.estab_plinks);
-        mesh_accept_plinks_update(sdata);
+        return mesh_accept_plinks_update(sdata);
 }
 
 static inline
-void mesh_plink_dec_estab_count(struct ieee80211_sub_if_data *sdata)
+u32 mesh_plink_dec_estab_count(struct ieee80211_sub_if_data *sdata)
 {
         atomic_dec(&sdata->u.mesh.mshstats.estab_plinks);
-        mesh_accept_plinks_update(sdata);
+        return mesh_accept_plinks_update(sdata);
 }
 
 /**
@@ -117,7 +117,7 @@ static u32 mesh_set_ht_prot_mode(struct ieee80211_sub_if_data *sdata)
         u16 ht_opmode;
         bool non_ht_sta = false, ht20_sta = false;
 
-        if (local->_oper_channel_type == NL80211_CHAN_NO_HT)
+        if (sdata->vif.bss_conf.channel_type == NL80211_CHAN_NO_HT)
                 return 0;
 
         rcu_read_lock();
@@ -147,7 +147,8 @@ out:
 
         if (non_ht_sta)
                 ht_opmode = IEEE80211_HT_OP_MODE_PROTECTION_NONHT_MIXED;
-        else if (ht20_sta && local->_oper_channel_type > NL80211_CHAN_HT20)
+        else if (ht20_sta &&
+                 sdata->vif.bss_conf.channel_type > NL80211_CHAN_HT20)
                 ht_opmode = IEEE80211_HT_OP_MODE_PROTECTION_20MHZ;
         else
                 ht_opmode = IEEE80211_HT_OP_MODE_PROTECTION_NONE;
@@ -170,22 +171,21 @@ out:
  * @sta: mesh peer link to deactivate
  *
  * All mesh paths with this peer as next hop will be flushed
+ * Returns beacon changed flag if the beacon content changed.
  *
  * Locking: the caller must hold sta->lock
  */
-static bool __mesh_plink_deactivate(struct sta_info *sta)
+static u32 __mesh_plink_deactivate(struct sta_info *sta)
 {
         struct ieee80211_sub_if_data *sdata = sta->sdata;
-        bool deactivated = false;
+        u32 changed = 0;
 
-        if (sta->plink_state == NL80211_PLINK_ESTAB) {
-                mesh_plink_dec_estab_count(sdata);
-                deactivated = true;
-        }
+        if (sta->plink_state == NL80211_PLINK_ESTAB)
+                changed = mesh_plink_dec_estab_count(sdata);
         sta->plink_state = NL80211_PLINK_BLOCKED;
         mesh_path_flush_by_nexthop(sta);
 
-        return deactivated;
+        return changed;
 }
 
 /**
@@ -198,18 +198,17 @@ static bool __mesh_plink_deactivate(struct sta_info *sta)
 void mesh_plink_deactivate(struct sta_info *sta)
 {
         struct ieee80211_sub_if_data *sdata = sta->sdata;
-        bool deactivated;
+        u32 changed;
 
         spin_lock_bh(&sta->lock);
-        deactivated = __mesh_plink_deactivate(sta);
+        changed = __mesh_plink_deactivate(sta);
         sta->reason = cpu_to_le16(WLAN_REASON_MESH_PEER_CANCELED);
         mesh_plink_frame_tx(sdata, WLAN_SP_MESH_PEERING_CLOSE,
                             sta->sta.addr, sta->llid, sta->plid,
                             sta->reason);
         spin_unlock_bh(&sta->lock);
 
-        if (deactivated)
-                ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_BEACON);
+        ieee80211_bss_info_change_notify(sdata, changed);
 }
 
 static int mesh_plink_frame_tx(struct ieee80211_sub_if_data *sdata,
@@ -217,12 +216,14 @@ static int mesh_plink_frame_tx(struct ieee80211_sub_if_data *sdata,
                 u8 *da, __le16 llid, __le16 plid, __le16 reason) {
         struct ieee80211_local *local = sdata->local;
         struct sk_buff *skb;
+        struct ieee80211_tx_info *info;
         struct ieee80211_mgmt *mgmt;
         bool include_plid = false;
         u16 peering_proto = 0;
         u8 *pos, ie_len = 4;
         int hdr_len = offsetof(struct ieee80211_mgmt, u.action.u.self_prot) +
                       sizeof(mgmt->u.action.u.self_prot);
+        int err = -ENOMEM;
 
         skb = dev_alloc_skb(local->tx_headroom +
                             hdr_len +
@@ -238,6 +239,7 @@ static int mesh_plink_frame_tx(struct ieee80211_sub_if_data *sdata,
                             sdata->u.mesh.ie_len);
         if (!skb)
                 return -1;
+        info = IEEE80211_SKB_CB(skb);
         skb_reserve(skb, local->tx_headroom);
         mgmt = (struct ieee80211_mgmt *) skb_put(skb, hdr_len);
         memset(mgmt, 0, hdr_len);
@@ -258,15 +260,18 @@ static int mesh_plink_frame_tx(struct ieee80211_sub_if_data *sdata,
                         pos = skb_put(skb, 2);
                         memcpy(pos + 2, &plid, 2);
                 }
-                if (ieee80211_add_srates_ie(sdata, skb, true) ||
-                    ieee80211_add_ext_srates_ie(sdata, skb, true) ||
+                if (ieee80211_add_srates_ie(sdata, skb, true,
+                                            local->oper_channel->band) ||
+                    ieee80211_add_ext_srates_ie(sdata, skb, true,
+                                                local->oper_channel->band) ||
                     mesh_add_rsn_ie(skb, sdata) ||
                     mesh_add_meshid_ie(skb, sdata) ||
                     mesh_add_meshconf_ie(skb, sdata))
-                        return -1;
+                        goto free;
         } else {        /* WLAN_SP_MESH_PEERING_CLOSE */
+                info->flags |= IEEE80211_TX_CTL_NO_ACK;
                 if (mesh_add_meshid_ie(skb, sdata))
-                        return -1;
+                        goto free;
         }
 
         /* Add Mesh Peering Management element */
@@ -285,11 +290,12 @@ static int mesh_plink_frame_tx(struct ieee80211_sub_if_data *sdata,
                 ie_len += 2;    /* reason code */
                 break;
         default:
-                return -EINVAL;
+                err = -EINVAL;
+                goto free;
         }
 
         if (WARN_ON(skb_tailroom(skb) < 2 + ie_len))
-                return -ENOMEM;
+                goto free;
 
         pos = skb_put(skb, 2 + ie_len);
         *pos++ = WLAN_EID_PEER_MGMT;
@@ -310,14 +316,17 @@ static int mesh_plink_frame_tx(struct ieee80211_sub_if_data *sdata,
         if (action != WLAN_SP_MESH_PEERING_CLOSE) {
                 if (mesh_add_ht_cap_ie(skb, sdata) ||
                     mesh_add_ht_oper_ie(skb, sdata))
-                        return -1;
+                        goto free;
         }
 
         if (mesh_add_vendor_ies(skb, sdata))
-                return -1;
+                goto free;
 
         ieee80211_tx_skb(sdata, skb);
         return 0;
+free:
+        kfree_skb(skb);
+        return err;
 }
 
 /**
@@ -362,9 +371,14 @@ static struct sta_info *mesh_peer_init(struct ieee80211_sub_if_data *sdata,
 
         spin_lock_bh(&sta->lock);
         sta->last_rx = jiffies;
+        if (sta->plink_state == NL80211_PLINK_ESTAB) {
+                spin_unlock_bh(&sta->lock);
+                return sta;
+        }
+
         sta->sta.supp_rates[band] = rates;
         if (elems->ht_cap_elem &&
-            sdata->local->_oper_channel_type != NL80211_CHAN_NO_HT)
+            sdata->vif.bss_conf.channel_type != NL80211_CHAN_NO_HT)
                 ieee80211_ht_cap_ie_to_sta_ht_cap(sdata, sband,
                                                   elems->ht_cap_elem,
                                                   &sta->sta.ht_cap);
@@ -541,15 +555,14 @@ int mesh_plink_open(struct sta_info *sta)
 void mesh_plink_block(struct sta_info *sta)
 {
         struct ieee80211_sub_if_data *sdata = sta->sdata;
-        bool deactivated;
+        u32 changed;
 
         spin_lock_bh(&sta->lock);
-        deactivated = __mesh_plink_deactivate(sta);
+        changed = __mesh_plink_deactivate(sta);
         sta->plink_state = NL80211_PLINK_BLOCKED;
         spin_unlock_bh(&sta->lock);
 
-        if (deactivated)
-                ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_BEACON);
+        ieee80211_bss_info_change_notify(sdata, changed);
 }
 
 
@@ -852,9 +865,8 @@ void mesh_rx_plink_frame(struct ieee80211_sub_if_data *sdata, struct ieee80211_m
                         del_timer(&sta->plink_timer);
                         sta->plink_state = NL80211_PLINK_ESTAB;
                         spin_unlock_bh(&sta->lock);
-                        mesh_plink_inc_estab_count(sdata);
+                        changed |= mesh_plink_inc_estab_count(sdata);
                         changed |= mesh_set_ht_prot_mode(sdata);
-                        changed |= BSS_CHANGED_BEACON;
                         mpl_dbg(sdata, "Mesh plink with %pM ESTABLISHED\n",
                                 sta->sta.addr);
                         break;
@@ -888,9 +900,8 @@ void mesh_rx_plink_frame(struct ieee80211_sub_if_data *sdata, struct ieee80211_m
                         del_timer(&sta->plink_timer);
                         sta->plink_state = NL80211_PLINK_ESTAB;
                         spin_unlock_bh(&sta->lock);
-                        mesh_plink_inc_estab_count(sdata);
+                        changed |= mesh_plink_inc_estab_count(sdata);
                         changed |= mesh_set_ht_prot_mode(sdata);
-                        changed |= BSS_CHANGED_BEACON;
                         mpl_dbg(sdata, "Mesh plink with %pM ESTABLISHED\n",
                                 sta->sta.addr);
                         mesh_plink_frame_tx(sdata,
@@ -908,13 +919,12 @@ void mesh_rx_plink_frame(struct ieee80211_sub_if_data *sdata, struct ieee80211_m
                 case CLS_ACPT:
                         reason = cpu_to_le16(WLAN_REASON_MESH_CLOSE);
                         sta->reason = reason;
-                        __mesh_plink_deactivate(sta);
+                        changed |= __mesh_plink_deactivate(sta);
                         sta->plink_state = NL80211_PLINK_HOLDING;
                         llid = sta->llid;
                         mod_plink_timer(sta, dot11MeshHoldingTimeout(sdata));
                         spin_unlock_bh(&sta->lock);
                         changed |= mesh_set_ht_prot_mode(sdata);
-                        changed |= BSS_CHANGED_BEACON;
                         mesh_plink_frame_tx(sdata, WLAN_SP_MESH_PEERING_CLOSE,
                                             sta->sta.addr, llid, plid, reason);
                         break;
diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
index cef0c9e79aba..a8cf70bf1cba 100644
--- a/net/mac80211/mlme.c
+++ b/net/mac80211/mlme.c
@@ -146,6 +146,9 @@ void ieee80211_sta_reset_beacon_monitor(struct ieee80211_sub_if_data *sdata)
         if (sdata->vif.driver_flags & IEEE80211_VIF_BEACON_FILTER)
                 return;
 
+        if (sdata->local->hw.flags & IEEE80211_HW_CONNECTION_MONITOR)
+                return;
+
         mod_timer(&sdata->u.mgd.bcn_mon_timer,
                   round_jiffies_up(jiffies + sdata->u.mgd.beacon_timeout));
 }
@@ -182,15 +185,15 @@ static u32 ieee80211_config_ht_tx(struct ieee80211_sub_if_data *sdata,
         u16 ht_opmode;
         bool disable_40 = false;
 
-        sband = local->hw.wiphy->bands[local->hw.conf.channel->band];
+        sband = local->hw.wiphy->bands[local->oper_channel->band];
 
         switch (sdata->vif.bss_conf.channel_type) {
         case NL80211_CHAN_HT40PLUS:
-                if (local->hw.conf.channel->flags & IEEE80211_CHAN_NO_HT40PLUS)
+                if (local->oper_channel->flags & IEEE80211_CHAN_NO_HT40PLUS)
                         disable_40 = true;
                 break;
         case NL80211_CHAN_HT40MINUS:
-                if (local->hw.conf.channel->flags & IEEE80211_CHAN_NO_HT40MINUS)
+                if (local->oper_channel->flags & IEEE80211_CHAN_NO_HT40MINUS)
                         disable_40 = true;
                 break;
         default:
@@ -326,6 +329,26 @@ static void ieee80211_add_ht_ie(struct ieee80211_sub_if_data *sdata,
         ieee80211_ie_build_ht_cap(pos, &ht_cap, cap);
 }
 
+static void ieee80211_add_vht_ie(struct ieee80211_sub_if_data *sdata,
+                                 struct sk_buff *skb,
+                                 struct ieee80211_supported_band *sband)
+{
+        u8 *pos;
+        u32 cap;
+        struct ieee80211_sta_vht_cap vht_cap;
+
+        BUILD_BUG_ON(sizeof(vht_cap) != sizeof(sband->vht_cap));
+
+        memcpy(&vht_cap, &sband->vht_cap, sizeof(vht_cap));
+
+        /* determine capability flags */
+        cap = vht_cap.cap;
+
+        /* reserve and fill IE */
+        pos = skb_put(skb, sizeof(struct ieee80211_vht_capabilities) + 2);
+        ieee80211_ie_build_vht_cap(pos, &vht_cap, cap);
+}
+
 static void ieee80211_send_assoc(struct ieee80211_sub_if_data *sdata)
 {
         struct ieee80211_local *local = sdata->local;
@@ -371,6 +394,7 @@ static void ieee80211_send_assoc(struct ieee80211_sub_if_data *sdata)
                         4 + /* power capability */
                         2 + 2 * sband->n_channels + /* supported channels */
                         2 + sizeof(struct ieee80211_ht_cap) + /* HT */
+                        2 + sizeof(struct ieee80211_vht_capabilities) + /* VHT */
                         assoc_data->ie_len + /* extra IEs */
                         9, /* WMM */
                         GFP_KERNEL);
@@ -503,6 +527,9 @@ static void ieee80211_send_assoc(struct ieee80211_sub_if_data *sdata)
                 ieee80211_add_ht_ie(sdata, skb, assoc_data->ap_ht_param,
                                     sband, local->oper_channel, ifmgd->ap_smps);
 
+        if (!(ifmgd->flags & IEEE80211_STA_DISABLE_VHT))
+                ieee80211_add_vht_ie(sdata, skb, sband);
+
         /* if present, add any custom non-vendor IEs that go after HT */
         if (assoc_data->ie_len && assoc_data->ie) {
                 noffset = ieee80211_ie_split_vendor(assoc_data->ie,
@@ -583,8 +610,6 @@ static void ieee80211_send_deauth_disassoc(struct ieee80211_sub_if_data *sdata,
                         IEEE80211_SKB_CB(skb)->flags |=
                                 IEEE80211_TX_INTFL_DONT_ENCRYPT;
 
-                drv_mgd_prepare_tx(local, sdata);
-
                 ieee80211_tx_skb(sdata, skb);
         }
 }
@@ -687,6 +712,7 @@ static void ieee80211_chswitch_work(struct work_struct *work)
         /* XXX: shouldn't really modify cfg80211-owned data! */
         ifmgd->associated->channel = sdata->local->oper_channel;
 
+        /* XXX: wait for a beacon first? */
         ieee80211_wake_queues_by_reason(&sdata->local->hw,
                                         IEEE80211_QUEUE_STOP_REASON_CSA);
  out:
@@ -763,36 +789,32 @@ void ieee80211_sta_process_chanswitch(struct ieee80211_sub_if_data *sdata,
 
         sdata->local->csa_channel = new_ch;
 
+        ifmgd->flags |= IEEE80211_STA_CSA_RECEIVED;
+
+        if (sw_elem->mode)
+                ieee80211_stop_queues_by_reason(&sdata->local->hw,
+                                IEEE80211_QUEUE_STOP_REASON_CSA);
+
         if (sdata->local->ops->channel_switch) {
                 /* use driver's channel switch callback */
-                struct ieee80211_channel_switch ch_switch;
-                memset(&ch_switch, 0, sizeof(ch_switch));
-                ch_switch.timestamp = timestamp;
-                if (sw_elem->mode) {
-                        ch_switch.block_tx = true;
-                        ieee80211_stop_queues_by_reason(&sdata->local->hw,
-                                        IEEE80211_QUEUE_STOP_REASON_CSA);
-                }
-                ch_switch.channel = new_ch;
-                ch_switch.count = sw_elem->count;
-                ifmgd->flags |= IEEE80211_STA_CSA_RECEIVED;
+                struct ieee80211_channel_switch ch_switch = {
+                        .timestamp = timestamp,
+                        .block_tx = sw_elem->mode,
+                        .channel = new_ch,
+                        .count = sw_elem->count,
+                };
+
                 drv_channel_switch(sdata->local, &ch_switch);
                 return;
         }
 
         /* channel switch handled in software */
-        if (sw_elem->count <= 1) {
+        if (sw_elem->count <= 1)
                 ieee80211_queue_work(&sdata->local->hw, &ifmgd->chswitch_work);
-        } else {
-                if (sw_elem->mode)
-                        ieee80211_stop_queues_by_reason(&sdata->local->hw,
-                                        IEEE80211_QUEUE_STOP_REASON_CSA);
-                ifmgd->flags |= IEEE80211_STA_CSA_RECEIVED;
+        else
                 mod_timer(&ifmgd->chswitch_timer,
-                          jiffies +
-                          msecs_to_jiffies(sw_elem->count *
-                                           cbss->beacon_interval));
-        }
+                          TU_TO_EXP_TIME(sw_elem->count *
+                                         cbss->beacon_interval));
 }
 
 static void ieee80211_handle_pwr_constr(struct ieee80211_sub_if_data *sdata,
@@ -1007,6 +1029,16 @@ void ieee80211_recalc_ps(struct ieee80211_local *local, s32 latency)
         ieee80211_change_ps(local);
 }
 
+void ieee80211_recalc_ps_vif(struct ieee80211_sub_if_data *sdata)
+{
+        bool ps_allowed = ieee80211_powersave_allowed(sdata);
+
+        if (sdata->vif.bss_conf.ps != ps_allowed) {
+                sdata->vif.bss_conf.ps = ps_allowed;
+                ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_PS);
+        }
+}
+
 void ieee80211_dynamic_ps_disable_work(struct work_struct *work)
 {
         struct ieee80211_local *local =
@@ -1239,7 +1271,7 @@ static u32 ieee80211_handle_bss_capability(struct ieee80211_sub_if_data *sdata,
         }
 
         use_short_slot = !!(capab & WLAN_CAPABILITY_SHORT_SLOT_TIME);
-        if (sdata->local->hw.conf.channel->band == IEEE80211_BAND_5GHZ)
+        if (sdata->local->oper_channel->band == IEEE80211_BAND_5GHZ)
                 use_short_slot = true;
 
         if (use_protection != bss_conf->use_cts_prot) {
@@ -1310,6 +1342,8 @@ static void ieee80211_set_associated(struct ieee80211_sub_if_data *sdata,
         ieee80211_recalc_smps(local);
         mutex_unlock(&local->iflist_mtx);
 
+        ieee80211_recalc_ps_vif(sdata);
+
         netif_tx_start_all_queues(sdata->dev);
         netif_carrier_on(sdata->dev);
 }
@@ -1371,6 +1405,9 @@ static void ieee80211_set_disassoc(struct ieee80211_sub_if_data *sdata,
         }
         local->ps_sdata = NULL;
 
+        /* disable per-vif ps */
+        ieee80211_recalc_ps_vif(sdata);
+
         /* flush out any pending frame (e.g. DELBA) before deauth/disassoc */
         if (tx)
                 drv_flush(local, false);
@@ -1430,6 +1467,8 @@ static void ieee80211_set_disassoc(struct ieee80211_sub_if_data *sdata,
         del_timer_sync(&sdata->u.mgd.bcn_mon_timer);
         del_timer_sync(&sdata->u.mgd.timer);
         del_timer_sync(&sdata->u.mgd.chswitch_timer);
+
+        sdata->u.mgd.timers_running = 0;
 }
 
 void ieee80211_sta_rx_notify(struct ieee80211_sub_if_data *sdata,
@@ -1540,7 +1579,8 @@ static void ieee80211_mgd_probe_ap_send(struct ieee80211_sub_if_data *sdata)
                         ssid_len = ssid[1];
 
                 ieee80211_send_probe_req(sdata, dst, ssid + 2, ssid_len, NULL,
-                                         0, (u32) -1, true, false);
+                                         0, (u32) -1, true, false,
+                                         ifmgd->associated->channel);
         }
 
         ifmgd->probe_timeout = jiffies + msecs_to_jiffies(probe_wait_ms);
@@ -1643,7 +1683,9 @@ struct sk_buff *ieee80211_ap_probereq_get(struct ieee80211_hw *hw,
                 ssid_len = ssid[1];
 
         skb = ieee80211_build_probe_req(sdata, cbss->bssid,
-                                        (u32) -1, ssid + 2, ssid_len,
+                                        (u32) -1,
+                                        sdata->local->oper_channel,
+                                        ssid + 2, ssid_len,
                                         NULL, 0, true);
 
         return skb;
@@ -1654,7 +1696,6 @@ static void __ieee80211_connection_loss(struct ieee80211_sub_if_data *sdata)
 {
         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
         struct ieee80211_local *local = sdata->local;
-        u8 bssid[ETH_ALEN];
         u8 frame_buf[DEAUTH_DISASSOC_LEN];
 
         mutex_lock(&ifmgd->mtx);
@@ -1663,9 +1704,8 @@ static void __ieee80211_connection_loss(struct ieee80211_sub_if_data *sdata)
                 return;
         }
 
-        memcpy(bssid, ifmgd->associated->bssid, ETH_ALEN);
-
-        sdata_info(sdata, "Connection to AP %pM lost\n", bssid);
+        sdata_info(sdata, "Connection to AP %pM lost\n",
+                   ifmgd->associated->bssid);
 
         ieee80211_set_disassoc(sdata, IEEE80211_STYPE_DEAUTH,
                                WLAN_REASON_DISASSOC_DUE_TO_INACTIVITY,
@@ -1683,7 +1723,7 @@ static void __ieee80211_connection_loss(struct ieee80211_sub_if_data *sdata)
         mutex_unlock(&local->mtx);
 }
 
-void ieee80211_beacon_connection_loss_work(struct work_struct *work)
+static void ieee80211_beacon_connection_loss_work(struct work_struct *work)
 {
         struct ieee80211_sub_if_data *sdata =
                 container_of(work, struct ieee80211_sub_if_data,
@@ -2230,14 +2270,10 @@ static void ieee80211_rx_bss_info(struct ieee80211_sub_if_data *sdata,
                 mutex_unlock(&local->iflist_mtx);
         }
 
-        if (elems->ch_switch_elem && (elems->ch_switch_elem_len == 3) &&
-            (memcmp(mgmt->bssid, sdata->u.mgd.associated->bssid,
-                                                        ETH_ALEN) == 0)) {
-                struct ieee80211_channel_sw_ie *sw_elem =
-                        (struct ieee80211_channel_sw_ie *)elems->ch_switch_elem;
-                ieee80211_sta_process_chanswitch(sdata, sw_elem,
+        if (elems->ch_switch_ie &&
+            memcmp(mgmt->bssid, sdata->u.mgd.associated->bssid, ETH_ALEN) == 0)
+                ieee80211_sta_process_chanswitch(sdata, elems->ch_switch_ie,
                                                  bss, rx_status->mactime);
-        }
 }
 
 
@@ -2324,7 +2360,7 @@ static void ieee80211_rx_mgmt_beacon(struct ieee80211_sub_if_data *sdata,
         if (baselen > len)
                 return;
 
-        if (rx_status->freq != local->hw.conf.channel->center_freq)
+        if (rx_status->freq != local->oper_channel->center_freq)
                 return;
 
         if (ifmgd->assoc_data && !ifmgd->assoc_data->have_beacon &&
@@ -2488,7 +2524,7 @@ static void ieee80211_rx_mgmt_beacon(struct ieee80211_sub_if_data *sdata,
             !(ifmgd->flags & IEEE80211_STA_DISABLE_11N)) {
                 struct ieee80211_supported_band *sband;
 
-                sband = local->hw.wiphy->bands[local->hw.conf.channel->band];
+                sband = local->hw.wiphy->bands[local->oper_channel->band];
 
                 changed |= ieee80211_config_ht_tx(sdata, elems.ht_operation,
                                                   bssid, true);
@@ -2671,7 +2707,8 @@ static int ieee80211_probe_auth(struct ieee80211_sub_if_data *sdata)
                  * will not answer to direct packet in unassociated state.
                  */
                 ieee80211_send_probe_req(sdata, NULL, ssidie + 2, ssidie[1],
-                                         NULL, 0, (u32) -1, true, false);
+                                         NULL, 0, (u32) -1, true, false,
+                                         auth_data->bss->channel);
         }
 
         auth_data->timeout = jiffies + IEEE80211_AUTH_TIMEOUT;
@@ -2998,41 +3035,17 @@ int ieee80211_max_network_latency(struct notifier_block *nb,
         return 0;
 }
 
-static int ieee80211_prep_connection(struct ieee80211_sub_if_data *sdata,
-                                     struct cfg80211_bss *cbss, bool assoc)
+static int ieee80211_prep_channel(struct ieee80211_sub_if_data *sdata,
+                                  struct cfg80211_bss *cbss)
 {
         struct ieee80211_local *local = sdata->local;
         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
-        struct ieee80211_bss *bss = (void *)cbss->priv;
-        struct sta_info *sta = NULL;
-        bool have_sta = false;
-        int err;
         int ht_cfreq;
         enum nl80211_channel_type channel_type = NL80211_CHAN_NO_HT;
         const u8 *ht_oper_ie;
         const struct ieee80211_ht_operation *ht_oper = NULL;
         struct ieee80211_supported_band *sband;
 
-        if (WARN_ON(!ifmgd->auth_data && !ifmgd->assoc_data))
-                return -EINVAL;
-
-        if (assoc) {
-                rcu_read_lock();
-                have_sta = sta_info_get(sdata, cbss->bssid);
-                rcu_read_unlock();
-        }
-
-        if (!have_sta) {
-                sta = sta_info_alloc(sdata, cbss->bssid, GFP_KERNEL);
-                if (!sta)
-                        return -ENOMEM;
-        }
-
-        mutex_lock(&local->mtx);
-        ieee80211_recalc_idle(sdata->local);
-        mutex_unlock(&local->mtx);
-
-        /* switch to the right channel */
         sband = local->hw.wiphy->bands[cbss->channel->band];
 
         ifmgd->flags &= ~IEEE80211_STA_DISABLE_40MHZ;
@@ -3095,10 +3108,51 @@ static int ieee80211_prep_connection(struct ieee80211_sub_if_data *sdata,
         local->oper_channel = cbss->channel;
         ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_CHANNEL);
 
-        if (sta) {
+        return 0;
+}
+
+static int ieee80211_prep_connection(struct ieee80211_sub_if_data *sdata,
+                                     struct cfg80211_bss *cbss, bool assoc)
+{
+        struct ieee80211_local *local = sdata->local;
+        struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
+        struct ieee80211_bss *bss = (void *)cbss->priv;
+        struct sta_info *new_sta = NULL;
+        bool have_sta = false;
+        int err;
+
+        if (WARN_ON(!ifmgd->auth_data && !ifmgd->assoc_data))
+                return -EINVAL;
+
+        if (assoc) {
+                rcu_read_lock();
+                have_sta = sta_info_get(sdata, cbss->bssid);
+                rcu_read_unlock();
+        }
+
+        if (!have_sta) {
+                new_sta = sta_info_alloc(sdata, cbss->bssid, GFP_KERNEL);
+                if (!new_sta)
+                        return -ENOMEM;
+        }
+
+        mutex_lock(&local->mtx);
+        ieee80211_recalc_idle(sdata->local);
+        mutex_unlock(&local->mtx);
+
+        if (new_sta) {
                 u32 rates = 0, basic_rates = 0;
                 bool have_higher_than_11mbit;
                 int min_rate = INT_MAX, min_rate_index = -1;
+                struct ieee80211_supported_band *sband;
+
+                sband = local->hw.wiphy->bands[cbss->channel->band];
+
+                err = ieee80211_prep_channel(sdata, cbss);
+                if (err) {
+                        sta_info_free(local, new_sta);
+                        return err;
+                }
 
                 ieee80211_get_rates(sband, bss->supp_rates,
                                     bss->supp_rates_len,
@@ -3120,7 +3174,7 @@ static int ieee80211_prep_connection(struct ieee80211_sub_if_data *sdata,
                         basic_rates = BIT(min_rate_index);
                 }
 
-                sta->sta.supp_rates[cbss->channel->band] = rates;
+                new_sta->sta.supp_rates[cbss->channel->band] = rates;
                 sdata->vif.bss_conf.basic_rates = basic_rates;
 
                 /* cf. IEEE 802.11 9.2.12 */
@@ -3143,10 +3197,10 @@ static int ieee80211_prep_connection(struct ieee80211_sub_if_data *sdata,
                         BSS_CHANGED_BEACON_INT);
 
                 if (assoc)
-                        sta_info_pre_move_state(sta, IEEE80211_STA_AUTH);
+                        sta_info_pre_move_state(new_sta, IEEE80211_STA_AUTH);
 
-                err = sta_info_insert(sta);
-                sta = NULL;
+                err = sta_info_insert(new_sta);
+                new_sta = NULL;
                 if (err) {
                         sdata_info(sdata,
                                    "failed to insert STA entry for the AP (error %d)\n",
@@ -3298,9 +3352,13 @@ int ieee80211_mgd_assoc(struct ieee80211_sub_if_data *sdata,
         }
 
         /* prepare assoc data */
-
-        ifmgd->flags &= ~IEEE80211_STA_DISABLE_11N;
-        ifmgd->flags &= ~IEEE80211_STA_NULLFUNC_ACKED;
+        
+        /*
+         * keep only the 40 MHz disable bit set as it might have
+         * been set during authentication already, all other bits
+         * should be reset for a new connection
+         */
+        ifmgd->flags &= IEEE80211_STA_DISABLE_40MHZ;
 
         ifmgd->beacon_crc_valid = false;
 
@@ -3316,21 +3374,34 @@ int ieee80211_mgd_assoc(struct ieee80211_sub_if_data *sdata,
                     req->crypto.ciphers_pairwise[i] == WLAN_CIPHER_SUITE_TKIP ||
                     req->crypto.ciphers_pairwise[i] == WLAN_CIPHER_SUITE_WEP104) {
                         ifmgd->flags |= IEEE80211_STA_DISABLE_11N;
+                        ifmgd->flags |= IEEE80211_STA_DISABLE_VHT;
                         netdev_info(sdata->dev,
-                                    "disabling HT due to WEP/TKIP use\n");
+                                    "disabling HT/VHT due to WEP/TKIP use\n");
                 }
         }
 
-        if (req->flags & ASSOC_REQ_DISABLE_HT)
+        if (req->flags & ASSOC_REQ_DISABLE_HT) {
                 ifmgd->flags |= IEEE80211_STA_DISABLE_11N;
+                ifmgd->flags |= IEEE80211_STA_DISABLE_VHT;
+        }
 
         /* Also disable HT if we don't support it or the AP doesn't use WMM */
         sband = local->hw.wiphy->bands[req->bss->channel->band];
         if (!sband->ht_cap.ht_supported ||
             local->hw.queues < IEEE80211_NUM_ACS || !bss->wmm_used) {
                 ifmgd->flags |= IEEE80211_STA_DISABLE_11N;
-                netdev_info(sdata->dev,
-                            "disabling HT as WMM/QoS is not supported\n");
+                if (!bss->wmm_used)
+                        netdev_info(sdata->dev,
+                                    "disabling HT as WMM/QoS is not supported by the AP\n");
+        }
+
+        /* disable VHT if we don't support it or the AP doesn't use WMM */
+        if (!sband->vht_cap.vht_supported ||
+            local->hw.queues < IEEE80211_NUM_ACS || !bss->wmm_used) {
+                ifmgd->flags |= IEEE80211_STA_DISABLE_VHT;
+                if (!bss->wmm_used)
+                        netdev_info(sdata->dev,
+                                    "disabling VHT as WMM/QoS is not supported by the AP\n");
         }
 
         memcpy(&ifmgd->ht_capa, &req->ht_capa, sizeof(ifmgd->ht_capa));
@@ -3465,14 +3536,17 @@ int ieee80211_mgd_deauth(struct ieee80211_sub_if_data *sdata,
                    req->bssid, req->reason_code);
 
         if (ifmgd->associated &&
-            ether_addr_equal(ifmgd->associated->bssid, req->bssid))
+            ether_addr_equal(ifmgd->associated->bssid, req->bssid)) {
                 ieee80211_set_disassoc(sdata, IEEE80211_STYPE_DEAUTH,
                                        req->reason_code, true, frame_buf);
-        else
+        } else {
+                drv_mgd_prepare_tx(sdata->local, sdata);
                 ieee80211_send_deauth_disassoc(sdata, req->bssid,
                                                IEEE80211_STYPE_DEAUTH,
                                                req->reason_code, true,
                                                frame_buf);
+        }
+
         mutex_unlock(&ifmgd->mtx);
 
         __cfg80211_send_deauth(sdata->dev, frame_buf, DEAUTH_DISASSOC_LEN);
diff --git a/net/mac80211/offchannel.c b/net/mac80211/offchannel.c
index 635c3250c668..507121dad082 100644
--- a/net/mac80211/offchannel.c
+++ b/net/mac80211/offchannel.c
@@ -116,6 +116,9 @@ void ieee80211_offchannel_stop_vifs(struct ieee80211_local *local,
                 if (!ieee80211_sdata_running(sdata))
                         continue;
 
+                if (sdata->vif.type == NL80211_IFTYPE_P2P_DEVICE)
+                        continue;
+
                 if (sdata->vif.type != NL80211_IFTYPE_MONITOR)
                         set_bit(SDATA_STATE_OFFCHANNEL, &sdata->state);
 
@@ -144,6 +147,9 @@ void ieee80211_offchannel_return(struct ieee80211_local *local,
 
         mutex_lock(&local->iflist_mtx);
         list_for_each_entry(sdata, &local->interfaces, list) {
+                if (sdata->vif.type == NL80211_IFTYPE_P2P_DEVICE)
+                        continue;
+
                 if (sdata->vif.type != NL80211_IFTYPE_MONITOR)
                         clear_bit(SDATA_STATE_OFFCHANNEL, &sdata->state);
 
diff --git a/net/mac80211/rate.h b/net/mac80211/rate.h
index 6e4fd32c6617..10de668eb9f6 100644
--- a/net/mac80211/rate.h
+++ b/net/mac80211/rate.h
@@ -56,7 +56,7 @@ static inline void rate_control_rate_init(struct sta_info *sta)
         if (!ref)
                 return;
 
-        sband = local->hw.wiphy->bands[local->hw.conf.channel->band];
+        sband = local->hw.wiphy->bands[local->oper_channel->band];
 
         ref->ops->rate_init(ref->priv, sband, ista, priv_sta);
         set_sta_flag(sta, WLAN_STA_RATE_CONTROL);
diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
index 0cb4edee6af5..b382605c5733 100644
--- a/net/mac80211/rx.c
+++ b/net/mac80211/rx.c
@@ -60,7 +60,9 @@ static inline int should_drop_frame(struct sk_buff *skb,
         struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
 
-        if (status->flag & (RX_FLAG_FAILED_FCS_CRC | RX_FLAG_FAILED_PLCP_CRC))
+        if (status->flag & (RX_FLAG_FAILED_FCS_CRC |
+                            RX_FLAG_FAILED_PLCP_CRC |
+                            RX_FLAG_AMPDU_IS_ZEROLEN))
                 return 1;
         if (unlikely(skb->len < 16 + present_fcs_len))
                 return 1;
@@ -91,6 +93,13 @@ ieee80211_rx_radiotap_len(struct ieee80211_local *local,
         if (status->flag & RX_FLAG_HT) /* HT info */
                 len += 3;
 
+        if (status->flag & RX_FLAG_AMPDU_DETAILS) {
+                /* padding */
+                while (len & 3)
+                        len++;
+                len += 8;
+        }
+
         return len;
 }
 
@@ -215,6 +224,37 @@ ieee80211_add_rx_radiotap_header(struct ieee80211_local *local,
                 pos++;
                 *pos++ = status->rate_idx;
         }
+
+        if (status->flag & RX_FLAG_AMPDU_DETAILS) {
+                u16 flags = 0;
+
+                /* ensure 4 byte alignment */
+                while ((pos - (u8 *)rthdr) & 3)
+                        pos++;
+                rthdr->it_present |=
+                        cpu_to_le32(1 << IEEE80211_RADIOTAP_AMPDU_STATUS);
+                put_unaligned_le32(status->ampdu_reference, pos);
+                pos += 4;
+                if (status->flag & RX_FLAG_AMPDU_REPORT_ZEROLEN)
+                        flags |= IEEE80211_RADIOTAP_AMPDU_REPORT_ZEROLEN;
+                if (status->flag & RX_FLAG_AMPDU_IS_ZEROLEN)
+                        flags |= IEEE80211_RADIOTAP_AMPDU_IS_ZEROLEN;
+                if (status->flag & RX_FLAG_AMPDU_LAST_KNOWN)
+                        flags |= IEEE80211_RADIOTAP_AMPDU_LAST_KNOWN;
+                if (status->flag & RX_FLAG_AMPDU_IS_LAST)
+                        flags |= IEEE80211_RADIOTAP_AMPDU_IS_LAST;
+                if (status->flag & RX_FLAG_AMPDU_DELIM_CRC_ERROR)
+                        flags |= IEEE80211_RADIOTAP_AMPDU_DELIM_CRC_ERR;
+                if (status->flag & RX_FLAG_AMPDU_DELIM_CRC_KNOWN)
+                        flags |= IEEE80211_RADIOTAP_AMPDU_DELIM_CRC_KNOWN;
+                put_unaligned_le16(flags, pos);
+                pos += 2;
+                if (status->flag & RX_FLAG_AMPDU_DELIM_CRC_KNOWN)
+                        *pos++ = status->ampdu_delimiter_crc;
+                else
+                        *pos++ = 0;
+                *pos++ = 0;
+        }
 }
 
 /*
@@ -2268,7 +2308,7 @@ ieee80211_rx_h_action(struct ieee80211_rx_data *rx)
 
                 goto queue;
         case WLAN_CATEGORY_SPECTRUM_MGMT:
-                if (local->hw.conf.channel->band != IEEE80211_BAND_5GHZ)
+                if (status->band != IEEE80211_BAND_5GHZ)
                         break;
 
                 if (sdata->vif.type != NL80211_IFTYPE_STATION)
@@ -2772,8 +2812,7 @@ static int prepare_for_handlers(struct ieee80211_rx_data *rx,
                 if (!bssid) {
                         if (!ether_addr_equal(sdata->vif.addr, hdr->addr1))
                                 return 0;
-                } else if (!ieee80211_bssid_match(bssid,
-                                        sdata->vif.addr)) {
+                } else if (!ieee80211_bssid_match(bssid, sdata->vif.addr)) {
                         /*
                          * Accept public action frames even when the
                          * BSSID doesn't match, this is used for P2P
@@ -2793,9 +2832,18 @@ static int prepare_for_handlers(struct ieee80211_rx_data *rx,
                 if (!ether_addr_equal(sdata->u.wds.remote_addr, hdr->addr2))
                         return 0;
                 break;
+        case NL80211_IFTYPE_P2P_DEVICE:
+                if (!ieee80211_is_public_action(hdr, skb->len) &&
+                    !ieee80211_is_probe_req(hdr->frame_control) &&
+                    !ieee80211_is_probe_resp(hdr->frame_control) &&
+                    !ieee80211_is_beacon(hdr->frame_control))
+                        return 0;
+                if (!ether_addr_equal(sdata->vif.addr, hdr->addr1))
+                        status->rx_flags &= ~IEEE80211_RX_RA_MATCH;
+                break;
         default:
                 /* should never get here */
-                WARN_ON(1);
+                WARN_ON_ONCE(1);
                 break;
         }
 
diff --git a/net/mac80211/scan.c b/net/mac80211/scan.c
index bcaee5d12839..740e414d44f4 100644
--- a/net/mac80211/scan.c
+++ b/net/mac80211/scan.c
@@ -299,7 +299,7 @@ static void __ieee80211_scan_completed(struct ieee80211_hw *hw, bool aborted,
         if (local->scan_req != local->int_scan_req)
                 cfg80211_scan_done(local->scan_req, aborted);
         local->scan_req = NULL;
-        local->scan_sdata = NULL;
+        rcu_assign_pointer(local->scan_sdata, NULL);
 
         local->scanning = 0;
         local->scan_channel = NULL;
@@ -416,7 +416,8 @@ static void ieee80211_scan_state_send_probe(struct ieee80211_local *local,
                         local->scan_req->ssids[i].ssid_len,
                         local->scan_req->ie, local->scan_req->ie_len,
                         local->scan_req->rates[band], false,
-                        local->scan_req->no_cck);
+                        local->scan_req->no_cck,
+                        local->hw.conf.channel);
 
         /*
          * After sending probe requests, wait for probe responses
@@ -479,11 +480,10 @@ static int __ieee80211_start_scan(struct ieee80211_sub_if_data *sdata,
         if (local->ops->hw_scan) {
                 __set_bit(SCAN_HW_SCANNING, &local->scanning);
         } else if ((req->n_channels == 1) &&
-                   (req->channels[0]->center_freq ==
-                    local->hw.conf.channel->center_freq)) {
-
-                /* If we are scanning only on the current channel, then
-                 * we do not need to stop normal activities
+                   (req->channels[0] == local->oper_channel)) {
+                /*
+                 * If we are scanning only on the operating channel
+                 * then we do not need to stop normal activities
                  */
                 unsigned long next_delay;
 
@@ -984,7 +984,6 @@ int ieee80211_request_sched_scan_stop(struct ieee80211_sub_if_data *sdata)
                         kfree(local->sched_scan_ies.ie[i]);
 
                 drv_sched_scan_stop(local, sdata);
-                rcu_assign_pointer(local->sched_scan_sdata, NULL);
         }
 out:
         mutex_unlock(&local->mtx);
diff --git a/net/mac80211/status.c b/net/mac80211/status.c
index 8cd72914cdaf..b0801b7d572d 100644
--- a/net/mac80211/status.c
+++ b/net/mac80211/status.c
@@ -519,19 +519,27 @@ void ieee80211_tx_status(struct ieee80211_hw *hw, struct sk_buff *skb)
                 u64 cookie = (unsigned long)skb;
                 acked = info->flags & IEEE80211_TX_STAT_ACK;
 
-                /*
-                 * TODO: When we have non-netdev frame TX,
-                 * we cannot use skb->dev->ieee80211_ptr
-                 */
-
                 if (ieee80211_is_nullfunc(hdr->frame_control) ||
-                    ieee80211_is_qos_nullfunc(hdr->frame_control))
+                    ieee80211_is_qos_nullfunc(hdr->frame_control)) {
                         cfg80211_probe_status(skb->dev, hdr->addr1,
                                               cookie, acked, GFP_ATOMIC);
-                else
+                } else if (skb->dev) {
                         cfg80211_mgmt_tx_status(
                                 skb->dev->ieee80211_ptr, cookie, skb->data,
                                 skb->len, acked, GFP_ATOMIC);
+                } else {
+                        struct ieee80211_sub_if_data *p2p_sdata;
+
+                        rcu_read_lock();
+
+                        p2p_sdata = rcu_dereference(local->p2p_sdata);
+                        if (p2p_sdata) {
+                                cfg80211_mgmt_tx_status(
+                                        &p2p_sdata->wdev, cookie, skb->data,
+                                        skb->len, acked, GFP_ATOMIC);
+                        }
+                        rcu_read_unlock();
+                }
         }
 
         if (unlikely(info->ack_frame_id)) {
diff --git a/net/mac80211/trace.h b/net/mac80211/trace.h
index c6d33b55b2df..18d9c8a52e9e 100644
--- a/net/mac80211/trace.h
+++ b/net/mac80211/trace.h
@@ -24,7 +24,7 @@
                         __string(vif_name, sdata->dev ? sdata->dev->name : "<nodev>")
 #define VIF_ASSIGN      __entry->vif_type = sdata->vif.type; __entry->sdata = sdata;    \
                         __entry->p2p = sdata->vif.p2p;                                  \
-                        __assign_str(vif_name, sdata->dev ? sdata->dev->name : "<nodev>")
+                        __assign_str(vif_name, sdata->dev ? sdata->dev->name : sdata->name)
 #define VIF_PR_FMT      " vif:%s(%d%s)"
 #define VIF_PR_ARG      __get_str(vif_name), __entry->vif_type, __entry->p2p ? "/p2p" : ""
 
@@ -274,9 +274,12 @@ TRACE_EVENT(drv_config,
                 __entry->dynamic_ps_timeout = local->hw.conf.dynamic_ps_timeout;
                 __entry->max_sleep_period = local->hw.conf.max_sleep_period;
                 __entry->listen_interval = local->hw.conf.listen_interval;
-                __entry->long_frame_max_tx_count = local->hw.conf.long_frame_max_tx_count;
-                __entry->short_frame_max_tx_count = local->hw.conf.short_frame_max_tx_count;
-                __entry->center_freq = local->hw.conf.channel->center_freq;
+                __entry->long_frame_max_tx_count =
+                        local->hw.conf.long_frame_max_tx_count;
+                __entry->short_frame_max_tx_count =
+                        local->hw.conf.short_frame_max_tx_count;
+                __entry->center_freq = local->hw.conf.channel ?
+                                        local->hw.conf.channel->center_freq : 0;
                 __entry->channel_type = local->hw.conf.channel_type;
                 __entry->smps = local->hw.conf.smps_mode;
         ),
diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c
index acf712ffb5e6..29eb4e678235 100644
--- a/net/mac80211/tx.c
+++ b/net/mac80211/tx.c
@@ -55,7 +55,7 @@ static __le16 ieee80211_duration(struct ieee80211_tx_data *tx,
         if (WARN_ON_ONCE(info->control.rates[0].idx < 0))
                 return 0;
 
-        sband = local->hw.wiphy->bands[tx->channel->band];
+        sband = local->hw.wiphy->bands[info->band];
         txrate = &sband->bitrates[info->control.rates[0].idx];
 
         erp = txrate->flags & IEEE80211_RATE_ERP_G;
@@ -615,7 +615,7 @@ ieee80211_tx_h_rate_ctrl(struct ieee80211_tx_data *tx)
 
         memset(&txrc, 0, sizeof(txrc));
 
-        sband = tx->local->hw.wiphy->bands[tx->channel->band];
+        sband = tx->local->hw.wiphy->bands[info->band];
 
         len = min_t(u32, tx->skb->len + FCS_LEN,
                          tx->local->hw.wiphy->frag_threshold);
@@ -626,13 +626,13 @@ ieee80211_tx_h_rate_ctrl(struct ieee80211_tx_data *tx)
         txrc.bss_conf = &tx->sdata->vif.bss_conf;
         txrc.skb = tx->skb;
         txrc.reported_rate.idx = -1;
-        txrc.rate_idx_mask = tx->sdata->rc_rateidx_mask[tx->channel->band];
+        txrc.rate_idx_mask = tx->sdata->rc_rateidx_mask[info->band];
         if (txrc.rate_idx_mask == (1 << sband->n_bitrates) - 1)
                 txrc.max_rate_idx = -1;
         else
                 txrc.max_rate_idx = fls(txrc.rate_idx_mask) - 1;
         memcpy(txrc.rate_idx_mcs_mask,
-               tx->sdata->rc_rateidx_mcs_mask[tx->channel->band],
+               tx->sdata->rc_rateidx_mcs_mask[info->band],
                sizeof(txrc.rate_idx_mcs_mask));
         txrc.bss = (tx->sdata->vif.type == NL80211_IFTYPE_AP ||
                     tx->sdata->vif.type == NL80211_IFTYPE_MESH_POINT ||
@@ -667,7 +667,7 @@ ieee80211_tx_h_rate_ctrl(struct ieee80211_tx_data *tx)
                  "scanning and associated. Target station: "
                  "%pM on %d GHz band\n",
                  tx->sdata->name, hdr->addr1,
-                 tx->channel->band ? 5 : 2))
+                 info->band ? 5 : 2))
                 return TX_DROP;
 
         /*
@@ -1131,7 +1131,6 @@ ieee80211_tx_prepare(struct ieee80211_sub_if_data *sdata,
         tx->skb = skb;
         tx->local = local;
         tx->sdata = sdata;
-        tx->channel = local->hw.conf.channel;
         __skb_queue_head_init(&tx->skbs);
 
         /*
@@ -1204,6 +1203,7 @@ static bool ieee80211_tx_frags(struct ieee80211_local *local,
                                struct sk_buff_head *skbs,
                                bool txpending)
 {
+        struct ieee80211_tx_control control;
         struct sk_buff *skb, *tmp;
         unsigned long flags;
 
@@ -1240,10 +1240,10 @@ static bool ieee80211_tx_frags(struct ieee80211_local *local,
                 spin_unlock_irqrestore(&local->queue_stop_reason_lock, flags);
 
                 info->control.vif = vif;
-                info->control.sta = sta;
+                control.sta = sta;
 
                 __skb_unlink(skb, skbs);
-                drv_tx(local, skb);
+                drv_tx(local, &control, skb);
         }
 
         return true;
@@ -1399,8 +1399,7 @@ static bool ieee80211_tx(struct ieee80211_sub_if_data *sdata,
                 goto out;
         }
 
-        tx.channel = local->hw.conf.channel;
-        info->band = tx.channel->band;
+        info->band = local->hw.conf.channel->band;
 
         /* set up hw_queue value early */
         if (!(info->flags & IEEE80211_TX_CTL_TX_OFFCHAN) ||
@@ -1720,7 +1719,7 @@ netdev_tx_t ieee80211_subif_start_xmit(struct sk_buff *skb,
         struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
         struct ieee80211_local *local = sdata->local;
         struct ieee80211_tx_info *info;
-        int ret = NETDEV_TX_BUSY, head_need;
+        int head_need;
         u16 ethertype, hdrlen,  meshhdrlen = 0;
         __le16 fc;
         struct ieee80211_hdr hdr;
@@ -1736,10 +1735,8 @@ netdev_tx_t ieee80211_subif_start_xmit(struct sk_buff *skb,
         u32 info_flags = 0;
         u16 info_id = 0;
 
-        if (unlikely(skb->len < ETH_HLEN)) {
-                ret = NETDEV_TX_OK;
+        if (unlikely(skb->len < ETH_HLEN))
                 goto fail;
-        }
 
         /* convert Ethernet header to proper 802.11 header (based on
          * operation mode) */
@@ -1787,7 +1784,6 @@ netdev_tx_t ieee80211_subif_start_xmit(struct sk_buff *skb,
                 if (!sdata->u.mesh.mshcfg.dot11MeshTTL) {
                         /* Do not send frames with mesh_ttl == 0 */
                         sdata->u.mesh.mshstats.dropped_frames_ttl++;
-                        ret = NETDEV_TX_OK;
                         goto fail;
                 }
                 rcu_read_lock();
@@ -1811,37 +1807,31 @@ netdev_tx_t ieee80211_subif_start_xmit(struct sk_buff *skb,
                         meshhdrlen = ieee80211_new_mesh_header(&mesh_hdr,
                                         sdata, NULL, NULL);
                 } else {
-                        int is_mesh_mcast = 1;
-                        const u8 *mesh_da;
+                        /* DS -> MBSS (802.11-2012 13.11.3.3).
+                         * For unicast with unknown forwarding information,
+                         * destination might be in the MBSS or if that fails
+                         * forwarded to another mesh gate. In either case
+                         * resolution will be handled in ieee80211_xmit(), so
+                         * leave the original DA. This also works for mcast */
+                        const u8 *mesh_da = skb->data;
+
+                        if (mppath)
+                                mesh_da = mppath->mpp;
+                        else if (mpath)
+                                mesh_da = mpath->dst;
+                        rcu_read_unlock();
 
-                        if (is_multicast_ether_addr(skb->data))
-                                /* DA TA mSA AE:SA */
-                                mesh_da = skb->data;
-                        else {
-                                static const u8 bcast[ETH_ALEN] =
-                                        { 0xff, 0xff, 0xff, 0xff, 0xff, 0xff };
-                                if (mppath) {
-                                        /* RA TA mDA mSA AE:DA SA */
-                                        mesh_da = mppath->mpp;
-                                        is_mesh_mcast = 0;
-                                } else if (mpath) {
-                                        mesh_da = mpath->dst;
-                                        is_mesh_mcast = 0;
-                                } else {
-                                        /* DA TA mSA AE:SA */
-                                        mesh_da = bcast;
-                                }
-                        }
                         hdrlen = ieee80211_fill_mesh_addresses(&hdr, &fc,
                                         mesh_da, sdata->vif.addr);
-                        rcu_read_unlock();
-                        if (is_mesh_mcast)
+                        if (is_multicast_ether_addr(mesh_da))
+                                /* DA TA mSA AE:SA */
                                 meshhdrlen =
                                         ieee80211_new_mesh_header(&mesh_hdr,
                                                         sdata,
                                                         skb->data + ETH_ALEN,
                                                         NULL);
                         else
+                                /* RA TA mDA mSA AE:DA SA */
                                 meshhdrlen =
                                         ieee80211_new_mesh_header(&mesh_hdr,
                                                         sdata,
@@ -1880,10 +1870,8 @@ netdev_tx_t ieee80211_subif_start_xmit(struct sk_buff *skb,
 
                 if (tdls_direct) {
                         /* link during setup - throw out frames to peer */
-                        if (!tdls_auth) {
-                                ret = NETDEV_TX_OK;
+                        if (!tdls_auth)
                                 goto fail;
-                        }
 
                         /* DA SA BSSID */
                         memcpy(hdr.addr1, skb->data, ETH_ALEN);
@@ -1917,7 +1905,6 @@ netdev_tx_t ieee80211_subif_start_xmit(struct sk_buff *skb,
                 hdrlen = 24;
                 break;
         default:
-                ret = NETDEV_TX_OK;
                 goto fail;
         }
 
@@ -1962,7 +1949,6 @@ netdev_tx_t ieee80211_subif_start_xmit(struct sk_buff *skb,
 
                 I802_DEBUG_INC(local->tx_handlers_drop_unauth_port);
 
-                ret = NETDEV_TX_OK;
                 goto fail;
         }
 
@@ -2017,10 +2003,8 @@ netdev_tx_t ieee80211_subif_start_xmit(struct sk_buff *skb,
                 skb = skb_clone(skb, GFP_ATOMIC);
                 kfree_skb(tmp_skb);
 
-                if (!skb) {
-                        ret = NETDEV_TX_OK;
+                if (!skb)
                         goto fail;
-                }
         }
 
         hdr.frame_control = fc;
@@ -2123,10 +2107,8 @@ netdev_tx_t ieee80211_subif_start_xmit(struct sk_buff *skb,
         return NETDEV_TX_OK;
 
  fail:
-        if (ret == NETDEV_TX_OK)
-                dev_kfree_skb(skb);
-
-        return ret;
+        dev_kfree_skb(skb);
+        return NETDEV_TX_OK;
 }
 
 
@@ -2301,12 +2283,9 @@ struct sk_buff *ieee80211_beacon_get_tim(struct ieee80211_hw *hw,
         struct ieee80211_sub_if_data *sdata = NULL;
         struct ieee80211_if_ap *ap = NULL;
         struct beacon_data *beacon;
-        struct ieee80211_supported_band *sband;
-        enum ieee80211_band band = local->hw.conf.channel->band;
+        enum ieee80211_band band = local->oper_channel->band;
         struct ieee80211_tx_rate_control txrc;
 
-        sband = local->hw.wiphy->bands[band];
-
         rcu_read_lock();
 
         sdata = vif_to_sdata(vif);
@@ -2416,7 +2395,7 @@ struct sk_buff *ieee80211_beacon_get_tim(struct ieee80211_hw *hw,
                 memset(mgmt, 0, hdr_len);
                 mgmt->frame_control =
                     cpu_to_le16(IEEE80211_FTYPE_MGMT | IEEE80211_STYPE_BEACON);
-                memset(mgmt->da, 0xff, ETH_ALEN);
+                eth_broadcast_addr(mgmt->da);
                 memcpy(mgmt->sa, sdata->vif.addr, ETH_ALEN);
                 memcpy(mgmt->bssid, sdata->vif.addr, ETH_ALEN);
                 mgmt->u.beacon.beacon_int =
@@ -2428,9 +2407,9 @@ struct sk_buff *ieee80211_beacon_get_tim(struct ieee80211_hw *hw,
                 *pos++ = WLAN_EID_SSID;
                 *pos++ = 0x0;
 
-                if (ieee80211_add_srates_ie(sdata, skb, true) ||
+                if (ieee80211_add_srates_ie(sdata, skb, true, band) ||
                     mesh_add_ds_params_ie(skb, sdata) ||
-                    ieee80211_add_ext_srates_ie(sdata, skb, true) ||
+                    ieee80211_add_ext_srates_ie(sdata, skb, true, band) ||
                     mesh_add_rsn_ie(skb, sdata) ||
                     mesh_add_ht_cap_ie(skb, sdata) ||
                     mesh_add_ht_oper_ie(skb, sdata) ||
@@ -2453,12 +2432,12 @@ struct sk_buff *ieee80211_beacon_get_tim(struct ieee80211_hw *hw,
 
         memset(&txrc, 0, sizeof(txrc));
         txrc.hw = hw;
-        txrc.sband = sband;
+        txrc.sband = local->hw.wiphy->bands[band];
         txrc.bss_conf = &sdata->vif.bss_conf;
         txrc.skb = skb;
         txrc.reported_rate.idx = -1;
         txrc.rate_idx_mask = sdata->rc_rateidx_mask[band];
-        if (txrc.rate_idx_mask == (1 << sband->n_bitrates) - 1)
+        if (txrc.rate_idx_mask == (1 << txrc.sband->n_bitrates) - 1)
                 txrc.max_rate_idx = -1;
         else
                 txrc.max_rate_idx = fls(txrc.rate_idx_mask) - 1;
@@ -2482,7 +2461,8 @@ struct sk_buff *ieee80211_proberesp_get(struct ieee80211_hw *hw,
                                         struct ieee80211_vif *vif)
 {
         struct ieee80211_if_ap *ap = NULL;
-        struct sk_buff *presp = NULL, *skb = NULL;
+        struct sk_buff *skb = NULL;
+        struct probe_resp *presp = NULL;
         struct ieee80211_hdr *hdr;
         struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
 
@@ -2496,10 +2476,12 @@ struct sk_buff *ieee80211_proberesp_get(struct ieee80211_hw *hw,
         if (!presp)
                 goto out;
 
-        skb = skb_copy(presp, GFP_ATOMIC);
+        skb = dev_alloc_skb(presp->len);
         if (!skb)
                 goto out;
 
+        memcpy(skb_put(skb, presp->len), presp->data, presp->len);
+
         hdr = (struct ieee80211_hdr *) skb->data;
         memset(hdr->addr1, 0, sizeof(hdr->addr1));
 
@@ -2610,9 +2592,9 @@ struct sk_buff *ieee80211_probereq_get(struct ieee80211_hw *hw,
         memset(hdr, 0, sizeof(*hdr));
         hdr->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
                                          IEEE80211_STYPE_PROBE_REQ);
-        memset(hdr->addr1, 0xff, ETH_ALEN);
+        eth_broadcast_addr(hdr->addr1);
         memcpy(hdr->addr2, vif->addr, ETH_ALEN);
-        memset(hdr->addr3, 0xff, ETH_ALEN);
+        eth_broadcast_addr(hdr->addr3);
 
         pos = skb_put(skb, ie_ssid_len);
         *pos++ = WLAN_EID_SSID;
@@ -2709,8 +2691,7 @@ ieee80211_get_buffered_bc(struct ieee80211_hw *hw,
         info = IEEE80211_SKB_CB(skb);
 
         tx.flags |= IEEE80211_TX_PS_BUFFERED;
-        tx.channel = local->hw.conf.channel;
-        info->band = tx.channel->band;
+        info->band = local->oper_channel->band;
 
         if (invoke_tx_handlers(&tx))
                 skb = NULL;
diff --git a/net/mac80211/util.c b/net/mac80211/util.c
index 39b82fee4904..471fb0516c99 100644
--- a/net/mac80211/util.c
+++ b/net/mac80211/util.c
@@ -276,6 +276,9 @@ void ieee80211_propagate_queue_wake(struct ieee80211_local *local, int queue)
         list_for_each_entry_rcu(sdata, &local->interfaces, list) {
                 int ac;
 
+                if (!sdata->dev)
+                        continue;
+
                 if (test_bit(SDATA_STATE_OFFCHANNEL, &sdata->state))
                         continue;
 
@@ -364,6 +367,9 @@ static void __ieee80211_stop_queue(struct ieee80211_hw *hw, int queue,
         list_for_each_entry_rcu(sdata, &local->interfaces, list) {
                 int ac;
 
+                if (!sdata->dev)
+                        continue;
+
                 for (ac = 0; ac < n_acs; ac++) {
                         if (sdata->vif.hw_queue[ac] == queue ||
                             sdata->vif.cab_queue == queue)
@@ -768,8 +774,11 @@ u32 ieee802_11_parse_elems_crc(u8 *start, size_t len,
                                 elem_parse_failed = true;
                         break;
                 case WLAN_EID_CHANNEL_SWITCH:
-                        elems->ch_switch_elem = pos;
-                        elems->ch_switch_elem_len = elen;
+                        if (elen != sizeof(struct ieee80211_channel_sw_ie)) {
+                                elem_parse_failed = true;
+                                break;
+                        }
+                        elems->ch_switch_ie = (void *)pos;
                         break;
                 case WLAN_EID_QUIET:
                         if (!elems->quiet_elem) {
@@ -832,7 +841,7 @@ void ieee80211_set_wmm_default(struct ieee80211_sub_if_data *sdata,
 
         memset(&qparam, 0, sizeof(qparam));
 
-        use_11b = (local->hw.conf.channel->band == IEEE80211_BAND_2GHZ) &&
+        use_11b = (local->oper_channel->band == IEEE80211_BAND_2GHZ) &&
                  !(sdata->flags & IEEE80211_SDATA_OPERATING_GMODE);
 
         /*
@@ -899,7 +908,8 @@ void ieee80211_set_wmm_default(struct ieee80211_sub_if_data *sdata,
                 drv_conf_tx(local, sdata, ac, &qparam);
         }
 
-        if (sdata->vif.type != NL80211_IFTYPE_MONITOR) {
+        if (sdata->vif.type != NL80211_IFTYPE_MONITOR &&
+            sdata->vif.type != NL80211_IFTYPE_P2P_DEVICE) {
                 sdata->vif.bss_conf.qos = enable_qos;
                 if (bss_notify)
                         ieee80211_bss_info_change_notify(sdata,
@@ -919,7 +929,7 @@ void ieee80211_sta_def_wmm_params(struct ieee80211_sub_if_data *sdata,
                 if ((supp_rates[i] & 0x7f) * 5 > 110)
                         have_higher_than_11mbit = 1;
 
-        if (local->hw.conf.channel->band == IEEE80211_BAND_2GHZ &&
+        if (local->oper_channel->band == IEEE80211_BAND_2GHZ &&
             have_higher_than_11mbit)
                 sdata->flags |= IEEE80211_SDATA_OPERATING_GMODE;
         else
@@ -1100,6 +1110,7 @@ int ieee80211_build_preq_ies(struct ieee80211_local *local, u8 *buffer,
 
 struct sk_buff *ieee80211_build_probe_req(struct ieee80211_sub_if_data *sdata,
                                           u8 *dst, u32 ratemask,
+                                          struct ieee80211_channel *chan,
                                           const u8 *ssid, size_t ssid_len,
                                           const u8 *ie, size_t ie_len,
                                           bool directed)
@@ -1109,7 +1120,7 @@ struct sk_buff *ieee80211_build_probe_req(struct ieee80211_sub_if_data *sdata,
         struct ieee80211_mgmt *mgmt;
         size_t buf_len;
         u8 *buf;
-        u8 chan;
+        u8 chan_no;
 
         /* FIXME: come up with a proper value */
         buf = kmalloc(200 + ie_len, GFP_KERNEL);
@@ -1122,14 +1133,12 @@ struct sk_buff *ieee80211_build_probe_req(struct ieee80211_sub_if_data *sdata,
          * badly-behaved APs don't respond when this parameter is included.
          */
         if (directed)
-                chan = 0;
+                chan_no = 0;
         else
-                chan = ieee80211_frequency_to_channel(
-                        local->hw.conf.channel->center_freq);
+                chan_no = ieee80211_frequency_to_channel(chan->center_freq);
 
-        buf_len = ieee80211_build_preq_ies(local, buf, ie, ie_len,
-                                           local->hw.conf.channel->band,
-                                           ratemask, chan);
+        buf_len = ieee80211_build_preq_ies(local, buf, ie, ie_len, chan->band,
+                                           ratemask, chan_no);
 
         skb = ieee80211_probereq_get(&local->hw, &sdata->vif,
                                      ssid, ssid_len,
@@ -1154,11 +1163,13 @@ struct sk_buff *ieee80211_build_probe_req(struct ieee80211_sub_if_data *sdata,
 void ieee80211_send_probe_req(struct ieee80211_sub_if_data *sdata, u8 *dst,
                               const u8 *ssid, size_t ssid_len,
                               const u8 *ie, size_t ie_len,
-                              u32 ratemask, bool directed, bool no_cck)
+                              u32 ratemask, bool directed, bool no_cck,
+                              struct ieee80211_channel *channel)
 {
         struct sk_buff *skb;
 
-        skb = ieee80211_build_probe_req(sdata, dst, ratemask, ssid, ssid_len,
+        skb = ieee80211_build_probe_req(sdata, dst, ratemask, channel,
+                                        ssid, ssid_len,
                                         ie, ie_len, directed);
         if (skb) {
                 if (no_cck)
@@ -1359,7 +1370,8 @@ int ieee80211_reconfig(struct ieee80211_local *local)
                 switch (sdata->vif.type) {
                 case NL80211_IFTYPE_STATION:
                         changed |= BSS_CHANGED_ASSOC |
-                                   BSS_CHANGED_ARP_FILTER;
+                                   BSS_CHANGED_ARP_FILTER |
+                                   BSS_CHANGED_PS;
                         mutex_lock(&sdata->u.mgd.mtx);
                         ieee80211_bss_info_change_notify(sdata, changed);
                         mutex_unlock(&sdata->u.mgd.mtx);
@@ -1385,6 +1397,9 @@ int ieee80211_reconfig(struct ieee80211_local *local)
                 case NL80211_IFTYPE_MONITOR:
                         /* ignore virtual */
                         break;
+                case NL80211_IFTYPE_P2P_DEVICE:
+                        changed = BSS_CHANGED_IDLE;
+                        break;
                 case NL80211_IFTYPE_UNSPECIFIED:
                 case NUM_NL80211_IFTYPES:
                 case NL80211_IFTYPE_P2P_CLIENT:
@@ -1571,6 +1586,8 @@ void ieee80211_recalc_smps(struct ieee80211_local *local)
         list_for_each_entry(sdata, &local->interfaces, list) {
                 if (!ieee80211_sdata_running(sdata))
                         continue;
+                if (sdata->vif.type == NL80211_IFTYPE_P2P_DEVICE)
+                        continue;
                 if (sdata->vif.type != NL80211_IFTYPE_STATION)
                         goto set;
 
@@ -1809,7 +1826,8 @@ ieee80211_ht_oper_to_channel_type(struct ieee80211_ht_operation *ht_oper)
 }
 
 int ieee80211_add_srates_ie(struct ieee80211_sub_if_data *sdata,
-                            struct sk_buff *skb, bool need_basic)
+                            struct sk_buff *skb, bool need_basic,
+                            enum ieee80211_band band)
 {
         struct ieee80211_local *local = sdata->local;
         struct ieee80211_supported_band *sband;
@@ -1817,7 +1835,7 @@ int ieee80211_add_srates_ie(struct ieee80211_sub_if_data *sdata,
         u8 i, rates, *pos;
         u32 basic_rates = sdata->vif.bss_conf.basic_rates;
 
-        sband = local->hw.wiphy->bands[local->hw.conf.channel->band];
+        sband = local->hw.wiphy->bands[band];
         rates = sband->n_bitrates;
         if (rates > 8)
                 rates = 8;
@@ -1840,7 +1858,8 @@ int ieee80211_add_srates_ie(struct ieee80211_sub_if_data *sdata,
 }
 
 int ieee80211_add_ext_srates_ie(struct ieee80211_sub_if_data *sdata,
-                                struct sk_buff *skb, bool need_basic)
+                                struct sk_buff *skb, bool need_basic,
+                                enum ieee80211_band band)
 {
         struct ieee80211_local *local = sdata->local;
         struct ieee80211_supported_band *sband;
@@ -1848,7 +1867,7 @@ int ieee80211_add_ext_srates_ie(struct ieee80211_sub_if_data *sdata,
         u8 i, exrates, *pos;
         u32 basic_rates = sdata->vif.bss_conf.basic_rates;
 
-        sband = local->hw.wiphy->bands[local->hw.conf.channel->band];
+        sband = local->hw.wiphy->bands[band];
         exrates = sband->n_bitrates;
         if (exrates > 8)
                 exrates -= 8;
diff --git a/net/netfilter/Kconfig b/net/netfilter/Kconfig
index c19b214ffd57..3f4b3b4a7762 100644
--- a/net/netfilter/Kconfig
+++ b/net/netfilter/Kconfig
@@ -356,6 +356,55 @@ config NETFILTER_NETLINK_QUEUE_CT
           If this option is enabled, NFQUEUE can include Connection Tracking
           information together with the packet is the enqueued via NFNETLINK.
 
+config NF_NAT
+        tristate
+
+config NF_NAT_NEEDED
+        bool
+        depends on NF_NAT
+        default y
+
+config NF_NAT_PROTO_DCCP
+        tristate
+        depends on NF_NAT && NF_CT_PROTO_DCCP
+        default NF_NAT && NF_CT_PROTO_DCCP
+
+config NF_NAT_PROTO_UDPLITE
+        tristate
+        depends on NF_NAT && NF_CT_PROTO_UDPLITE
+        default NF_NAT && NF_CT_PROTO_UDPLITE
+
+config NF_NAT_PROTO_SCTP
+        tristate
+        default NF_NAT && NF_CT_PROTO_SCTP
+        depends on NF_NAT && NF_CT_PROTO_SCTP
+        select LIBCRC32C
+
+config NF_NAT_AMANDA
+        tristate
+        depends on NF_CONNTRACK && NF_NAT
+        default NF_NAT && NF_CONNTRACK_AMANDA
+
+config NF_NAT_FTP
+        tristate
+        depends on NF_CONNTRACK && NF_NAT
+        default NF_NAT && NF_CONNTRACK_FTP
+
+config NF_NAT_IRC
+        tristate
+        depends on NF_CONNTRACK && NF_NAT
+        default NF_NAT && NF_CONNTRACK_IRC
+
+config NF_NAT_SIP
+        tristate
+        depends on NF_CONNTRACK && NF_NAT
+        default NF_NAT && NF_CONNTRACK_SIP
+
+config NF_NAT_TFTP
+        tristate
+        depends on NF_CONNTRACK && NF_NAT
+        default NF_NAT && NF_CONNTRACK_TFTP
+
 endif # NF_CONNTRACK
 
 # transparent proxy support
@@ -621,19 +670,6 @@ config NETFILTER_XT_TARGET_NFQUEUE
 
           To compile it as a module, choose M here.  If unsure, say N.
 
-config NETFILTER_XT_TARGET_NOTRACK
-        tristate  '"NOTRACK" target support'
-        depends on IP_NF_RAW || IP6_NF_RAW
-        depends on NF_CONNTRACK
-        help
-          The NOTRACK target allows a select rule to specify
-          which packets *not* to enter the conntrack/NAT
-          subsystem with all the consequences (no ICMP error tracking,
-          no protocol helpers for the selected packets).
-
-          If you want to compile it as a module, say M here and read
-          <file:Documentation/kbuild/modules.txt>.  If unsure, say `N'.
-
 config NETFILTER_XT_TARGET_RATEEST
         tristate '"RATEEST" target support'
         depends on NETFILTER_ADVANCED
diff --git a/net/netfilter/Makefile b/net/netfilter/Makefile
index 1c5160f2278e..98244d4c75f2 100644
--- a/net/netfilter/Makefile
+++ b/net/netfilter/Makefile
@@ -43,6 +43,24 @@ obj-$(CONFIG_NF_CONNTRACK_SANE) += nf_conntrack_sane.o
 obj-$(CONFIG_NF_CONNTRACK_SIP) += nf_conntrack_sip.o
 obj-$(CONFIG_NF_CONNTRACK_TFTP) += nf_conntrack_tftp.o
 
+nf_nat-y        := nf_nat_core.o nf_nat_proto_unknown.o nf_nat_proto_common.o \
+                   nf_nat_proto_udp.o nf_nat_proto_tcp.o nf_nat_helper.o
+
+obj-$(CONFIG_NF_NAT) += nf_nat.o
+obj-$(CONFIG_NF_NAT) += xt_nat.o
+
+# NAT protocols (nf_nat)
+obj-$(CONFIG_NF_NAT_PROTO_DCCP) += nf_nat_proto_dccp.o
+obj-$(CONFIG_NF_NAT_PROTO_UDPLITE) += nf_nat_proto_udplite.o
+obj-$(CONFIG_NF_NAT_PROTO_SCTP) += nf_nat_proto_sctp.o
+
+# NAT helpers
+obj-$(CONFIG_NF_NAT_AMANDA) += nf_nat_amanda.o
+obj-$(CONFIG_NF_NAT_FTP) += nf_nat_ftp.o
+obj-$(CONFIG_NF_NAT_IRC) += nf_nat_irc.o
+obj-$(CONFIG_NF_NAT_SIP) += nf_nat_sip.o
+obj-$(CONFIG_NF_NAT_TFTP) += nf_nat_tftp.o
+
 # transparent proxy support
 obj-$(CONFIG_NETFILTER_TPROXY) += nf_tproxy_core.o
 
@@ -67,7 +85,6 @@ obj-$(CONFIG_NETFILTER_XT_TARGET_LED) += xt_LED.o
 obj-$(CONFIG_NETFILTER_XT_TARGET_LOG) += xt_LOG.o
 obj-$(CONFIG_NETFILTER_XT_TARGET_NFLOG) += xt_NFLOG.o
 obj-$(CONFIG_NETFILTER_XT_TARGET_NFQUEUE) += xt_NFQUEUE.o
-obj-$(CONFIG_NETFILTER_XT_TARGET_NOTRACK) += xt_NOTRACK.o
 obj-$(CONFIG_NETFILTER_XT_TARGET_RATEEST) += xt_RATEEST.o
 obj-$(CONFIG_NETFILTER_XT_TARGET_SECMARK) += xt_SECMARK.o
 obj-$(CONFIG_NETFILTER_XT_TARGET_TPROXY) += xt_TPROXY.o
diff --git a/net/netfilter/core.c b/net/netfilter/core.c
index 0bc6b60db4df..68912dadf13d 100644
--- a/net/netfilter/core.c
+++ b/net/netfilter/core.c
@@ -126,7 +126,7 @@ unsigned int nf_iterate(struct list_head *head,
                         unsigned int hook,
                         const struct net_device *indev,
                         const struct net_device *outdev,
-                        struct list_head **i,
+                        struct nf_hook_ops **elemp,
                         int (*okfn)(struct sk_buff *),
                         int hook_thresh)
 {
@@ -136,22 +136,20 @@ unsigned int nf_iterate(struct list_head *head,
          * The caller must not block between calls to this
          * function because of risk of continuing from deleted element.
          */
-        list_for_each_continue_rcu(*i, head) {
-                struct nf_hook_ops *elem = (struct nf_hook_ops *)*i;
-
-                if (hook_thresh > elem->priority)
+        list_for_each_entry_continue_rcu((*elemp), head, list) {
+                if (hook_thresh > (*elemp)->priority)
                         continue;
 
                 /* Optimization: we don't need to hold module
                    reference here, since function can't sleep. --RR */
 repeat:
-                verdict = elem->hook(hook, skb, indev, outdev, okfn);
+                verdict = (*elemp)->hook(hook, skb, indev, outdev, okfn);
                 if (verdict != NF_ACCEPT) {
 #ifdef CONFIG_NETFILTER_DEBUG
                         if (unlikely((verdict & NF_VERDICT_MASK)
                                                         > NF_MAX_VERDICT)) {
                                 NFDEBUG("Evil return from %p(%u).\n",
-                                        elem->hook, hook);
+                                        (*elemp)->hook, hook);
                                 continue;
                         }
 #endif
@@ -172,14 +170,14 @@ int nf_hook_slow(u_int8_t pf, unsigned int hook, struct sk_buff *skb,
                  int (*okfn)(struct sk_buff *),
                  int hook_thresh)
 {
-        struct list_head *elem;
+        struct nf_hook_ops *elem;
         unsigned int verdict;
         int ret = 0;
 
         /* We may already have this, but read-locks nest anyway */
         rcu_read_lock();
 
-        elem = &nf_hooks[pf][hook];
+        elem = list_entry_rcu(&nf_hooks[pf][hook], struct nf_hook_ops, list);
 next_hook:
         verdict = nf_iterate(&nf_hooks[pf][hook], skb, hook, indev,
                              outdev, &elem, okfn, hook_thresh);
@@ -273,6 +271,11 @@ EXPORT_SYMBOL_GPL(nfq_ct_nat_hook);
 
 #endif /* CONFIG_NF_CONNTRACK */
 
+#ifdef CONFIG_NF_NAT_NEEDED
+void (*nf_nat_decode_session_hook)(struct sk_buff *, struct flowi *);
+EXPORT_SYMBOL(nf_nat_decode_session_hook);
+#endif
+
 #ifdef CONFIG_PROC_FS
 struct proc_dir_entry *proc_net_netfilter;
 EXPORT_SYMBOL(proc_net_netfilter);
diff --git a/net/netfilter/ipvs/Kconfig b/net/netfilter/ipvs/Kconfig
index f9871385a65e..8b2cffdfdd99 100644
--- a/net/netfilter/ipvs/Kconfig
+++ b/net/netfilter/ipvs/Kconfig
@@ -250,7 +250,8 @@ comment 'IPVS application helper'
 
 config  IP_VS_FTP
         tristate "FTP protocol helper"
-        depends on IP_VS_PROTO_TCP && NF_CONNTRACK && NF_NAT
+        depends on IP_VS_PROTO_TCP && NF_CONNTRACK && NF_NAT && \
+                NF_CONNTRACK_FTP
         select IP_VS_NFCT
         ---help---
           FTP is a protocol that transfers IP address and/or port number in
diff --git a/net/netfilter/ipvs/ip_vs_app.c b/net/netfilter/ipvs/ip_vs_app.c
index 64f9e8f13207..9713e6e86d47 100644
--- a/net/netfilter/ipvs/ip_vs_app.c
+++ b/net/netfilter/ipvs/ip_vs_app.c
@@ -180,22 +180,38 @@ register_ip_vs_app_inc(struct net *net, struct ip_vs_app *app, __u16 proto,
 }
 
 
-/*
- *      ip_vs_app registration routine
- */
-int register_ip_vs_app(struct net *net, struct ip_vs_app *app)
+/* Register application for netns */
+struct ip_vs_app *register_ip_vs_app(struct net *net, struct ip_vs_app *app)
 {
         struct netns_ipvs *ipvs = net_ipvs(net);
-        /* increase the module use count */
-        ip_vs_use_count_inc();
+        struct ip_vs_app *a;
+        int err = 0;
+
+        if (!ipvs)
+                return ERR_PTR(-ENOENT);
 
         mutex_lock(&__ip_vs_app_mutex);
 
-        list_add(&app->a_list, &ipvs->app_list);
+        list_for_each_entry(a, &ipvs->app_list, a_list) {
+                if (!strcmp(app->name, a->name)) {
+                        err = -EEXIST;
+                        goto out_unlock;
+                }
+        }
+        a = kmemdup(app, sizeof(*app), GFP_KERNEL);
+        if (!a) {
+                err = -ENOMEM;
+                goto out_unlock;
+        }
+        INIT_LIST_HEAD(&a->incs_list);
+        list_add(&a->a_list, &ipvs->app_list);
+        /* increase the module use count */
+        ip_vs_use_count_inc();
 
+out_unlock:
         mutex_unlock(&__ip_vs_app_mutex);
 
-        return 0;
+        return err ? ERR_PTR(err) : a;
 }
 
 
@@ -205,20 +221,29 @@ int register_ip_vs_app(struct net *net, struct ip_vs_app *app)
  */
 void unregister_ip_vs_app(struct net *net, struct ip_vs_app *app)
 {
-        struct ip_vs_app *inc, *nxt;
+        struct netns_ipvs *ipvs = net_ipvs(net);
+        struct ip_vs_app *a, *anxt, *inc, *nxt;
+
+        if (!ipvs)
+                return;
 
         mutex_lock(&__ip_vs_app_mutex);
 
-        list_for_each_entry_safe(inc, nxt, &app->incs_list, a_list) {
-                ip_vs_app_inc_release(net, inc);
-        }
+        list_for_each_entry_safe(a, anxt, &ipvs->app_list, a_list) {
+                if (app && strcmp(app->name, a->name))
+                        continue;
+                list_for_each_entry_safe(inc, nxt, &a->incs_list, a_list) {
+                        ip_vs_app_inc_release(net, inc);
+                }
 
-        list_del(&app->a_list);
+                list_del(&a->a_list);
+                kfree(a);
 
-        mutex_unlock(&__ip_vs_app_mutex);
+                /* decrease the module use count */
+                ip_vs_use_count_dec();
+        }
 
-        /* decrease the module use count */
-        ip_vs_use_count_dec();
+        mutex_unlock(&__ip_vs_app_mutex);
 }
 
 
@@ -586,5 +611,6 @@ int __net_init ip_vs_app_net_init(struct net *net)
 
 void __net_exit ip_vs_app_net_cleanup(struct net *net)
 {
+        unregister_ip_vs_app(net, NULL /* all */);
         proc_net_remove(net, "ip_vs_app");
 }
diff --git a/net/netfilter/ipvs/ip_vs_core.c b/net/netfilter/ipvs/ip_vs_core.c
index b54eccef40b5..58918e20f9d5 100644
--- a/net/netfilter/ipvs/ip_vs_core.c
+++ b/net/netfilter/ipvs/ip_vs_core.c
@@ -1303,7 +1303,8 @@ ip_vs_in_icmp(struct sk_buff *skb, int *related, unsigned int hooknum)
         struct ip_vs_conn *cp;
         struct ip_vs_protocol *pp;
         struct ip_vs_proto_data *pd;
-        unsigned int offset, ihl, verdict;
+        unsigned int offset, offset2, ihl, verdict;
+        bool ipip;
 
         *related = 1;
 
@@ -1345,6 +1346,21 @@ ip_vs_in_icmp(struct sk_buff *skb, int *related, unsigned int hooknum)
 
         net = skb_net(skb);
 
+        /* Special case for errors for IPIP packets */
+        ipip = false;
+        if (cih->protocol == IPPROTO_IPIP) {
+                if (unlikely(cih->frag_off & htons(IP_OFFSET)))
+                        return NF_ACCEPT;
+                /* Error for our IPIP must arrive at LOCAL_IN */
+                if (!(skb_rtable(skb)->rt_flags & RTCF_LOCAL))
+                        return NF_ACCEPT;
+                offset += cih->ihl * 4;
+                cih = skb_header_pointer(skb, offset, sizeof(_ciph), &_ciph);
+                if (cih == NULL)
+                        return NF_ACCEPT; /* The packet looks wrong, ignore */
+                ipip = true;
+        }
+
         pd = ip_vs_proto_data_get(net, cih->protocol);
         if (!pd)
                 return NF_ACCEPT;
@@ -1358,11 +1374,14 @@ ip_vs_in_icmp(struct sk_buff *skb, int *related, unsigned int hooknum)
         IP_VS_DBG_PKT(11, AF_INET, pp, skb, offset,
                       "Checking incoming ICMP for");
 
+        offset2 = offset;
         offset += cih->ihl * 4;
 
         ip_vs_fill_iphdr(AF_INET, cih, &ciph);
-        /* The embedded headers contain source and dest in reverse order */
-        cp = pp->conn_in_get(AF_INET, skb, &ciph, offset, 1);
+        /* The embedded headers contain source and dest in reverse order.
+         * For IPIP this is error for request, not for reply.
+         */
+        cp = pp->conn_in_get(AF_INET, skb, &ciph, offset, ipip ? 0 : 1);
         if (!cp)
                 return NF_ACCEPT;
 
@@ -1376,6 +1395,57 @@ ip_vs_in_icmp(struct sk_buff *skb, int *related, unsigned int hooknum)
                 goto out;
         }
 
+        if (ipip) {
+                __be32 info = ic->un.gateway;
+
+                /* Update the MTU */
+                if (ic->type == ICMP_DEST_UNREACH &&
+                    ic->code == ICMP_FRAG_NEEDED) {
+                        struct ip_vs_dest *dest = cp->dest;
+                        u32 mtu = ntohs(ic->un.frag.mtu);
+
+                        /* Strip outer IP and ICMP, go to IPIP header */
+                        __skb_pull(skb, ihl + sizeof(_icmph));
+                        offset2 -= ihl + sizeof(_icmph);
+                        skb_reset_network_header(skb);
+                        IP_VS_DBG(12, "ICMP for IPIP %pI4->%pI4: mtu=%u\n",
+                                &ip_hdr(skb)->saddr, &ip_hdr(skb)->daddr, mtu);
+                        rcu_read_lock();
+                        ipv4_update_pmtu(skb, dev_net(skb->dev),
+                                         mtu, 0, 0, 0, 0);
+                        rcu_read_unlock();
+                        /* Client uses PMTUD? */
+                        if (!(cih->frag_off & htons(IP_DF)))
+                                goto ignore_ipip;
+                        /* Prefer the resulting PMTU */
+                        if (dest) {
+                                spin_lock(&dest->dst_lock);
+                                if (dest->dst_cache)
+                                        mtu = dst_mtu(dest->dst_cache);
+                                spin_unlock(&dest->dst_lock);
+                        }
+                        if (mtu > 68 + sizeof(struct iphdr))
+                                mtu -= sizeof(struct iphdr);
+                        info = htonl(mtu);
+                }
+                /* Strip outer IP, ICMP and IPIP, go to IP header of
+                 * original request.
+                 */
+                __skb_pull(skb, offset2);
+                skb_reset_network_header(skb);
+                IP_VS_DBG(12, "Sending ICMP for %pI4->%pI4: t=%u, c=%u, i=%u\n",
+                        &ip_hdr(skb)->saddr, &ip_hdr(skb)->daddr,
+                        ic->type, ic->code, ntohl(info));
+                icmp_send(skb, ic->type, ic->code, info);
+                /* ICMP can be shorter but anyways, account it */
+                ip_vs_out_stats(cp, skb);
+
+ignore_ipip:
+                consume_skb(skb);
+                verdict = NF_STOLEN;
+                goto out;
+        }
+
         /* do the statistics and put it back */
         ip_vs_in_stats(cp, skb);
         if (IPPROTO_TCP == cih->protocol || IPPROTO_UDP == cih->protocol)
diff --git a/net/netfilter/ipvs/ip_vs_ctl.c b/net/netfilter/ipvs/ip_vs_ctl.c
index 84444dda194b..767cc12da0fe 100644
--- a/net/netfilter/ipvs/ip_vs_ctl.c
+++ b/net/netfilter/ipvs/ip_vs_ctl.c
@@ -1171,8 +1171,10 @@ ip_vs_add_service(struct net *net, struct ip_vs_service_user_kern *u,
                 goto out_err;
         }
         svc->stats.cpustats = alloc_percpu(struct ip_vs_cpu_stats);
-        if (!svc->stats.cpustats)
+        if (!svc->stats.cpustats) {
+                ret = -ENOMEM;
                 goto out_err;
+        }
 
         /* I'm the first user of the service */
         atomic_set(&svc->usecnt, 0);
@@ -1801,6 +1803,12 @@ static struct ctl_table vs_vars[] = {
                 .mode           = 0644,
                 .proc_handler   = proc_dointvec,
         },
+        {
+                .procname       = "pmtu_disc",
+                .maxlen         = sizeof(int),
+                .mode           = 0644,
+                .proc_handler   = proc_dointvec,
+        },
 #ifdef CONFIG_IP_VS_DEBUG
         {
                 .procname       = "debug_level",
@@ -2759,6 +2767,7 @@ do_ip_vs_get_ctl(struct sock *sk, int cmd, void __user *user, int *len)
         {
                 struct ip_vs_timeout_user t;
 
+                memset(&t, 0, sizeof(t));
                 __ip_vs_get_timeouts(net, &t);
                 if (copy_to_user(user, &t, sizeof(t)) != 0)
                         ret = -EFAULT;
@@ -3675,7 +3684,7 @@ static void ip_vs_genl_unregister(void)
  * per netns intit/exit func.
  */
 #ifdef CONFIG_SYSCTL
-int __net_init ip_vs_control_net_init_sysctl(struct net *net)
+static int __net_init ip_vs_control_net_init_sysctl(struct net *net)
 {
         int idx;
         struct netns_ipvs *ipvs = net_ipvs(net);
@@ -3726,6 +3735,8 @@ int __net_init ip_vs_control_net_init_sysctl(struct net *net)
         ipvs->sysctl_sync_retries = clamp_t(int, DEFAULT_SYNC_RETRIES, 0, 3);
         tbl[idx++].data = &ipvs->sysctl_sync_retries;
         tbl[idx++].data = &ipvs->sysctl_nat_icmp_send;
+        ipvs->sysctl_pmtu_disc = 1;
+        tbl[idx++].data = &ipvs->sysctl_pmtu_disc;
 
 
         ipvs->sysctl_hdr = register_net_sysctl(net, "net/ipv4/vs", tbl);
@@ -3743,7 +3754,7 @@ int __net_init ip_vs_control_net_init_sysctl(struct net *net)
         return 0;
 }
 
-void __net_exit ip_vs_control_net_cleanup_sysctl(struct net *net)
+static void __net_exit ip_vs_control_net_cleanup_sysctl(struct net *net)
 {
         struct netns_ipvs *ipvs = net_ipvs(net);
 
@@ -3754,8 +3765,8 @@ void __net_exit ip_vs_control_net_cleanup_sysctl(struct net *net)
 
 #else
 
-int __net_init ip_vs_control_net_init_sysctl(struct net *net) { return 0; }
-void __net_exit ip_vs_control_net_cleanup_sysctl(struct net *net) { }
+static int __net_init ip_vs_control_net_init_sysctl(struct net *net) { return 0; }
+static void __net_exit ip_vs_control_net_cleanup_sysctl(struct net *net) { }
 
 #endif
 
diff --git a/net/netfilter/ipvs/ip_vs_ftp.c b/net/netfilter/ipvs/ip_vs_ftp.c
index b20b29c903ef..4f53a5f04437 100644
--- a/net/netfilter/ipvs/ip_vs_ftp.c
+++ b/net/netfilter/ipvs/ip_vs_ftp.c
@@ -268,6 +268,7 @@ static int ip_vs_ftp_out(struct ip_vs_app *app, struct ip_vs_conn *cp,
                          * packet.
                          */
                         ret = nf_nat_mangle_tcp_packet(skb, ct, ctinfo,
+                                                       iph->ihl * 4,
                                                        start-data, end-start,
                                                        buf, buf_len);
                         if (ret) {
@@ -441,16 +442,10 @@ static int __net_init __ip_vs_ftp_init(struct net *net)
 
         if (!ipvs)
                 return -ENOENT;
-        app = kmemdup(&ip_vs_ftp, sizeof(struct ip_vs_app), GFP_KERNEL);
-        if (!app)
-                return -ENOMEM;
-        INIT_LIST_HEAD(&app->a_list);
-        INIT_LIST_HEAD(&app->incs_list);
-        ipvs->ftp_app = app;
 
-        ret = register_ip_vs_app(net, app);
-        if (ret)
-                goto err_exit;
+        app = register_ip_vs_app(net, &ip_vs_ftp);
+        if (IS_ERR(app))
+                return PTR_ERR(app);
 
         for (i = 0; i < ports_count; i++) {
                 if (!ports[i])
@@ -464,9 +459,7 @@ static int __net_init __ip_vs_ftp_init(struct net *net)
         return 0;
 
 err_unreg:
-        unregister_ip_vs_app(net, app);
-err_exit:
-        kfree(ipvs->ftp_app);
+        unregister_ip_vs_app(net, &ip_vs_ftp);
         return ret;
 }
 /*
@@ -474,10 +467,7 @@ err_exit:
  */
 static void __ip_vs_ftp_exit(struct net *net)
 {
-        struct netns_ipvs *ipvs = net_ipvs(net);
-
-        unregister_ip_vs_app(net, ipvs->ftp_app);
-        kfree(ipvs->ftp_app);
+        unregister_ip_vs_app(net, &ip_vs_ftp);
 }
 
 static struct pernet_operations ip_vs_ftp_ops = {
diff --git a/net/netfilter/ipvs/ip_vs_xmit.c b/net/netfilter/ipvs/ip_vs_xmit.c
index 65b616ae1716..56f6d5d81a77 100644
--- a/net/netfilter/ipvs/ip_vs_xmit.c
+++ b/net/netfilter/ipvs/ip_vs_xmit.c
@@ -49,6 +49,7 @@ enum {
         IP_VS_RT_MODE_RDR       = 4, /* Allow redirect from remote daddr to
                                       * local
                                       */
+        IP_VS_RT_MODE_CONNECT   = 8, /* Always bind route to saddr */
 };
 
 /*
@@ -84,6 +85,58 @@ __ip_vs_dst_check(struct ip_vs_dest *dest, u32 rtos)
         return dst;
 }
 
+static inline bool
+__mtu_check_toobig_v6(const struct sk_buff *skb, u32 mtu)
+{
+        if (IP6CB(skb)->frag_max_size) {
+                /* frag_max_size tell us that, this packet have been
+                 * defragmented by netfilter IPv6 conntrack module.
+                 */
+                if (IP6CB(skb)->frag_max_size > mtu)
+                        return true; /* largest fragment violate MTU */
+        }
+        else if (skb->len > mtu && !skb_is_gso(skb)) {
+                return true; /* Packet size violate MTU size */
+        }
+        return false;
+}
+
+/* Get route to daddr, update *saddr, optionally bind route to saddr */
+static struct rtable *do_output_route4(struct net *net, __be32 daddr,
+                                       u32 rtos, int rt_mode, __be32 *saddr)
+{
+        struct flowi4 fl4;
+        struct rtable *rt;
+        int loop = 0;
+
+        memset(&fl4, 0, sizeof(fl4));
+        fl4.daddr = daddr;
+        fl4.saddr = (rt_mode & IP_VS_RT_MODE_CONNECT) ? *saddr : 0;
+        fl4.flowi4_tos = rtos;
+
+retry:
+        rt = ip_route_output_key(net, &fl4);
+        if (IS_ERR(rt)) {
+                /* Invalid saddr ? */
+                if (PTR_ERR(rt) == -EINVAL && *saddr &&
+                    rt_mode & IP_VS_RT_MODE_CONNECT && !loop) {
+                        *saddr = 0;
+                        flowi4_update_output(&fl4, 0, rtos, daddr, 0);
+                        goto retry;
+                }
+                IP_VS_DBG_RL("ip_route_output error, dest: %pI4\n", &daddr);
+                return NULL;
+        } else if (!*saddr && rt_mode & IP_VS_RT_MODE_CONNECT && fl4.saddr) {
+                ip_rt_put(rt);
+                *saddr = fl4.saddr;
+                flowi4_update_output(&fl4, 0, rtos, daddr, fl4.saddr);
+                loop++;
+                goto retry;
+        }
+        *saddr = fl4.saddr;
+        return rt;
+}
+
 /* Get route to destination or remote server */
 static struct rtable *
 __ip_vs_get_out_rt(struct sk_buff *skb, struct ip_vs_dest *dest,
@@ -98,20 +151,13 @@ __ip_vs_get_out_rt(struct sk_buff *skb, struct ip_vs_dest *dest,
                 spin_lock(&dest->dst_lock);
                 if (!(rt = (struct rtable *)
                       __ip_vs_dst_check(dest, rtos))) {
-                        struct flowi4 fl4;
-
-                        memset(&fl4, 0, sizeof(fl4));
-                        fl4.daddr = dest->addr.ip;
-                        fl4.flowi4_tos = rtos;
-                        rt = ip_route_output_key(net, &fl4);
-                        if (IS_ERR(rt)) {
+                        rt = do_output_route4(net, dest->addr.ip, rtos,
+                                              rt_mode, &dest->dst_saddr.ip);
+                        if (!rt) {
                                 spin_unlock(&dest->dst_lock);
-                                IP_VS_DBG_RL("ip_route_output error, dest: %pI4\n",
-                                             &dest->addr.ip);
                                 return NULL;
                         }
                         __ip_vs_dst_set(dest, rtos, dst_clone(&rt->dst), 0);
-                        dest->dst_saddr.ip = fl4.saddr;
                         IP_VS_DBG(10, "new dst %pI4, src %pI4, refcnt=%d, "
                                   "rtos=%X\n",
                                   &dest->addr.ip, &dest->dst_saddr.ip,
@@ -122,19 +168,17 @@ __ip_vs_get_out_rt(struct sk_buff *skb, struct ip_vs_dest *dest,
                         *ret_saddr = dest->dst_saddr.ip;
                 spin_unlock(&dest->dst_lock);
         } else {
-                struct flowi4 fl4;
+                __be32 saddr = htonl(INADDR_ANY);
 
-                memset(&fl4, 0, sizeof(fl4));
-                fl4.daddr = daddr;
-                fl4.flowi4_tos = rtos;
-                rt = ip_route_output_key(net, &fl4);
-                if (IS_ERR(rt)) {
-                        IP_VS_DBG_RL("ip_route_output error, dest: %pI4\n",
-                                     &daddr);
+                /* For such unconfigured boxes avoid many route lookups
+                 * for performance reasons because we do not remember saddr
+                 */
+                rt_mode &= ~IP_VS_RT_MODE_CONNECT;
+                rt = do_output_route4(net, daddr, rtos, rt_mode, &saddr);
+                if (!rt)
                         return NULL;
-                }
                 if (ret_saddr)
-                        *ret_saddr = fl4.saddr;
+                        *ret_saddr = saddr;
         }
 
         local = rt->rt_flags & RTCF_LOCAL;
@@ -331,6 +375,7 @@ ip_vs_dst_reset(struct ip_vs_dest *dest)
         old_dst = dest->dst_cache;
         dest->dst_cache = NULL;
         dst_release(old_dst);
+        dest->dst_saddr.ip = 0;
 }
 
 #define IP_VS_XMIT_TUNNEL(skb, cp)                              \
@@ -462,7 +507,7 @@ ip_vs_bypass_xmit_v6(struct sk_buff *skb, struct ip_vs_conn *cp,
 
         /* MTU checking */
         mtu = dst_mtu(&rt->dst);
-        if (skb->len > mtu && !skb_is_gso(skb)) {
+        if (__mtu_check_toobig_v6(skb, mtu)) {
                 if (!skb->dev) {
                         struct net *net = dev_net(skb_dst(skb)->dev);
 
@@ -683,7 +728,7 @@ ip_vs_nat_xmit_v6(struct sk_buff *skb, struct ip_vs_conn *cp,
 
         /* MTU checking */
         mtu = dst_mtu(&rt->dst);
-        if (skb->len > mtu && !skb_is_gso(skb)) {
+        if (__mtu_check_toobig_v6(skb, mtu)) {
                 if (!skb->dev) {
                         struct net *net = dev_net(skb_dst(skb)->dev);
 
@@ -766,12 +811,13 @@ int
 ip_vs_tunnel_xmit(struct sk_buff *skb, struct ip_vs_conn *cp,
                   struct ip_vs_protocol *pp)
 {
+        struct netns_ipvs *ipvs = net_ipvs(skb_net(skb));
         struct rtable *rt;                      /* Route to the other host */
         __be32 saddr;                           /* Source for tunnel */
         struct net_device *tdev;                /* Device to other host */
         struct iphdr  *old_iph = ip_hdr(skb);
         u8     tos = old_iph->tos;
-        __be16 df = old_iph->frag_off;
+        __be16 df;
         struct iphdr  *iph;                     /* Our new IP header */
         unsigned int max_headroom;              /* The extra header space needed */
         int    mtu;
@@ -781,7 +827,8 @@ ip_vs_tunnel_xmit(struct sk_buff *skb, struct ip_vs_conn *cp,
 
         if (!(rt = __ip_vs_get_out_rt(skb, cp->dest, cp->daddr.ip,
                                       RT_TOS(tos), IP_VS_RT_MODE_LOCAL |
-                                                   IP_VS_RT_MODE_NON_LOCAL,
+                                                   IP_VS_RT_MODE_NON_LOCAL |
+                                                   IP_VS_RT_MODE_CONNECT,
                                                    &saddr)))
                 goto tx_error_icmp;
         if (rt->rt_flags & RTCF_LOCAL) {
@@ -796,13 +843,13 @@ ip_vs_tunnel_xmit(struct sk_buff *skb, struct ip_vs_conn *cp,
                 IP_VS_DBG_RL("%s(): mtu less than 68\n", __func__);
                 goto tx_error_put;
         }
-        if (skb_dst(skb))
+        if (rt_is_output_route(skb_rtable(skb)))
                 skb_dst(skb)->ops->update_pmtu(skb_dst(skb), NULL, skb, mtu);
 
-        df |= (old_iph->frag_off & htons(IP_DF));
+        /* Copy DF, reset fragment offset and MF */
+        df = sysctl_pmtu_disc(ipvs) ? old_iph->frag_off & htons(IP_DF) : 0;
 
-        if ((old_iph->frag_off & htons(IP_DF) &&
-            mtu < ntohs(old_iph->tot_len) && !skb_is_gso(skb))) {
+        if (df && mtu < ntohs(old_iph->tot_len) && !skb_is_gso(skb)) {
                 icmp_send(skb, ICMP_DEST_UNREACH,ICMP_FRAG_NEEDED, htonl(mtu));
                 IP_VS_DBG_RL("%s(): frag needed\n", __func__);
                 goto tx_error_put;
@@ -915,8 +962,8 @@ ip_vs_tunnel_xmit_v6(struct sk_buff *skb, struct ip_vs_conn *cp,
         if (skb_dst(skb))
                 skb_dst(skb)->ops->update_pmtu(skb_dst(skb), NULL, skb, mtu);
 
-        if (mtu < ntohs(old_iph->payload_len) + sizeof(struct ipv6hdr) &&
-            !skb_is_gso(skb)) {
+        /* MTU checking: Notice that 'mtu' have been adjusted before hand */
+        if (__mtu_check_toobig_v6(skb, mtu)) {
                 if (!skb->dev) {
                         struct net *net = dev_net(skb_dst(skb)->dev);
 
@@ -1082,7 +1129,7 @@ ip_vs_dr_xmit_v6(struct sk_buff *skb, struct ip_vs_conn *cp,
 
         /* MTU checking */
         mtu = dst_mtu(&rt->dst);
-        if (skb->len > mtu) {
+        if (__mtu_check_toobig_v6(skb, mtu)) {
                 if (!skb->dev) {
                         struct net *net = dev_net(skb_dst(skb)->dev);
 
@@ -1318,7 +1365,7 @@ ip_vs_icmp_xmit_v6(struct sk_buff *skb, struct ip_vs_conn *cp,
 
         /* MTU checking */
         mtu = dst_mtu(&rt->dst);
-        if (skb->len > mtu && !skb_is_gso(skb)) {
+        if (__mtu_check_toobig_v6(skb, mtu)) {
                 if (!skb->dev) {
                         struct net *net = dev_net(skb_dst(skb)->dev);
 
diff --git a/net/netfilter/nf_conntrack_amanda.c b/net/netfilter/nf_conntrack_amanda.c
index f2de8c55ac50..c514fe6033d2 100644
--- a/net/netfilter/nf_conntrack_amanda.c
+++ b/net/netfilter/nf_conntrack_amanda.c
@@ -40,6 +40,7 @@ MODULE_PARM_DESC(ts_algo, "textsearch algorithm to use (default kmp)");
 
 unsigned int (*nf_nat_amanda_hook)(struct sk_buff *skb,
                                    enum ip_conntrack_info ctinfo,
+                                   unsigned int protoff,
                                    unsigned int matchoff,
                                    unsigned int matchlen,
                                    struct nf_conntrack_expect *exp)
@@ -155,8 +156,8 @@ static int amanda_help(struct sk_buff *skb,
 
                 nf_nat_amanda = rcu_dereference(nf_nat_amanda_hook);
                 if (nf_nat_amanda && ct->status & IPS_NAT_MASK)
-                        ret = nf_nat_amanda(skb, ctinfo, off - dataoff,
-                                            len, exp);
+                        ret = nf_nat_amanda(skb, ctinfo, protoff,
+                                            off - dataoff, len, exp);
                 else if (nf_ct_expect_related(exp) != 0)
                         ret = NF_DROP;
                 nf_ct_expect_put(exp);
diff --git a/net/netfilter/nf_conntrack_core.c b/net/netfilter/nf_conntrack_core.c
index cf4875565d67..dcb27910ab3c 100644
--- a/net/netfilter/nf_conntrack_core.c
+++ b/net/netfilter/nf_conntrack_core.c
@@ -55,6 +55,12 @@ int (*nfnetlink_parse_nat_setup_hook)(struct nf_conn *ct,
                                       const struct nlattr *attr) __read_mostly;
 EXPORT_SYMBOL_GPL(nfnetlink_parse_nat_setup_hook);
 
+int (*nf_nat_seq_adjust_hook)(struct sk_buff *skb,
+                              struct nf_conn *ct,
+                              enum ip_conntrack_info ctinfo,
+                              unsigned int protoff);
+EXPORT_SYMBOL_GPL(nf_nat_seq_adjust_hook);
+
 DEFINE_SPINLOCK(nf_conntrack_lock);
 EXPORT_SYMBOL_GPL(nf_conntrack_lock);
 
@@ -249,12 +255,15 @@ static void death_by_event(unsigned long ul_conntrack)
 {
         struct nf_conn *ct = (void *)ul_conntrack;
         struct net *net = nf_ct_net(ct);
+        struct nf_conntrack_ecache *ecache = nf_ct_ecache_find(ct);
+
+        BUG_ON(ecache == NULL);
 
         if (nf_conntrack_event(IPCT_DESTROY, ct) < 0) {
                 /* bad luck, let's retry again */
-                ct->timeout.expires = jiffies +
+                ecache->timeout.expires = jiffies +
                         (random32() % net->ct.sysctl_events_retry_timeout);
-                add_timer(&ct->timeout);
+                add_timer(&ecache->timeout);
                 return;
         }
         /* we've got the event delivered, now it's dying */
@@ -268,6 +277,9 @@ static void death_by_event(unsigned long ul_conntrack)
 void nf_ct_insert_dying_list(struct nf_conn *ct)
 {
         struct net *net = nf_ct_net(ct);
+        struct nf_conntrack_ecache *ecache = nf_ct_ecache_find(ct);
+
+        BUG_ON(ecache == NULL);
 
         /* add this conntrack to the dying list */
         spin_lock_bh(&nf_conntrack_lock);
@@ -275,10 +287,10 @@ void nf_ct_insert_dying_list(struct nf_conn *ct)
                              &net->ct.dying);
         spin_unlock_bh(&nf_conntrack_lock);
         /* set a new timer to retry event delivery */
-        setup_timer(&ct->timeout, death_by_event, (unsigned long)ct);
-        ct->timeout.expires = jiffies +
+        setup_timer(&ecache->timeout, death_by_event, (unsigned long)ct);
+        ecache->timeout.expires = jiffies +
                 (random32() % net->ct.sysctl_events_retry_timeout);
-        add_timer(&ct->timeout);
+        add_timer(&ecache->timeout);
 }
 EXPORT_SYMBOL_GPL(nf_ct_insert_dying_list);
 
@@ -924,7 +936,6 @@ nf_conntrack_in(struct net *net, u_int8_t pf, unsigned int hooknum,
         enum ip_conntrack_info ctinfo;
         struct nf_conntrack_l3proto *l3proto;
         struct nf_conntrack_l4proto *l4proto;
-        struct nf_conn_timeout *timeout_ext;
         unsigned int *timeouts;
         unsigned int dataoff;
         u_int8_t protonum;
@@ -991,11 +1002,7 @@ nf_conntrack_in(struct net *net, u_int8_t pf, unsigned int hooknum,
         NF_CT_ASSERT(skb->nfct);
 
         /* Decide what timeout policy we want to apply to this flow. */
-        timeout_ext = nf_ct_timeout_find(ct);
-        if (timeout_ext)
-                timeouts = NF_CT_TIMEOUT_EXT_DATA(timeout_ext);
-        else
-                timeouts = l4proto->get_timeouts(net);
+        timeouts = nf_ct_timeout_lookup(net, ct, l4proto);
 
         ret = l4proto->packet(ct, skb, dataoff, ctinfo, pf, hooknum, timeouts);
         if (ret <= 0) {
diff --git a/net/netfilter/nf_conntrack_expect.c b/net/netfilter/nf_conntrack_expect.c
index 45cf602a76bc..527651a53a45 100644
--- a/net/netfilter/nf_conntrack_expect.c
+++ b/net/netfilter/nf_conntrack_expect.c
@@ -361,23 +361,6 @@ static void evict_oldest_expect(struct nf_conn *master,
         }
 }
 
-static inline int refresh_timer(struct nf_conntrack_expect *i)
-{
-        struct nf_conn_help *master_help = nfct_help(i->master);
-        const struct nf_conntrack_expect_policy *p;
-
-        if (!del_timer(&i->timeout))
-                return 0;
-
-        p = &rcu_dereference_protected(
-                master_help->helper,
-                lockdep_is_held(&nf_conntrack_lock)
-                )->expect_policy[i->class];
-        i->timeout.expires = jiffies + p->timeout * HZ;
-        add_timer(&i->timeout);
-        return 1;
-}
-
 static inline int __nf_ct_expect_check(struct nf_conntrack_expect *expect)
 {
         const struct nf_conntrack_expect_policy *p;
@@ -386,7 +369,7 @@ static inline int __nf_ct_expect_check(struct nf_conntrack_expect *expect)
         struct nf_conn_help *master_help = nfct_help(master);
         struct nf_conntrack_helper *helper;
         struct net *net = nf_ct_exp_net(expect);
-        struct hlist_node *n;
+        struct hlist_node *n, *next;
         unsigned int h;
         int ret = 1;
 
@@ -395,12 +378,12 @@ static inline int __nf_ct_expect_check(struct nf_conntrack_expect *expect)
                 goto out;
         }
         h = nf_ct_expect_dst_hash(&expect->tuple);
-        hlist_for_each_entry(i, n, &net->ct.expect_hash[h], hnode) {
+        hlist_for_each_entry_safe(i, n, next, &net->ct.expect_hash[h], hnode) {
                 if (expect_matches(i, expect)) {
-                        /* Refresh timer: if it's dying, ignore.. */
-                        if (refresh_timer(i)) {
-                                ret = 0;
-                                goto out;
+                        if (del_timer(&i->timeout)) {
+                                nf_ct_unlink_expect(i);
+                                nf_ct_expect_put(i);
+                                break;
                         }
                 } else if (expect_clash(i, expect)) {
                         ret = -EBUSY;
diff --git a/net/netfilter/nf_conntrack_ftp.c b/net/netfilter/nf_conntrack_ftp.c
index 4bb771d1f57a..f8cc26ad4456 100644
--- a/net/netfilter/nf_conntrack_ftp.c
+++ b/net/netfilter/nf_conntrack_ftp.c
@@ -48,6 +48,7 @@ module_param(loose, bool, 0600);
 unsigned int (*nf_nat_ftp_hook)(struct sk_buff *skb,
                                 enum ip_conntrack_info ctinfo,
                                 enum nf_ct_ftp_type type,
+                                unsigned int protoff,
                                 unsigned int matchoff,
                                 unsigned int matchlen,
                                 struct nf_conntrack_expect *exp);
@@ -489,7 +490,7 @@ static int help(struct sk_buff *skb,
         nf_nat_ftp = rcu_dereference(nf_nat_ftp_hook);
         if (nf_nat_ftp && ct->status & IPS_NAT_MASK)
                 ret = nf_nat_ftp(skb, ctinfo, search[dir][i].ftptype,
-                                 matchoff, matchlen, exp);
+                                 protoff, matchoff, matchlen, exp);
         else {
                 /* Can't expect this?  Best to drop packet now. */
                 if (nf_ct_expect_related(exp) != 0)
diff --git a/net/netfilter/nf_conntrack_h323_main.c b/net/netfilter/nf_conntrack_h323_main.c
index 4283b207e63b..1b30b0dee708 100644
--- a/net/netfilter/nf_conntrack_h323_main.c
+++ b/net/netfilter/nf_conntrack_h323_main.c
@@ -49,12 +49,12 @@ MODULE_PARM_DESC(callforward_filter, "only create call forwarding expectations "
                                      "(determined by routing information)");
 
 /* Hooks for NAT */
-int (*set_h245_addr_hook) (struct sk_buff *skb,
+int (*set_h245_addr_hook) (struct sk_buff *skb, unsigned int protoff,
                            unsigned char **data, int dataoff,
                            H245_TransportAddress *taddr,
                            union nf_inet_addr *addr, __be16 port)
                            __read_mostly;
-int (*set_h225_addr_hook) (struct sk_buff *skb,
+int (*set_h225_addr_hook) (struct sk_buff *skb, unsigned int protoff,
                            unsigned char **data, int dataoff,
                            TransportAddress *taddr,
                            union nf_inet_addr *addr, __be16 port)
@@ -62,16 +62,17 @@ int (*set_h225_addr_hook) (struct sk_buff *skb,
 int (*set_sig_addr_hook) (struct sk_buff *skb,
                           struct nf_conn *ct,
                           enum ip_conntrack_info ctinfo,
-                          unsigned char **data,
+                          unsigned int protoff, unsigned char **data,
                           TransportAddress *taddr, int count) __read_mostly;
 int (*set_ras_addr_hook) (struct sk_buff *skb,
                           struct nf_conn *ct,
                           enum ip_conntrack_info ctinfo,
-                          unsigned char **data,
+                          unsigned int protoff, unsigned char **data,
                           TransportAddress *taddr, int count) __read_mostly;
 int (*nat_rtp_rtcp_hook) (struct sk_buff *skb,
                           struct nf_conn *ct,
                           enum ip_conntrack_info ctinfo,
+                          unsigned int protoff,
                           unsigned char **data, int dataoff,
                           H245_TransportAddress *taddr,
                           __be16 port, __be16 rtp_port,
@@ -80,24 +81,28 @@ int (*nat_rtp_rtcp_hook) (struct sk_buff *skb,
 int (*nat_t120_hook) (struct sk_buff *skb,
                       struct nf_conn *ct,
                       enum ip_conntrack_info ctinfo,
+                      unsigned int protoff,
                       unsigned char **data, int dataoff,
                       H245_TransportAddress *taddr, __be16 port,
                       struct nf_conntrack_expect *exp) __read_mostly;
 int (*nat_h245_hook) (struct sk_buff *skb,
                       struct nf_conn *ct,
                       enum ip_conntrack_info ctinfo,
+                      unsigned int protoff,
                       unsigned char **data, int dataoff,
                       TransportAddress *taddr, __be16 port,
                       struct nf_conntrack_expect *exp) __read_mostly;
 int (*nat_callforwarding_hook) (struct sk_buff *skb,
                                 struct nf_conn *ct,
                                 enum ip_conntrack_info ctinfo,
+                                unsigned int protoff,
                                 unsigned char **data, int dataoff,
                                 TransportAddress *taddr, __be16 port,
                                 struct nf_conntrack_expect *exp) __read_mostly;
 int (*nat_q931_hook) (struct sk_buff *skb,
                       struct nf_conn *ct,
                       enum ip_conntrack_info ctinfo,
+                      unsigned int protoff,
                       unsigned char **data, TransportAddress *taddr, int idx,
                       __be16 port, struct nf_conntrack_expect *exp)
                       __read_mostly;
@@ -251,6 +256,7 @@ static int get_h245_addr(struct nf_conn *ct, const unsigned char *data,
 /****************************************************************************/
 static int expect_rtp_rtcp(struct sk_buff *skb, struct nf_conn *ct,
                            enum ip_conntrack_info ctinfo,
+                           unsigned int protoff,
                            unsigned char **data, int dataoff,
                            H245_TransportAddress *taddr)
 {
@@ -295,9 +301,10 @@ static int expect_rtp_rtcp(struct sk_buff *skb, struct nf_conn *ct,
                    &ct->tuplehash[!dir].tuple.dst.u3,
                    sizeof(ct->tuplehash[dir].tuple.src.u3)) &&
                    (nat_rtp_rtcp = rcu_dereference(nat_rtp_rtcp_hook)) &&
+                   nf_ct_l3num(ct) == NFPROTO_IPV4 &&
                    ct->status & IPS_NAT_MASK) {
                 /* NAT needed */
-                ret = nat_rtp_rtcp(skb, ct, ctinfo, data, dataoff,
+                ret = nat_rtp_rtcp(skb, ct, ctinfo, protoff, data, dataoff,
                                    taddr, port, rtp_port, rtp_exp, rtcp_exp);
         } else {                /* Conntrack only */
                 if (nf_ct_expect_related(rtp_exp) == 0) {
@@ -324,6 +331,7 @@ static int expect_rtp_rtcp(struct sk_buff *skb, struct nf_conn *ct,
 static int expect_t120(struct sk_buff *skb,
                        struct nf_conn *ct,
                        enum ip_conntrack_info ctinfo,
+                       unsigned int protoff,
                        unsigned char **data, int dataoff,
                        H245_TransportAddress *taddr)
 {
@@ -353,9 +361,10 @@ static int expect_t120(struct sk_buff *skb,
                    &ct->tuplehash[!dir].tuple.dst.u3,
                    sizeof(ct->tuplehash[dir].tuple.src.u3)) &&
             (nat_t120 = rcu_dereference(nat_t120_hook)) &&
+            nf_ct_l3num(ct) == NFPROTO_IPV4 &&
             ct->status & IPS_NAT_MASK) {
                 /* NAT needed */
-                ret = nat_t120(skb, ct, ctinfo, data, dataoff, taddr,
+                ret = nat_t120(skb, ct, ctinfo, protoff, data, dataoff, taddr,
                                port, exp);
         } else {                /* Conntrack only */
                 if (nf_ct_expect_related(exp) == 0) {
@@ -374,6 +383,7 @@ static int expect_t120(struct sk_buff *skb,
 static int process_h245_channel(struct sk_buff *skb,
                                 struct nf_conn *ct,
                                 enum ip_conntrack_info ctinfo,
+                                unsigned int protoff,
                                 unsigned char **data, int dataoff,
                                 H2250LogicalChannelParameters *channel)
 {
@@ -381,7 +391,7 @@ static int process_h245_channel(struct sk_buff *skb,
 
         if (channel->options & eH2250LogicalChannelParameters_mediaChannel) {
                 /* RTP */
-                ret = expect_rtp_rtcp(skb, ct, ctinfo, data, dataoff,
+                ret = expect_rtp_rtcp(skb, ct, ctinfo, protoff, data, dataoff,
                                       &channel->mediaChannel);
                 if (ret < 0)
                         return -1;
@@ -390,7 +400,7 @@ static int process_h245_channel(struct sk_buff *skb,
         if (channel->
             options & eH2250LogicalChannelParameters_mediaControlChannel) {
                 /* RTCP */
-                ret = expect_rtp_rtcp(skb, ct, ctinfo, data, dataoff,
+                ret = expect_rtp_rtcp(skb, ct, ctinfo, protoff, data, dataoff,
                                       &channel->mediaControlChannel);
                 if (ret < 0)
                         return -1;
@@ -402,6 +412,7 @@ static int process_h245_channel(struct sk_buff *skb,
 /****************************************************************************/
 static int process_olc(struct sk_buff *skb, struct nf_conn *ct,
                        enum ip_conntrack_info ctinfo,
+                       unsigned int protoff,
                        unsigned char **data, int dataoff,
                        OpenLogicalChannel *olc)
 {
@@ -412,7 +423,8 @@ static int process_olc(struct sk_buff *skb, struct nf_conn *ct,
         if (olc->forwardLogicalChannelParameters.multiplexParameters.choice ==
             eOpenLogicalChannel_forwardLogicalChannelParameters_multiplexParameters_h2250LogicalChannelParameters)
         {
-                ret = process_h245_channel(skb, ct, ctinfo, data, dataoff,
+                ret = process_h245_channel(skb, ct, ctinfo,
+                                           protoff, data, dataoff,
                                            &olc->
                                            forwardLogicalChannelParameters.
                                            multiplexParameters.
@@ -430,7 +442,8 @@ static int process_olc(struct sk_buff *skb, struct nf_conn *ct,
                 eOpenLogicalChannel_reverseLogicalChannelParameters_multiplexParameters_h2250LogicalChannelParameters))
         {
                 ret =
-                    process_h245_channel(skb, ct, ctinfo, data, dataoff,
+                    process_h245_channel(skb, ct, ctinfo,
+                                         protoff, data, dataoff,
                                          &olc->
                                          reverseLogicalChannelParameters.
                                          multiplexParameters.
@@ -448,7 +461,7 @@ static int process_olc(struct sk_buff *skb, struct nf_conn *ct,
             t120.choice == eDataProtocolCapability_separateLANStack &&
             olc->separateStack.networkAddress.choice ==
             eNetworkAccessParameters_networkAddress_localAreaAddress) {
-                ret = expect_t120(skb, ct, ctinfo, data, dataoff,
+                ret = expect_t120(skb, ct, ctinfo, protoff, data, dataoff,
                                   &olc->separateStack.networkAddress.
                                   localAreaAddress);
                 if (ret < 0)
@@ -461,7 +474,7 @@ static int process_olc(struct sk_buff *skb, struct nf_conn *ct,
 /****************************************************************************/
 static int process_olca(struct sk_buff *skb, struct nf_conn *ct,
                         enum ip_conntrack_info ctinfo,
-                        unsigned char **data, int dataoff,
+                        unsigned int protoff, unsigned char **data, int dataoff,
                         OpenLogicalChannelAck *olca)
 {
         H2250LogicalChannelAckParameters *ack;
@@ -477,7 +490,8 @@ static int process_olca(struct sk_buff *skb, struct nf_conn *ct,
                 choice ==
                 eOpenLogicalChannelAck_reverseLogicalChannelParameters_multiplexParameters_h2250LogicalChannelParameters))
         {
-                ret = process_h245_channel(skb, ct, ctinfo, data, dataoff,
+                ret = process_h245_channel(skb, ct, ctinfo,
+                                           protoff, data, dataoff,
                                            &olca->
                                            reverseLogicalChannelParameters.
                                            multiplexParameters.
@@ -496,7 +510,8 @@ static int process_olca(struct sk_buff *skb, struct nf_conn *ct,
                 if (ack->options &
                     eH2250LogicalChannelAckParameters_mediaChannel) {
                         /* RTP */
-                        ret = expect_rtp_rtcp(skb, ct, ctinfo, data, dataoff,
+                        ret = expect_rtp_rtcp(skb, ct, ctinfo,
+                                              protoff, data, dataoff,
                                               &ack->mediaChannel);
                         if (ret < 0)
                                 return -1;
@@ -505,7 +520,8 @@ static int process_olca(struct sk_buff *skb, struct nf_conn *ct,
                 if (ack->options &
                     eH2250LogicalChannelAckParameters_mediaControlChannel) {
                         /* RTCP */
-                        ret = expect_rtp_rtcp(skb, ct, ctinfo, data, dataoff,
+                        ret = expect_rtp_rtcp(skb, ct, ctinfo,
+                                              protoff, data, dataoff,
                                               &ack->mediaControlChannel);
                         if (ret < 0)
                                 return -1;
@@ -515,7 +531,7 @@ static int process_olca(struct sk_buff *skb, struct nf_conn *ct,
         if ((olca->options & eOpenLogicalChannelAck_separateStack) &&
                 olca->separateStack.networkAddress.choice ==
                 eNetworkAccessParameters_networkAddress_localAreaAddress) {
-                ret = expect_t120(skb, ct, ctinfo, data, dataoff,
+                ret = expect_t120(skb, ct, ctinfo, protoff, data, dataoff,
                                   &olca->separateStack.networkAddress.
                                   localAreaAddress);
                 if (ret < 0)
@@ -528,14 +544,15 @@ static int process_olca(struct sk_buff *skb, struct nf_conn *ct,
 /****************************************************************************/
 static int process_h245(struct sk_buff *skb, struct nf_conn *ct,
                         enum ip_conntrack_info ctinfo,
-                        unsigned char **data, int dataoff,
+                        unsigned int protoff, unsigned char **data, int dataoff,
                         MultimediaSystemControlMessage *mscm)
 {
         switch (mscm->choice) {
         case eMultimediaSystemControlMessage_request:
                 if (mscm->request.choice ==
                     eRequestMessage_openLogicalChannel) {
-                        return process_olc(skb, ct, ctinfo, data, dataoff,
+                        return process_olc(skb, ct, ctinfo,
+                                           protoff, data, dataoff,
                                            &mscm->request.openLogicalChannel);
                 }
                 pr_debug("nf_ct_h323: H.245 Request %d\n",
@@ -544,7 +561,8 @@ static int process_h245(struct sk_buff *skb, struct nf_conn *ct,
         case eMultimediaSystemControlMessage_response:
                 if (mscm->response.choice ==
                     eResponseMessage_openLogicalChannelAck) {
-                        return process_olca(skb, ct, ctinfo, data, dataoff,
+                        return process_olca(skb, ct, ctinfo,
+                                            protoff, data, dataoff,
                                             &mscm->response.
                                             openLogicalChannelAck);
                 }
@@ -595,7 +613,8 @@ static int h245_help(struct sk_buff *skb, unsigned int protoff,
                 }
 
                 /* Process H.245 signal */
-                if (process_h245(skb, ct, ctinfo, &data, dataoff, &mscm) < 0)
+                if (process_h245(skb, ct, ctinfo, protoff,
+                                 &data, dataoff, &mscm) < 0)
                         goto drop;
         }
 
@@ -659,7 +678,7 @@ int get_h225_addr(struct nf_conn *ct, unsigned char *data,
 /****************************************************************************/
 static int expect_h245(struct sk_buff *skb, struct nf_conn *ct,
                        enum ip_conntrack_info ctinfo,
-                       unsigned char **data, int dataoff,
+                       unsigned int protoff, unsigned char **data, int dataoff,
                        TransportAddress *taddr)
 {
         int dir = CTINFO2DIR(ctinfo);
@@ -688,9 +707,10 @@ static int expect_h245(struct sk_buff *skb, struct nf_conn *ct,
                    &ct->tuplehash[!dir].tuple.dst.u3,
                    sizeof(ct->tuplehash[dir].tuple.src.u3)) &&
             (nat_h245 = rcu_dereference(nat_h245_hook)) &&
+            nf_ct_l3num(ct) == NFPROTO_IPV4 &&
             ct->status & IPS_NAT_MASK) {
                 /* NAT needed */
-                ret = nat_h245(skb, ct, ctinfo, data, dataoff, taddr,
+                ret = nat_h245(skb, ct, ctinfo, protoff, data, dataoff, taddr,
                                port, exp);
         } else {                /* Conntrack only */
                 if (nf_ct_expect_related(exp) == 0) {
@@ -776,6 +796,7 @@ static int callforward_do_filter(const union nf_inet_addr *src,
 static int expect_callforwarding(struct sk_buff *skb,
                                  struct nf_conn *ct,
                                  enum ip_conntrack_info ctinfo,
+                                 unsigned int protoff,
                                  unsigned char **data, int dataoff,
                                  TransportAddress *taddr)
 {
@@ -811,9 +832,11 @@ static int expect_callforwarding(struct sk_buff *skb,
                    &ct->tuplehash[!dir].tuple.dst.u3,
                    sizeof(ct->tuplehash[dir].tuple.src.u3)) &&
             (nat_callforwarding = rcu_dereference(nat_callforwarding_hook)) &&
+            nf_ct_l3num(ct) == NFPROTO_IPV4 &&
             ct->status & IPS_NAT_MASK) {
                 /* Need NAT */
-                ret = nat_callforwarding(skb, ct, ctinfo, data, dataoff,
+                ret = nat_callforwarding(skb, ct, ctinfo,
+                                         protoff, data, dataoff,
                                          taddr, port, exp);
         } else {                /* Conntrack only */
                 if (nf_ct_expect_related(exp) == 0) {
@@ -831,6 +854,7 @@ static int expect_callforwarding(struct sk_buff *skb,
 /****************************************************************************/
 static int process_setup(struct sk_buff *skb, struct nf_conn *ct,
                          enum ip_conntrack_info ctinfo,
+                         unsigned int protoff,
                          unsigned char **data, int dataoff,
                          Setup_UUIE *setup)
 {
@@ -844,7 +868,7 @@ static int process_setup(struct sk_buff *skb, struct nf_conn *ct,
         pr_debug("nf_ct_q931: Setup\n");
 
         if (setup->options & eSetup_UUIE_h245Address) {
-                ret = expect_h245(skb, ct, ctinfo, data, dataoff,
+                ret = expect_h245(skb, ct, ctinfo, protoff, data, dataoff,
                                   &setup->h245Address);
                 if (ret < 0)
                         return -1;
@@ -852,14 +876,15 @@ static int process_setup(struct sk_buff *skb, struct nf_conn *ct,
 
         set_h225_addr = rcu_dereference(set_h225_addr_hook);
         if ((setup->options & eSetup_UUIE_destCallSignalAddress) &&
-            (set_h225_addr) && ct->status & IPS_NAT_MASK &&
+            (set_h225_addr) && nf_ct_l3num(ct) == NFPROTO_IPV4 &&
+            ct->status & IPS_NAT_MASK &&
             get_h225_addr(ct, *data, &setup->destCallSignalAddress,
                           &addr, &port) &&
             memcmp(&addr, &ct->tuplehash[!dir].tuple.src.u3, sizeof(addr))) {
                 pr_debug("nf_ct_q931: set destCallSignalAddress %pI6:%hu->%pI6:%hu\n",
                          &addr, ntohs(port), &ct->tuplehash[!dir].tuple.src.u3,
                          ntohs(ct->tuplehash[!dir].tuple.src.u.tcp.port));
-                ret = set_h225_addr(skb, data, dataoff,
+                ret = set_h225_addr(skb, protoff, data, dataoff,
                                     &setup->destCallSignalAddress,
                                     &ct->tuplehash[!dir].tuple.src.u3,
                                     ct->tuplehash[!dir].tuple.src.u.tcp.port);
@@ -868,14 +893,15 @@ static int process_setup(struct sk_buff *skb, struct nf_conn *ct,
         }
 
         if ((setup->options & eSetup_UUIE_sourceCallSignalAddress) &&
-            (set_h225_addr) && ct->status & IPS_NAT_MASK &&
+            (set_h225_addr) && nf_ct_l3num(ct) == NFPROTO_IPV4 &&
+            ct->status & IPS_NAT_MASK &&
             get_h225_addr(ct, *data, &setup->sourceCallSignalAddress,
                           &addr, &port) &&
             memcmp(&addr, &ct->tuplehash[!dir].tuple.dst.u3, sizeof(addr))) {
                 pr_debug("nf_ct_q931: set sourceCallSignalAddress %pI6:%hu->%pI6:%hu\n",
                          &addr, ntohs(port), &ct->tuplehash[!dir].tuple.dst.u3,
                          ntohs(ct->tuplehash[!dir].tuple.dst.u.tcp.port));
-                ret = set_h225_addr(skb, data, dataoff,
+                ret = set_h225_addr(skb, protoff, data, dataoff,
                                     &setup->sourceCallSignalAddress,
                                     &ct->tuplehash[!dir].tuple.dst.u3,
                                     ct->tuplehash[!dir].tuple.dst.u.tcp.port);
@@ -885,7 +911,8 @@ static int process_setup(struct sk_buff *skb, struct nf_conn *ct,
 
         if (setup->options & eSetup_UUIE_fastStart) {
                 for (i = 0; i < setup->fastStart.count; i++) {
-                        ret = process_olc(skb, ct, ctinfo, data, dataoff,
+                        ret = process_olc(skb, ct, ctinfo,
+                                          protoff, data, dataoff,
                                           &setup->fastStart.item[i]);
                         if (ret < 0)
                                 return -1;
@@ -899,6 +926,7 @@ static int process_setup(struct sk_buff *skb, struct nf_conn *ct,
 static int process_callproceeding(struct sk_buff *skb,
                                   struct nf_conn *ct,
                                   enum ip_conntrack_info ctinfo,
+                                  unsigned int protoff,
                                   unsigned char **data, int dataoff,
                                   CallProceeding_UUIE *callproc)
 {
@@ -908,7 +936,7 @@ static int process_callproceeding(struct sk_buff *skb,
         pr_debug("nf_ct_q931: CallProceeding\n");
 
         if (callproc->options & eCallProceeding_UUIE_h245Address) {
-                ret = expect_h245(skb, ct, ctinfo, data, dataoff,
+                ret = expect_h245(skb, ct, ctinfo, protoff, data, dataoff,
                                   &callproc->h245Address);
                 if (ret < 0)
                         return -1;
@@ -916,7 +944,8 @@ static int process_callproceeding(struct sk_buff *skb,
 
         if (callproc->options & eCallProceeding_UUIE_fastStart) {
                 for (i = 0; i < callproc->fastStart.count; i++) {
-                        ret = process_olc(skb, ct, ctinfo, data, dataoff,
+                        ret = process_olc(skb, ct, ctinfo,
+                                          protoff, data, dataoff,
                                           &callproc->fastStart.item[i]);
                         if (ret < 0)
                                 return -1;
@@ -929,6 +958,7 @@ static int process_callproceeding(struct sk_buff *skb,
 /****************************************************************************/
 static int process_connect(struct sk_buff *skb, struct nf_conn *ct,
                            enum ip_conntrack_info ctinfo,
+                           unsigned int protoff,
                            unsigned char **data, int dataoff,
                            Connect_UUIE *connect)
 {
@@ -938,7 +968,7 @@ static int process_connect(struct sk_buff *skb, struct nf_conn *ct,
         pr_debug("nf_ct_q931: Connect\n");
 
         if (connect->options & eConnect_UUIE_h245Address) {
-                ret = expect_h245(skb, ct, ctinfo, data, dataoff,
+                ret = expect_h245(skb, ct, ctinfo, protoff, data, dataoff,
                                   &connect->h245Address);
                 if (ret < 0)
                         return -1;
@@ -946,7 +976,8 @@ static int process_connect(struct sk_buff *skb, struct nf_conn *ct,
 
         if (connect->options & eConnect_UUIE_fastStart) {
                 for (i = 0; i < connect->fastStart.count; i++) {
-                        ret = process_olc(skb, ct, ctinfo, data, dataoff,
+                        ret = process_olc(skb, ct, ctinfo,
+                                          protoff, data, dataoff,
                                           &connect->fastStart.item[i]);
                         if (ret < 0)
                                 return -1;
@@ -959,6 +990,7 @@ static int process_connect(struct sk_buff *skb, struct nf_conn *ct,
 /****************************************************************************/
 static int process_alerting(struct sk_buff *skb, struct nf_conn *ct,
                             enum ip_conntrack_info ctinfo,
+                            unsigned int protoff,
                             unsigned char **data, int dataoff,
                             Alerting_UUIE *alert)
 {
@@ -968,7 +1000,7 @@ static int process_alerting(struct sk_buff *skb, struct nf_conn *ct,
         pr_debug("nf_ct_q931: Alerting\n");
 
         if (alert->options & eAlerting_UUIE_h245Address) {
-                ret = expect_h245(skb, ct, ctinfo, data, dataoff,
+                ret = expect_h245(skb, ct, ctinfo, protoff, data, dataoff,
                                   &alert->h245Address);
                 if (ret < 0)
                         return -1;
@@ -976,7 +1008,8 @@ static int process_alerting(struct sk_buff *skb, struct nf_conn *ct,
 
         if (alert->options & eAlerting_UUIE_fastStart) {
                 for (i = 0; i < alert->fastStart.count; i++) {
-                        ret = process_olc(skb, ct, ctinfo, data, dataoff,
+                        ret = process_olc(skb, ct, ctinfo,
+                                          protoff, data, dataoff,
                                           &alert->fastStart.item[i]);
                         if (ret < 0)
                                 return -1;
@@ -989,6 +1022,7 @@ static int process_alerting(struct sk_buff *skb, struct nf_conn *ct,
 /****************************************************************************/
 static int process_facility(struct sk_buff *skb, struct nf_conn *ct,
                             enum ip_conntrack_info ctinfo,
+                            unsigned int protoff,
                             unsigned char **data, int dataoff,
                             Facility_UUIE *facility)
 {
@@ -999,15 +1033,15 @@ static int process_facility(struct sk_buff *skb, struct nf_conn *ct,
 
         if (facility->reason.choice == eFacilityReason_callForwarded) {
                 if (facility->options & eFacility_UUIE_alternativeAddress)
-                        return expect_callforwarding(skb, ct, ctinfo, data,
-                                                     dataoff,
+                        return expect_callforwarding(skb, ct, ctinfo,
+                                                     protoff, data, dataoff,
                                                      &facility->
                                                      alternativeAddress);
                 return 0;
         }
 
         if (facility->options & eFacility_UUIE_h245Address) {
-                ret = expect_h245(skb, ct, ctinfo, data, dataoff,
+                ret = expect_h245(skb, ct, ctinfo, protoff, data, dataoff,
                                   &facility->h245Address);
                 if (ret < 0)
                         return -1;
@@ -1015,7 +1049,8 @@ static int process_facility(struct sk_buff *skb, struct nf_conn *ct,
 
         if (facility->options & eFacility_UUIE_fastStart) {
                 for (i = 0; i < facility->fastStart.count; i++) {
-                        ret = process_olc(skb, ct, ctinfo, data, dataoff,
+                        ret = process_olc(skb, ct, ctinfo,
+                                          protoff, data, dataoff,
                                           &facility->fastStart.item[i]);
                         if (ret < 0)
                                 return -1;
@@ -1028,6 +1063,7 @@ static int process_facility(struct sk_buff *skb, struct nf_conn *ct,
 /****************************************************************************/
 static int process_progress(struct sk_buff *skb, struct nf_conn *ct,
                             enum ip_conntrack_info ctinfo,
+                            unsigned int protoff,
                             unsigned char **data, int dataoff,
                             Progress_UUIE *progress)
 {
@@ -1037,7 +1073,7 @@ static int process_progress(struct sk_buff *skb, struct nf_conn *ct,
         pr_debug("nf_ct_q931: Progress\n");
 
         if (progress->options & eProgress_UUIE_h245Address) {
-                ret = expect_h245(skb, ct, ctinfo, data, dataoff,
+                ret = expect_h245(skb, ct, ctinfo, protoff, data, dataoff,
                                   &progress->h245Address);
                 if (ret < 0)
                         return -1;
@@ -1045,7 +1081,8 @@ static int process_progress(struct sk_buff *skb, struct nf_conn *ct,
 
         if (progress->options & eProgress_UUIE_fastStart) {
                 for (i = 0; i < progress->fastStart.count; i++) {
-                        ret = process_olc(skb, ct, ctinfo, data, dataoff,
+                        ret = process_olc(skb, ct, ctinfo,
+                                          protoff, data, dataoff,
                                           &progress->fastStart.item[i]);
                         if (ret < 0)
                                 return -1;
@@ -1058,7 +1095,8 @@ static int process_progress(struct sk_buff *skb, struct nf_conn *ct,
 /****************************************************************************/
 static int process_q931(struct sk_buff *skb, struct nf_conn *ct,
                         enum ip_conntrack_info ctinfo,
-                        unsigned char **data, int dataoff, Q931 *q931)
+                        unsigned int protoff, unsigned char **data, int dataoff,
+                        Q931 *q931)
 {
         H323_UU_PDU *pdu = &q931->UUIE.h323_uu_pdu;
         int i;
@@ -1066,28 +1104,29 @@ static int process_q931(struct sk_buff *skb, struct nf_conn *ct,
 
         switch (pdu->h323_message_body.choice) {
         case eH323_UU_PDU_h323_message_body_setup:
-                ret = process_setup(skb, ct, ctinfo, data, dataoff,
+                ret = process_setup(skb, ct, ctinfo, protoff, data, dataoff,
                                     &pdu->h323_message_body.setup);
                 break;
         case eH323_UU_PDU_h323_message_body_callProceeding:
-                ret = process_callproceeding(skb, ct, ctinfo, data, dataoff,
+                ret = process_callproceeding(skb, ct, ctinfo,
+                                             protoff, data, dataoff,
                                              &pdu->h323_message_body.
                                              callProceeding);
                 break;
         case eH323_UU_PDU_h323_message_body_connect:
-                ret = process_connect(skb, ct, ctinfo, data, dataoff,
+                ret = process_connect(skb, ct, ctinfo, protoff, data, dataoff,
                                       &pdu->h323_message_body.connect);
                 break;
         case eH323_UU_PDU_h323_message_body_alerting:
-                ret = process_alerting(skb, ct, ctinfo, data, dataoff,
+                ret = process_alerting(skb, ct, ctinfo, protoff, data, dataoff,
                                        &pdu->h323_message_body.alerting);
                 break;
         case eH323_UU_PDU_h323_message_body_facility:
-                ret = process_facility(skb, ct, ctinfo, data, dataoff,
+                ret = process_facility(skb, ct, ctinfo, protoff, data, dataoff,
                                        &pdu->h323_message_body.facility);
                 break;
         case eH323_UU_PDU_h323_message_body_progress:
-                ret = process_progress(skb, ct, ctinfo, data, dataoff,
+                ret = process_progress(skb, ct, ctinfo, protoff, data, dataoff,
                                        &pdu->h323_message_body.progress);
                 break;
         default:
@@ -1101,7 +1140,8 @@ static int process_q931(struct sk_buff *skb, struct nf_conn *ct,
 
         if (pdu->options & eH323_UU_PDU_h245Control) {
                 for (i = 0; i < pdu->h245Control.count; i++) {
-                        ret = process_h245(skb, ct, ctinfo, data, dataoff,
+                        ret = process_h245(skb, ct, ctinfo,
+                                           protoff, data, dataoff,
                                            &pdu->h245Control.item[i]);
                         if (ret < 0)
                                 return -1;
@@ -1146,7 +1186,8 @@ static int q931_help(struct sk_buff *skb, unsigned int protoff,
                 }
 
                 /* Process Q.931 signal */
-                if (process_q931(skb, ct, ctinfo, &data, dataoff, &q931) < 0)
+                if (process_q931(skb, ct, ctinfo, protoff,
+                                 &data, dataoff, &q931) < 0)
                         goto drop;
         }
 
@@ -1243,7 +1284,7 @@ static int set_expect_timeout(struct nf_conntrack_expect *exp,
 /****************************************************************************/
 static int expect_q931(struct sk_buff *skb, struct nf_conn *ct,
                        enum ip_conntrack_info ctinfo,
-                       unsigned char **data,
+                       unsigned int protoff, unsigned char **data,
                        TransportAddress *taddr, int count)
 {
         struct nf_ct_h323_master *info = nfct_help_data(ct);
@@ -1278,8 +1319,10 @@ static int expect_q931(struct sk_buff *skb, struct nf_conn *ct,
         exp->flags = NF_CT_EXPECT_PERMANENT;    /* Accept multiple calls */
 
         nat_q931 = rcu_dereference(nat_q931_hook);
-        if (nat_q931 && ct->status & IPS_NAT_MASK) {    /* Need NAT */
-                ret = nat_q931(skb, ct, ctinfo, data, taddr, i, port, exp);
+        if (nat_q931 && nf_ct_l3num(ct) == NFPROTO_IPV4 &&
+            ct->status & IPS_NAT_MASK) {        /* Need NAT */
+                ret = nat_q931(skb, ct, ctinfo, protoff, data,
+                               taddr, i, port, exp);
         } else {                /* Conntrack only */
                 if (nf_ct_expect_related(exp) == 0) {
                         pr_debug("nf_ct_ras: expect Q.931 ");
@@ -1299,6 +1342,7 @@ static int expect_q931(struct sk_buff *skb, struct nf_conn *ct,
 /****************************************************************************/
 static int process_grq(struct sk_buff *skb, struct nf_conn *ct,
                        enum ip_conntrack_info ctinfo,
+                       unsigned int protoff,
                        unsigned char **data, GatekeeperRequest *grq)
 {
         typeof(set_ras_addr_hook) set_ras_addr;
@@ -1306,8 +1350,9 @@ static int process_grq(struct sk_buff *skb, struct nf_conn *ct,
         pr_debug("nf_ct_ras: GRQ\n");
 
         set_ras_addr = rcu_dereference(set_ras_addr_hook);
-        if (set_ras_addr && ct->status & IPS_NAT_MASK)  /* NATed */
-                return set_ras_addr(skb, ct, ctinfo, data,
+        if (set_ras_addr && nf_ct_l3num(ct) == NFPROTO_IPV4 &&
+            ct->status & IPS_NAT_MASK)  /* NATed */
+                return set_ras_addr(skb, ct, ctinfo, protoff, data,
                                     &grq->rasAddress, 1);
         return 0;
 }
@@ -1315,6 +1360,7 @@ static int process_grq(struct sk_buff *skb, struct nf_conn *ct,
 /****************************************************************************/
 static int process_gcf(struct sk_buff *skb, struct nf_conn *ct,
                        enum ip_conntrack_info ctinfo,
+                       unsigned int protoff,
                        unsigned char **data, GatekeeperConfirm *gcf)
 {
         int dir = CTINFO2DIR(ctinfo);
@@ -1359,6 +1405,7 @@ static int process_gcf(struct sk_buff *skb, struct nf_conn *ct,
 /****************************************************************************/
 static int process_rrq(struct sk_buff *skb, struct nf_conn *ct,
                        enum ip_conntrack_info ctinfo,
+                       unsigned int protoff,
                        unsigned char **data, RegistrationRequest *rrq)
 {
         struct nf_ct_h323_master *info = nfct_help_data(ct);
@@ -1367,15 +1414,16 @@ static int process_rrq(struct sk_buff *skb, struct nf_conn *ct,
 
         pr_debug("nf_ct_ras: RRQ\n");
 
-        ret = expect_q931(skb, ct, ctinfo, data,
+        ret = expect_q931(skb, ct, ctinfo, protoff, data,
                           rrq->callSignalAddress.item,
                           rrq->callSignalAddress.count);
         if (ret < 0)
                 return -1;
 
         set_ras_addr = rcu_dereference(set_ras_addr_hook);
-        if (set_ras_addr && ct->status & IPS_NAT_MASK) {
-                ret = set_ras_addr(skb, ct, ctinfo, data,
+        if (set_ras_addr && nf_ct_l3num(ct) == NFPROTO_IPV4 &&
+            ct->status & IPS_NAT_MASK) {
+                ret = set_ras_addr(skb, ct, ctinfo, protoff, data,
                                    rrq->rasAddress.item,
                                    rrq->rasAddress.count);
                 if (ret < 0)
@@ -1394,6 +1442,7 @@ static int process_rrq(struct sk_buff *skb, struct nf_conn *ct,
 /****************************************************************************/
 static int process_rcf(struct sk_buff *skb, struct nf_conn *ct,
                        enum ip_conntrack_info ctinfo,
+                       unsigned int protoff,
                        unsigned char **data, RegistrationConfirm *rcf)
 {
         struct nf_ct_h323_master *info = nfct_help_data(ct);
@@ -1405,8 +1454,9 @@ static int process_rcf(struct sk_buff *skb, struct nf_conn *ct,
         pr_debug("nf_ct_ras: RCF\n");
 
         set_sig_addr = rcu_dereference(set_sig_addr_hook);
-        if (set_sig_addr && ct->status & IPS_NAT_MASK) {
-                ret = set_sig_addr(skb, ct, ctinfo, data,
+        if (set_sig_addr && nf_ct_l3num(ct) == NFPROTO_IPV4 &&
+            ct->status & IPS_NAT_MASK) {
+                ret = set_sig_addr(skb, ct, ctinfo, protoff, data,
                                         rcf->callSignalAddress.item,
                                         rcf->callSignalAddress.count);
                 if (ret < 0)
@@ -1443,6 +1493,7 @@ static int process_rcf(struct sk_buff *skb, struct nf_conn *ct,
 /****************************************************************************/
 static int process_urq(struct sk_buff *skb, struct nf_conn *ct,
                        enum ip_conntrack_info ctinfo,
+                       unsigned int protoff,
                        unsigned char **data, UnregistrationRequest *urq)
 {
         struct nf_ct_h323_master *info = nfct_help_data(ct);
@@ -1453,8 +1504,9 @@ static int process_urq(struct sk_buff *skb, struct nf_conn *ct,
         pr_debug("nf_ct_ras: URQ\n");
 
         set_sig_addr = rcu_dereference(set_sig_addr_hook);
-        if (set_sig_addr && ct->status & IPS_NAT_MASK) {
-                ret = set_sig_addr(skb, ct, ctinfo, data,
+        if (set_sig_addr && nf_ct_l3num(ct) == NFPROTO_IPV4 &&
+            ct->status & IPS_NAT_MASK) {
+                ret = set_sig_addr(skb, ct, ctinfo, protoff, data,
                                    urq->callSignalAddress.item,
                                    urq->callSignalAddress.count);
                 if (ret < 0)
@@ -1475,6 +1527,7 @@ static int process_urq(struct sk_buff *skb, struct nf_conn *ct,
 /****************************************************************************/
 static int process_arq(struct sk_buff *skb, struct nf_conn *ct,
                        enum ip_conntrack_info ctinfo,
+                       unsigned int protoff,
                        unsigned char **data, AdmissionRequest *arq)
 {
         const struct nf_ct_h323_master *info = nfct_help_data(ct);
@@ -1491,9 +1544,10 @@ static int process_arq(struct sk_buff *skb, struct nf_conn *ct,
                           &addr, &port) &&
             !memcmp(&addr, &ct->tuplehash[dir].tuple.src.u3, sizeof(addr)) &&
             port == info->sig_port[dir] &&
+            nf_ct_l3num(ct) == NFPROTO_IPV4 &&
             set_h225_addr && ct->status & IPS_NAT_MASK) {
                 /* Answering ARQ */
-                return set_h225_addr(skb, data, 0,
+                return set_h225_addr(skb, protoff, data, 0,
                                      &arq->destCallSignalAddress,
                                      &ct->tuplehash[!dir].tuple.dst.u3,
                                      info->sig_port[!dir]);
@@ -1503,9 +1557,10 @@ static int process_arq(struct sk_buff *skb, struct nf_conn *ct,
             get_h225_addr(ct, *data, &arq->srcCallSignalAddress,
                           &addr, &port) &&
             !memcmp(&addr, &ct->tuplehash[dir].tuple.src.u3, sizeof(addr)) &&
-            set_h225_addr && ct->status & IPS_NAT_MASK) {
+            set_h225_addr && nf_ct_l3num(ct) == NFPROTO_IPV4 &&
+            ct->status & IPS_NAT_MASK) {
                 /* Calling ARQ */
-                return set_h225_addr(skb, data, 0,
+                return set_h225_addr(skb, protoff, data, 0,
                                      &arq->srcCallSignalAddress,
                                      &ct->tuplehash[!dir].tuple.dst.u3,
                                      port);
@@ -1517,6 +1572,7 @@ static int process_arq(struct sk_buff *skb, struct nf_conn *ct,
 /****************************************************************************/
 static int process_acf(struct sk_buff *skb, struct nf_conn *ct,
                        enum ip_conntrack_info ctinfo,
+                       unsigned int protoff,
                        unsigned char **data, AdmissionConfirm *acf)
 {
         int dir = CTINFO2DIR(ctinfo);
@@ -1535,8 +1591,9 @@ static int process_acf(struct sk_buff *skb, struct nf_conn *ct,
         if (!memcmp(&addr, &ct->tuplehash[dir].tuple.dst.u3, sizeof(addr))) {
                 /* Answering ACF */
                 set_sig_addr = rcu_dereference(set_sig_addr_hook);
-                if (set_sig_addr && ct->status & IPS_NAT_MASK)
-                        return set_sig_addr(skb, ct, ctinfo, data,
+                if (set_sig_addr && nf_ct_l3num(ct) == NFPROTO_IPV4 &&
+                    ct->status & IPS_NAT_MASK)
+                        return set_sig_addr(skb, ct, ctinfo, protoff, data,
                                             &acf->destCallSignalAddress, 1);
                 return 0;
         }
@@ -1564,6 +1621,7 @@ static int process_acf(struct sk_buff *skb, struct nf_conn *ct,
 /****************************************************************************/
 static int process_lrq(struct sk_buff *skb, struct nf_conn *ct,
                        enum ip_conntrack_info ctinfo,
+                       unsigned int protoff,
                        unsigned char **data, LocationRequest *lrq)
 {
         typeof(set_ras_addr_hook) set_ras_addr;
@@ -1571,8 +1629,9 @@ static int process_lrq(struct sk_buff *skb, struct nf_conn *ct,
         pr_debug("nf_ct_ras: LRQ\n");
 
         set_ras_addr = rcu_dereference(set_ras_addr_hook);
-        if (set_ras_addr && ct->status & IPS_NAT_MASK)
-                return set_ras_addr(skb, ct, ctinfo, data,
+        if (set_ras_addr && nf_ct_l3num(ct) == NFPROTO_IPV4 &&
+            ct->status & IPS_NAT_MASK)
+                return set_ras_addr(skb, ct, ctinfo, protoff, data,
                                     &lrq->replyAddress, 1);
         return 0;
 }
@@ -1580,6 +1639,7 @@ static int process_lrq(struct sk_buff *skb, struct nf_conn *ct,
 /****************************************************************************/
 static int process_lcf(struct sk_buff *skb, struct nf_conn *ct,
                        enum ip_conntrack_info ctinfo,
+                       unsigned int protoff,
                        unsigned char **data, LocationConfirm *lcf)
 {
         int dir = CTINFO2DIR(ctinfo);
@@ -1619,6 +1679,7 @@ static int process_lcf(struct sk_buff *skb, struct nf_conn *ct,
 /****************************************************************************/
 static int process_irr(struct sk_buff *skb, struct nf_conn *ct,
                        enum ip_conntrack_info ctinfo,
+                       unsigned int protoff,
                        unsigned char **data, InfoRequestResponse *irr)
 {
         int ret;
@@ -1628,16 +1689,18 @@ static int process_irr(struct sk_buff *skb, struct nf_conn *ct,
         pr_debug("nf_ct_ras: IRR\n");
 
         set_ras_addr = rcu_dereference(set_ras_addr_hook);
-        if (set_ras_addr && ct->status & IPS_NAT_MASK) {
-                ret = set_ras_addr(skb, ct, ctinfo, data,
+        if (set_ras_addr && nf_ct_l3num(ct) == NFPROTO_IPV4 &&
+            ct->status & IPS_NAT_MASK) {
+                ret = set_ras_addr(skb, ct, ctinfo, protoff, data,
                                    &irr->rasAddress, 1);
                 if (ret < 0)
                         return -1;
         }
 
         set_sig_addr = rcu_dereference(set_sig_addr_hook);
-        if (set_sig_addr && ct->status & IPS_NAT_MASK) {
-                ret = set_sig_addr(skb, ct, ctinfo, data,
+        if (set_sig_addr && nf_ct_l3num(ct) == NFPROTO_IPV4 &&
+            ct->status & IPS_NAT_MASK) {
+                ret = set_sig_addr(skb, ct, ctinfo, protoff, data,
                                         irr->callSignalAddress.item,
                                         irr->callSignalAddress.count);
                 if (ret < 0)
@@ -1650,38 +1713,39 @@ static int process_irr(struct sk_buff *skb, struct nf_conn *ct,
 /****************************************************************************/
 static int process_ras(struct sk_buff *skb, struct nf_conn *ct,
                        enum ip_conntrack_info ctinfo,
+                       unsigned int protoff,
                        unsigned char **data, RasMessage *ras)
 {
         switch (ras->choice) {
         case eRasMessage_gatekeeperRequest:
-                return process_grq(skb, ct, ctinfo, data,
+                return process_grq(skb, ct, ctinfo, protoff, data,
                                    &ras->gatekeeperRequest);
         case eRasMessage_gatekeeperConfirm:
-                return process_gcf(skb, ct, ctinfo, data,
+                return process_gcf(skb, ct, ctinfo, protoff, data,
                                    &ras->gatekeeperConfirm);
         case eRasMessage_registrationRequest:
-                return process_rrq(skb, ct, ctinfo, data,
+                return process_rrq(skb, ct, ctinfo, protoff, data,
                                    &ras->registrationRequest);
         case eRasMessage_registrationConfirm:
-                return process_rcf(skb, ct, ctinfo, data,
+                return process_rcf(skb, ct, ctinfo, protoff, data,
                                    &ras->registrationConfirm);
         case eRasMessage_unregistrationRequest:
-                return process_urq(skb, ct, ctinfo, data,
+                return process_urq(skb, ct, ctinfo, protoff, data,
                                    &ras->unregistrationRequest);
         case eRasMessage_admissionRequest:
-                return process_arq(skb, ct, ctinfo, data,
+                return process_arq(skb, ct, ctinfo, protoff, data,
                                    &ras->admissionRequest);
         case eRasMessage_admissionConfirm:
-                return process_acf(skb, ct, ctinfo, data,
+                return process_acf(skb, ct, ctinfo, protoff, data,
                                    &ras->admissionConfirm);
         case eRasMessage_locationRequest:
-                return process_lrq(skb, ct, ctinfo, data,
+                return process_lrq(skb, ct, ctinfo, protoff, data,
                                    &ras->locationRequest);
         case eRasMessage_locationConfirm:
-                return process_lcf(skb, ct, ctinfo, data,
+                return process_lcf(skb, ct, ctinfo, protoff, data,
                                    &ras->locationConfirm);
         case eRasMessage_infoRequestResponse:
-                return process_irr(skb, ct, ctinfo, data,
+                return process_irr(skb, ct, ctinfo, protoff, data,
                                    &ras->infoRequestResponse);
         default:
                 pr_debug("nf_ct_ras: RAS message %d\n", ras->choice);
@@ -1721,7 +1785,7 @@ static int ras_help(struct sk_buff *skb, unsigned int protoff,
         }
 
         /* Process RAS message */
-        if (process_ras(skb, ct, ctinfo, &data, &ras) < 0)
+        if (process_ras(skb, ct, ctinfo, protoff, &data, &ras) < 0)
                 goto drop;
 
       accept:
diff --git a/net/netfilter/nf_conntrack_irc.c b/net/netfilter/nf_conntrack_irc.c
index 009c52cfd1ec..3b20aa77cfc8 100644
--- a/net/netfilter/nf_conntrack_irc.c
+++ b/net/netfilter/nf_conntrack_irc.c
@@ -33,6 +33,7 @@ static DEFINE_SPINLOCK(irc_buffer_lock);
 
 unsigned int (*nf_nat_irc_hook)(struct sk_buff *skb,
                                 enum ip_conntrack_info ctinfo,
+                                unsigned int protoff,
                                 unsigned int matchoff,
                                 unsigned int matchlen,
                                 struct nf_conntrack_expect *exp) __read_mostly;
@@ -205,7 +206,7 @@ static int help(struct sk_buff *skb, unsigned int protoff,
 
                         nf_nat_irc = rcu_dereference(nf_nat_irc_hook);
                         if (nf_nat_irc && ct->status & IPS_NAT_MASK)
-                                ret = nf_nat_irc(skb, ctinfo,
+                                ret = nf_nat_irc(skb, ctinfo, protoff,
                                                  addr_beg_p - ib_ptr,
                                                  addr_end_p - addr_beg_p,
                                                  exp);
diff --git a/net/netfilter/nf_conntrack_netlink.c b/net/netfilter/nf_conntrack_netlink.c
index 14f67a2cbcb5..a205bd6ce294 100644
--- a/net/netfilter/nf_conntrack_netlink.c
+++ b/net/netfilter/nf_conntrack_netlink.c
@@ -45,7 +45,7 @@
 #include <net/netfilter/nf_conntrack_timestamp.h>
 #ifdef CONFIG_NF_NAT_NEEDED
 #include <net/netfilter/nf_nat_core.h>
-#include <net/netfilter/nf_nat_protocol.h>
+#include <net/netfilter/nf_nat_l4proto.h>
 #include <net/netfilter/nf_nat_helper.h>
 #endif
 
@@ -1096,13 +1096,14 @@ ctnetlink_parse_nat_setup(struct nf_conn *ct,
                           const struct nlattr *attr)
 {
         typeof(nfnetlink_parse_nat_setup_hook) parse_nat_setup;
+        int err;
 
         parse_nat_setup = rcu_dereference(nfnetlink_parse_nat_setup_hook);
         if (!parse_nat_setup) {
 #ifdef CONFIG_MODULES
                 rcu_read_unlock();
                 nfnl_unlock();
-                if (request_module("nf-nat-ipv4") < 0) {
+                if (request_module("nf-nat") < 0) {
                         nfnl_lock();
                         rcu_read_lock();
                         return -EOPNOTSUPP;
@@ -1115,7 +1116,26 @@ ctnetlink_parse_nat_setup(struct nf_conn *ct,
                 return -EOPNOTSUPP;
         }
 
-        return parse_nat_setup(ct, manip, attr);
+        err = parse_nat_setup(ct, manip, attr);
+        if (err == -EAGAIN) {
+#ifdef CONFIG_MODULES
+                rcu_read_unlock();
+                spin_unlock_bh(&nf_conntrack_lock);
+                nfnl_unlock();
+                if (request_module("nf-nat-%u", nf_ct_l3num(ct)) < 0) {
+                        nfnl_lock();
+                        spin_lock_bh(&nf_conntrack_lock);
+                        rcu_read_lock();
+                        return -EOPNOTSUPP;
+                }
+                nfnl_lock();
+                spin_lock_bh(&nf_conntrack_lock);
+                rcu_read_lock();
+#else
+                err = -EOPNOTSUPP;
+#endif
+        }
+        return err;
 }
 #endif
 
@@ -1896,10 +1916,15 @@ static int
 ctnetlink_nfqueue_parse(const struct nlattr *attr, struct nf_conn *ct)
 {
         struct nlattr *cda[CTA_MAX+1];
+        int ret;
 
         nla_parse_nested(cda, CTA_MAX, attr, ct_nla_policy);
 
-        return ctnetlink_nfqueue_parse_ct((const struct nlattr **)cda, ct);
+        spin_lock_bh(&nf_conntrack_lock);
+        ret = ctnetlink_nfqueue_parse_ct((const struct nlattr **)cda, ct);
+        spin_unlock_bh(&nf_conntrack_lock);
+
+        return ret;
 }
 
 static struct nfq_ct_hook ctnetlink_nfqueue_hook = {
@@ -1974,6 +1999,8 @@ nla_put_failure:
         return -1;
 }
 
+static const union nf_inet_addr any_addr;
+
 static int
 ctnetlink_exp_dump_expect(struct sk_buff *skb,
                           const struct nf_conntrack_expect *exp)
@@ -2000,7 +2027,8 @@ ctnetlink_exp_dump_expect(struct sk_buff *skb,
                 goto nla_put_failure;
 
 #ifdef CONFIG_NF_NAT_NEEDED
-        if (exp->saved_ip || exp->saved_proto.all) {
+        if (!nf_inet_addr_cmp(&exp->saved_addr, &any_addr) ||
+            exp->saved_proto.all) {
                 nest_parms = nla_nest_start(skb, CTA_EXPECT_NAT | NLA_F_NESTED);
                 if (!nest_parms)
                         goto nla_put_failure;
@@ -2009,7 +2037,7 @@ ctnetlink_exp_dump_expect(struct sk_buff *skb,
                         goto nla_put_failure;
 
                 nat_tuple.src.l3num = nf_ct_l3num(master);
-                nat_tuple.src.u3.ip = exp->saved_ip;
+                nat_tuple.src.u3 = exp->saved_addr;
                 nat_tuple.dst.protonum = nf_ct_protonum(master);
                 nat_tuple.src.u = exp->saved_proto;
 
@@ -2405,7 +2433,7 @@ ctnetlink_parse_expect_nat(const struct nlattr *attr,
         if (err < 0)
                 return err;
 
-        exp->saved_ip = nat_tuple.src.u3.ip;
+        exp->saved_addr = nat_tuple.src.u3;
         exp->saved_proto = nat_tuple.src.u;
         exp->dir = ntohl(nla_get_be32(tb[CTA_EXPECT_NAT_DIR]));
 
@@ -2785,7 +2813,8 @@ static int __init ctnetlink_init(void)
                 goto err_unreg_subsys;
         }
 
-        if (register_pernet_subsys(&ctnetlink_net_ops)) {
+        ret = register_pernet_subsys(&ctnetlink_net_ops);
+        if (ret < 0) {
                 pr_err("ctnetlink_init: cannot register pernet operations\n");
                 goto err_unreg_exp_subsys;
         }
diff --git a/net/netfilter/nf_conntrack_pptp.c b/net/netfilter/nf_conntrack_pptp.c
index 6fed9ec35248..cc7669ef0b95 100644
--- a/net/netfilter/nf_conntrack_pptp.c
+++ b/net/netfilter/nf_conntrack_pptp.c
@@ -45,14 +45,14 @@ static DEFINE_SPINLOCK(nf_pptp_lock);
 int
 (*nf_nat_pptp_hook_outbound)(struct sk_buff *skb,
                              struct nf_conn *ct, enum ip_conntrack_info ctinfo,
-                             struct PptpControlHeader *ctlh,
+                             unsigned int protoff, struct PptpControlHeader *ctlh,
                              union pptp_ctrl_union *pptpReq) __read_mostly;
 EXPORT_SYMBOL_GPL(nf_nat_pptp_hook_outbound);
 
 int
 (*nf_nat_pptp_hook_inbound)(struct sk_buff *skb,
                             struct nf_conn *ct, enum ip_conntrack_info ctinfo,
-                            struct PptpControlHeader *ctlh,
+                            unsigned int protoff, struct PptpControlHeader *ctlh,
                             union pptp_ctrl_union *pptpReq) __read_mostly;
 EXPORT_SYMBOL_GPL(nf_nat_pptp_hook_inbound);
 
@@ -262,7 +262,7 @@ out_unexpect_orig:
 }
 
 static inline int
-pptp_inbound_pkt(struct sk_buff *skb,
+pptp_inbound_pkt(struct sk_buff *skb, unsigned int protoff,
                  struct PptpControlHeader *ctlh,
                  union pptp_ctrl_union *pptpReq,
                  unsigned int reqlen,
@@ -376,7 +376,8 @@ pptp_inbound_pkt(struct sk_buff *skb,
 
         nf_nat_pptp_inbound = rcu_dereference(nf_nat_pptp_hook_inbound);
         if (nf_nat_pptp_inbound && ct->status & IPS_NAT_MASK)
-                return nf_nat_pptp_inbound(skb, ct, ctinfo, ctlh, pptpReq);
+                return nf_nat_pptp_inbound(skb, ct, ctinfo,
+                                           protoff, ctlh, pptpReq);
         return NF_ACCEPT;
 
 invalid:
@@ -389,7 +390,7 @@ invalid:
 }
 
 static inline int
-pptp_outbound_pkt(struct sk_buff *skb,
+pptp_outbound_pkt(struct sk_buff *skb, unsigned int protoff,
                   struct PptpControlHeader *ctlh,
                   union pptp_ctrl_union *pptpReq,
                   unsigned int reqlen,
@@ -471,7 +472,8 @@ pptp_outbound_pkt(struct sk_buff *skb,
 
         nf_nat_pptp_outbound = rcu_dereference(nf_nat_pptp_hook_outbound);
         if (nf_nat_pptp_outbound && ct->status & IPS_NAT_MASK)
-                return nf_nat_pptp_outbound(skb, ct, ctinfo, ctlh, pptpReq);
+                return nf_nat_pptp_outbound(skb, ct, ctinfo,
+                                            protoff, ctlh, pptpReq);
         return NF_ACCEPT;
 
 invalid:
@@ -570,11 +572,11 @@ conntrack_pptp_help(struct sk_buff *skb, unsigned int protoff,
          * established from PNS->PAC.  However, RFC makes no guarantee */
         if (dir == IP_CT_DIR_ORIGINAL)
                 /* client -> server (PNS -> PAC) */
-                ret = pptp_outbound_pkt(skb, ctlh, pptpReq, reqlen, ct,
+                ret = pptp_outbound_pkt(skb, protoff, ctlh, pptpReq, reqlen, ct,
                                         ctinfo);
         else
                 /* server -> client (PAC -> PNS) */
-                ret = pptp_inbound_pkt(skb, ctlh, pptpReq, reqlen, ct,
+                ret = pptp_inbound_pkt(skb, protoff, ctlh, pptpReq, reqlen, ct,
                                        ctinfo);
         pr_debug("sstate: %d->%d, cstate: %d->%d\n",
                  oldsstate, info->sstate, oldcstate, info->cstate);
diff --git a/net/netfilter/nf_conntrack_proto.c b/net/netfilter/nf_conntrack_proto.c
index 0dc63854390f..51e928db48c8 100644
--- a/net/netfilter/nf_conntrack_proto.c
+++ b/net/netfilter/nf_conntrack_proto.c
@@ -21,7 +21,6 @@
 #include <linux/notifier.h>
 #include <linux/kernel.h>
 #include <linux/netdevice.h>
-#include <linux/rtnetlink.h>
 
 #include <net/netfilter/nf_conntrack.h>
 #include <net/netfilter/nf_conntrack_l3proto.h>
@@ -294,9 +293,7 @@ void nf_conntrack_l3proto_unregister(struct net *net,
         nf_ct_l3proto_unregister_sysctl(net, proto);
 
         /* Remove all contrack entries for this protocol */
-        rtnl_lock();
         nf_ct_iterate_cleanup(net, kill_l3proto, proto);
-        rtnl_unlock();
 }
 EXPORT_SYMBOL_GPL(nf_conntrack_l3proto_unregister);
 
@@ -502,9 +499,7 @@ void nf_conntrack_l4proto_unregister(struct net *net,
         nf_ct_l4proto_unregister_sysctl(net, pn, l4proto);
 
         /* Remove all contrack entries for this protocol */
-        rtnl_lock();
         nf_ct_iterate_cleanup(net, kill_l4proto, l4proto);
-        rtnl_unlock();
 }
 EXPORT_SYMBOL_GPL(nf_conntrack_l4proto_unregister);
 
diff --git a/net/netfilter/nf_conntrack_proto_tcp.c b/net/netfilter/nf_conntrack_proto_tcp.c
index a5ac11ebef33..9c2cc716f4a5 100644
--- a/net/netfilter/nf_conntrack_proto_tcp.c
+++ b/net/netfilter/nf_conntrack_proto_tcp.c
@@ -505,10 +505,10 @@ static inline s16 nat_offset(const struct nf_conn *ct,
 
         return get_offset != NULL ? get_offset(ct, dir, seq) : 0;
 }
-#define NAT_OFFSET(pf, ct, dir, seq) \
-        (pf == NFPROTO_IPV4 ? nat_offset(ct, dir, seq) : 0)
+#define NAT_OFFSET(ct, dir, seq) \
+        (nat_offset(ct, dir, seq))
 #else
-#define NAT_OFFSET(pf, ct, dir, seq)    0
+#define NAT_OFFSET(ct, dir, seq)        0
 #endif
 
 static bool tcp_in_window(const struct nf_conn *ct,
@@ -541,7 +541,7 @@ static bool tcp_in_window(const struct nf_conn *ct,
                 tcp_sack(skb, dataoff, tcph, &sack);
 
         /* Take into account NAT sequence number mangling */
-        receiver_offset = NAT_OFFSET(pf, ct, !dir, ack - 1);
+        receiver_offset = NAT_OFFSET(ct, !dir, ack - 1);
         ack -= receiver_offset;
         sack -= receiver_offset;
 
diff --git a/net/netfilter/nf_conntrack_sip.c b/net/netfilter/nf_conntrack_sip.c
index 758a1bacc126..df8f4f284481 100644
--- a/net/netfilter/nf_conntrack_sip.c
+++ b/net/netfilter/nf_conntrack_sip.c
@@ -52,15 +52,17 @@ module_param(sip_direct_media, int, 0600);
 MODULE_PARM_DESC(sip_direct_media, "Expect Media streams between signalling "
                                    "endpoints only (default 1)");
 
-unsigned int (*nf_nat_sip_hook)(struct sk_buff *skb, unsigned int dataoff,
-                                const char **dptr,
+unsigned int (*nf_nat_sip_hook)(struct sk_buff *skb, unsigned int protoff,
+                                unsigned int dataoff, const char **dptr,
                                 unsigned int *datalen) __read_mostly;
 EXPORT_SYMBOL_GPL(nf_nat_sip_hook);
 
-void (*nf_nat_sip_seq_adjust_hook)(struct sk_buff *skb, s16 off) __read_mostly;
+void (*nf_nat_sip_seq_adjust_hook)(struct sk_buff *skb, unsigned int protoff,
+                                   s16 off) __read_mostly;
 EXPORT_SYMBOL_GPL(nf_nat_sip_seq_adjust_hook);
 
 unsigned int (*nf_nat_sip_expect_hook)(struct sk_buff *skb,
+                                       unsigned int protoff,
                                        unsigned int dataoff,
                                        const char **dptr,
                                        unsigned int *datalen,
@@ -69,7 +71,8 @@ unsigned int (*nf_nat_sip_expect_hook)(struct sk_buff *skb,
                                        unsigned int matchlen) __read_mostly;
 EXPORT_SYMBOL_GPL(nf_nat_sip_expect_hook);
 
-unsigned int (*nf_nat_sdp_addr_hook)(struct sk_buff *skb, unsigned int dataoff,
+unsigned int (*nf_nat_sdp_addr_hook)(struct sk_buff *skb, unsigned int protoff,
+                                     unsigned int dataoff,
                                      const char **dptr,
                                      unsigned int *datalen,
                                      unsigned int sdpoff,
@@ -79,7 +82,8 @@ unsigned int (*nf_nat_sdp_addr_hook)(struct sk_buff *skb, unsigned int dataoff,
                                      __read_mostly;
 EXPORT_SYMBOL_GPL(nf_nat_sdp_addr_hook);
 
-unsigned int (*nf_nat_sdp_port_hook)(struct sk_buff *skb, unsigned int dataoff,
+unsigned int (*nf_nat_sdp_port_hook)(struct sk_buff *skb, unsigned int protoff,
+                                     unsigned int dataoff,
                                      const char **dptr,
                                      unsigned int *datalen,
                                      unsigned int matchoff,
@@ -88,6 +92,7 @@ unsigned int (*nf_nat_sdp_port_hook)(struct sk_buff *skb, unsigned int dataoff,
 EXPORT_SYMBOL_GPL(nf_nat_sdp_port_hook);
 
 unsigned int (*nf_nat_sdp_session_hook)(struct sk_buff *skb,
+                                        unsigned int protoff,
                                         unsigned int dataoff,
                                         const char **dptr,
                                         unsigned int *datalen,
@@ -96,7 +101,8 @@ unsigned int (*nf_nat_sdp_session_hook)(struct sk_buff *skb,
                                         __read_mostly;
 EXPORT_SYMBOL_GPL(nf_nat_sdp_session_hook);
 
-unsigned int (*nf_nat_sdp_media_hook)(struct sk_buff *skb, unsigned int dataoff,
+unsigned int (*nf_nat_sdp_media_hook)(struct sk_buff *skb, unsigned int protoff,
+                                      unsigned int dataoff,
                                       const char **dptr,
                                       unsigned int *datalen,
                                       struct nf_conntrack_expect *rtp_exp,
@@ -183,12 +189,12 @@ static int media_len(const struct nf_conn *ct, const char *dptr,
         return len + digits_len(ct, dptr, limit, shift);
 }
 
-static int parse_addr(const struct nf_conn *ct, const char *cp,
-                      const char **endp, union nf_inet_addr *addr,
-                      const char *limit)
+static int sip_parse_addr(const struct nf_conn *ct, const char *cp,
+                          const char **endp, union nf_inet_addr *addr,
+                          const char *limit, bool delim)
 {
         const char *end;
-        int ret = 0;
+        int ret;
 
         if (!ct)
                 return 0;
@@ -197,16 +203,28 @@ static int parse_addr(const struct nf_conn *ct, const char *cp,
         switch (nf_ct_l3num(ct)) {
         case AF_INET:
                 ret = in4_pton(cp, limit - cp, (u8 *)&addr->ip, -1, &end);
+                if (ret == 0)
+                        return 0;
                 break;
         case AF_INET6:
+                if (cp < limit && *cp == '[')
+                        cp++;
+                else if (delim)
+                        return 0;
+
                 ret = in6_pton(cp, limit - cp, (u8 *)&addr->ip6, -1, &end);
+                if (ret == 0)
+                        return 0;
+
+                if (end < limit && *end == ']')
+                        end++;
+                else if (delim)
+                        return 0;
                 break;
         default:
                 BUG();
         }
 
-        if (ret == 0 || end == cp)
-                return 0;
         if (endp)
                 *endp = end;
         return 1;
@@ -219,7 +237,7 @@ static int epaddr_len(const struct nf_conn *ct, const char *dptr,
         union nf_inet_addr addr;
         const char *aux = dptr;
 
-        if (!parse_addr(ct, dptr, &dptr, &addr, limit)) {
+        if (!sip_parse_addr(ct, dptr, &dptr, &addr, limit, true)) {
                 pr_debug("ip: %s parse failed.!\n", dptr);
                 return 0;
         }
@@ -296,7 +314,7 @@ int ct_sip_parse_request(const struct nf_conn *ct,
                 return 0;
         dptr += shift;
 
-        if (!parse_addr(ct, dptr, &end, addr, limit))
+        if (!sip_parse_addr(ct, dptr, &end, addr, limit, true))
                 return -1;
         if (end < limit && *end == ':') {
                 end++;
@@ -550,7 +568,7 @@ int ct_sip_parse_header_uri(const struct nf_conn *ct, const char *dptr,
         if (ret == 0)
                 return ret;
 
-        if (!parse_addr(ct, dptr + *matchoff, &c, addr, limit))
+        if (!sip_parse_addr(ct, dptr + *matchoff, &c, addr, limit, true))
                 return -1;
         if (*c == ':') {
                 c++;
@@ -599,7 +617,7 @@ int ct_sip_parse_address_param(const struct nf_conn *ct, const char *dptr,
                                unsigned int dataoff, unsigned int datalen,
                                const char *name,
                                unsigned int *matchoff, unsigned int *matchlen,
-                               union nf_inet_addr *addr)
+                               union nf_inet_addr *addr, bool delim)
 {
         const char *limit = dptr + datalen;
         const char *start, *end;
@@ -613,7 +631,7 @@ int ct_sip_parse_address_param(const struct nf_conn *ct, const char *dptr,
                 return 0;
 
         start += strlen(name);
-        if (!parse_addr(ct, start, &end, addr, limit))
+        if (!sip_parse_addr(ct, start, &end, addr, limit, delim))
                 return 0;
         *matchoff = start - dptr;
         *matchlen = end - start;
@@ -675,6 +693,47 @@ static int ct_sip_parse_transport(struct nf_conn *ct, const char *dptr,
         return 1;
 }
 
+static int sdp_parse_addr(const struct nf_conn *ct, const char *cp,
+                          const char **endp, union nf_inet_addr *addr,
+                          const char *limit)
+{
+        const char *end;
+        int ret;
+
+        memset(addr, 0, sizeof(*addr));
+        switch (nf_ct_l3num(ct)) {
+        case AF_INET:
+                ret = in4_pton(cp, limit - cp, (u8 *)&addr->ip, -1, &end);
+                break;
+        case AF_INET6:
+                ret = in6_pton(cp, limit - cp, (u8 *)&addr->ip6, -1, &end);
+                break;
+        default:
+                BUG();
+        }
+
+        if (ret == 0)
+                return 0;
+        if (endp)
+                *endp = end;
+        return 1;
+}
+
+/* skip ip address. returns its length. */
+static int sdp_addr_len(const struct nf_conn *ct, const char *dptr,
+                        const char *limit, int *shift)
+{
+        union nf_inet_addr addr;
+        const char *aux = dptr;
+
+        if (!sdp_parse_addr(ct, dptr, &dptr, &addr, limit)) {
+                pr_debug("ip: %s parse failed.!\n", dptr);
+                return 0;
+        }
+
+        return dptr - aux;
+}
+
 /* SDP header parsing: a SDP session description contains an ordered set of
  * headers, starting with a section containing general session parameters,
  * optionally followed by multiple media descriptions.
@@ -684,13 +743,18 @@ static int ct_sip_parse_transport(struct nf_conn *ct, const char *dptr,
  * be tolerant and also accept records terminated with a single newline
  * character". We handle both cases.
  */
-static const struct sip_header ct_sdp_hdrs[] = {
-        [SDP_HDR_VERSION]               = SDP_HDR("v=", NULL, digits_len),
-        [SDP_HDR_OWNER_IP4]             = SDP_HDR("o=", "IN IP4 ", epaddr_len),
-        [SDP_HDR_CONNECTION_IP4]        = SDP_HDR("c=", "IN IP4 ", epaddr_len),
-        [SDP_HDR_OWNER_IP6]             = SDP_HDR("o=", "IN IP6 ", epaddr_len),
-        [SDP_HDR_CONNECTION_IP6]        = SDP_HDR("c=", "IN IP6 ", epaddr_len),
-        [SDP_HDR_MEDIA]                 = SDP_HDR("m=", NULL, media_len),
+static const struct sip_header ct_sdp_hdrs_v4[] = {
+        [SDP_HDR_VERSION]       = SDP_HDR("v=", NULL, digits_len),
+        [SDP_HDR_OWNER]         = SDP_HDR("o=", "IN IP4 ", sdp_addr_len),
+        [SDP_HDR_CONNECTION]    = SDP_HDR("c=", "IN IP4 ", sdp_addr_len),
+        [SDP_HDR_MEDIA]         = SDP_HDR("m=", NULL, media_len),
+};
+
+static const struct sip_header ct_sdp_hdrs_v6[] = {
+        [SDP_HDR_VERSION]       = SDP_HDR("v=", NULL, digits_len),
+        [SDP_HDR_OWNER]         = SDP_HDR("o=", "IN IP6 ", sdp_addr_len),
+        [SDP_HDR_CONNECTION]    = SDP_HDR("c=", "IN IP6 ", sdp_addr_len),
+        [SDP_HDR_MEDIA]         = SDP_HDR("m=", NULL, media_len),
 };
 
 /* Linear string search within SDP header values */
@@ -716,11 +780,14 @@ int ct_sip_get_sdp_header(const struct nf_conn *ct, const char *dptr,
                           enum sdp_header_types term,
                           unsigned int *matchoff, unsigned int *matchlen)
 {
-        const struct sip_header *hdr = &ct_sdp_hdrs[type];
-        const struct sip_header *thdr = &ct_sdp_hdrs[term];
+        const struct sip_header *hdrs, *hdr, *thdr;
         const char *start = dptr, *limit = dptr + datalen;
         int shift = 0;
 
+        hdrs = nf_ct_l3num(ct) == NFPROTO_IPV4 ? ct_sdp_hdrs_v4 : ct_sdp_hdrs_v6;
+        hdr = &hdrs[type];
+        thdr = &hdrs[term];
+
         for (dptr += dataoff; dptr < limit; dptr++) {
                 /* Find beginning of line */
                 if (*dptr != '\r' && *dptr != '\n')
@@ -775,8 +842,8 @@ static int ct_sip_parse_sdp_addr(const struct nf_conn *ct, const char *dptr,
         if (ret <= 0)
                 return ret;
 
-        if (!parse_addr(ct, dptr + *matchoff, NULL, addr,
-                        dptr + *matchoff + *matchlen))
+        if (!sdp_parse_addr(ct, dptr + *matchoff, NULL, addr,
+                            dptr + *matchoff + *matchlen))
                 return -1;
         return 1;
 }
@@ -830,7 +897,8 @@ static void flush_expectations(struct nf_conn *ct, bool media)
         spin_unlock_bh(&nf_conntrack_lock);
 }
 
-static int set_expected_rtp_rtcp(struct sk_buff *skb, unsigned int dataoff,
+static int set_expected_rtp_rtcp(struct sk_buff *skb, unsigned int protoff,
+                                 unsigned int dataoff,
                                  const char **dptr, unsigned int *datalen,
                                  union nf_inet_addr *daddr, __be16 port,
                                  enum sip_expectation_classes class,
@@ -886,12 +954,12 @@ static int set_expected_rtp_rtcp(struct sk_buff *skb, unsigned int dataoff,
                     exp->class != class)
                         break;
 #ifdef CONFIG_NF_NAT_NEEDED
-                if (exp->tuple.src.l3num == AF_INET && !direct_rtp &&
-                    (exp->saved_ip != exp->tuple.dst.u3.ip ||
+                if (!direct_rtp &&
+                    (!nf_inet_addr_cmp(&exp->saved_addr, &exp->tuple.dst.u3) ||
                      exp->saved_proto.udp.port != exp->tuple.dst.u.udp.port) &&
                     ct->status & IPS_NAT_MASK) {
-                        daddr->ip               = exp->saved_ip;
-                        tuple.dst.u3.ip         = exp->saved_ip;
+                        *daddr                  = exp->saved_addr;
+                        tuple.dst.u3            = exp->saved_addr;
                         tuple.dst.u.udp.port    = exp->saved_proto.udp.port;
                         direct_rtp = 1;
                 } else
@@ -907,7 +975,7 @@ static int set_expected_rtp_rtcp(struct sk_buff *skb, unsigned int dataoff,
         if (direct_rtp) {
                 nf_nat_sdp_port = rcu_dereference(nf_nat_sdp_port_hook);
                 if (nf_nat_sdp_port &&
-                    !nf_nat_sdp_port(skb, dataoff, dptr, datalen,
+                    !nf_nat_sdp_port(skb, protoff, dataoff, dptr, datalen,
                                      mediaoff, medialen, ntohs(rtp_port)))
                         goto err1;
         }
@@ -929,7 +997,7 @@ static int set_expected_rtp_rtcp(struct sk_buff *skb, unsigned int dataoff,
 
         nf_nat_sdp_media = rcu_dereference(nf_nat_sdp_media_hook);
         if (nf_nat_sdp_media && ct->status & IPS_NAT_MASK && !direct_rtp)
-                ret = nf_nat_sdp_media(skb, dataoff, dptr, datalen,
+                ret = nf_nat_sdp_media(skb, protoff, dataoff, dptr, datalen,
                                        rtp_exp, rtcp_exp,
                                        mediaoff, medialen, daddr);
         else {
@@ -970,7 +1038,8 @@ static const struct sdp_media_type *sdp_media_type(const char *dptr,
         return NULL;
 }
 
-static int process_sdp(struct sk_buff *skb, unsigned int dataoff,
+static int process_sdp(struct sk_buff *skb, unsigned int protoff,
+                       unsigned int dataoff,
                        const char **dptr, unsigned int *datalen,
                        unsigned int cseq)
 {
@@ -983,15 +1052,12 @@ static int process_sdp(struct sk_buff *skb, unsigned int dataoff,
         unsigned int i;
         union nf_inet_addr caddr, maddr, rtp_addr;
         unsigned int port;
-        enum sdp_header_types c_hdr;
         const struct sdp_media_type *t;
         int ret = NF_ACCEPT;
         typeof(nf_nat_sdp_addr_hook) nf_nat_sdp_addr;
         typeof(nf_nat_sdp_session_hook) nf_nat_sdp_session;
 
         nf_nat_sdp_addr = rcu_dereference(nf_nat_sdp_addr_hook);
-        c_hdr = nf_ct_l3num(ct) == AF_INET ? SDP_HDR_CONNECTION_IP4 :
-                                             SDP_HDR_CONNECTION_IP6;
 
         /* Find beginning of session description */
         if (ct_sip_get_sdp_header(ct, *dptr, 0, *datalen,
@@ -1005,7 +1071,7 @@ static int process_sdp(struct sk_buff *skb, unsigned int dataoff,
          * the end of the session description. */
         caddr_len = 0;
         if (ct_sip_parse_sdp_addr(ct, *dptr, sdpoff, *datalen,
-                                  c_hdr, SDP_HDR_MEDIA,
+                                  SDP_HDR_CONNECTION, SDP_HDR_MEDIA,
                                   &matchoff, &matchlen, &caddr) > 0)
                 caddr_len = matchlen;
 
@@ -1035,7 +1101,7 @@ static int process_sdp(struct sk_buff *skb, unsigned int dataoff,
                 /* The media description overrides the session description. */
                 maddr_len = 0;
                 if (ct_sip_parse_sdp_addr(ct, *dptr, mediaoff, *datalen,
-                                          c_hdr, SDP_HDR_MEDIA,
+                                          SDP_HDR_CONNECTION, SDP_HDR_MEDIA,
                                           &matchoff, &matchlen, &maddr) > 0) {
                         maddr_len = matchlen;
                         memcpy(&rtp_addr, &maddr, sizeof(rtp_addr));
@@ -1044,7 +1110,8 @@ static int process_sdp(struct sk_buff *skb, unsigned int dataoff,
                 else
                         return NF_DROP;
 
-                ret = set_expected_rtp_rtcp(skb, dataoff, dptr, datalen,
+                ret = set_expected_rtp_rtcp(skb, protoff, dataoff,
+                                            dptr, datalen,
                                             &rtp_addr, htons(port), t->class,
                                             mediaoff, medialen);
                 if (ret != NF_ACCEPT)
@@ -1052,8 +1119,9 @@ static int process_sdp(struct sk_buff *skb, unsigned int dataoff,
 
                 /* Update media connection address if present */
                 if (maddr_len && nf_nat_sdp_addr && ct->status & IPS_NAT_MASK) {
-                        ret = nf_nat_sdp_addr(skb, dataoff, dptr, datalen,
-                                              mediaoff, c_hdr, SDP_HDR_MEDIA,
+                        ret = nf_nat_sdp_addr(skb, protoff, dataoff,
+                                              dptr, datalen, mediaoff,
+                                              SDP_HDR_CONNECTION, SDP_HDR_MEDIA,
                                               &rtp_addr);
                         if (ret != NF_ACCEPT)
                                 return ret;
@@ -1064,12 +1132,13 @@ static int process_sdp(struct sk_buff *skb, unsigned int dataoff,
         /* Update session connection and owner addresses */
         nf_nat_sdp_session = rcu_dereference(nf_nat_sdp_session_hook);
         if (nf_nat_sdp_session && ct->status & IPS_NAT_MASK)
-                ret = nf_nat_sdp_session(skb, dataoff, dptr, datalen, sdpoff,
-                                         &rtp_addr);
+                ret = nf_nat_sdp_session(skb, protoff, dataoff,
+                                         dptr, datalen, sdpoff, &rtp_addr);
 
         return ret;
 }
-static int process_invite_response(struct sk_buff *skb, unsigned int dataoff,
+static int process_invite_response(struct sk_buff *skb, unsigned int protoff,
+                                   unsigned int dataoff,
                                    const char **dptr, unsigned int *datalen,
                                    unsigned int cseq, unsigned int code)
 {
@@ -1079,13 +1148,14 @@ static int process_invite_response(struct sk_buff *skb, unsigned int dataoff,
 
         if ((code >= 100 && code <= 199) ||
             (code >= 200 && code <= 299))
-                return process_sdp(skb, dataoff, dptr, datalen, cseq);
+                return process_sdp(skb, protoff, dataoff, dptr, datalen, cseq);
         else if (ct_sip_info->invite_cseq == cseq)
                 flush_expectations(ct, true);
         return NF_ACCEPT;
 }
 
-static int process_update_response(struct sk_buff *skb, unsigned int dataoff,
+static int process_update_response(struct sk_buff *skb, unsigned int protoff,
+                                   unsigned int dataoff,
                                    const char **dptr, unsigned int *datalen,
                                    unsigned int cseq, unsigned int code)
 {
@@ -1095,13 +1165,14 @@ static int process_update_response(struct sk_buff *skb, unsigned int dataoff,
 
         if ((code >= 100 && code <= 199) ||
             (code >= 200 && code <= 299))
-                return process_sdp(skb, dataoff, dptr, datalen, cseq);
+                return process_sdp(skb, protoff, dataoff, dptr, datalen, cseq);
         else if (ct_sip_info->invite_cseq == cseq)
                 flush_expectations(ct, true);
         return NF_ACCEPT;
 }
 
-static int process_prack_response(struct sk_buff *skb, unsigned int dataoff,
+static int process_prack_response(struct sk_buff *skb, unsigned int protoff,
+                                  unsigned int dataoff,
                                   const char **dptr, unsigned int *datalen,
                                   unsigned int cseq, unsigned int code)
 {
@@ -1111,13 +1182,14 @@ static int process_prack_response(struct sk_buff *skb, unsigned int dataoff,
 
         if ((code >= 100 && code <= 199) ||
             (code >= 200 && code <= 299))
-                return process_sdp(skb, dataoff, dptr, datalen, cseq);
+                return process_sdp(skb, protoff, dataoff, dptr, datalen, cseq);
         else if (ct_sip_info->invite_cseq == cseq)
                 flush_expectations(ct, true);
         return NF_ACCEPT;
 }
 
-static int process_invite_request(struct sk_buff *skb, unsigned int dataoff,
+static int process_invite_request(struct sk_buff *skb, unsigned int protoff,
+                                  unsigned int dataoff,
                                   const char **dptr, unsigned int *datalen,
                                   unsigned int cseq)
 {
@@ -1127,13 +1199,14 @@ static int process_invite_request(struct sk_buff *skb, unsigned int dataoff,
         unsigned int ret;
 
         flush_expectations(ct, true);
-        ret = process_sdp(skb, dataoff, dptr, datalen, cseq);
+        ret = process_sdp(skb, protoff, dataoff, dptr, datalen, cseq);
         if (ret == NF_ACCEPT)
                 ct_sip_info->invite_cseq = cseq;
         return ret;
 }
 
-static int process_bye_request(struct sk_buff *skb, unsigned int dataoff,
+static int process_bye_request(struct sk_buff *skb, unsigned int protoff,
+                               unsigned int dataoff,
                                const char **dptr, unsigned int *datalen,
                                unsigned int cseq)
 {
@@ -1148,7 +1221,8 @@ static int process_bye_request(struct sk_buff *skb, unsigned int dataoff,
  * signalling connections. The expectation is marked inactive and is activated
  * when receiving a response indicating success from the registrar.
  */
-static int process_register_request(struct sk_buff *skb, unsigned int dataoff,
+static int process_register_request(struct sk_buff *skb, unsigned int protoff,
+                                    unsigned int dataoff,
                                     const char **dptr, unsigned int *datalen,
                                     unsigned int cseq)
 {
@@ -1223,8 +1297,8 @@ static int process_register_request(struct sk_buff *skb, unsigned int dataoff,
 
         nf_nat_sip_expect = rcu_dereference(nf_nat_sip_expect_hook);
         if (nf_nat_sip_expect && ct->status & IPS_NAT_MASK)
-                ret = nf_nat_sip_expect(skb, dataoff, dptr, datalen, exp,
-                                        matchoff, matchlen);
+                ret = nf_nat_sip_expect(skb, protoff, dataoff, dptr, datalen,
+                                        exp, matchoff, matchlen);
         else {
                 if (nf_ct_expect_related(exp) != 0)
                         ret = NF_DROP;
@@ -1239,7 +1313,8 @@ store_cseq:
         return ret;
 }
 
-static int process_register_response(struct sk_buff *skb, unsigned int dataoff,
+static int process_register_response(struct sk_buff *skb, unsigned int protoff,
+                                     unsigned int dataoff,
                                      const char **dptr, unsigned int *datalen,
                                      unsigned int cseq, unsigned int code)
 {
@@ -1321,7 +1396,8 @@ static const struct sip_handler sip_handlers[] = {
         SIP_HANDLER("REGISTER", process_register_request, process_register_response),
 };
 
-static int process_sip_response(struct sk_buff *skb, unsigned int dataoff,
+static int process_sip_response(struct sk_buff *skb, unsigned int protoff,
+                                unsigned int dataoff,
                                 const char **dptr, unsigned int *datalen)
 {
         enum ip_conntrack_info ctinfo;
@@ -1352,13 +1428,14 @@ static int process_sip_response(struct sk_buff *skb, unsigned int dataoff,
                 if (*datalen < matchend + handler->len ||
                     strnicmp(*dptr + matchend, handler->method, handler->len))
                         continue;
-                return handler->response(skb, dataoff, dptr, datalen,
+                return handler->response(skb, protoff, dataoff, dptr, datalen,
                                          cseq, code);
         }
         return NF_ACCEPT;
 }
 
-static int process_sip_request(struct sk_buff *skb, unsigned int dataoff,
+static int process_sip_request(struct sk_buff *skb, unsigned int protoff,
+                               unsigned int dataoff,
                                const char **dptr, unsigned int *datalen)
 {
         enum ip_conntrack_info ctinfo;
@@ -1383,26 +1460,28 @@ static int process_sip_request(struct sk_buff *skb, unsigned int dataoff,
                 if (!cseq)
                         return NF_DROP;
 
-                return handler->request(skb, dataoff, dptr, datalen, cseq);
+                return handler->request(skb, protoff, dataoff, dptr, datalen,
+                                        cseq);
         }
         return NF_ACCEPT;
 }
 
 static int process_sip_msg(struct sk_buff *skb, struct nf_conn *ct,
-                           unsigned int dataoff, const char **dptr,
-                           unsigned int *datalen)
+                           unsigned int protoff, unsigned int dataoff,
+                           const char **dptr, unsigned int *datalen)
 {
         typeof(nf_nat_sip_hook) nf_nat_sip;
         int ret;
 
         if (strnicmp(*dptr, "SIP/2.0 ", strlen("SIP/2.0 ")) != 0)
-                ret = process_sip_request(skb, dataoff, dptr, datalen);
+                ret = process_sip_request(skb, protoff, dataoff, dptr, datalen);
         else
-                ret = process_sip_response(skb, dataoff, dptr, datalen);
+                ret = process_sip_response(skb, protoff, dataoff, dptr, datalen);
 
         if (ret == NF_ACCEPT && ct->status & IPS_NAT_MASK) {
                 nf_nat_sip = rcu_dereference(nf_nat_sip_hook);
-                if (nf_nat_sip && !nf_nat_sip(skb, dataoff, dptr, datalen))
+                if (nf_nat_sip && !nf_nat_sip(skb, protoff, dataoff,
+                                              dptr, datalen))
                         ret = NF_DROP;
         }
 
@@ -1470,7 +1549,8 @@ static int sip_help_tcp(struct sk_buff *skb, unsigned int protoff,
                 if (msglen > datalen)
                         return NF_DROP;
 
-                ret = process_sip_msg(skb, ct, dataoff, &dptr, &msglen);
+                ret = process_sip_msg(skb, ct, protoff, dataoff,
+                                      &dptr, &msglen);
                 if (ret != NF_ACCEPT)
                         break;
                 diff     = msglen - origlen;
@@ -1484,7 +1564,7 @@ static int sip_help_tcp(struct sk_buff *skb, unsigned int protoff,
         if (ret == NF_ACCEPT && ct->status & IPS_NAT_MASK) {
                 nf_nat_sip_seq_adjust = rcu_dereference(nf_nat_sip_seq_adjust_hook);
                 if (nf_nat_sip_seq_adjust)
-                        nf_nat_sip_seq_adjust(skb, tdiff);
+                        nf_nat_sip_seq_adjust(skb, protoff, tdiff);
         }
 
         return ret;
@@ -1511,11 +1591,10 @@ static int sip_help_udp(struct sk_buff *skb, unsigned int protoff,
         if (datalen < strlen("SIP/2.0 200"))
                 return NF_ACCEPT;
 
-        return process_sip_msg(skb, ct, dataoff, &dptr, &datalen);
+        return process_sip_msg(skb, ct, protoff, dataoff, &dptr, &datalen);
 }
 
 static struct nf_conntrack_helper sip[MAX_PORTS][4] __read_mostly;
-static char sip_names[MAX_PORTS][4][sizeof("sip-65535")] __read_mostly;
 
 static const struct nf_conntrack_expect_policy sip_exp_policy[SIP_EXPECT_MAX + 1] = {
         [SIP_EXPECT_SIGNALLING] = {
@@ -1585,9 +1664,9 @@ static int __init nf_conntrack_sip_init(void)
                         sip[i][j].me = THIS_MODULE;
 
                         if (ports[i] == SIP_PORT)
-                                sprintf(sip_names[i][j], "sip");
+                                sprintf(sip[i][j].name, "sip");
                         else
-                                sprintf(sip_names[i][j], "sip-%u", i);
+                                sprintf(sip[i][j].name, "sip-%u", i);
 
                         pr_debug("port #%u: %u\n", i, ports[i]);
 
diff --git a/net/netfilter/nf_internals.h b/net/netfilter/nf_internals.h
index 770f76432ad0..3deec997be89 100644
--- a/net/netfilter/nf_internals.h
+++ b/net/netfilter/nf_internals.h
@@ -18,13 +18,13 @@ extern unsigned int nf_iterate(struct list_head *head,
                                 unsigned int hook,
                                 const struct net_device *indev,
                                 const struct net_device *outdev,
-                                struct list_head **i,
+                                struct nf_hook_ops **elemp,
                                 int (*okfn)(struct sk_buff *),
                                 int hook_thresh);
 
 /* nf_queue.c */
 extern int nf_queue(struct sk_buff *skb,
-                    struct list_head *elem,
+                    struct nf_hook_ops *elem,
                     u_int8_t pf, unsigned int hook,
                     struct net_device *indev,
                     struct net_device *outdev,
diff --git a/net/ipv4/netfilter/nf_nat_amanda.c b/net/netfilter/nf_nat_amanda.c
index 3c04d24e2976..42d337881171 100644
--- a/net/ipv4/netfilter/nf_nat_amanda.c
+++ b/net/netfilter/nf_nat_amanda.c
@@ -16,7 +16,6 @@
 #include <net/netfilter/nf_conntrack_helper.h>
 #include <net/netfilter/nf_conntrack_expect.h>
 #include <net/netfilter/nf_nat_helper.h>
-#include <net/netfilter/nf_nat_rule.h>
 #include <linux/netfilter/nf_conntrack_amanda.h>
 
 MODULE_AUTHOR("Brian J. Murrell <netfilter@interlinx.bc.ca>");
@@ -26,6 +25,7 @@ MODULE_ALIAS("ip_nat_amanda");
 
 static unsigned int help(struct sk_buff *skb,
                          enum ip_conntrack_info ctinfo,
+                         unsigned int protoff,
                          unsigned int matchoff,
                          unsigned int matchlen,
                          struct nf_conntrack_expect *exp)
@@ -61,7 +61,7 @@ static unsigned int help(struct sk_buff *skb,
 
         sprintf(buffer, "%u", port);
         ret = nf_nat_mangle_udp_packet(skb, exp->master, ctinfo,
-                                       matchoff, matchlen,
+                                       protoff, matchoff, matchlen,
                                        buffer, strlen(buffer));
         if (ret != NF_ACCEPT)
                 nf_ct_unexpect_related(exp);
diff --git a/net/ipv4/netfilter/nf_nat_core.c b/net/netfilter/nf_nat_core.c
index 44b082fd48ab..29d445235199 100644
--- a/net/ipv4/netfilter/nf_nat_core.c
+++ b/net/netfilter/nf_nat_core.c
@@ -1,7 +1,7 @@
-/* NAT for netfilter; shared with compatibility layer. */
-
-/* (C) 1999-2001 Paul `Rusty' Russell
+/*
+ * (C) 1999-2001 Paul `Rusty' Russell
  * (C) 2002-2006 Netfilter Core Team <coreteam@netfilter.org>
+ * (C) 2011 Patrick McHardy <kaber@trash.net>
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License version 2 as
@@ -13,39 +13,106 @@
 #include <linux/timer.h>
 #include <linux/skbuff.h>
 #include <linux/gfp.h>
-#include <net/checksum.h>
-#include <net/icmp.h>
-#include <net/ip.h>
-#include <net/tcp.h>  /* For tcp_prot in getorigdst */
-#include <linux/icmp.h>
-#include <linux/udp.h>
+#include <net/xfrm.h>
 #include <linux/jhash.h>
+#include <linux/rtnetlink.h>
 
-#include <linux/netfilter_ipv4.h>
 #include <net/netfilter/nf_conntrack.h>
 #include <net/netfilter/nf_conntrack_core.h>
 #include <net/netfilter/nf_nat.h>
-#include <net/netfilter/nf_nat_protocol.h>
+#include <net/netfilter/nf_nat_l3proto.h>
+#include <net/netfilter/nf_nat_l4proto.h>
 #include <net/netfilter/nf_nat_core.h>
 #include <net/netfilter/nf_nat_helper.h>
 #include <net/netfilter/nf_conntrack_helper.h>
 #include <net/netfilter/nf_conntrack_l3proto.h>
 #include <net/netfilter/nf_conntrack_zones.h>
+#include <linux/netfilter/nf_nat.h>
 
 static DEFINE_SPINLOCK(nf_nat_lock);
 
-static struct nf_conntrack_l3proto *l3proto __read_mostly;
-
-#define MAX_IP_NAT_PROTO 256
-static const struct nf_nat_protocol __rcu *nf_nat_protos[MAX_IP_NAT_PROTO]
+static DEFINE_MUTEX(nf_nat_proto_mutex);
+static const struct nf_nat_l3proto __rcu *nf_nat_l3protos[NFPROTO_NUMPROTO]
+                                                __read_mostly;
+static const struct nf_nat_l4proto __rcu **nf_nat_l4protos[NFPROTO_NUMPROTO]
                                                 __read_mostly;
 
-static inline const struct nf_nat_protocol *
-__nf_nat_proto_find(u_int8_t protonum)
+
+inline const struct nf_nat_l3proto *
+__nf_nat_l3proto_find(u8 family)
 {
-        return rcu_dereference(nf_nat_protos[protonum]);
+        return rcu_dereference(nf_nat_l3protos[family]);
 }
 
+inline const struct nf_nat_l4proto *
+__nf_nat_l4proto_find(u8 family, u8 protonum)
+{
+        return rcu_dereference(nf_nat_l4protos[family][protonum]);
+}
+EXPORT_SYMBOL_GPL(__nf_nat_l4proto_find);
+
+#ifdef CONFIG_XFRM
+static void __nf_nat_decode_session(struct sk_buff *skb, struct flowi *fl)
+{
+        const struct nf_nat_l3proto *l3proto;
+        const struct nf_conn *ct;
+        enum ip_conntrack_info ctinfo;
+        enum ip_conntrack_dir dir;
+        unsigned  long statusbit;
+        u8 family;
+
+        ct = nf_ct_get(skb, &ctinfo);
+        if (ct == NULL)
+                return;
+
+        family = ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.src.l3num;
+        rcu_read_lock();
+        l3proto = __nf_nat_l3proto_find(family);
+        if (l3proto == NULL)
+                goto out;
+
+        dir = CTINFO2DIR(ctinfo);
+        if (dir == IP_CT_DIR_ORIGINAL)
+                statusbit = IPS_DST_NAT;
+        else
+                statusbit = IPS_SRC_NAT;
+
+        l3proto->decode_session(skb, ct, dir, statusbit, fl);
+out:
+        rcu_read_unlock();
+}
+
+int nf_xfrm_me_harder(struct sk_buff *skb, unsigned int family)
+{
+        struct flowi fl;
+        unsigned int hh_len;
+        struct dst_entry *dst;
+
+        if (xfrm_decode_session(skb, &fl, family) < 0)
+                return -1;
+
+        dst = skb_dst(skb);
+        if (dst->xfrm)
+                dst = ((struct xfrm_dst *)dst)->route;
+        dst_hold(dst);
+
+        dst = xfrm_lookup(dev_net(dst->dev), dst, &fl, skb->sk, 0);
+        if (IS_ERR(dst))
+                return -1;
+
+        skb_dst_drop(skb);
+        skb_dst_set(skb, dst);
+
+        /* Change in oif may mean change in hh_len. */
+        hh_len = skb_dst(skb)->dev->hard_header_len;
+        if (skb_headroom(skb) < hh_len &&
+            pskb_expand_head(skb, hh_len - skb_headroom(skb), 0, GFP_ATOMIC))
+                return -1;
+        return 0;
+}
+EXPORT_SYMBOL(nf_xfrm_me_harder);
+#endif /* CONFIG_XFRM */
+
 /* We keep an extra hash for each conntrack, for fast searching. */
 static inline unsigned int
 hash_by_src(const struct net *net, u16 zone,
@@ -54,10 +121,9 @@ hash_by_src(const struct net *net, u16 zone,
         unsigned int hash;
 
         /* Original src, to ensure we map it consistently if poss. */
-        hash = jhash_3words((__force u32)tuple->src.u3.ip,
-                            (__force u32)tuple->src.u.all ^ zone,
-                            tuple->dst.protonum, nf_conntrack_hash_rnd);
-        return ((u64)hash * net->ipv4.nat_htable_size) >> 32;
+        hash = jhash2((u32 *)&tuple->src, sizeof(tuple->src) / sizeof(u32),
+                      tuple->dst.protonum ^ zone ^ nf_conntrack_hash_rnd);
+        return ((u64)hash * net->ct.nat_htable_size) >> 32;
 }
 
 /* Is this tuple already taken? (not by us) */
@@ -66,10 +132,11 @@ nf_nat_used_tuple(const struct nf_conntrack_tuple *tuple,
                   const struct nf_conn *ignored_conntrack)
 {
         /* Conntrack tracking doesn't keep track of outgoing tuples; only
-           incoming ones.  NAT means they don't have a fixed mapping,
-           so we invert the tuple and look for the incoming reply.
-
-           We could keep a separate hash if this proves too slow. */
+         * incoming ones.  NAT means they don't have a fixed mapping,
+         * so we invert the tuple and look for the incoming reply.
+         *
+         * We could keep a separate hash if this proves too slow.
+         */
         struct nf_conntrack_tuple reply;
 
         nf_ct_invert_tuplepr(&reply, tuple);
@@ -78,31 +145,26 @@ nf_nat_used_tuple(const struct nf_conntrack_tuple *tuple,
 EXPORT_SYMBOL(nf_nat_used_tuple);
 
 /* If we source map this tuple so reply looks like reply_tuple, will
- * that meet the constraints of range. */
-static int
-in_range(const struct nf_conntrack_tuple *tuple,
-         const struct nf_nat_ipv4_range *range)
+ * that meet the constraints of range.
+ */
+static int in_range(const struct nf_nat_l3proto *l3proto,
+                    const struct nf_nat_l4proto *l4proto,
+                    const struct nf_conntrack_tuple *tuple,
+                    const struct nf_nat_range *range)
 {
-        const struct nf_nat_protocol *proto;
-        int ret = 0;
-
         /* If we are supposed to map IPs, then we must be in the
-           range specified, otherwise let this drag us onto a new src IP. */
-        if (range->flags & NF_NAT_RANGE_MAP_IPS) {
-                if (ntohl(tuple->src.u3.ip) < ntohl(range->min_ip) ||
-                    ntohl(tuple->src.u3.ip) > ntohl(range->max_ip))
-                        return 0;
-        }
+         * range specified, otherwise let this drag us onto a new src IP.
+         */
+        if (range->flags & NF_NAT_RANGE_MAP_IPS &&
+            !l3proto->in_range(tuple, range))
+                return 0;
 
-        rcu_read_lock();
-        proto = __nf_nat_proto_find(tuple->dst.protonum);
         if (!(range->flags & NF_NAT_RANGE_PROTO_SPECIFIED) ||
-            proto->in_range(tuple, NF_NAT_MANIP_SRC,
-                            &range->min, &range->max))
-                ret = 1;
-        rcu_read_unlock();
+            l4proto->in_range(tuple, NF_NAT_MANIP_SRC,
+                              &range->min_proto, &range->max_proto))
+                return 1;
 
-        return ret;
+        return 0;
 }
 
 static inline int
@@ -113,24 +175,25 @@ same_src(const struct nf_conn *ct,
 
         t = &ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple;
         return (t->dst.protonum == tuple->dst.protonum &&
-                t->src.u3.ip == tuple->src.u3.ip &&
+                nf_inet_addr_cmp(&t->src.u3, &tuple->src.u3) &&
                 t->src.u.all == tuple->src.u.all);
 }
 
 /* Only called for SRC manip */
 static int
 find_appropriate_src(struct net *net, u16 zone,
+                     const struct nf_nat_l3proto *l3proto,
+                     const struct nf_nat_l4proto *l4proto,
                      const struct nf_conntrack_tuple *tuple,
                      struct nf_conntrack_tuple *result,
-                     const struct nf_nat_ipv4_range *range)
+                     const struct nf_nat_range *range)
 {
         unsigned int h = hash_by_src(net, zone, tuple);
         const struct nf_conn_nat *nat;
         const struct nf_conn *ct;
         const struct hlist_node *n;
 
-        rcu_read_lock();
-        hlist_for_each_entry_rcu(nat, n, &net->ipv4.nat_bysource[h], bysource) {
+        hlist_for_each_entry_rcu(nat, n, &net->ct.nat_bysource[h], bysource) {
                 ct = nat->ct;
                 if (same_src(ct, tuple) && nf_ct_zone(ct) == zone) {
                         /* Copy source part from reply tuple. */
@@ -138,119 +201,150 @@ find_appropriate_src(struct net *net, u16 zone,
                                        &ct->tuplehash[IP_CT_DIR_REPLY].tuple);
                         result->dst = tuple->dst;
 
-                        if (in_range(result, range)) {
+                        if (in_range(l3proto, l4proto, result, range)) {
                                 rcu_read_unlock();
                                 return 1;
                         }
                 }
         }
-        rcu_read_unlock();
         return 0;
 }
 
 /* For [FUTURE] fragmentation handling, we want the least-used
-   src-ip/dst-ip/proto triple.  Fairness doesn't come into it.  Thus
-   if the range specifies 1.2.3.4 ports 10000-10005 and 1.2.3.5 ports
-   1-65535, we don't do pro-rata allocation based on ports; we choose
-   the ip with the lowest src-ip/dst-ip/proto usage.
-*/
+ * src-ip/dst-ip/proto triple.  Fairness doesn't come into it.  Thus
+ * if the range specifies 1.2.3.4 ports 10000-10005 and 1.2.3.5 ports
+ * 1-65535, we don't do pro-rata allocation based on ports; we choose
+ * the ip with the lowest src-ip/dst-ip/proto usage.
+ */
 static void
 find_best_ips_proto(u16 zone, struct nf_conntrack_tuple *tuple,
-                    const struct nf_nat_ipv4_range *range,
+                    const struct nf_nat_range *range,
                     const struct nf_conn *ct,
                     enum nf_nat_manip_type maniptype)
 {
-        __be32 *var_ipp;
+        union nf_inet_addr *var_ipp;
+        unsigned int i, max;
         /* Host order */
-        u_int32_t minip, maxip, j;
+        u32 minip, maxip, j, dist;
+        bool full_range;
 
         /* No IP mapping?  Do nothing. */
         if (!(range->flags & NF_NAT_RANGE_MAP_IPS))
                 return;
 
         if (maniptype == NF_NAT_MANIP_SRC)
-                var_ipp = &tuple->src.u3.ip;
+                var_ipp = &tuple->src.u3;
         else
-                var_ipp = &tuple->dst.u3.ip;
+                var_ipp = &tuple->dst.u3;
 
         /* Fast path: only one choice. */
-        if (range->min_ip == range->max_ip) {
-                *var_ipp = range->min_ip;
+        if (nf_inet_addr_cmp(&range->min_addr, &range->max_addr)) {
+                *var_ipp = range->min_addr;
                 return;
         }
 
+        if (nf_ct_l3num(ct) == NFPROTO_IPV4)
+                max = sizeof(var_ipp->ip) / sizeof(u32) - 1;
+        else
+                max = sizeof(var_ipp->ip6) / sizeof(u32) - 1;
+
         /* Hashing source and destination IPs gives a fairly even
          * spread in practice (if there are a small number of IPs
          * involved, there usually aren't that many connections
          * anyway).  The consistency means that servers see the same
          * client coming from the same IP (some Internet Banking sites
-         * like this), even across reboots. */
-        minip = ntohl(range->min_ip);
-        maxip = ntohl(range->max_ip);
-        j = jhash_2words((__force u32)tuple->src.u3.ip,
-                         range->flags & NF_NAT_RANGE_PERSISTENT ?
-                                0 : (__force u32)tuple->dst.u3.ip ^ zone, 0);
-        j = ((u64)j * (maxip - minip + 1)) >> 32;
-        *var_ipp = htonl(minip + j);
+         * like this), even across reboots.
+         */
+        j = jhash2((u32 *)&tuple->src.u3, sizeof(tuple->src.u3),
+                   range->flags & NF_NAT_RANGE_PERSISTENT ?
+                        0 : (__force u32)tuple->dst.u3.all[max] ^ zone);
+
+        full_range = false;
+        for (i = 0; i <= max; i++) {
+                /* If first bytes of the address are at the maximum, use the
+                 * distance. Otherwise use the full range.
+                 */
+                if (!full_range) {
+                        minip = ntohl((__force __be32)range->min_addr.all[i]);
+                        maxip = ntohl((__force __be32)range->max_addr.all[i]);
+                        dist  = maxip - minip + 1;
+                } else {
+                        minip = 0;
+                        dist  = ~0;
+                }
+
+                var_ipp->all[i] = (__force __u32)
+                        htonl(minip + (((u64)j * dist) >> 32));
+                if (var_ipp->all[i] != range->max_addr.all[i])
+                        full_range = true;
+
+                if (!(range->flags & NF_NAT_RANGE_PERSISTENT))
+                        j ^= (__force u32)tuple->dst.u3.all[i];
+        }
 }
 
-/* Manipulate the tuple into the range given.  For NF_INET_POST_ROUTING,
- * we change the source to map into the range.  For NF_INET_PRE_ROUTING
+/* Manipulate the tuple into the range given. For NF_INET_POST_ROUTING,
+ * we change the source to map into the range. For NF_INET_PRE_ROUTING
  * and NF_INET_LOCAL_OUT, we change the destination to map into the
- * range.  It might not be possible to get a unique tuple, but we try.
+ * range. It might not be possible to get a unique tuple, but we try.
  * At worst (or if we race), we will end up with a final duplicate in
  * __ip_conntrack_confirm and drop the packet. */
 static void
 get_unique_tuple(struct nf_conntrack_tuple *tuple,
                  const struct nf_conntrack_tuple *orig_tuple,
-                 const struct nf_nat_ipv4_range *range,
+                 const struct nf_nat_range *range,
                  struct nf_conn *ct,
                  enum nf_nat_manip_type maniptype)
 {
+        const struct nf_nat_l3proto *l3proto;
+        const struct nf_nat_l4proto *l4proto;
         struct net *net = nf_ct_net(ct);
-        const struct nf_nat_protocol *proto;
         u16 zone = nf_ct_zone(ct);
 
-        /* 1) If this srcip/proto/src-proto-part is currently mapped,
-           and that same mapping gives a unique tuple within the given
-           range, use that.
+        rcu_read_lock();
+        l3proto = __nf_nat_l3proto_find(orig_tuple->src.l3num);
+        l4proto = __nf_nat_l4proto_find(orig_tuple->src.l3num,
+                                        orig_tuple->dst.protonum);
 
-           This is only required for source (ie. NAT/masq) mappings.
-           So far, we don't do local source mappings, so multiple
-           manips not an issue.  */
+        /* 1) If this srcip/proto/src-proto-part is currently mapped,
+         * and that same mapping gives a unique tuple within the given
+         * range, use that.
+         *
+         * This is only required for source (ie. NAT/masq) mappings.
+         * So far, we don't do local source mappings, so multiple
+         * manips not an issue.
+         */
         if (maniptype == NF_NAT_MANIP_SRC &&
             !(range->flags & NF_NAT_RANGE_PROTO_RANDOM)) {
                 /* try the original tuple first */
-                if (in_range(orig_tuple, range)) {
+                if (in_range(l3proto, l4proto, orig_tuple, range)) {
                         if (!nf_nat_used_tuple(orig_tuple, ct)) {
                                 *tuple = *orig_tuple;
-                                return;
+                                goto out;
                         }
-                } else if (find_appropriate_src(net, zone, orig_tuple, tuple,
-                           range)) {
+                } else if (find_appropriate_src(net, zone, l3proto, l4proto,
+                                                orig_tuple, tuple, range)) {
                         pr_debug("get_unique_tuple: Found current src map\n");
                         if (!nf_nat_used_tuple(tuple, ct))
-                                return;
+                                goto out;
                 }
         }
 
-        /* 2) Select the least-used IP/proto combination in the given
-           range. */
+        /* 2) Select the least-used IP/proto combination in the given range */
         *tuple = *orig_tuple;
         find_best_ips_proto(zone, tuple, range, ct, maniptype);
 
         /* 3) The per-protocol part of the manip is made to map into
-           the range to make a unique tuple. */
-
-        rcu_read_lock();
-        proto = __nf_nat_proto_find(orig_tuple->dst.protonum);
+         * the range to make a unique tuple.
+         */
 
         /* Only bother mapping if it's not already in range and unique */
         if (!(range->flags & NF_NAT_RANGE_PROTO_RANDOM)) {
                 if (range->flags & NF_NAT_RANGE_PROTO_SPECIFIED) {
-                        if (proto->in_range(tuple, maniptype, &range->min,
-                                            &range->max) &&
-                            (range->min.all == range->max.all ||
+                        if (l4proto->in_range(tuple, maniptype,
+                                              &range->min_proto,
+                                              &range->max_proto) &&
+                            (range->min_proto.all == range->max_proto.all ||
                              !nf_nat_used_tuple(tuple, ct)))
                                 goto out;
                 } else if (!nf_nat_used_tuple(tuple, ct)) {
@@ -259,14 +353,14 @@ get_unique_tuple(struct nf_conntrack_tuple *tuple,
         }
 
         /* Last change: get protocol to try to obtain unique tuple. */
-        proto->unique_tuple(tuple, range, maniptype, ct);
+        l4proto->unique_tuple(l3proto, tuple, range, maniptype, ct);
 out:
         rcu_read_unlock();
 }
 
 unsigned int
 nf_nat_setup_info(struct nf_conn *ct,
-                  const struct nf_nat_ipv4_range *range,
+                  const struct nf_nat_range *range,
                   enum nf_nat_manip_type maniptype)
 {
         struct net *net = nf_ct_net(ct);
@@ -288,10 +382,10 @@ nf_nat_setup_info(struct nf_conn *ct,
         BUG_ON(nf_nat_initialized(ct, maniptype));
 
         /* What we've got will look like inverse of reply. Normally
-           this is what is in the conntrack, except for prior
-           manipulations (future optimization: if num_manips == 0,
-           orig_tp =
-           conntrack->tuplehash[IP_CT_DIR_ORIGINAL].tuple) */
+         * this is what is in the conntrack, except for prior
+         * manipulations (future optimization: if num_manips == 0,
+         * orig_tp = ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple)
+         */
         nf_ct_invert_tuplepr(&curr_tuple,
                              &ct->tuplehash[IP_CT_DIR_REPLY].tuple);
 
@@ -317,11 +411,11 @@ nf_nat_setup_info(struct nf_conn *ct,
                 srchash = hash_by_src(net, nf_ct_zone(ct),
                                       &ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple);
                 spin_lock_bh(&nf_nat_lock);
-                /* nf_conntrack_alter_reply might re-allocate extension area */
+                /* nf_conntrack_alter_reply might re-allocate extension aera */
                 nat = nfct_nat(ct);
                 nat->ct = ct;
                 hlist_add_head_rcu(&nat->bysource,
-                                   &net->ipv4.nat_bysource[srchash]);
+                                   &net->ct.nat_bysource[srchash]);
                 spin_unlock_bh(&nf_nat_lock);
         }
 
@@ -335,47 +429,14 @@ nf_nat_setup_info(struct nf_conn *ct,
 }
 EXPORT_SYMBOL(nf_nat_setup_info);
 
-/* Returns true if succeeded. */
-static bool
-manip_pkt(u_int16_t proto,
-          struct sk_buff *skb,
-          unsigned int iphdroff,
-          const struct nf_conntrack_tuple *target,
-          enum nf_nat_manip_type maniptype)
-{
-        struct iphdr *iph;
-        const struct nf_nat_protocol *p;
-
-        if (!skb_make_writable(skb, iphdroff + sizeof(*iph)))
-                return false;
-
-        iph = (void *)skb->data + iphdroff;
-
-        /* Manipulate protcol part. */
-
-        /* rcu_read_lock()ed by nf_hook_slow */
-        p = __nf_nat_proto_find(proto);
-        if (!p->manip_pkt(skb, iphdroff, target, maniptype))
-                return false;
-
-        iph = (void *)skb->data + iphdroff;
-
-        if (maniptype == NF_NAT_MANIP_SRC) {
-                csum_replace4(&iph->check, iph->saddr, target->src.u3.ip);
-                iph->saddr = target->src.u3.ip;
-        } else {
-                csum_replace4(&iph->check, iph->daddr, target->dst.u3.ip);
-                iph->daddr = target->dst.u3.ip;
-        }
-        return true;
-}
-
 /* Do packet manipulations according to nf_nat_setup_info. */
 unsigned int nf_nat_packet(struct nf_conn *ct,
                            enum ip_conntrack_info ctinfo,
                            unsigned int hooknum,
                            struct sk_buff *skb)
 {
+        const struct nf_nat_l3proto *l3proto;
+        const struct nf_nat_l4proto *l4proto;
         enum ip_conntrack_dir dir = CTINFO2DIR(ctinfo);
         unsigned long statusbit;
         enum nf_nat_manip_type mtype = HOOK2MANIP(hooknum);
@@ -396,129 +457,174 @@ unsigned int nf_nat_packet(struct nf_conn *ct,
                 /* We are aiming to look like inverse of other direction. */
                 nf_ct_invert_tuplepr(&target, &ct->tuplehash[!dir].tuple);
 
-                if (!manip_pkt(target.dst.protonum, skb, 0, &target, mtype))
+                l3proto = __nf_nat_l3proto_find(target.src.l3num);
+                l4proto = __nf_nat_l4proto_find(target.src.l3num,
+                                                target.dst.protonum);
+                if (!l3proto->manip_pkt(skb, 0, l4proto, &target, mtype))
                         return NF_DROP;
         }
         return NF_ACCEPT;
 }
 EXPORT_SYMBOL_GPL(nf_nat_packet);
 
-/* Dir is direction ICMP is coming from (opposite to packet it contains) */
-int nf_nat_icmp_reply_translation(struct nf_conn *ct,
-                                  enum ip_conntrack_info ctinfo,
-                                  unsigned int hooknum,
-                                  struct sk_buff *skb)
+struct nf_nat_proto_clean {
+        u8      l3proto;
+        u8      l4proto;
+        bool    hash;
+};
+
+/* Clear NAT section of all conntracks, in case we're loaded again. */
+static int nf_nat_proto_clean(struct nf_conn *i, void *data)
 {
-        struct {
-                struct icmphdr icmp;
-                struct iphdr ip;
-        } *inside;
-        struct nf_conntrack_tuple target;
-        int hdrlen = ip_hdrlen(skb);
-        enum ip_conntrack_dir dir = CTINFO2DIR(ctinfo);
-        unsigned long statusbit;
-        enum nf_nat_manip_type manip = HOOK2MANIP(hooknum);
+        const struct nf_nat_proto_clean *clean = data;
+        struct nf_conn_nat *nat = nfct_nat(i);
 
-        if (!skb_make_writable(skb, hdrlen + sizeof(*inside)))
+        if (!nat)
                 return 0;
-
-        inside = (void *)skb->data + hdrlen;
-
-        /* We're actually going to mangle it beyond trivial checksum
-           adjustment, so make sure the current checksum is correct. */
-        if (nf_ip_checksum(skb, hooknum, hdrlen, 0))
+        if ((clean->l3proto && nf_ct_l3num(i) != clean->l3proto) ||
+            (clean->l4proto && nf_ct_protonum(i) != clean->l4proto))
                 return 0;
 
-        /* Must be RELATED */
-        NF_CT_ASSERT(skb->nfctinfo == IP_CT_RELATED ||
-                     skb->nfctinfo == IP_CT_RELATED_REPLY);
-
-        /* Redirects on non-null nats must be dropped, else they'll
-           start talking to each other without our translation, and be
-           confused... --RR */
-        if (inside->icmp.type == ICMP_REDIRECT) {
-                /* If NAT isn't finished, assume it and drop. */
-                if ((ct->status & IPS_NAT_DONE_MASK) != IPS_NAT_DONE_MASK)
-                        return 0;
-
-                if (ct->status & IPS_NAT_MASK)
-                        return 0;
+        if (clean->hash) {
+                spin_lock_bh(&nf_nat_lock);
+                hlist_del_rcu(&nat->bysource);
+                spin_unlock_bh(&nf_nat_lock);
+        } else {
+                memset(nat, 0, sizeof(*nat));
+                i->status &= ~(IPS_NAT_MASK | IPS_NAT_DONE_MASK |
+                               IPS_SEQ_ADJUST);
         }
+        return 0;
+}
 
-        if (manip == NF_NAT_MANIP_SRC)
-                statusbit = IPS_SRC_NAT;
-        else
-                statusbit = IPS_DST_NAT;
-
-        /* Invert if this is reply dir. */
-        if (dir == IP_CT_DIR_REPLY)
-                statusbit ^= IPS_NAT_MASK;
-
-        if (!(ct->status & statusbit))
-                return 1;
-
-        pr_debug("icmp_reply_translation: translating error %p manip %u "
-                 "dir %s\n", skb, manip,
-                 dir == IP_CT_DIR_ORIGINAL ? "ORIG" : "REPLY");
-
-        /* Change inner back to look like incoming packet.  We do the
-           opposite manip on this hook to normal, because it might not
-           pass all hooks (locally-generated ICMP).  Consider incoming
-           packet: PREROUTING (DST manip), routing produces ICMP, goes
-           through POSTROUTING (which must correct the DST manip). */
-        if (!manip_pkt(inside->ip.protocol, skb, hdrlen + sizeof(inside->icmp),
-                       &ct->tuplehash[!dir].tuple, !manip))
-                return 0;
+static void nf_nat_l4proto_clean(u8 l3proto, u8 l4proto)
+{
+        struct nf_nat_proto_clean clean = {
+                .l3proto = l3proto,
+                .l4proto = l4proto,
+        };
+        struct net *net;
+
+        rtnl_lock();
+        /* Step 1 - remove from bysource hash */
+        clean.hash = true;
+        for_each_net(net)
+                nf_ct_iterate_cleanup(net, nf_nat_proto_clean, &clean);
+        synchronize_rcu();
 
-        if (skb->ip_summed != CHECKSUM_PARTIAL) {
-                /* Reloading "inside" here since manip_pkt inner. */
-                inside = (void *)skb->data + hdrlen;
-                inside->icmp.checksum = 0;
-                inside->icmp.checksum =
-                        csum_fold(skb_checksum(skb, hdrlen,
-                                               skb->len - hdrlen, 0));
-        }
+        /* Step 2 - clean NAT section */
+        clean.hash = false;
+        for_each_net(net)
+                nf_ct_iterate_cleanup(net, nf_nat_proto_clean, &clean);
+        rtnl_unlock();
+}
 
-        /* Change outer to look the reply to an incoming packet
-         * (proto 0 means don't invert per-proto part). */
-        nf_ct_invert_tuplepr(&target, &ct->tuplehash[!dir].tuple);
-        if (!manip_pkt(0, skb, 0, &target, manip))
-                return 0;
+static void nf_nat_l3proto_clean(u8 l3proto)
+{
+        struct nf_nat_proto_clean clean = {
+                .l3proto = l3proto,
+        };
+        struct net *net;
+
+        rtnl_lock();
+        /* Step 1 - remove from bysource hash */
+        clean.hash = true;
+        for_each_net(net)
+                nf_ct_iterate_cleanup(net, nf_nat_proto_clean, &clean);
+        synchronize_rcu();
 
-        return 1;
+        /* Step 2 - clean NAT section */
+        clean.hash = false;
+        for_each_net(net)
+                nf_ct_iterate_cleanup(net, nf_nat_proto_clean, &clean);
+        rtnl_unlock();
 }
-EXPORT_SYMBOL_GPL(nf_nat_icmp_reply_translation);
 
 /* Protocol registration. */
-int nf_nat_protocol_register(const struct nf_nat_protocol *proto)
+int nf_nat_l4proto_register(u8 l3proto, const struct nf_nat_l4proto *l4proto)
 {
+        const struct nf_nat_l4proto **l4protos;
+        unsigned int i;
         int ret = 0;
 
-        spin_lock_bh(&nf_nat_lock);
+        mutex_lock(&nf_nat_proto_mutex);
+        if (nf_nat_l4protos[l3proto] == NULL) {
+                l4protos = kmalloc(IPPROTO_MAX * sizeof(struct nf_nat_l4proto *),
+                                   GFP_KERNEL);
+                if (l4protos == NULL) {
+                        ret = -ENOMEM;
+                        goto out;
+                }
+
+                for (i = 0; i < IPPROTO_MAX; i++)
+                        RCU_INIT_POINTER(l4protos[i], &nf_nat_l4proto_unknown);
+
+                /* Before making proto_array visible to lockless readers,
+                 * we must make sure its content is committed to memory.
+                 */
+                smp_wmb();
+
+                nf_nat_l4protos[l3proto] = l4protos;
+        }
+
         if (rcu_dereference_protected(
-                        nf_nat_protos[proto->protonum],
-                        lockdep_is_held(&nf_nat_lock)
-                        ) != &nf_nat_unknown_protocol) {
+                        nf_nat_l4protos[l3proto][l4proto->l4proto],
+                        lockdep_is_held(&nf_nat_proto_mutex)
+                        ) != &nf_nat_l4proto_unknown) {
                 ret = -EBUSY;
                 goto out;
         }
-        RCU_INIT_POINTER(nf_nat_protos[proto->protonum], proto);
+        RCU_INIT_POINTER(nf_nat_l4protos[l3proto][l4proto->l4proto], l4proto);
  out:
-        spin_unlock_bh(&nf_nat_lock);
+        mutex_unlock(&nf_nat_proto_mutex);
         return ret;
 }
-EXPORT_SYMBOL(nf_nat_protocol_register);
+EXPORT_SYMBOL_GPL(nf_nat_l4proto_register);
 
 /* No one stores the protocol anywhere; simply delete it. */
-void nf_nat_protocol_unregister(const struct nf_nat_protocol *proto)
+void nf_nat_l4proto_unregister(u8 l3proto, const struct nf_nat_l4proto *l4proto)
 {
-        spin_lock_bh(&nf_nat_lock);
-        RCU_INIT_POINTER(nf_nat_protos[proto->protonum],
-                           &nf_nat_unknown_protocol);
-        spin_unlock_bh(&nf_nat_lock);
+        mutex_lock(&nf_nat_proto_mutex);
+        RCU_INIT_POINTER(nf_nat_l4protos[l3proto][l4proto->l4proto],
+                         &nf_nat_l4proto_unknown);
+        mutex_unlock(&nf_nat_proto_mutex);
         synchronize_rcu();
+
+        nf_nat_l4proto_clean(l3proto, l4proto->l4proto);
 }
-EXPORT_SYMBOL(nf_nat_protocol_unregister);
+EXPORT_SYMBOL_GPL(nf_nat_l4proto_unregister);
+
+int nf_nat_l3proto_register(const struct nf_nat_l3proto *l3proto)
+{
+        int err;
+
+        err = nf_ct_l3proto_try_module_get(l3proto->l3proto);
+        if (err < 0)
+                return err;
+
+        mutex_lock(&nf_nat_proto_mutex);
+        RCU_INIT_POINTER(nf_nat_l4protos[l3proto->l3proto][IPPROTO_TCP],
+                         &nf_nat_l4proto_tcp);
+        RCU_INIT_POINTER(nf_nat_l4protos[l3proto->l3proto][IPPROTO_UDP],
+                         &nf_nat_l4proto_udp);
+        mutex_unlock(&nf_nat_proto_mutex);
+
+        RCU_INIT_POINTER(nf_nat_l3protos[l3proto->l3proto], l3proto);
+        return 0;
+}
+EXPORT_SYMBOL_GPL(nf_nat_l3proto_register);
+
+void nf_nat_l3proto_unregister(const struct nf_nat_l3proto *l3proto)
+{
+        mutex_lock(&nf_nat_proto_mutex);
+        RCU_INIT_POINTER(nf_nat_l3protos[l3proto->l3proto], NULL);
+        mutex_unlock(&nf_nat_proto_mutex);
+        synchronize_rcu();
+
+        nf_nat_l3proto_clean(l3proto->l3proto);
+        nf_ct_l3proto_module_put(l3proto->l3proto);
+}
+EXPORT_SYMBOL_GPL(nf_nat_l3proto_unregister);
 
 /* No one using conntrack by the time this called. */
 static void nf_nat_cleanup_conntrack(struct nf_conn *ct)
@@ -570,34 +676,36 @@ static const struct nla_policy protonat_nla_policy[CTA_PROTONAT_MAX+1] = {
 
 static int nfnetlink_parse_nat_proto(struct nlattr *attr,
                                      const struct nf_conn *ct,
-                                     struct nf_nat_ipv4_range *range)
+                                     struct nf_nat_range *range)
 {
         struct nlattr *tb[CTA_PROTONAT_MAX+1];
-        const struct nf_nat_protocol *npt;
+        const struct nf_nat_l4proto *l4proto;
         int err;
 
         err = nla_parse_nested(tb, CTA_PROTONAT_MAX, attr, protonat_nla_policy);
         if (err < 0)
                 return err;
 
-        rcu_read_lock();
-        npt = __nf_nat_proto_find(nf_ct_protonum(ct));
-        if (npt->nlattr_to_range)
-                err = npt->nlattr_to_range(tb, range);
-        rcu_read_unlock();
+        l4proto = __nf_nat_l4proto_find(nf_ct_l3num(ct), nf_ct_protonum(ct));
+        if (l4proto->nlattr_to_range)
+                err = l4proto->nlattr_to_range(tb, range);
+
         return err;
 }
 
 static const struct nla_policy nat_nla_policy[CTA_NAT_MAX+1] = {
-        [CTA_NAT_MINIP]         = { .type = NLA_U32 },
-        [CTA_NAT_MAXIP]         = { .type = NLA_U32 },
+        [CTA_NAT_V4_MINIP]      = { .type = NLA_U32 },
+        [CTA_NAT_V4_MAXIP]      = { .type = NLA_U32 },
+        [CTA_NAT_V6_MINIP]      = { .len = sizeof(struct in6_addr) },
+        [CTA_NAT_V6_MAXIP]      = { .len = sizeof(struct in6_addr) },
         [CTA_NAT_PROTO]         = { .type = NLA_NESTED },
 };
 
 static int
 nfnetlink_parse_nat(const struct nlattr *nat,
-                    const struct nf_conn *ct, struct nf_nat_ipv4_range *range)
+                    const struct nf_conn *ct, struct nf_nat_range *range)
 {
+        const struct nf_nat_l3proto *l3proto;
         struct nlattr *tb[CTA_NAT_MAX+1];
         int err;
 
@@ -607,25 +715,23 @@ nfnetlink_parse_nat(const struct nlattr *nat,
         if (err < 0)
                 return err;
 
-        if (tb[CTA_NAT_MINIP])
-                range->min_ip = nla_get_be32(tb[CTA_NAT_MINIP]);
-
-        if (!tb[CTA_NAT_MAXIP])
-                range->max_ip = range->min_ip;
-        else
-                range->max_ip = nla_get_be32(tb[CTA_NAT_MAXIP]);
-
-        if (range->min_ip)
-                range->flags |= NF_NAT_RANGE_MAP_IPS;
+        rcu_read_lock();
+        l3proto = __nf_nat_l3proto_find(nf_ct_l3num(ct));
+        if (l3proto == NULL) {
+                err = -EAGAIN;
+                goto out;
+        }
+        err = l3proto->nlattr_to_range(tb, range);
+        if (err < 0)
+                goto out;
 
         if (!tb[CTA_NAT_PROTO])
-                return 0;
+                goto out;
 
         err = nfnetlink_parse_nat_proto(tb[CTA_NAT_PROTO], ct, range);
-        if (err < 0)
-                return err;
-
-        return 0;
+out:
+        rcu_read_unlock();
+        return err;
 }
 
 static int
@@ -633,10 +739,12 @@ nfnetlink_parse_nat_setup(struct nf_conn *ct,
                           enum nf_nat_manip_type manip,
                           const struct nlattr *attr)
 {
-        struct nf_nat_ipv4_range range;
+        struct nf_nat_range range;
+        int err;
 
-        if (nfnetlink_parse_nat(attr, ct, &range) < 0)
-                return -EINVAL;
+        err = nfnetlink_parse_nat(attr, ct, &range);
+        if (err < 0)
+                return err;
         if (nf_nat_initialized(ct, manip))
                 return -EEXIST;
 
@@ -655,30 +763,20 @@ nfnetlink_parse_nat_setup(struct nf_conn *ct,
 static int __net_init nf_nat_net_init(struct net *net)
 {
         /* Leave them the same for the moment. */
-        net->ipv4.nat_htable_size = net->ct.htable_size;
-        net->ipv4.nat_bysource = nf_ct_alloc_hashtable(&net->ipv4.nat_htable_size, 0);
-        if (!net->ipv4.nat_bysource)
+        net->ct.nat_htable_size = net->ct.htable_size;
+        net->ct.nat_bysource = nf_ct_alloc_hashtable(&net->ct.nat_htable_size, 0);
+        if (!net->ct.nat_bysource)
                 return -ENOMEM;
         return 0;
 }
 
-/* Clear NAT section of all conntracks, in case we're loaded again. */
-static int clean_nat(struct nf_conn *i, void *data)
-{
-        struct nf_conn_nat *nat = nfct_nat(i);
-
-        if (!nat)
-                return 0;
-        memset(nat, 0, sizeof(*nat));
-        i->status &= ~(IPS_NAT_MASK | IPS_NAT_DONE_MASK | IPS_SEQ_ADJUST);
-        return 0;
-}
-
 static void __net_exit nf_nat_net_exit(struct net *net)
 {
-        nf_ct_iterate_cleanup(net, &clean_nat, NULL);
+        struct nf_nat_proto_clean clean = {};
+
+        nf_ct_iterate_cleanup(net, &nf_nat_proto_clean, &clean);
         synchronize_rcu();
-        nf_ct_free_hashtable(net->ipv4.nat_bysource, net->ipv4.nat_htable_size);
+        nf_ct_free_hashtable(net->ct.nat_bysource, net->ct.nat_htable_size);
 }
 
 static struct pernet_operations nf_nat_net_ops = {
@@ -697,11 +795,8 @@ static struct nfq_ct_nat_hook nfq_ct_nat = {
 
 static int __init nf_nat_init(void)
 {
-        size_t i;
         int ret;
 
-        need_ipv4_conntrack();
-
         ret = nf_ct_extend_register(&nat_extend);
         if (ret < 0) {
                 printk(KERN_ERR "nf_nat_core: Unable to register extension\n");
@@ -712,22 +807,11 @@ static int __init nf_nat_init(void)
         if (ret < 0)
                 goto cleanup_extend;
 
-        /* Sew in builtin protocols. */
-        spin_lock_bh(&nf_nat_lock);
-        for (i = 0; i < MAX_IP_NAT_PROTO; i++)
-                RCU_INIT_POINTER(nf_nat_protos[i], &nf_nat_unknown_protocol);
-        RCU_INIT_POINTER(nf_nat_protos[IPPROTO_TCP], &nf_nat_protocol_tcp);
-        RCU_INIT_POINTER(nf_nat_protos[IPPROTO_UDP], &nf_nat_protocol_udp);
-        RCU_INIT_POINTER(nf_nat_protos[IPPROTO_ICMP], &nf_nat_protocol_icmp);
-        spin_unlock_bh(&nf_nat_lock);
+        nf_ct_helper_expectfn_register(&follow_master_nat);
 
         /* Initialize fake conntrack so that NAT will skip it */
         nf_ct_untracked_status_or(IPS_NAT_DONE_MASK);
 
-        l3proto = nf_ct_l3proto_find_get((u_int16_t)AF_INET);
-
-        nf_ct_helper_expectfn_register(&follow_master_nat);
-
         BUG_ON(nf_nat_seq_adjust_hook != NULL);
         RCU_INIT_POINTER(nf_nat_seq_adjust_hook, nf_nat_seq_adjust);
         BUG_ON(nfnetlink_parse_nat_setup_hook != NULL);
@@ -736,6 +820,10 @@ static int __init nf_nat_init(void)
         BUG_ON(nf_ct_nat_offset != NULL);
         RCU_INIT_POINTER(nf_ct_nat_offset, nf_nat_get_offset);
         RCU_INIT_POINTER(nfq_ct_nat_hook, &nfq_ct_nat);
+#ifdef CONFIG_XFRM
+        BUG_ON(nf_nat_decode_session_hook != NULL);
+        RCU_INIT_POINTER(nf_nat_decode_session_hook, __nf_nat_decode_session);
+#endif
         return 0;
 
  cleanup_extend:
@@ -745,19 +833,24 @@ static int __init nf_nat_init(void)
 
 static void __exit nf_nat_cleanup(void)
 {
+        unsigned int i;
+
         unregister_pernet_subsys(&nf_nat_net_ops);
-        nf_ct_l3proto_put(l3proto);
         nf_ct_extend_unregister(&nat_extend);
         nf_ct_helper_expectfn_unregister(&follow_master_nat);
         RCU_INIT_POINTER(nf_nat_seq_adjust_hook, NULL);
         RCU_INIT_POINTER(nfnetlink_parse_nat_setup_hook, NULL);
         RCU_INIT_POINTER(nf_ct_nat_offset, NULL);
         RCU_INIT_POINTER(nfq_ct_nat_hook, NULL);
+#ifdef CONFIG_XFRM
+        RCU_INIT_POINTER(nf_nat_decode_session_hook, NULL);
+#endif
+        for (i = 0; i < NFPROTO_NUMPROTO; i++)
+                kfree(nf_nat_l4protos[i]);
         synchronize_net();
 }
 
 MODULE_LICENSE("GPL");
-MODULE_ALIAS("nf-nat-ipv4");
 
 module_init(nf_nat_init);
 module_exit(nf_nat_cleanup);
diff --git a/net/ipv4/netfilter/nf_nat_ftp.c b/net/netfilter/nf_nat_ftp.c
index e462a957d080..e839b97b2863 100644
--- a/net/ipv4/netfilter/nf_nat_ftp.c
+++ b/net/netfilter/nf_nat_ftp.c
@@ -10,12 +10,11 @@
 
 #include <linux/module.h>
 #include <linux/moduleparam.h>
-#include <linux/ip.h>
+#include <linux/inet.h>
 #include <linux/tcp.h>
 #include <linux/netfilter_ipv4.h>
 #include <net/netfilter/nf_nat.h>
 #include <net/netfilter/nf_nat_helper.h>
-#include <net/netfilter/nf_nat_rule.h>
 #include <net/netfilter/nf_conntrack_helper.h>
 #include <net/netfilter/nf_conntrack_expect.h>
 #include <linux/netfilter/nf_conntrack_ftp.h>
@@ -27,22 +26,27 @@ MODULE_ALIAS("ip_nat_ftp");
 
 /* FIXME: Time out? --RR */
 
-static int nf_nat_ftp_fmt_cmd(enum nf_ct_ftp_type type,
+static int nf_nat_ftp_fmt_cmd(struct nf_conn *ct, enum nf_ct_ftp_type type,
                               char *buffer, size_t buflen,
-                              __be32 addr, u16 port)
+                              union nf_inet_addr *addr, u16 port)
 {
         switch (type) {
         case NF_CT_FTP_PORT:
         case NF_CT_FTP_PASV:
                 return snprintf(buffer, buflen, "%u,%u,%u,%u,%u,%u",
-                                ((unsigned char *)&addr)[0],
-                                ((unsigned char *)&addr)[1],
-                                ((unsigned char *)&addr)[2],
-                                ((unsigned char *)&addr)[3],
+                                ((unsigned char *)&addr->ip)[0],
+                                ((unsigned char *)&addr->ip)[1],
+                                ((unsigned char *)&addr->ip)[2],
+                                ((unsigned char *)&addr->ip)[3],
                                 port >> 8,
                                 port & 0xFF);
         case NF_CT_FTP_EPRT:
-                return snprintf(buffer, buflen, "|1|%pI4|%u|", &addr, port);
+                if (nf_ct_l3num(ct) == NFPROTO_IPV4)
+                        return snprintf(buffer, buflen, "|1|%pI4|%u|",
+                                        &addr->ip, port);
+                else
+                        return snprintf(buffer, buflen, "|2|%pI6|%u|",
+                                        &addr->ip6, port);
         case NF_CT_FTP_EPSV:
                 return snprintf(buffer, buflen, "|||%u|", port);
         }
@@ -55,21 +59,22 @@ static int nf_nat_ftp_fmt_cmd(enum nf_ct_ftp_type type,
 static unsigned int nf_nat_ftp(struct sk_buff *skb,
                                enum ip_conntrack_info ctinfo,
                                enum nf_ct_ftp_type type,
+                               unsigned int protoff,
                                unsigned int matchoff,
                                unsigned int matchlen,
                                struct nf_conntrack_expect *exp)
 {
-        __be32 newip;
+        union nf_inet_addr newaddr;
         u_int16_t port;
         int dir = CTINFO2DIR(ctinfo);
         struct nf_conn *ct = exp->master;
-        char buffer[sizeof("|1|255.255.255.255|65535|")];
+        char buffer[sizeof("|1||65535|") + INET6_ADDRSTRLEN];
         unsigned int buflen;
 
         pr_debug("FTP_NAT: type %i, off %u len %u\n", type, matchoff, matchlen);
 
         /* Connection will come from wherever this packet goes, hence !dir */
-        newip = ct->tuplehash[!dir].tuple.dst.u3.ip;
+        newaddr = ct->tuplehash[!dir].tuple.dst.u3;
         exp->saved_proto.tcp.port = exp->tuple.dst.u.tcp.port;
         exp->dir = !dir;
 
@@ -94,13 +99,14 @@ static unsigned int nf_nat_ftp(struct sk_buff *skb,
         if (port == 0)
                 return NF_DROP;
 
-        buflen = nf_nat_ftp_fmt_cmd(type, buffer, sizeof(buffer), newip, port);
+        buflen = nf_nat_ftp_fmt_cmd(ct, type, buffer, sizeof(buffer),
+                                    &newaddr, port);
         if (!buflen)
                 goto out;
 
         pr_debug("calling nf_nat_mangle_tcp_packet\n");
 
-        if (!nf_nat_mangle_tcp_packet(skb, ct, ctinfo, matchoff,
+        if (!nf_nat_mangle_tcp_packet(skb, ct, ctinfo, protoff, matchoff,
                                       matchlen, buffer, buflen))
                 goto out;
 
diff --git a/net/ipv4/netfilter/nf_nat_helper.c b/net/netfilter/nf_nat_helper.c
index 2e59ad0b90ca..23c2b38676a6 100644
--- a/net/ipv4/netfilter/nf_nat_helper.c
+++ b/net/netfilter/nf_nat_helper.c
@@ -1,4 +1,4 @@
-/* ip_nat_helper.c - generic support functions for NAT helpers
+/* nf_nat_helper.c - generic support functions for NAT helpers
  *
  * (C) 2000-2002 Harald Welte <laforge@netfilter.org>
  * (C) 2003-2006 Netfilter Core Team <coreteam@netfilter.org>
@@ -9,23 +9,19 @@
  */
 #include <linux/module.h>
 #include <linux/gfp.h>
-#include <linux/kmod.h>
 #include <linux/types.h>
-#include <linux/timer.h>
 #include <linux/skbuff.h>
 #include <linux/tcp.h>
 #include <linux/udp.h>
-#include <net/checksum.h>
 #include <net/tcp.h>
-#include <net/route.h>
 
-#include <linux/netfilter_ipv4.h>
 #include <net/netfilter/nf_conntrack.h>
 #include <net/netfilter/nf_conntrack_helper.h>
 #include <net/netfilter/nf_conntrack_ecache.h>
 #include <net/netfilter/nf_conntrack_expect.h>
 #include <net/netfilter/nf_nat.h>
-#include <net/netfilter/nf_nat_protocol.h>
+#include <net/netfilter/nf_nat_l3proto.h>
+#include <net/netfilter/nf_nat_l4proto.h>
 #include <net/netfilter/nf_nat_core.h>
 #include <net/netfilter/nf_nat_helper.h>
 
@@ -90,7 +86,6 @@ s16 nf_nat_get_offset(const struct nf_conn *ct,
 
         return offset;
 }
-EXPORT_SYMBOL_GPL(nf_nat_get_offset);
 
 /* Frobs data inside this packet, which is linear. */
 static void mangle_contents(struct sk_buff *skb,
@@ -125,9 +120,13 @@ static void mangle_contents(struct sk_buff *skb,
                 __skb_trim(skb, skb->len + rep_len - match_len);
         }
 
-        /* fix IP hdr checksum information */
-        ip_hdr(skb)->tot_len = htons(skb->len);
-        ip_send_check(ip_hdr(skb));
+        if (nf_ct_l3num((struct nf_conn *)skb->nfct) == NFPROTO_IPV4) {
+                /* fix IP hdr checksum information */
+                ip_hdr(skb)->tot_len = htons(skb->len);
+                ip_send_check(ip_hdr(skb));
+        } else
+                ipv6_hdr(skb)->payload_len =
+                        htons(skb->len - sizeof(struct ipv6hdr));
 }
 
 /* Unusual, but possible case. */
@@ -166,35 +165,6 @@ void nf_nat_tcp_seq_adjust(struct sk_buff *skb, struct nf_conn *ct,
 }
 EXPORT_SYMBOL_GPL(nf_nat_tcp_seq_adjust);
 
-static void nf_nat_csum(struct sk_buff *skb, const struct iphdr *iph, void *data,
-                        int datalen, __sum16 *check, int oldlen)
-{
-        struct rtable *rt = skb_rtable(skb);
-
-        if (skb->ip_summed != CHECKSUM_PARTIAL) {
-                if (!(rt->rt_flags & RTCF_LOCAL) &&
-                    (!skb->dev || skb->dev->features & NETIF_F_V4_CSUM)) {
-                        skb->ip_summed = CHECKSUM_PARTIAL;
-                        skb->csum_start = skb_headroom(skb) +
-                                          skb_network_offset(skb) +
-                                          iph->ihl * 4;
-                        skb->csum_offset = (void *)check - data;
-                        *check = ~csum_tcpudp_magic(iph->saddr, iph->daddr,
-                                                    datalen, iph->protocol, 0);
-                } else {
-                        *check = 0;
-                        *check = csum_tcpudp_magic(iph->saddr, iph->daddr,
-                                                   datalen, iph->protocol,
-                                                   csum_partial(data, datalen,
-                                                                0));
-                        if (iph->protocol == IPPROTO_UDP && !*check)
-                                *check = CSUM_MANGLED_0;
-                }
-        } else
-                inet_proto_csum_replace2(check, skb,
-                                         htons(oldlen), htons(datalen), 1);
-}
-
 /* Generic function for mangling variable-length address changes inside
  * NATed TCP connections (like the PORT XXX,XXX,XXX,XXX,XXX,XXX
  * command in FTP).
@@ -206,12 +176,13 @@ static void nf_nat_csum(struct sk_buff *skb, const struct iphdr *iph, void *data
 int __nf_nat_mangle_tcp_packet(struct sk_buff *skb,
                                struct nf_conn *ct,
                                enum ip_conntrack_info ctinfo,
+                               unsigned int protoff,
                                unsigned int match_offset,
                                unsigned int match_len,
                                const char *rep_buffer,
                                unsigned int rep_len, bool adjust)
 {
-        struct iphdr *iph;
+        const struct nf_nat_l3proto *l3proto;
         struct tcphdr *tcph;
         int oldlen, datalen;
 
@@ -225,15 +196,17 @@ int __nf_nat_mangle_tcp_packet(struct sk_buff *skb,
 
         SKB_LINEAR_ASSERT(skb);
 
-        iph = ip_hdr(skb);
-        tcph = (void *)iph + iph->ihl*4;
+        tcph = (void *)skb->data + protoff;
 
-        oldlen = skb->len - iph->ihl*4;
-        mangle_contents(skb, iph->ihl*4 + tcph->doff*4,
+        oldlen = skb->len - protoff;
+        mangle_contents(skb, protoff + tcph->doff*4,
                         match_offset, match_len, rep_buffer, rep_len);
 
-        datalen = skb->len - iph->ihl*4;
-        nf_nat_csum(skb, iph, tcph, datalen, &tcph->check, oldlen);
+        datalen = skb->len - protoff;
+
+        l3proto = __nf_nat_l3proto_find(nf_ct_l3num(ct));
+        l3proto->csum_recalc(skb, IPPROTO_TCP, tcph, &tcph->check,
+                             datalen, oldlen);
 
         if (adjust && rep_len != match_len)
                 nf_nat_set_seq_adjust(ct, ctinfo, tcph->seq,
@@ -257,12 +230,13 @@ int
 nf_nat_mangle_udp_packet(struct sk_buff *skb,
                          struct nf_conn *ct,
                          enum ip_conntrack_info ctinfo,
+                         unsigned int protoff,
                          unsigned int match_offset,
                          unsigned int match_len,
                          const char *rep_buffer,
                          unsigned int rep_len)
 {
-        struct iphdr *iph;
+        const struct nf_nat_l3proto *l3proto;
         struct udphdr *udph;
         int datalen, oldlen;
 
@@ -274,22 +248,23 @@ nf_nat_mangle_udp_packet(struct sk_buff *skb,
             !enlarge_skb(skb, rep_len - match_len))
                 return 0;
 
-        iph = ip_hdr(skb);
-        udph = (void *)iph + iph->ihl*4;
+        udph = (void *)skb->data + protoff;
 
-        oldlen = skb->len - iph->ihl*4;
-        mangle_contents(skb, iph->ihl*4 + sizeof(*udph),
+        oldlen = skb->len - protoff;
+        mangle_contents(skb, protoff + sizeof(*udph),
                         match_offset, match_len, rep_buffer, rep_len);
 
         /* update the length of the UDP packet */
-        datalen = skb->len - iph->ihl*4;
+        datalen = skb->len - protoff;
         udph->len = htons(datalen);
 
         /* fix udp checksum if udp checksum was previously calculated */
         if (!udph->check && skb->ip_summed != CHECKSUM_PARTIAL)
                 return 1;
 
-        nf_nat_csum(skb, iph, udph, datalen, &udph->check, oldlen);
+        l3proto = __nf_nat_l3proto_find(nf_ct_l3num(ct));
+        l3proto->csum_recalc(skb, IPPROTO_UDP, udph, &udph->check,
+                             datalen, oldlen);
 
         return 1;
 }
@@ -341,6 +316,7 @@ sack_adjust(struct sk_buff *skb,
 /* TCP SACK sequence number adjustment */
 static inline unsigned int
 nf_nat_sack_adjust(struct sk_buff *skb,
+                   unsigned int protoff,
                    struct tcphdr *tcph,
                    struct nf_conn *ct,
                    enum ip_conntrack_info ctinfo)
@@ -348,8 +324,8 @@ nf_nat_sack_adjust(struct sk_buff *skb,
         unsigned int dir, optoff, optend;
         struct nf_conn_nat *nat = nfct_nat(ct);
 
-        optoff = ip_hdrlen(skb) + sizeof(struct tcphdr);
-        optend = ip_hdrlen(skb) + tcph->doff * 4;
+        optoff = protoff + sizeof(struct tcphdr);
+        optend = protoff + tcph->doff * 4;
 
         if (!skb_make_writable(skb, optend))
                 return 0;
@@ -387,7 +363,8 @@ nf_nat_sack_adjust(struct sk_buff *skb,
 int
 nf_nat_seq_adjust(struct sk_buff *skb,
                   struct nf_conn *ct,
-                  enum ip_conntrack_info ctinfo)
+                  enum ip_conntrack_info ctinfo,
+                  unsigned int protoff)
 {
         struct tcphdr *tcph;
         int dir;
@@ -401,10 +378,10 @@ nf_nat_seq_adjust(struct sk_buff *skb,
         this_way = &nat->seq[dir];
         other_way = &nat->seq[!dir];
 
-        if (!skb_make_writable(skb, ip_hdrlen(skb) + sizeof(*tcph)))
+        if (!skb_make_writable(skb, protoff + sizeof(*tcph)))
                 return 0;
 
-        tcph = (void *)skb->data + ip_hdrlen(skb);
+        tcph = (void *)skb->data + protoff;
         if (after(ntohl(tcph->seq), this_way->correction_pos))
                 seqoff = this_way->offset_after;
         else
@@ -429,7 +406,7 @@ nf_nat_seq_adjust(struct sk_buff *skb,
         tcph->seq = newseq;
         tcph->ack_seq = newack;
 
-        return nf_nat_sack_adjust(skb, tcph, ct, ctinfo);
+        return nf_nat_sack_adjust(skb, protoff, tcph, ct, ctinfo);
 }
 
 /* Setup NAT on this expected conntrack so it follows master. */
@@ -437,22 +414,22 @@ nf_nat_seq_adjust(struct sk_buff *skb,
 void nf_nat_follow_master(struct nf_conn *ct,
                           struct nf_conntrack_expect *exp)
 {
-        struct nf_nat_ipv4_range range;
+        struct nf_nat_range range;
 
         /* This must be a fresh one. */
         BUG_ON(ct->status & IPS_NAT_DONE_MASK);
 
         /* Change src to where master sends to */
         range.flags = NF_NAT_RANGE_MAP_IPS;
-        range.min_ip = range.max_ip
-                = ct->master->tuplehash[!exp->dir].tuple.dst.u3.ip;
+        range.min_addr = range.max_addr
+                = ct->master->tuplehash[!exp->dir].tuple.dst.u3;
         nf_nat_setup_info(ct, &range, NF_NAT_MANIP_SRC);
 
         /* For DST manip, map port here to where it's expected. */
         range.flags = (NF_NAT_RANGE_MAP_IPS | NF_NAT_RANGE_PROTO_SPECIFIED);
-        range.min = range.max = exp->saved_proto;
-        range.min_ip = range.max_ip
-                = ct->master->tuplehash[!exp->dir].tuple.src.u3.ip;
+        range.min_proto = range.max_proto = exp->saved_proto;
+        range.min_addr = range.max_addr
+                = ct->master->tuplehash[!exp->dir].tuple.src.u3;
         nf_nat_setup_info(ct, &range, NF_NAT_MANIP_DST);
 }
 EXPORT_SYMBOL(nf_nat_follow_master);
diff --git a/net/ipv4/netfilter/nf_nat_irc.c b/net/netfilter/nf_nat_irc.c
index 979ae165f4ef..1fedee6e7fb6 100644
--- a/net/ipv4/netfilter/nf_nat_irc.c
+++ b/net/netfilter/nf_nat_irc.c
@@ -17,7 +17,6 @@
 
 #include <net/netfilter/nf_nat.h>
 #include <net/netfilter/nf_nat_helper.h>
-#include <net/netfilter/nf_nat_rule.h>
 #include <net/netfilter/nf_conntrack_helper.h>
 #include <net/netfilter/nf_conntrack_expect.h>
 #include <linux/netfilter/nf_conntrack_irc.h>
@@ -29,12 +28,12 @@ MODULE_ALIAS("ip_nat_irc");
 
 static unsigned int help(struct sk_buff *skb,
                          enum ip_conntrack_info ctinfo,
+                         unsigned int protoff,
                          unsigned int matchoff,
                          unsigned int matchlen,
                          struct nf_conntrack_expect *exp)
 {
         char buffer[sizeof("4294967296 65635")];
-        u_int32_t ip;
         u_int16_t port;
         unsigned int ret;
 
@@ -60,13 +59,8 @@ static unsigned int help(struct sk_buff *skb,
         if (port == 0)
                 return NF_DROP;
 
-        ip = ntohl(exp->master->tuplehash[IP_CT_DIR_REPLY].tuple.dst.u3.ip);
-        sprintf(buffer, "%u %u", ip, port);
-        pr_debug("nf_nat_irc: inserting '%s' == %pI4, port %u\n",
-                 buffer, &ip, port);
-
         ret = nf_nat_mangle_tcp_packet(skb, exp->master, ctinfo,
-                                       matchoff, matchlen, buffer,
+                                       protoff, matchoff, matchlen, buffer,
                                        strlen(buffer));
         if (ret != NF_ACCEPT)
                 nf_ct_unexpect_related(exp);
diff --git a/net/ipv4/netfilter/nf_nat_proto_common.c b/net/netfilter/nf_nat_proto_common.c
index 9993bc93e102..9baaf734c142 100644
--- a/net/ipv4/netfilter/nf_nat_proto_common.c
+++ b/net/netfilter/nf_nat_proto_common.c
@@ -9,20 +9,18 @@
 
 #include <linux/types.h>
 #include <linux/random.h>
-#include <linux/ip.h>
-
 #include <linux/netfilter.h>
 #include <linux/export.h>
-#include <net/secure_seq.h>
+
 #include <net/netfilter/nf_nat.h>
 #include <net/netfilter/nf_nat_core.h>
-#include <net/netfilter/nf_nat_rule.h>
-#include <net/netfilter/nf_nat_protocol.h>
+#include <net/netfilter/nf_nat_l3proto.h>
+#include <net/netfilter/nf_nat_l4proto.h>
 
-bool nf_nat_proto_in_range(const struct nf_conntrack_tuple *tuple,
-                           enum nf_nat_manip_type maniptype,
-                           const union nf_conntrack_man_proto *min,
-                           const union nf_conntrack_man_proto *max)
+bool nf_nat_l4proto_in_range(const struct nf_conntrack_tuple *tuple,
+                             enum nf_nat_manip_type maniptype,
+                             const union nf_conntrack_man_proto *min,
+                             const union nf_conntrack_man_proto *max)
 {
         __be16 port;
 
@@ -34,13 +32,14 @@ bool nf_nat_proto_in_range(const struct nf_conntrack_tuple *tuple,
         return ntohs(port) >= ntohs(min->all) &&
                ntohs(port) <= ntohs(max->all);
 }
-EXPORT_SYMBOL_GPL(nf_nat_proto_in_range);
+EXPORT_SYMBOL_GPL(nf_nat_l4proto_in_range);
 
-void nf_nat_proto_unique_tuple(struct nf_conntrack_tuple *tuple,
-                               const struct nf_nat_ipv4_range *range,
-                               enum nf_nat_manip_type maniptype,
-                               const struct nf_conn *ct,
-                               u_int16_t *rover)
+void nf_nat_l4proto_unique_tuple(const struct nf_nat_l3proto *l3proto,
+                                 struct nf_conntrack_tuple *tuple,
+                                 const struct nf_nat_range *range,
+                                 enum nf_nat_manip_type maniptype,
+                                 const struct nf_conn *ct,
+                                 u16 *rover)
 {
         unsigned int range_size, min, i;
         __be16 *portptr;
@@ -71,15 +70,14 @@ void nf_nat_proto_unique_tuple(struct nf_conntrack_tuple *tuple,
                         range_size = 65535 - 1024 + 1;
                 }
         } else {
-                min = ntohs(range->min.all);
-                range_size = ntohs(range->max.all) - min + 1;
+                min = ntohs(range->min_proto.all);
+                range_size = ntohs(range->max_proto.all) - min + 1;
         }
 
         if (range->flags & NF_NAT_RANGE_PROTO_RANDOM)
-                off = secure_ipv4_port_ephemeral(tuple->src.u3.ip, tuple->dst.u3.ip,
-                                                 maniptype == NF_NAT_MANIP_SRC
-                                                 ? tuple->dst.u.all
-                                                 : tuple->src.u.all);
+                off = l3proto->secure_port(tuple, maniptype == NF_NAT_MANIP_SRC
+                                                  ? tuple->dst.u.all
+                                                  : tuple->src.u.all);
         else
                 off = *rover;
 
@@ -93,22 +91,22 @@ void nf_nat_proto_unique_tuple(struct nf_conntrack_tuple *tuple,
         }
         return;
 }
-EXPORT_SYMBOL_GPL(nf_nat_proto_unique_tuple);
+EXPORT_SYMBOL_GPL(nf_nat_l4proto_unique_tuple);
 
 #if defined(CONFIG_NF_CT_NETLINK) || defined(CONFIG_NF_CT_NETLINK_MODULE)
-int nf_nat_proto_nlattr_to_range(struct nlattr *tb[],
-                                 struct nf_nat_ipv4_range *range)
+int nf_nat_l4proto_nlattr_to_range(struct nlattr *tb[],
+                                   struct nf_nat_range *range)
 {
         if (tb[CTA_PROTONAT_PORT_MIN]) {
-                range->min.all = nla_get_be16(tb[CTA_PROTONAT_PORT_MIN]);
-                range->max.all = range->min.tcp.port;
+                range->min_proto.all = nla_get_be16(tb[CTA_PROTONAT_PORT_MIN]);
+                range->max_proto.all = range->min_proto.all;
                 range->flags |= NF_NAT_RANGE_PROTO_SPECIFIED;
         }
         if (tb[CTA_PROTONAT_PORT_MAX]) {
-                range->max.all = nla_get_be16(tb[CTA_PROTONAT_PORT_MAX]);
+                range->max_proto.all = nla_get_be16(tb[CTA_PROTONAT_PORT_MAX]);
                 range->flags |= NF_NAT_RANGE_PROTO_SPECIFIED;
         }
         return 0;
 }
-EXPORT_SYMBOL_GPL(nf_nat_proto_nlattr_to_range);
+EXPORT_SYMBOL_GPL(nf_nat_l4proto_nlattr_to_range);
 #endif
diff --git a/net/ipv4/netfilter/nf_nat_proto_dccp.c b/net/netfilter/nf_nat_proto_dccp.c
index 3f67138d187c..c8be2cdac0bf 100644
--- a/net/ipv4/netfilter/nf_nat_proto_dccp.c
+++ b/net/netfilter/nf_nat_proto_dccp.c
@@ -1,7 +1,7 @@
 /*
  * DCCP NAT protocol helper
  *
- * Copyright (c) 2005, 2006. 2008 Patrick McHardy <kaber@trash.net>
+ * Copyright (c) 2005, 2006, 2008 Patrick McHardy <kaber@trash.net>
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License version 2 as
@@ -13,35 +13,34 @@
 #include <linux/module.h>
 #include <linux/init.h>
 #include <linux/skbuff.h>
-#include <linux/ip.h>
 #include <linux/dccp.h>
 
 #include <net/netfilter/nf_conntrack.h>
 #include <net/netfilter/nf_nat.h>
-#include <net/netfilter/nf_nat_protocol.h>
+#include <net/netfilter/nf_nat_l3proto.h>
+#include <net/netfilter/nf_nat_l4proto.h>
 
 static u_int16_t dccp_port_rover;
 
 static void
-dccp_unique_tuple(struct nf_conntrack_tuple *tuple,
-                  const struct nf_nat_ipv4_range *range,
+dccp_unique_tuple(const struct nf_nat_l3proto *l3proto,
+                  struct nf_conntrack_tuple *tuple,
+                  const struct nf_nat_range *range,
                   enum nf_nat_manip_type maniptype,
                   const struct nf_conn *ct)
 {
-        nf_nat_proto_unique_tuple(tuple, range, maniptype, ct,
-                                  &dccp_port_rover);
+        nf_nat_l4proto_unique_tuple(l3proto, tuple, range, maniptype, ct,
+                                    &dccp_port_rover);
 }
 
 static bool
 dccp_manip_pkt(struct sk_buff *skb,
-               unsigned int iphdroff,
+               const struct nf_nat_l3proto *l3proto,
+               unsigned int iphdroff, unsigned int hdroff,
                const struct nf_conntrack_tuple *tuple,
                enum nf_nat_manip_type maniptype)
 {
-        const struct iphdr *iph = (const void *)(skb->data + iphdroff);
         struct dccp_hdr *hdr;
-        unsigned int hdroff = iphdroff + iph->ihl * 4;
-        __be32 oldip, newip;
         __be16 *portptr, oldport, newport;
         int hdrsize = 8; /* DCCP connection tracking guarantees this much */
 
@@ -51,17 +50,12 @@ dccp_manip_pkt(struct sk_buff *skb,
         if (!skb_make_writable(skb, hdroff + hdrsize))
                 return false;
 
-        iph = (struct iphdr *)(skb->data + iphdroff);
         hdr = (struct dccp_hdr *)(skb->data + hdroff);
 
         if (maniptype == NF_NAT_MANIP_SRC) {
-                oldip = iph->saddr;
-                newip = tuple->src.u3.ip;
                 newport = tuple->src.u.dccp.port;
                 portptr = &hdr->dccph_sport;
         } else {
-                oldip = iph->daddr;
-                newip = tuple->dst.u3.ip;
                 newport = tuple->dst.u.dccp.port;
                 portptr = &hdr->dccph_dport;
         }
@@ -72,30 +66,46 @@ dccp_manip_pkt(struct sk_buff *skb,
         if (hdrsize < sizeof(*hdr))
                 return true;
 
-        inet_proto_csum_replace4(&hdr->dccph_checksum, skb, oldip, newip, 1);
+        l3proto->csum_update(skb, iphdroff, &hdr->dccph_checksum,
+                             tuple, maniptype);
         inet_proto_csum_replace2(&hdr->dccph_checksum, skb, oldport, newport,
                                  0);
         return true;
 }
 
-static const struct nf_nat_protocol nf_nat_protocol_dccp = {
-        .protonum               = IPPROTO_DCCP,
+static const struct nf_nat_l4proto nf_nat_l4proto_dccp = {
+        .l4proto                = IPPROTO_DCCP,
         .manip_pkt              = dccp_manip_pkt,
-        .in_range               = nf_nat_proto_in_range,
+        .in_range               = nf_nat_l4proto_in_range,
         .unique_tuple           = dccp_unique_tuple,
 #if defined(CONFIG_NF_CT_NETLINK) || defined(CONFIG_NF_CT_NETLINK_MODULE)
-        .nlattr_to_range        = nf_nat_proto_nlattr_to_range,
+        .nlattr_to_range        = nf_nat_l4proto_nlattr_to_range,
 #endif
 };
 
 static int __init nf_nat_proto_dccp_init(void)
 {
-        return nf_nat_protocol_register(&nf_nat_protocol_dccp);
+        int err;
+
+        err = nf_nat_l4proto_register(NFPROTO_IPV4, &nf_nat_l4proto_dccp);
+        if (err < 0)
+                goto err1;
+        err = nf_nat_l4proto_register(NFPROTO_IPV6, &nf_nat_l4proto_dccp);
+        if (err < 0)
+                goto err2;
+        return 0;
+
+err2:
+        nf_nat_l4proto_unregister(NFPROTO_IPV4, &nf_nat_l4proto_dccp);
+err1:
+        return err;
 }
 
 static void __exit nf_nat_proto_dccp_fini(void)
 {
-        nf_nat_protocol_unregister(&nf_nat_protocol_dccp);
+        nf_nat_l4proto_unregister(NFPROTO_IPV6, &nf_nat_l4proto_dccp);
+        nf_nat_l4proto_unregister(NFPROTO_IPV4, &nf_nat_l4proto_dccp);
+
 }
 
 module_init(nf_nat_proto_dccp_init);
diff --git a/net/ipv4/netfilter/nf_nat_proto_sctp.c b/net/netfilter/nf_nat_proto_sctp.c
index 3cce9b6c1c29..e64faa5ca893 100644
--- a/net/ipv4/netfilter/nf_nat_proto_sctp.c
+++ b/net/netfilter/nf_nat_proto_sctp.c
@@ -8,53 +8,46 @@
 
 #include <linux/types.h>
 #include <linux/init.h>
-#include <linux/ip.h>
 #include <linux/sctp.h>
 #include <linux/module.h>
 #include <net/sctp/checksum.h>
 
-#include <net/netfilter/nf_nat_protocol.h>
+#include <net/netfilter/nf_nat_l4proto.h>
 
 static u_int16_t nf_sctp_port_rover;
 
 static void
-sctp_unique_tuple(struct nf_conntrack_tuple *tuple,
-                  const struct nf_nat_ipv4_range *range,
+sctp_unique_tuple(const struct nf_nat_l3proto *l3proto,
+                  struct nf_conntrack_tuple *tuple,
+                  const struct nf_nat_range *range,
                   enum nf_nat_manip_type maniptype,
                   const struct nf_conn *ct)
 {
-        nf_nat_proto_unique_tuple(tuple, range, maniptype, ct,
-                                  &nf_sctp_port_rover);
+        nf_nat_l4proto_unique_tuple(l3proto, tuple, range, maniptype, ct,
+                                    &nf_sctp_port_rover);
 }
 
 static bool
 sctp_manip_pkt(struct sk_buff *skb,
-               unsigned int iphdroff,
+               const struct nf_nat_l3proto *l3proto,
+               unsigned int iphdroff, unsigned int hdroff,
                const struct nf_conntrack_tuple *tuple,
                enum nf_nat_manip_type maniptype)
 {
-        const struct iphdr *iph = (struct iphdr *)(skb->data + iphdroff);
         struct sk_buff *frag;
         sctp_sctphdr_t *hdr;
-        unsigned int hdroff = iphdroff + iph->ihl*4;
-        __be32 oldip, newip;
         __be32 crc32;
 
         if (!skb_make_writable(skb, hdroff + sizeof(*hdr)))
                 return false;
 
-        iph = (struct iphdr *)(skb->data + iphdroff);
         hdr = (struct sctphdr *)(skb->data + hdroff);
 
         if (maniptype == NF_NAT_MANIP_SRC) {
-                /* Get rid of src ip and src pt */
-                oldip = iph->saddr;
-                newip = tuple->src.u3.ip;
+                /* Get rid of src port */
                 hdr->source = tuple->src.u.sctp.port;
         } else {
-                /* Get rid of dst ip and dst pt */
-                oldip = iph->daddr;
-                newip = tuple->dst.u3.ip;
+                /* Get rid of dst port */
                 hdr->dest = tuple->dst.u.sctp.port;
         }
 
@@ -68,24 +61,38 @@ sctp_manip_pkt(struct sk_buff *skb,
         return true;
 }
 
-static const struct nf_nat_protocol nf_nat_protocol_sctp = {
-        .protonum               = IPPROTO_SCTP,
+static const struct nf_nat_l4proto nf_nat_l4proto_sctp = {
+        .l4proto                = IPPROTO_SCTP,
         .manip_pkt              = sctp_manip_pkt,
-        .in_range               = nf_nat_proto_in_range,
+        .in_range               = nf_nat_l4proto_in_range,
         .unique_tuple           = sctp_unique_tuple,
 #if defined(CONFIG_NF_CT_NETLINK) || defined(CONFIG_NF_CT_NETLINK_MODULE)
-        .nlattr_to_range        = nf_nat_proto_nlattr_to_range,
+        .nlattr_to_range        = nf_nat_l4proto_nlattr_to_range,
 #endif
 };
 
 static int __init nf_nat_proto_sctp_init(void)
 {
-        return nf_nat_protocol_register(&nf_nat_protocol_sctp);
+        int err;
+
+        err = nf_nat_l4proto_register(NFPROTO_IPV4, &nf_nat_l4proto_sctp);
+        if (err < 0)
+                goto err1;
+        err = nf_nat_l4proto_register(NFPROTO_IPV6, &nf_nat_l4proto_sctp);
+        if (err < 0)
+                goto err2;
+        return 0;
+
+err2:
+        nf_nat_l4proto_unregister(NFPROTO_IPV4, &nf_nat_l4proto_sctp);
+err1:
+        return err;
 }
 
 static void __exit nf_nat_proto_sctp_exit(void)
 {
-        nf_nat_protocol_unregister(&nf_nat_protocol_sctp);
+        nf_nat_l4proto_unregister(NFPROTO_IPV6, &nf_nat_l4proto_sctp);
+        nf_nat_l4proto_unregister(NFPROTO_IPV4, &nf_nat_l4proto_sctp);
 }
 
 module_init(nf_nat_proto_sctp_init);
diff --git a/net/ipv4/netfilter/nf_nat_proto_tcp.c b/net/netfilter/nf_nat_proto_tcp.c
index 9fb4b4e72bbf..83ec8a6e4c36 100644
--- a/net/ipv4/netfilter/nf_nat_proto_tcp.c
+++ b/net/netfilter/nf_nat_proto_tcp.c
@@ -9,37 +9,36 @@
 #include <linux/types.h>
 #include <linux/init.h>
 #include <linux/export.h>
-#include <linux/ip.h>
 #include <linux/tcp.h>
 
 #include <linux/netfilter.h>
 #include <linux/netfilter/nfnetlink_conntrack.h>
 #include <net/netfilter/nf_nat.h>
-#include <net/netfilter/nf_nat_rule.h>
-#include <net/netfilter/nf_nat_protocol.h>
+#include <net/netfilter/nf_nat_l3proto.h>
+#include <net/netfilter/nf_nat_l4proto.h>
 #include <net/netfilter/nf_nat_core.h>
 
-static u_int16_t tcp_port_rover;
+static u16 tcp_port_rover;
 
 static void
-tcp_unique_tuple(struct nf_conntrack_tuple *tuple,
-                 const struct nf_nat_ipv4_range *range,
+tcp_unique_tuple(const struct nf_nat_l3proto *l3proto,
+                 struct nf_conntrack_tuple *tuple,
+                 const struct nf_nat_range *range,
                  enum nf_nat_manip_type maniptype,
                  const struct nf_conn *ct)
 {
-        nf_nat_proto_unique_tuple(tuple, range, maniptype, ct, &tcp_port_rover);
+        nf_nat_l4proto_unique_tuple(l3proto, tuple, range, maniptype, ct,
+                                    &tcp_port_rover);
 }
 
 static bool
 tcp_manip_pkt(struct sk_buff *skb,
-              unsigned int iphdroff,
+              const struct nf_nat_l3proto *l3proto,
+              unsigned int iphdroff, unsigned int hdroff,
               const struct nf_conntrack_tuple *tuple,
               enum nf_nat_manip_type maniptype)
 {
-        const struct iphdr *iph = (struct iphdr *)(skb->data + iphdroff);
         struct tcphdr *hdr;
-        unsigned int hdroff = iphdroff + iph->ihl*4;
-        __be32 oldip, newip;
         __be16 *portptr, newport, oldport;
         int hdrsize = 8; /* TCP connection tracking guarantees this much */
 
@@ -52,19 +51,14 @@ tcp_manip_pkt(struct sk_buff *skb,
         if (!skb_make_writable(skb, hdroff + hdrsize))
                 return false;
 
-        iph = (struct iphdr *)(skb->data + iphdroff);
         hdr = (struct tcphdr *)(skb->data + hdroff);
 
         if (maniptype == NF_NAT_MANIP_SRC) {
-                /* Get rid of src ip and src pt */
-                oldip = iph->saddr;
-                newip = tuple->src.u3.ip;
+                /* Get rid of src port */
                 newport = tuple->src.u.tcp.port;
                 portptr = &hdr->source;
         } else {
-                /* Get rid of dst ip and dst pt */
-                oldip = iph->daddr;
-                newip = tuple->dst.u3.ip;
+                /* Get rid of dst port */
                 newport = tuple->dst.u.tcp.port;
                 portptr = &hdr->dest;
         }
@@ -75,17 +69,17 @@ tcp_manip_pkt(struct sk_buff *skb,
         if (hdrsize < sizeof(*hdr))
                 return true;
 
-        inet_proto_csum_replace4(&hdr->check, skb, oldip, newip, 1);
+        l3proto->csum_update(skb, iphdroff, &hdr->check, tuple, maniptype);
         inet_proto_csum_replace2(&hdr->check, skb, oldport, newport, 0);
         return true;
 }
 
-const struct nf_nat_protocol nf_nat_protocol_tcp = {
-        .protonum               = IPPROTO_TCP,
+const struct nf_nat_l4proto nf_nat_l4proto_tcp = {
+        .l4proto                = IPPROTO_TCP,
         .manip_pkt              = tcp_manip_pkt,
-        .in_range               = nf_nat_proto_in_range,
+        .in_range               = nf_nat_l4proto_in_range,
         .unique_tuple           = tcp_unique_tuple,
 #if defined(CONFIG_NF_CT_NETLINK) || defined(CONFIG_NF_CT_NETLINK_MODULE)
-        .nlattr_to_range        = nf_nat_proto_nlattr_to_range,
+        .nlattr_to_range        = nf_nat_l4proto_nlattr_to_range,
 #endif
 };
diff --git a/net/ipv4/netfilter/nf_nat_proto_udp.c b/net/netfilter/nf_nat_proto_udp.c
index 9883336e628f..7df613fb34a2 100644
--- a/net/ipv4/netfilter/nf_nat_proto_udp.c
+++ b/net/netfilter/nf_nat_proto_udp.c
@@ -9,59 +9,53 @@
 #include <linux/types.h>
 #include <linux/export.h>
 #include <linux/init.h>
-#include <linux/ip.h>
 #include <linux/udp.h>
 
 #include <linux/netfilter.h>
 #include <net/netfilter/nf_nat.h>
 #include <net/netfilter/nf_nat_core.h>
-#include <net/netfilter/nf_nat_rule.h>
-#include <net/netfilter/nf_nat_protocol.h>
+#include <net/netfilter/nf_nat_l3proto.h>
+#include <net/netfilter/nf_nat_l4proto.h>
 
-static u_int16_t udp_port_rover;
+static u16 udp_port_rover;
 
 static void
-udp_unique_tuple(struct nf_conntrack_tuple *tuple,
-                 const struct nf_nat_ipv4_range *range,
+udp_unique_tuple(const struct nf_nat_l3proto *l3proto,
+                 struct nf_conntrack_tuple *tuple,
+                 const struct nf_nat_range *range,
                  enum nf_nat_manip_type maniptype,
                  const struct nf_conn *ct)
 {
-        nf_nat_proto_unique_tuple(tuple, range, maniptype, ct, &udp_port_rover);
+        nf_nat_l4proto_unique_tuple(l3proto, tuple, range, maniptype, ct,
+                                    &udp_port_rover);
 }
 
 static bool
 udp_manip_pkt(struct sk_buff *skb,
-              unsigned int iphdroff,
+              const struct nf_nat_l3proto *l3proto,
+              unsigned int iphdroff, unsigned int hdroff,
               const struct nf_conntrack_tuple *tuple,
               enum nf_nat_manip_type maniptype)
 {
-        const struct iphdr *iph = (struct iphdr *)(skb->data + iphdroff);
         struct udphdr *hdr;
-        unsigned int hdroff = iphdroff + iph->ihl*4;
-        __be32 oldip, newip;
         __be16 *portptr, newport;
 
         if (!skb_make_writable(skb, hdroff + sizeof(*hdr)))
                 return false;
-
-        iph = (struct iphdr *)(skb->data + iphdroff);
         hdr = (struct udphdr *)(skb->data + hdroff);
 
         if (maniptype == NF_NAT_MANIP_SRC) {
-                /* Get rid of src ip and src pt */
-                oldip = iph->saddr;
-                newip = tuple->src.u3.ip;
+                /* Get rid of src port */
                 newport = tuple->src.u.udp.port;
                 portptr = &hdr->source;
         } else {
-                /* Get rid of dst ip and dst pt */
-                oldip = iph->daddr;
-                newip = tuple->dst.u3.ip;
+                /* Get rid of dst port */
                 newport = tuple->dst.u.udp.port;
                 portptr = &hdr->dest;
         }
         if (hdr->check || skb->ip_summed == CHECKSUM_PARTIAL) {
-                inet_proto_csum_replace4(&hdr->check, skb, oldip, newip, 1);
+                l3proto->csum_update(skb, iphdroff, &hdr->check,
+                                     tuple, maniptype);
                 inet_proto_csum_replace2(&hdr->check, skb, *portptr, newport,
                                          0);
                 if (!hdr->check)
@@ -71,12 +65,12 @@ udp_manip_pkt(struct sk_buff *skb,
         return true;
 }
 
-const struct nf_nat_protocol nf_nat_protocol_udp = {
-        .protonum               = IPPROTO_UDP,
+const struct nf_nat_l4proto nf_nat_l4proto_udp = {
+        .l4proto                = IPPROTO_UDP,
         .manip_pkt              = udp_manip_pkt,
-        .in_range               = nf_nat_proto_in_range,
+        .in_range               = nf_nat_l4proto_in_range,
         .unique_tuple           = udp_unique_tuple,
 #if defined(CONFIG_NF_CT_NETLINK) || defined(CONFIG_NF_CT_NETLINK_MODULE)
-        .nlattr_to_range        = nf_nat_proto_nlattr_to_range,
+        .nlattr_to_range        = nf_nat_l4proto_nlattr_to_range,
 #endif
 };
diff --git a/net/ipv4/netfilter/nf_nat_proto_udplite.c b/net/netfilter/nf_nat_proto_udplite.c
index d24d10a7beb2..776a0d1317b1 100644
--- a/net/ipv4/netfilter/nf_nat_proto_udplite.c
+++ b/net/netfilter/nf_nat_proto_udplite.c
@@ -9,59 +9,53 @@
 
 #include <linux/types.h>
 #include <linux/init.h>
-#include <linux/ip.h>
 #include <linux/udp.h>
 
 #include <linux/netfilter.h>
 #include <linux/module.h>
 #include <net/netfilter/nf_nat.h>
-#include <net/netfilter/nf_nat_protocol.h>
+#include <net/netfilter/nf_nat_l3proto.h>
+#include <net/netfilter/nf_nat_l4proto.h>
 
-static u_int16_t udplite_port_rover;
+static u16 udplite_port_rover;
 
 static void
-udplite_unique_tuple(struct nf_conntrack_tuple *tuple,
-                     const struct nf_nat_ipv4_range *range,
+udplite_unique_tuple(const struct nf_nat_l3proto *l3proto,
+                     struct nf_conntrack_tuple *tuple,
+                     const struct nf_nat_range *range,
                      enum nf_nat_manip_type maniptype,
                      const struct nf_conn *ct)
 {
-        nf_nat_proto_unique_tuple(tuple, range, maniptype, ct,
-                                  &udplite_port_rover);
+        nf_nat_l4proto_unique_tuple(l3proto, tuple, range, maniptype, ct,
+                                    &udplite_port_rover);
 }
 
 static bool
 udplite_manip_pkt(struct sk_buff *skb,
-                  unsigned int iphdroff,
+                  const struct nf_nat_l3proto *l3proto,
+                  unsigned int iphdroff, unsigned int hdroff,
                   const struct nf_conntrack_tuple *tuple,
                   enum nf_nat_manip_type maniptype)
 {
-        const struct iphdr *iph = (struct iphdr *)(skb->data + iphdroff);
         struct udphdr *hdr;
-        unsigned int hdroff = iphdroff + iph->ihl*4;
-        __be32 oldip, newip;
         __be16 *portptr, newport;
 
         if (!skb_make_writable(skb, hdroff + sizeof(*hdr)))
                 return false;
 
-        iph = (struct iphdr *)(skb->data + iphdroff);
         hdr = (struct udphdr *)(skb->data + hdroff);
 
         if (maniptype == NF_NAT_MANIP_SRC) {
-                /* Get rid of src ip and src pt */
-                oldip = iph->saddr;
-                newip = tuple->src.u3.ip;
+                /* Get rid of source port */
                 newport = tuple->src.u.udp.port;
                 portptr = &hdr->source;
         } else {
-                /* Get rid of dst ip and dst pt */
-                oldip = iph->daddr;
-                newip = tuple->dst.u3.ip;
+                /* Get rid of dst port */
                 newport = tuple->dst.u.udp.port;
                 portptr = &hdr->dest;
         }
 
-        inet_proto_csum_replace4(&hdr->check, skb, oldip, newip, 1);
+        l3proto->csum_update(skb, iphdroff, &hdr->check, tuple, maniptype);
         inet_proto_csum_replace2(&hdr->check, skb, *portptr, newport, 0);
         if (!hdr->check)
                 hdr->check = CSUM_MANGLED_0;
@@ -70,24 +64,38 @@ udplite_manip_pkt(struct sk_buff *skb,
         return true;
 }
 
-static const struct nf_nat_protocol nf_nat_protocol_udplite = {
-        .protonum               = IPPROTO_UDPLITE,
+static const struct nf_nat_l4proto nf_nat_l4proto_udplite = {
+        .l4proto                = IPPROTO_UDPLITE,
         .manip_pkt              = udplite_manip_pkt,
-        .in_range               = nf_nat_proto_in_range,
+        .in_range               = nf_nat_l4proto_in_range,
         .unique_tuple           = udplite_unique_tuple,
 #if defined(CONFIG_NF_CT_NETLINK) || defined(CONFIG_NF_CT_NETLINK_MODULE)
-        .nlattr_to_range        = nf_nat_proto_nlattr_to_range,
+        .nlattr_to_range        = nf_nat_l4proto_nlattr_to_range,
 #endif
 };
 
 static int __init nf_nat_proto_udplite_init(void)
 {
-        return nf_nat_protocol_register(&nf_nat_protocol_udplite);
+        int err;
+
+        err = nf_nat_l4proto_register(NFPROTO_IPV4, &nf_nat_l4proto_udplite);
+        if (err < 0)
+                goto err1;
+        err = nf_nat_l4proto_register(NFPROTO_IPV6, &nf_nat_l4proto_udplite);
+        if (err < 0)
+                goto err2;
+        return 0;
+
+err2:
+        nf_nat_l4proto_unregister(NFPROTO_IPV4, &nf_nat_l4proto_udplite);
+err1:
+        return err;
 }
 
 static void __exit nf_nat_proto_udplite_fini(void)
 {
-        nf_nat_protocol_unregister(&nf_nat_protocol_udplite);
+        nf_nat_l4proto_unregister(NFPROTO_IPV6, &nf_nat_l4proto_udplite);
+        nf_nat_l4proto_unregister(NFPROTO_IPV4, &nf_nat_l4proto_udplite);
 }
 
 module_init(nf_nat_proto_udplite_init);
diff --git a/net/ipv4/netfilter/nf_nat_proto_unknown.c b/net/netfilter/nf_nat_proto_unknown.c
index e0afe8112b1c..6e494d584412 100644
--- a/net/ipv4/netfilter/nf_nat_proto_unknown.c
+++ b/net/netfilter/nf_nat_proto_unknown.c
@@ -15,8 +15,7 @@
 
 #include <linux/netfilter.h>
 #include <net/netfilter/nf_nat.h>
-#include <net/netfilter/nf_nat_rule.h>
-#include <net/netfilter/nf_nat_protocol.h>
+#include <net/netfilter/nf_nat_l4proto.h>
 
 static bool unknown_in_range(const struct nf_conntrack_tuple *tuple,
                              enum nf_nat_manip_type manip_type,
@@ -26,26 +25,29 @@ static bool unknown_in_range(const struct nf_conntrack_tuple *tuple,
         return true;
 }
 
-static void unknown_unique_tuple(struct nf_conntrack_tuple *tuple,
-                                 const struct nf_nat_ipv4_range *range,
+static void unknown_unique_tuple(const struct nf_nat_l3proto *l3proto,
+                                 struct nf_conntrack_tuple *tuple,
+                                 const struct nf_nat_range *range,
                                  enum nf_nat_manip_type maniptype,
                                  const struct nf_conn *ct)
 {
         /* Sorry: we can't help you; if it's not unique, we can't frob
-           anything. */
+         * anything.
+         */
         return;
 }
 
 static bool
 unknown_manip_pkt(struct sk_buff *skb,
-                  unsigned int iphdroff,
+                  const struct nf_nat_l3proto *l3proto,
+                  unsigned int iphdroff, unsigned int hdroff,
                   const struct nf_conntrack_tuple *tuple,
                   enum nf_nat_manip_type maniptype)
 {
         return true;
 }
 
-const struct nf_nat_protocol nf_nat_unknown_protocol = {
+const struct nf_nat_l4proto nf_nat_l4proto_unknown = {
         .manip_pkt              = unknown_manip_pkt,
         .in_range               = unknown_in_range,
         .unique_tuple           = unknown_unique_tuple,
diff --git a/net/ipv4/netfilter/nf_nat_sip.c b/net/netfilter/nf_nat_sip.c
index ea4a23813d26..16303c752213 100644
--- a/net/ipv4/netfilter/nf_nat_sip.c
+++ b/net/netfilter/nf_nat_sip.c
@@ -3,7 +3,7 @@
  * (C) 2005 by Christian Hentschel <chentschel@arnet.com.ar>
  * based on RR's ip_nat_ftp.c and other modules.
  * (C) 2007 United Security Providers
- * (C) 2007, 2008 Patrick McHardy <kaber@trash.net>
+ * (C) 2007, 2008, 2011, 2012 Patrick McHardy <kaber@trash.net>
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License version 2 as
@@ -12,14 +12,12 @@
 
 #include <linux/module.h>
 #include <linux/skbuff.h>
-#include <linux/ip.h>
-#include <net/ip.h>
+#include <linux/inet.h>
 #include <linux/udp.h>
 #include <linux/tcp.h>
 
 #include <net/netfilter/nf_nat.h>
 #include <net/netfilter/nf_nat_helper.h>
-#include <net/netfilter/nf_nat_rule.h>
 #include <net/netfilter/nf_conntrack_helper.h>
 #include <net/netfilter/nf_conntrack_expect.h>
 #include <linux/netfilter/nf_conntrack_sip.h>
@@ -30,7 +28,8 @@ MODULE_DESCRIPTION("SIP NAT helper");
 MODULE_ALIAS("ip_nat_sip");
 
 
-static unsigned int mangle_packet(struct sk_buff *skb, unsigned int dataoff,
+static unsigned int mangle_packet(struct sk_buff *skb, unsigned int protoff,
+                                  unsigned int dataoff,
                                   const char **dptr, unsigned int *datalen,
                                   unsigned int matchoff, unsigned int matchlen,
                                   const char *buffer, unsigned int buflen)
@@ -41,20 +40,20 @@ static unsigned int mangle_packet(struct sk_buff *skb, unsigned int dataoff,
         unsigned int baseoff;
 
         if (nf_ct_protonum(ct) == IPPROTO_TCP) {
-                th = (struct tcphdr *)(skb->data + ip_hdrlen(skb));
-                baseoff = ip_hdrlen(skb) + th->doff * 4;
+                th = (struct tcphdr *)(skb->data + protoff);
+                baseoff = protoff + th->doff * 4;
                 matchoff += dataoff - baseoff;
 
                 if (!__nf_nat_mangle_tcp_packet(skb, ct, ctinfo,
-                                                matchoff, matchlen,
+                                                protoff, matchoff, matchlen,
                                                 buffer, buflen, false))
                         return 0;
         } else {
-                baseoff = ip_hdrlen(skb) + sizeof(struct udphdr);
+                baseoff = protoff + sizeof(struct udphdr);
                 matchoff += dataoff - baseoff;
 
                 if (!nf_nat_mangle_udp_packet(skb, ct, ctinfo,
-                                              matchoff, matchlen,
+                                              protoff, matchoff, matchlen,
                                               buffer, buflen))
                         return 0;
         }
@@ -65,7 +64,30 @@ static unsigned int mangle_packet(struct sk_buff *skb, unsigned int dataoff,
         return 1;
 }
 
-static int map_addr(struct sk_buff *skb, unsigned int dataoff,
+static int sip_sprintf_addr(const struct nf_conn *ct, char *buffer,
+                            const union nf_inet_addr *addr, bool delim)
+{
+        if (nf_ct_l3num(ct) == NFPROTO_IPV4)
+                return sprintf(buffer, "%pI4", &addr->ip);
+        else {
+                if (delim)
+                        return sprintf(buffer, "[%pI6c]", &addr->ip6);
+                else
+                        return sprintf(buffer, "%pI6c", &addr->ip6);
+        }
+}
+
+static int sip_sprintf_addr_port(const struct nf_conn *ct, char *buffer,
+                                 const union nf_inet_addr *addr, u16 port)
+{
+        if (nf_ct_l3num(ct) == NFPROTO_IPV4)
+                return sprintf(buffer, "%pI4:%u", &addr->ip, port);
+        else
+                return sprintf(buffer, "[%pI6c]:%u", &addr->ip6, port);
+}
+
+static int map_addr(struct sk_buff *skb, unsigned int protoff,
+                    unsigned int dataoff,
                     const char **dptr, unsigned int *datalen,
                     unsigned int matchoff, unsigned int matchlen,
                     union nf_inet_addr *addr, __be16 port)
@@ -73,32 +95,32 @@ static int map_addr(struct sk_buff *skb, unsigned int dataoff,
         enum ip_conntrack_info ctinfo;
         struct nf_conn *ct = nf_ct_get(skb, &ctinfo);
         enum ip_conntrack_dir dir = CTINFO2DIR(ctinfo);
-        char buffer[sizeof("nnn.nnn.nnn.nnn:nnnnn")];
+        char buffer[INET6_ADDRSTRLEN + sizeof("[]:nnnnn")];
         unsigned int buflen;
-        __be32 newaddr;
+        union nf_inet_addr newaddr;
         __be16 newport;
 
-        if (ct->tuplehash[dir].tuple.src.u3.ip == addr->ip &&
+        if (nf_inet_addr_cmp(&ct->tuplehash[dir].tuple.src.u3, addr) &&
             ct->tuplehash[dir].tuple.src.u.udp.port == port) {
-                newaddr = ct->tuplehash[!dir].tuple.dst.u3.ip;
+                newaddr = ct->tuplehash[!dir].tuple.dst.u3;
                 newport = ct->tuplehash[!dir].tuple.dst.u.udp.port;
-        } else if (ct->tuplehash[dir].tuple.dst.u3.ip == addr->ip &&
+        } else if (nf_inet_addr_cmp(&ct->tuplehash[dir].tuple.dst.u3, addr) &&
                    ct->tuplehash[dir].tuple.dst.u.udp.port == port) {
-                newaddr = ct->tuplehash[!dir].tuple.src.u3.ip;
+                newaddr = ct->tuplehash[!dir].tuple.src.u3;
                 newport = ct->tuplehash[!dir].tuple.src.u.udp.port;
         } else
                 return 1;
 
-        if (newaddr == addr->ip && newport == port)
+        if (nf_inet_addr_cmp(&newaddr, addr) && newport == port)
                 return 1;
 
-        buflen = sprintf(buffer, "%pI4:%u", &newaddr, ntohs(newport));
-
-        return mangle_packet(skb, dataoff, dptr, datalen, matchoff, matchlen,
-                             buffer, buflen);
+        buflen = sip_sprintf_addr_port(ct, buffer, &newaddr, ntohs(newport));
+        return mangle_packet(skb, protoff, dataoff, dptr, datalen,
+                             matchoff, matchlen, buffer, buflen);
 }
 
-static int map_sip_addr(struct sk_buff *skb, unsigned int dataoff,
+static int map_sip_addr(struct sk_buff *skb, unsigned int protoff,
+                        unsigned int dataoff,
                         const char **dptr, unsigned int *datalen,
                         enum sip_header_types type)
 {
@@ -111,11 +133,12 @@ static int map_sip_addr(struct sk_buff *skb, unsigned int dataoff,
         if (ct_sip_parse_header_uri(ct, *dptr, NULL, *datalen, type, NULL,
                                     &matchoff, &matchlen, &addr, &port) <= 0)
                 return 1;
-        return map_addr(skb, dataoff, dptr, datalen, matchoff, matchlen,
-                        &addr, port);
+        return map_addr(skb, protoff, dataoff, dptr, datalen,
+                        matchoff, matchlen, &addr, port);
 }
 
-static unsigned int ip_nat_sip(struct sk_buff *skb, unsigned int dataoff,
+static unsigned int nf_nat_sip(struct sk_buff *skb, unsigned int protoff,
+                               unsigned int dataoff,
                                const char **dptr, unsigned int *datalen)
 {
         enum ip_conntrack_info ctinfo;
@@ -132,8 +155,8 @@ static unsigned int ip_nat_sip(struct sk_buff *skb, unsigned int dataoff,
                 if (ct_sip_parse_request(ct, *dptr, *datalen,
                                          &matchoff, &matchlen,
                                          &addr, &port) > 0 &&
-                    !map_addr(skb, dataoff, dptr, datalen, matchoff, matchlen,
-                              &addr, port))
+                    !map_addr(skb, protoff, dataoff, dptr, datalen,
+                              matchoff, matchlen, &addr, port))
                         return NF_DROP;
                 request = 1;
         } else
@@ -148,37 +171,41 @@ static unsigned int ip_nat_sip(struct sk_buff *skb, unsigned int dataoff,
         if (ct_sip_parse_header_uri(ct, *dptr, NULL, *datalen,
                                     hdr, NULL, &matchoff, &matchlen,
                                     &addr, &port) > 0) {
-                unsigned int matchend, poff, plen, buflen, n;
-                char buffer[sizeof("nnn.nnn.nnn.nnn:nnnnn")];
+                unsigned int olen, matchend, poff, plen, buflen, n;
+                char buffer[INET6_ADDRSTRLEN + sizeof("[]:nnnnn")];
 
                 /* We're only interested in headers related to this
                  * connection */
                 if (request) {
-                        if (addr.ip != ct->tuplehash[dir].tuple.src.u3.ip ||
+                        if (!nf_inet_addr_cmp(&addr,
+                                        &ct->tuplehash[dir].tuple.src.u3) ||
                             port != ct->tuplehash[dir].tuple.src.u.udp.port)
                                 goto next;
                 } else {
-                        if (addr.ip != ct->tuplehash[dir].tuple.dst.u3.ip ||
+                        if (!nf_inet_addr_cmp(&addr,
+                                        &ct->tuplehash[dir].tuple.dst.u3) ||
                             port != ct->tuplehash[dir].tuple.dst.u.udp.port)
                                 goto next;
                 }
 
-                if (!map_addr(skb, dataoff, dptr, datalen, matchoff, matchlen,
-                              &addr, port))
+                olen = *datalen;
+                if (!map_addr(skb, protoff, dataoff, dptr, datalen,
+                              matchoff, matchlen, &addr, port))
                         return NF_DROP;
 
-                matchend = matchoff + matchlen;
+                matchend = matchoff + matchlen + *datalen - olen;
 
                 /* The maddr= parameter (RFC 2361) specifies where to send
                  * the reply. */
                 if (ct_sip_parse_address_param(ct, *dptr, matchend, *datalen,
                                                "maddr=", &poff, &plen,
-                                               &addr) > 0 &&
-                    addr.ip == ct->tuplehash[dir].tuple.src.u3.ip &&
-                    addr.ip != ct->tuplehash[!dir].tuple.dst.u3.ip) {
-                        buflen = sprintf(buffer, "%pI4",
-                                        &ct->tuplehash[!dir].tuple.dst.u3.ip);
-                        if (!mangle_packet(skb, dataoff, dptr, datalen,
+                                               &addr, true) > 0 &&
+                    nf_inet_addr_cmp(&addr, &ct->tuplehash[dir].tuple.src.u3) &&
+                    !nf_inet_addr_cmp(&addr, &ct->tuplehash[!dir].tuple.dst.u3)) {
+                        buflen = sip_sprintf_addr(ct, buffer,
+                                        &ct->tuplehash[!dir].tuple.dst.u3,
+                                        true);
+                        if (!mangle_packet(skb, protoff, dataoff, dptr, datalen,
                                            poff, plen, buffer, buflen))
                                 return NF_DROP;
                 }
@@ -187,12 +214,13 @@ static unsigned int ip_nat_sip(struct sk_buff *skb, unsigned int dataoff,
                  * from which the server received the request. */
                 if (ct_sip_parse_address_param(ct, *dptr, matchend, *datalen,
                                                "received=", &poff, &plen,
-                                               &addr) > 0 &&
-                    addr.ip == ct->tuplehash[dir].tuple.dst.u3.ip &&
-                    addr.ip != ct->tuplehash[!dir].tuple.src.u3.ip) {
-                        buflen = sprintf(buffer, "%pI4",
-                                        &ct->tuplehash[!dir].tuple.src.u3.ip);
-                        if (!mangle_packet(skb, dataoff, dptr, datalen,
+                                               &addr, false) > 0 &&
+                    nf_inet_addr_cmp(&addr, &ct->tuplehash[dir].tuple.dst.u3) &&
+                    !nf_inet_addr_cmp(&addr, &ct->tuplehash[!dir].tuple.src.u3)) {
+                        buflen = sip_sprintf_addr(ct, buffer,
+                                        &ct->tuplehash[!dir].tuple.src.u3,
+                                        false);
+                        if (!mangle_packet(skb, protoff, dataoff, dptr, datalen,
                                            poff, plen, buffer, buflen))
                                 return NF_DROP;
                 }
@@ -206,7 +234,7 @@ static unsigned int ip_nat_sip(struct sk_buff *skb, unsigned int dataoff,
                     htons(n) != ct->tuplehash[!dir].tuple.src.u.udp.port) {
                         __be16 p = ct->tuplehash[!dir].tuple.src.u.udp.port;
                         buflen = sprintf(buffer, "%u", ntohs(p));
-                        if (!mangle_packet(skb, dataoff, dptr, datalen,
+                        if (!mangle_packet(skb, protoff, dataoff, dptr, datalen,
                                            poff, plen, buffer, buflen))
                                 return NF_DROP;
                 }
@@ -220,19 +248,21 @@ next:
                                        SIP_HDR_CONTACT, &in_header,
                                        &matchoff, &matchlen,
                                        &addr, &port) > 0) {
-                if (!map_addr(skb, dataoff, dptr, datalen, matchoff, matchlen,
+                if (!map_addr(skb, protoff, dataoff, dptr, datalen,
+                              matchoff, matchlen,
                               &addr, port))
                         return NF_DROP;
         }
 
-        if (!map_sip_addr(skb, dataoff, dptr, datalen, SIP_HDR_FROM) ||
-            !map_sip_addr(skb, dataoff, dptr, datalen, SIP_HDR_TO))
+        if (!map_sip_addr(skb, protoff, dataoff, dptr, datalen, SIP_HDR_FROM) ||
+            !map_sip_addr(skb, protoff, dataoff, dptr, datalen, SIP_HDR_TO))
                 return NF_DROP;
 
         return NF_ACCEPT;
 }
 
-static void ip_nat_sip_seq_adjust(struct sk_buff *skb, s16 off)
+static void nf_nat_sip_seq_adjust(struct sk_buff *skb, unsigned int protoff,
+                                  s16 off)
 {
         enum ip_conntrack_info ctinfo;
         struct nf_conn *ct = nf_ct_get(skb, &ctinfo);
@@ -241,37 +271,38 @@ static void ip_nat_sip_seq_adjust(struct sk_buff *skb, s16 off)
         if (nf_ct_protonum(ct) != IPPROTO_TCP || off == 0)
                 return;
 
-        th = (struct tcphdr *)(skb->data + ip_hdrlen(skb));
+        th = (struct tcphdr *)(skb->data + protoff);
         nf_nat_set_seq_adjust(ct, ctinfo, th->seq, off);
 }
 
 /* Handles expected signalling connections and media streams */
-static void ip_nat_sip_expected(struct nf_conn *ct,
+static void nf_nat_sip_expected(struct nf_conn *ct,
                                 struct nf_conntrack_expect *exp)
 {
-        struct nf_nat_ipv4_range range;
+        struct nf_nat_range range;
 
         /* This must be a fresh one. */
         BUG_ON(ct->status & IPS_NAT_DONE_MASK);
 
         /* For DST manip, map port here to where it's expected. */
         range.flags = (NF_NAT_RANGE_MAP_IPS | NF_NAT_RANGE_PROTO_SPECIFIED);
-        range.min = range.max = exp->saved_proto;
-        range.min_ip = range.max_ip = exp->saved_ip;
+        range.min_proto = range.max_proto = exp->saved_proto;
+        range.min_addr = range.max_addr = exp->saved_addr;
         nf_nat_setup_info(ct, &range, NF_NAT_MANIP_DST);
 
         /* Change src to where master sends to, but only if the connection
          * actually came from the same source. */
-        if (ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.src.u3.ip ==
-            ct->master->tuplehash[exp->dir].tuple.src.u3.ip) {
+        if (nf_inet_addr_cmp(&ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.src.u3,
+                             &ct->master->tuplehash[exp->dir].tuple.src.u3)) {
                 range.flags = NF_NAT_RANGE_MAP_IPS;
-                range.min_ip = range.max_ip
-                        = ct->master->tuplehash[!exp->dir].tuple.dst.u3.ip;
+                range.min_addr = range.max_addr
+                        = ct->master->tuplehash[!exp->dir].tuple.dst.u3;
                 nf_nat_setup_info(ct, &range, NF_NAT_MANIP_SRC);
         }
 }
 
-static unsigned int ip_nat_sip_expect(struct sk_buff *skb, unsigned int dataoff,
+static unsigned int nf_nat_sip_expect(struct sk_buff *skb, unsigned int protoff,
+                                      unsigned int dataoff,
                                       const char **dptr, unsigned int *datalen,
                                       struct nf_conntrack_expect *exp,
                                       unsigned int matchoff,
@@ -280,16 +311,17 @@ static unsigned int ip_nat_sip_expect(struct sk_buff *skb, unsigned int dataoff,
         enum ip_conntrack_info ctinfo;
         struct nf_conn *ct = nf_ct_get(skb, &ctinfo);
         enum ip_conntrack_dir dir = CTINFO2DIR(ctinfo);
-        __be32 newip;
+        union nf_inet_addr newaddr;
         u_int16_t port;
-        char buffer[sizeof("nnn.nnn.nnn.nnn:nnnnn")];
+        char buffer[INET6_ADDRSTRLEN + sizeof("[]:nnnnn")];
         unsigned int buflen;
 
         /* Connection will come from reply */
-        if (ct->tuplehash[dir].tuple.src.u3.ip == ct->tuplehash[!dir].tuple.dst.u3.ip)
-                newip = exp->tuple.dst.u3.ip;
+        if (nf_inet_addr_cmp(&ct->tuplehash[dir].tuple.src.u3,
+                             &ct->tuplehash[!dir].tuple.dst.u3))
+                newaddr = exp->tuple.dst.u3;
         else
-                newip = ct->tuplehash[!dir].tuple.dst.u3.ip;
+                newaddr = ct->tuplehash[!dir].tuple.dst.u3;
 
         /* If the signalling port matches the connection's source port in the
          * original direction, try to use the destination port in the opposite
@@ -300,11 +332,11 @@ static unsigned int ip_nat_sip_expect(struct sk_buff *skb, unsigned int dataoff,
         else
                 port = ntohs(exp->tuple.dst.u.udp.port);
 
-        exp->saved_ip = exp->tuple.dst.u3.ip;
-        exp->tuple.dst.u3.ip = newip;
+        exp->saved_addr = exp->tuple.dst.u3;
+        exp->tuple.dst.u3 = newaddr;
         exp->saved_proto.udp.port = exp->tuple.dst.u.udp.port;
         exp->dir = !dir;
-        exp->expectfn = ip_nat_sip_expected;
+        exp->expectfn = nf_nat_sip_expected;
 
         for (; port != 0; port++) {
                 int ret;
@@ -322,10 +354,10 @@ static unsigned int ip_nat_sip_expect(struct sk_buff *skb, unsigned int dataoff,
         if (port == 0)
                 return NF_DROP;
 
-        if (exp->tuple.dst.u3.ip != exp->saved_ip ||
+        if (!nf_inet_addr_cmp(&exp->tuple.dst.u3, &exp->saved_addr) ||
             exp->tuple.dst.u.udp.port != exp->saved_proto.udp.port) {
-                buflen = sprintf(buffer, "%pI4:%u", &newip, port);
-                if (!mangle_packet(skb, dataoff, dptr, datalen,
+                buflen = sip_sprintf_addr_port(ct, buffer, &newaddr, port);
+                if (!mangle_packet(skb, protoff, dataoff, dptr, datalen,
                                    matchoff, matchlen, buffer, buflen))
                         goto err;
         }
@@ -336,7 +368,8 @@ err:
         return NF_DROP;
 }
 
-static int mangle_content_len(struct sk_buff *skb, unsigned int dataoff,
+static int mangle_content_len(struct sk_buff *skb, unsigned int protoff,
+                              unsigned int dataoff,
                               const char **dptr, unsigned int *datalen)
 {
         enum ip_conntrack_info ctinfo;
@@ -358,11 +391,12 @@ static int mangle_content_len(struct sk_buff *skb, unsigned int dataoff,
                 return 0;
 
         buflen = sprintf(buffer, "%u", c_len);
-        return mangle_packet(skb, dataoff, dptr, datalen, matchoff, matchlen,
-                             buffer, buflen);
+        return mangle_packet(skb, protoff, dataoff, dptr, datalen,
+                             matchoff, matchlen, buffer, buflen);
 }
 
-static int mangle_sdp_packet(struct sk_buff *skb, unsigned int dataoff,
+static int mangle_sdp_packet(struct sk_buff *skb, unsigned int protoff,
+                             unsigned int dataoff,
                              const char **dptr, unsigned int *datalen,
                              unsigned int sdpoff,
                              enum sdp_header_types type,
@@ -376,29 +410,33 @@ static int mangle_sdp_packet(struct sk_buff *skb, unsigned int dataoff,
         if (ct_sip_get_sdp_header(ct, *dptr, sdpoff, *datalen, type, term,
                                   &matchoff, &matchlen) <= 0)
                 return -ENOENT;
-        return mangle_packet(skb, dataoff, dptr, datalen, matchoff, matchlen,
-                             buffer, buflen) ? 0 : -EINVAL;
+        return mangle_packet(skb, protoff, dataoff, dptr, datalen,
+                             matchoff, matchlen, buffer, buflen) ? 0 : -EINVAL;
 }
 
-static unsigned int ip_nat_sdp_addr(struct sk_buff *skb, unsigned int dataoff,
+static unsigned int nf_nat_sdp_addr(struct sk_buff *skb, unsigned int protoff,
+                                    unsigned int dataoff,
                                     const char **dptr, unsigned int *datalen,
                                     unsigned int sdpoff,
                                     enum sdp_header_types type,
                                     enum sdp_header_types term,
                                     const union nf_inet_addr *addr)
 {
-        char buffer[sizeof("nnn.nnn.nnn.nnn")];
+        enum ip_conntrack_info ctinfo;
+        struct nf_conn *ct = nf_ct_get(skb, &ctinfo);
+        char buffer[INET6_ADDRSTRLEN];
         unsigned int buflen;
 
-        buflen = sprintf(buffer, "%pI4", &addr->ip);
-        if (mangle_sdp_packet(skb, dataoff, dptr, datalen, sdpoff, type, term,
-                              buffer, buflen))
+        buflen = sip_sprintf_addr(ct, buffer, addr, false);
+        if (mangle_sdp_packet(skb, protoff, dataoff, dptr, datalen,
+                              sdpoff, type, term, buffer, buflen))
                 return 0;
 
-        return mangle_content_len(skb, dataoff, dptr, datalen);
+        return mangle_content_len(skb, protoff, dataoff, dptr, datalen);
 }
 
-static unsigned int ip_nat_sdp_port(struct sk_buff *skb, unsigned int dataoff,
+static unsigned int nf_nat_sdp_port(struct sk_buff *skb, unsigned int protoff,
+                                    unsigned int dataoff,
                                     const char **dptr, unsigned int *datalen,
                                     unsigned int matchoff,
                                     unsigned int matchlen,
@@ -408,30 +446,32 @@ static unsigned int ip_nat_sdp_port(struct sk_buff *skb, unsigned int dataoff,
         unsigned int buflen;
 
         buflen = sprintf(buffer, "%u", port);
-        if (!mangle_packet(skb, dataoff, dptr, datalen, matchoff, matchlen,
-                           buffer, buflen))
+        if (!mangle_packet(skb, protoff, dataoff, dptr, datalen,
+                           matchoff, matchlen, buffer, buflen))
                 return 0;
 
-        return mangle_content_len(skb, dataoff, dptr, datalen);
+        return mangle_content_len(skb, protoff, dataoff, dptr, datalen);
 }
 
-static unsigned int ip_nat_sdp_session(struct sk_buff *skb, unsigned int dataoff,
+static unsigned int nf_nat_sdp_session(struct sk_buff *skb, unsigned int protoff,
+                                       unsigned int dataoff,
                                        const char **dptr, unsigned int *datalen,
                                        unsigned int sdpoff,
                                        const union nf_inet_addr *addr)
 {
-        char buffer[sizeof("nnn.nnn.nnn.nnn")];
+        enum ip_conntrack_info ctinfo;
+        struct nf_conn *ct = nf_ct_get(skb, &ctinfo);
+        char buffer[INET6_ADDRSTRLEN];
         unsigned int buflen;
 
         /* Mangle session description owner and contact addresses */
-        buflen = sprintf(buffer, "%pI4", &addr->ip);
-        if (mangle_sdp_packet(skb, dataoff, dptr, datalen, sdpoff,
-                               SDP_HDR_OWNER_IP4, SDP_HDR_MEDIA,
-                               buffer, buflen))
+        buflen = sip_sprintf_addr(ct, buffer, addr, false);
+        if (mangle_sdp_packet(skb, protoff, dataoff, dptr, datalen, sdpoff,
+                              SDP_HDR_OWNER, SDP_HDR_MEDIA, buffer, buflen))
                 return 0;
 
-        switch (mangle_sdp_packet(skb, dataoff, dptr, datalen, sdpoff,
-                                  SDP_HDR_CONNECTION_IP4, SDP_HDR_MEDIA,
+        switch (mangle_sdp_packet(skb, protoff, dataoff, dptr, datalen, sdpoff,
+                                  SDP_HDR_CONNECTION, SDP_HDR_MEDIA,
                                   buffer, buflen)) {
         case 0:
         /*
@@ -447,12 +487,13 @@ static unsigned int ip_nat_sdp_session(struct sk_buff *skb, unsigned int dataoff
                 return 0;
         }
 
-        return mangle_content_len(skb, dataoff, dptr, datalen);
+        return mangle_content_len(skb, protoff, dataoff, dptr, datalen);
 }
 
 /* So, this packet has hit the connection tracking matching code.
    Mangle it, and change the expectation to match the new version. */
-static unsigned int ip_nat_sdp_media(struct sk_buff *skb, unsigned int dataoff,
+static unsigned int nf_nat_sdp_media(struct sk_buff *skb, unsigned int protoff,
+                                     unsigned int dataoff,
                                      const char **dptr, unsigned int *datalen,
                                      struct nf_conntrack_expect *rtp_exp,
                                      struct nf_conntrack_expect *rtcp_exp,
@@ -466,23 +507,23 @@ static unsigned int ip_nat_sdp_media(struct sk_buff *skb, unsigned int dataoff,
         u_int16_t port;
 
         /* Connection will come from reply */
-        if (ct->tuplehash[dir].tuple.src.u3.ip ==
-            ct->tuplehash[!dir].tuple.dst.u3.ip)
-                rtp_addr->ip = rtp_exp->tuple.dst.u3.ip;
+        if (nf_inet_addr_cmp(&ct->tuplehash[dir].tuple.src.u3,
+                             &ct->tuplehash[!dir].tuple.dst.u3))
+                *rtp_addr = rtp_exp->tuple.dst.u3;
         else
-                rtp_addr->ip = ct->tuplehash[!dir].tuple.dst.u3.ip;
+                *rtp_addr = ct->tuplehash[!dir].tuple.dst.u3;
 
-        rtp_exp->saved_ip = rtp_exp->tuple.dst.u3.ip;
-        rtp_exp->tuple.dst.u3.ip = rtp_addr->ip;
+        rtp_exp->saved_addr = rtp_exp->tuple.dst.u3;
+        rtp_exp->tuple.dst.u3 = *rtp_addr;
         rtp_exp->saved_proto.udp.port = rtp_exp->tuple.dst.u.udp.port;
         rtp_exp->dir = !dir;
-        rtp_exp->expectfn = ip_nat_sip_expected;
+        rtp_exp->expectfn = nf_nat_sip_expected;
 
-        rtcp_exp->saved_ip = rtcp_exp->tuple.dst.u3.ip;
-        rtcp_exp->tuple.dst.u3.ip = rtp_addr->ip;
+        rtcp_exp->saved_addr = rtcp_exp->tuple.dst.u3;
+        rtcp_exp->tuple.dst.u3 = *rtp_addr;
         rtcp_exp->saved_proto.udp.port = rtcp_exp->tuple.dst.u.udp.port;
         rtcp_exp->dir = !dir;
-        rtcp_exp->expectfn = ip_nat_sip_expected;
+        rtcp_exp->expectfn = nf_nat_sip_expected;
 
         /* Try to get same pair of ports: if not, try to change them. */
         for (port = ntohs(rtp_exp->tuple.dst.u.udp.port);
@@ -501,7 +542,10 @@ static unsigned int ip_nat_sdp_media(struct sk_buff *skb, unsigned int dataoff,
                 ret = nf_ct_expect_related(rtcp_exp);
                 if (ret == 0)
                         break;
-                else if (ret != -EBUSY) {
+                else if (ret == -EBUSY) {
+                        nf_ct_unexpect_related(rtp_exp);
+                        continue;
+                } else if (ret < 0) {
                         nf_ct_unexpect_related(rtp_exp);
                         port = 0;
                         break;
@@ -513,7 +557,7 @@ static unsigned int ip_nat_sdp_media(struct sk_buff *skb, unsigned int dataoff,
 
         /* Update media port. */
         if (rtp_exp->tuple.dst.u.udp.port != rtp_exp->saved_proto.udp.port &&
-            !ip_nat_sdp_port(skb, dataoff, dptr, datalen,
+            !nf_nat_sdp_port(skb, protoff, dataoff, dptr, datalen,
                              mediaoff, medialen, port))
                 goto err2;
 
@@ -527,8 +571,8 @@ err1:
 }
 
 static struct nf_ct_helper_expectfn sip_nat = {
-        .name           = "sip",
-        .expectfn       = ip_nat_sip_expected,
+        .name           = "sip",
+        .expectfn       = nf_nat_sip_expected,
 };
 
 static void __exit nf_nat_sip_fini(void)
@@ -553,13 +597,13 @@ static int __init nf_nat_sip_init(void)
         BUG_ON(nf_nat_sdp_port_hook != NULL);
         BUG_ON(nf_nat_sdp_session_hook != NULL);
         BUG_ON(nf_nat_sdp_media_hook != NULL);
-        RCU_INIT_POINTER(nf_nat_sip_hook, ip_nat_sip);
-        RCU_INIT_POINTER(nf_nat_sip_seq_adjust_hook, ip_nat_sip_seq_adjust);
-        RCU_INIT_POINTER(nf_nat_sip_expect_hook, ip_nat_sip_expect);
-        RCU_INIT_POINTER(nf_nat_sdp_addr_hook, ip_nat_sdp_addr);
-        RCU_INIT_POINTER(nf_nat_sdp_port_hook, ip_nat_sdp_port);
-        RCU_INIT_POINTER(nf_nat_sdp_session_hook, ip_nat_sdp_session);
-        RCU_INIT_POINTER(nf_nat_sdp_media_hook, ip_nat_sdp_media);
+        RCU_INIT_POINTER(nf_nat_sip_hook, nf_nat_sip);
+        RCU_INIT_POINTER(nf_nat_sip_seq_adjust_hook, nf_nat_sip_seq_adjust);
+        RCU_INIT_POINTER(nf_nat_sip_expect_hook, nf_nat_sip_expect);
+        RCU_INIT_POINTER(nf_nat_sdp_addr_hook, nf_nat_sdp_addr);
+        RCU_INIT_POINTER(nf_nat_sdp_port_hook, nf_nat_sdp_port);
+        RCU_INIT_POINTER(nf_nat_sdp_session_hook, nf_nat_sdp_session);
+        RCU_INIT_POINTER(nf_nat_sdp_media_hook, nf_nat_sdp_media);
         nf_ct_helper_expectfn_register(&sip_nat);
         return 0;
 }
diff --git a/net/ipv4/netfilter/nf_nat_tftp.c b/net/netfilter/nf_nat_tftp.c
index 9dbb8d284f99..ccabbda71a3e 100644
--- a/net/ipv4/netfilter/nf_nat_tftp.c
+++ b/net/netfilter/nf_nat_tftp.c
@@ -11,7 +11,6 @@
 #include <net/netfilter/nf_conntrack_helper.h>
 #include <net/netfilter/nf_conntrack_expect.h>
 #include <net/netfilter/nf_nat_helper.h>
-#include <net/netfilter/nf_nat_rule.h>
 #include <linux/netfilter/nf_conntrack_tftp.h>
 
 MODULE_AUTHOR("Magnus Boden <mb@ozaba.mine.nu>");
diff --git a/net/netfilter/nf_queue.c b/net/netfilter/nf_queue.c
index ce60cf0f6c11..8d2cf9ec37a8 100644
--- a/net/netfilter/nf_queue.c
+++ b/net/netfilter/nf_queue.c
@@ -118,7 +118,7 @@ static void nf_queue_entry_release_refs(struct nf_queue_entry *entry)
  * through nf_reinject().
  */
 static int __nf_queue(struct sk_buff *skb,
-                      struct list_head *elem,
+                      struct nf_hook_ops *elem,
                       u_int8_t pf, unsigned int hook,
                       struct net_device *indev,
                       struct net_device *outdev,
@@ -155,7 +155,7 @@ static int __nf_queue(struct sk_buff *skb,
 
         *entry = (struct nf_queue_entry) {
                 .skb    = skb,
-                .elem   = list_entry(elem, struct nf_hook_ops, list),
+                .elem   = elem,
                 .pf     = pf,
                 .hook   = hook,
                 .indev  = indev,
@@ -225,7 +225,7 @@ static void nf_bridge_adjust_segmented_data(struct sk_buff *skb)
 #endif
 
 int nf_queue(struct sk_buff *skb,
-             struct list_head *elem,
+             struct nf_hook_ops *elem,
              u_int8_t pf, unsigned int hook,
              struct net_device *indev,
              struct net_device *outdev,
@@ -287,7 +287,7 @@ int nf_queue(struct sk_buff *skb,
 void nf_reinject(struct nf_queue_entry *entry, unsigned int verdict)
 {
         struct sk_buff *skb = entry->skb;
-        struct list_head *elem = &entry->elem->list;
+        struct nf_hook_ops *elem = entry->elem;
         const struct nf_afinfo *afinfo;
         int err;
 
@@ -297,7 +297,7 @@ void nf_reinject(struct nf_queue_entry *entry, unsigned int verdict)
 
         /* Continue traversal iff userspace said ok... */
         if (verdict == NF_REPEAT) {
-                elem = elem->prev;
+                elem = list_entry(elem->list.prev, struct nf_hook_ops, list);
                 verdict = NF_ACCEPT;
         }
 
diff --git a/net/netfilter/nfnetlink_acct.c b/net/netfilter/nfnetlink_acct.c
index b2e7310ca0b8..d7ec92879071 100644
--- a/net/netfilter/nfnetlink_acct.c
+++ b/net/netfilter/nfnetlink_acct.c
@@ -79,11 +79,11 @@ nfnl_acct_new(struct sock *nfnl, struct sk_buff *skb,
 
         if (tb[NFACCT_BYTES]) {
                 atomic64_set(&nfacct->bytes,
-                             be64_to_cpu(nla_get_u64(tb[NFACCT_BYTES])));
+                             be64_to_cpu(nla_get_be64(tb[NFACCT_BYTES])));
         }
         if (tb[NFACCT_PKTS]) {
                 atomic64_set(&nfacct->pkts,
-                             be64_to_cpu(nla_get_u64(tb[NFACCT_PKTS])));
+                             be64_to_cpu(nla_get_be64(tb[NFACCT_PKTS])));
         }
         atomic_set(&nfacct->refcnt, 1);
         list_add_tail_rcu(&nfacct->head, &nfnl_acct_list);
diff --git a/net/netfilter/nfnetlink_cthelper.c b/net/netfilter/nfnetlink_cthelper.c
index d6836193d479..32a1ba3f3e27 100644
--- a/net/netfilter/nfnetlink_cthelper.c
+++ b/net/netfilter/nfnetlink_cthelper.c
@@ -74,7 +74,7 @@ nfnl_cthelper_parse_tuple(struct nf_conntrack_tuple *tuple,
         if (!tb[NFCTH_TUPLE_L3PROTONUM] || !tb[NFCTH_TUPLE_L4PROTONUM])
                 return -EINVAL;
 
-        tuple->src.l3num = ntohs(nla_get_u16(tb[NFCTH_TUPLE_L3PROTONUM]));
+        tuple->src.l3num = ntohs(nla_get_be16(tb[NFCTH_TUPLE_L3PROTONUM]));
         tuple->dst.protonum = nla_get_u8(tb[NFCTH_TUPLE_L4PROTONUM]);
 
         return 0;
diff --git a/net/netfilter/nfnetlink_log.c b/net/netfilter/nfnetlink_log.c
index 169ab59ed9d4..be194b144297 100644
--- a/net/netfilter/nfnetlink_log.c
+++ b/net/netfilter/nfnetlink_log.c
@@ -55,6 +55,7 @@ struct nfulnl_instance {
         unsigned int qlen;              /* number of nlmsgs in skb */
         struct sk_buff *skb;            /* pre-allocatd skb */
         struct timer_list timer;
+        struct user_namespace *peer_user_ns;    /* User namespace of the peer process */
         int peer_pid;                   /* PID of the peer process */
 
         /* configurable parameters */
@@ -132,7 +133,7 @@ instance_put(struct nfulnl_instance *inst)
 static void nfulnl_timer(unsigned long data);
 
 static struct nfulnl_instance *
-instance_create(u_int16_t group_num, int pid)
+instance_create(u_int16_t group_num, int pid, struct user_namespace *user_ns)
 {
         struct nfulnl_instance *inst;
         int err;
@@ -162,6 +163,7 @@ instance_create(u_int16_t group_num, int pid)
 
         setup_timer(&inst->timer, nfulnl_timer, (unsigned long)inst);
 
+        inst->peer_user_ns = user_ns;
         inst->peer_pid = pid;
         inst->group_num = group_num;
 
@@ -480,7 +482,7 @@ __build_packet_message(struct nfulnl_instance *inst,
         }
 
         if (indev && skb_mac_header_was_set(skb)) {
-                if (nla_put_be32(inst->skb, NFULA_HWTYPE, htons(skb->dev->type)) ||
+                if (nla_put_be16(inst->skb, NFULA_HWTYPE, htons(skb->dev->type)) ||
                     nla_put_be16(inst->skb, NFULA_HWLEN,
                                  htons(skb->dev->hard_header_len)) ||
                     nla_put(inst->skb, NFULA_HWHEADER, skb->dev->hard_header_len,
@@ -503,8 +505,11 @@ __build_packet_message(struct nfulnl_instance *inst,
                 read_lock_bh(&skb->sk->sk_callback_lock);
                 if (skb->sk->sk_socket && skb->sk->sk_socket->file) {
                         struct file *file = skb->sk->sk_socket->file;
-                        __be32 uid = htonl(file->f_cred->fsuid);
-                        __be32 gid = htonl(file->f_cred->fsgid);
+                        __be32 uid = htonl(from_kuid_munged(inst->peer_user_ns,
+                                                            file->f_cred->fsuid));
+                        __be32 gid = htonl(from_kgid_munged(inst->peer_user_ns,
+                                                            file->f_cred->fsgid));
+                        /* need to unlock here since NLA_PUT may goto */
                         read_unlock_bh(&skb->sk->sk_callback_lock);
                         if (nla_put_be32(inst->skb, NFULA_UID, uid) ||
                             nla_put_be32(inst->skb, NFULA_GID, gid))
@@ -783,7 +788,8 @@ nfulnl_recv_config(struct sock *ctnl, struct sk_buff *skb,
                         }
 
                         inst = instance_create(group_num,
-                                               NETLINK_CB(skb).pid);
+                                               NETLINK_CB(skb).pid,
+                                               sk_user_ns(NETLINK_CB(skb).ssk));
                         if (IS_ERR(inst)) {
                                 ret = PTR_ERR(inst);
                                 goto out;
@@ -996,8 +1002,10 @@ static int __init nfnetlink_log_init(void)
 
 #ifdef CONFIG_PROC_FS
         if (!proc_create("nfnetlink_log", 0440,
-                         proc_net_netfilter, &nful_file_ops))
+                         proc_net_netfilter, &nful_file_ops)) {
+                status = -ENOMEM;
                 goto cleanup_logger;
+        }
 #endif
         return status;
 
diff --git a/net/netfilter/xt_CT.c b/net/netfilter/xt_CT.c
index 116018560c60..16c712563860 100644
--- a/net/netfilter/xt_CT.c
+++ b/net/netfilter/xt_CT.c
@@ -72,14 +72,44 @@ static u8 xt_ct_find_proto(const struct xt_tgchk_param *par)
                 return 0;
 }
 
+static int
+xt_ct_set_helper(struct nf_conn *ct, const char *helper_name,
+                 const struct xt_tgchk_param *par)
+{
+        struct nf_conntrack_helper *helper;
+        struct nf_conn_help *help;
+        u8 proto;
+
+        proto = xt_ct_find_proto(par);
+        if (!proto) {
+                pr_info("You must specify a L4 protocol, and not use "
+                        "inversions on it.\n");
+                return -ENOENT;
+        }
+
+        helper = nf_conntrack_helper_try_module_get(helper_name, par->family,
+                                                    proto);
+        if (helper == NULL) {
+                pr_info("No such helper \"%s\"\n", helper_name);
+                return -ENOENT;
+        }
+
+        help = nf_ct_helper_ext_add(ct, helper, GFP_KERNEL);
+        if (help == NULL) {
+                module_put(helper->me);
+                return -ENOMEM;
+        }
+
+        help->helper = helper;
+        return 0;
+}
+
 static int xt_ct_tg_check_v0(const struct xt_tgchk_param *par)
 {
         struct xt_ct_target_info *info = par->targinfo;
         struct nf_conntrack_tuple t;
-        struct nf_conn_help *help;
         struct nf_conn *ct;
-        int ret = 0;
-        u8 proto;
+        int ret;
 
         if (info->flags & ~XT_CT_NOTRACK)
                 return -EINVAL;
@@ -112,31 +142,9 @@ static int xt_ct_tg_check_v0(const struct xt_tgchk_param *par)
                 goto err3;
 
         if (info->helper[0]) {
-                struct nf_conntrack_helper *helper;
-
-                ret = -ENOENT;
-                proto = xt_ct_find_proto(par);
-                if (!proto) {
-                        pr_info("You must specify a L4 protocol, "
-                                "and not use inversions on it.\n");
-                        goto err3;
-                }
-
-                ret = -ENOENT;
-                helper = nf_conntrack_helper_try_module_get(info->helper,
-                                                            par->family,
-                                                            proto);
-                if (helper == NULL) {
-                        pr_info("No such helper \"%s\"\n", info->helper);
-                        goto err3;
-                }
-
-                ret = -ENOMEM;
-                help = nf_ct_helper_ext_add(ct, helper, GFP_KERNEL);
-                if (help == NULL)
+                ret = xt_ct_set_helper(ct, info->helper, par);
+                if (ret < 0)
                         goto err3;
-
-                help->helper = helper;
         }
 
         __set_bit(IPS_TEMPLATE_BIT, &ct->status);
@@ -164,17 +172,77 @@ static void __xt_ct_tg_timeout_put(struct ctnl_timeout *timeout)
 }
 #endif
 
+static int
+xt_ct_set_timeout(struct nf_conn *ct, const struct xt_tgchk_param *par,
+                  const char *timeout_name)
+{
+#ifdef CONFIG_NF_CONNTRACK_TIMEOUT
+        typeof(nf_ct_timeout_find_get_hook) timeout_find_get;
+        struct ctnl_timeout *timeout;
+        struct nf_conn_timeout *timeout_ext;
+        const struct ipt_entry *e = par->entryinfo;
+        struct nf_conntrack_l4proto *l4proto;
+        int ret = 0;
+
+        rcu_read_lock();
+        timeout_find_get = rcu_dereference(nf_ct_timeout_find_get_hook);
+        if (timeout_find_get == NULL) {
+                ret = -ENOENT;
+                pr_info("Timeout policy base is empty\n");
+                goto out;
+        }
+
+        if (e->ip.invflags & IPT_INV_PROTO) {
+                ret = -EINVAL;
+                pr_info("You cannot use inversion on L4 protocol\n");
+                goto out;
+        }
+
+        timeout = timeout_find_get(timeout_name);
+        if (timeout == NULL) {
+                ret = -ENOENT;
+                pr_info("No such timeout policy \"%s\"\n", timeout_name);
+                goto out;
+        }
+
+        if (timeout->l3num != par->family) {
+                ret = -EINVAL;
+                pr_info("Timeout policy `%s' can only be used by L3 protocol "
+                        "number %d\n", timeout_name, timeout->l3num);
+                goto err_put_timeout;
+        }
+        /* Make sure the timeout policy matches any existing protocol tracker,
+         * otherwise default to generic.
+         */
+        l4proto = __nf_ct_l4proto_find(par->family, e->ip.proto);
+        if (timeout->l4proto->l4proto != l4proto->l4proto) {
+                ret = -EINVAL;
+                pr_info("Timeout policy `%s' can only be used by L4 protocol "
+                        "number %d\n",
+                        timeout_name, timeout->l4proto->l4proto);
+                goto err_put_timeout;
+        }
+        timeout_ext = nf_ct_timeout_ext_add(ct, timeout, GFP_ATOMIC);
+        if (timeout_ext == NULL)
+                ret = -ENOMEM;
+
+err_put_timeout:
+        __xt_ct_tg_timeout_put(timeout);
+out:
+        rcu_read_unlock();
+        return ret;
+#else
+        return -EOPNOTSUPP;
+#endif
+}
+
 static int xt_ct_tg_check_v1(const struct xt_tgchk_param *par)
 {
         struct xt_ct_target_info_v1 *info = par->targinfo;
         struct nf_conntrack_tuple t;
-        struct nf_conn_help *help;
         struct nf_conn *ct;
-        int ret = 0;
-        u8 proto;
-#ifdef CONFIG_NF_CONNTRACK_TIMEOUT
-        struct ctnl_timeout *timeout;
-#endif
+        int ret;
+
         if (info->flags & ~XT_CT_NOTRACK)
                 return -EINVAL;
 
@@ -206,93 +274,16 @@ static int xt_ct_tg_check_v1(const struct xt_tgchk_param *par)
                 goto err3;
 
         if (info->helper[0]) {
-                struct nf_conntrack_helper *helper;
-
-                ret = -ENOENT;
-                proto = xt_ct_find_proto(par);
-                if (!proto) {
-                        pr_info("You must specify a L4 protocol, "
-                                "and not use inversions on it.\n");
-                        goto err3;
-                }
-
-                ret = -ENOENT;
-                helper = nf_conntrack_helper_try_module_get(info->helper,
-                                                            par->family,
-                                                            proto);
-                if (helper == NULL) {
-                        pr_info("No such helper \"%s\"\n", info->helper);
-                        goto err3;
-                }
-
-                ret = -ENOMEM;
-                help = nf_ct_helper_ext_add(ct, helper, GFP_KERNEL);
-                if (help == NULL)
+                ret = xt_ct_set_helper(ct, info->helper, par);
+                if (ret < 0)
                         goto err3;
-
-                help->helper = helper;
         }
 
-#ifdef CONFIG_NF_CONNTRACK_TIMEOUT
         if (info->timeout[0]) {
-                typeof(nf_ct_timeout_find_get_hook) timeout_find_get;
-                struct nf_conn_timeout *timeout_ext;
-
-                rcu_read_lock();
-                timeout_find_get =
-                        rcu_dereference(nf_ct_timeout_find_get_hook);
-
-                if (timeout_find_get) {
-                        const struct ipt_entry *e = par->entryinfo;
-                        struct nf_conntrack_l4proto *l4proto;
-
-                        if (e->ip.invflags & IPT_INV_PROTO) {
-                                ret = -EINVAL;
-                                pr_info("You cannot use inversion on "
-                                         "L4 protocol\n");
-                                goto err4;
-                        }
-                        timeout = timeout_find_get(info->timeout);
-                        if (timeout == NULL) {
-                                ret = -ENOENT;
-                                pr_info("No such timeout policy \"%s\"\n",
-                                        info->timeout);
-                                goto err4;
-                        }
-                        if (timeout->l3num != par->family) {
-                                ret = -EINVAL;
-                                pr_info("Timeout policy `%s' can only be "
-                                        "used by L3 protocol number %d\n",
-                                        info->timeout, timeout->l3num);
-                                goto err5;
-                        }
-                        /* Make sure the timeout policy matches any existing
-                         * protocol tracker, otherwise default to generic.
-                         */
-                        l4proto = __nf_ct_l4proto_find(par->family,
-                                                       e->ip.proto);
-                        if (timeout->l4proto->l4proto != l4proto->l4proto) {
-                                ret = -EINVAL;
-                                pr_info("Timeout policy `%s' can only be "
-                                        "used by L4 protocol number %d\n",
-                                        info->timeout,
-                                        timeout->l4proto->l4proto);
-                                goto err5;
-                        }
-                        timeout_ext = nf_ct_timeout_ext_add(ct, timeout,
-                                                            GFP_ATOMIC);
-                        if (timeout_ext == NULL) {
-                                ret = -ENOMEM;
-                                goto err5;
-                        }
-                } else {
-                        ret = -ENOENT;
-                        pr_info("Timeout policy base is empty\n");
-                        goto err4;
-                }
-                rcu_read_unlock();
+                ret = xt_ct_set_timeout(ct, par, info->timeout);
+                if (ret < 0)
+                        goto err3;
         }
-#endif
 
         __set_bit(IPS_TEMPLATE_BIT, &ct->status);
         __set_bit(IPS_CONFIRMED_BIT, &ct->status);
@@ -300,12 +291,6 @@ out:
         info->ct = ct;
         return 0;
 
-#ifdef CONFIG_NF_CONNTRACK_TIMEOUT
-err5:
-        __xt_ct_tg_timeout_put(timeout);
-err4:
-        rcu_read_unlock();
-#endif
 err3:
         nf_conntrack_free(ct);
 err2:
@@ -330,15 +315,30 @@ static void xt_ct_tg_destroy_v0(const struct xt_tgdtor_param *par)
         nf_ct_put(info->ct);
 }
 
-static void xt_ct_tg_destroy_v1(const struct xt_tgdtor_param *par)
+static void xt_ct_destroy_timeout(struct nf_conn *ct)
 {
-        struct xt_ct_target_info_v1 *info = par->targinfo;
-        struct nf_conn *ct = info->ct;
-        struct nf_conn_help *help;
 #ifdef CONFIG_NF_CONNTRACK_TIMEOUT
         struct nf_conn_timeout *timeout_ext;
         typeof(nf_ct_timeout_put_hook) timeout_put;
+
+        rcu_read_lock();
+        timeout_put = rcu_dereference(nf_ct_timeout_put_hook);
+
+        if (timeout_put) {
+                timeout_ext = nf_ct_timeout_find(ct);
+                if (timeout_ext)
+                        timeout_put(timeout_ext->timeout);
+        }
+        rcu_read_unlock();
 #endif
+}
+
+static void xt_ct_tg_destroy_v1(const struct xt_tgdtor_param *par)
+{
+        struct xt_ct_target_info_v1 *info = par->targinfo;
+        struct nf_conn *ct = info->ct;
+        struct nf_conn_help *help;
+
         if (!nf_ct_is_untracked(ct)) {
                 help = nfct_help(ct);
                 if (help)
@@ -346,17 +346,7 @@ static void xt_ct_tg_destroy_v1(const struct xt_tgdtor_param *par)
 
                 nf_ct_l3proto_module_put(par->family);
 
-#ifdef CONFIG_NF_CONNTRACK_TIMEOUT
-                rcu_read_lock();
-                timeout_put = rcu_dereference(nf_ct_timeout_put_hook);
-
-                if (timeout_put) {
-                        timeout_ext = nf_ct_timeout_find(ct);
-                        if (timeout_ext)
-                                timeout_put(timeout_ext->timeout);
-                }
-                rcu_read_unlock();
-#endif
+                xt_ct_destroy_timeout(ct);
         }
         nf_ct_put(info->ct);
 }
diff --git a/net/netfilter/xt_LOG.c b/net/netfilter/xt_LOG.c
index ff5f75fddb15..02a2bf49dcbd 100644
--- a/net/netfilter/xt_LOG.c
+++ b/net/netfilter/xt_LOG.c
@@ -363,10 +363,12 @@ static void dump_ipv4_packet(struct sbuff *m,
         /* Max length: 15 "UID=4294967295 " */
         if ((logflags & XT_LOG_UID) && !iphoff && skb->sk) {
                 read_lock_bh(&skb->sk->sk_callback_lock);
-                if (skb->sk->sk_socket && skb->sk->sk_socket->file)
+                if (skb->sk->sk_socket && skb->sk->sk_socket->file) {
+                        const struct cred *cred = skb->sk->sk_socket->file->f_cred;
                         sb_add(m, "UID=%u GID=%u ",
-                                skb->sk->sk_socket->file->f_cred->fsuid,
-                                skb->sk->sk_socket->file->f_cred->fsgid);
+                                from_kuid_munged(&init_user_ns, cred->fsuid),
+                                from_kgid_munged(&init_user_ns, cred->fsgid));
+                }
                 read_unlock_bh(&skb->sk->sk_callback_lock);
         }
 
@@ -719,10 +721,12 @@ static void dump_ipv6_packet(struct sbuff *m,
         /* Max length: 15 "UID=4294967295 " */
         if ((logflags & XT_LOG_UID) && recurse && skb->sk) {
                 read_lock_bh(&skb->sk->sk_callback_lock);
-                if (skb->sk->sk_socket && skb->sk->sk_socket->file)
+                if (skb->sk->sk_socket && skb->sk->sk_socket->file) {
+                        const struct cred *cred = skb->sk->sk_socket->file->f_cred;
                         sb_add(m, "UID=%u GID=%u ",
-                                skb->sk->sk_socket->file->f_cred->fsuid,
-                                skb->sk->sk_socket->file->f_cred->fsgid);
+                                from_kuid_munged(&init_user_ns, cred->fsuid),
+                                from_kgid_munged(&init_user_ns, cred->fsgid));
+                }
                 read_unlock_bh(&skb->sk->sk_callback_lock);
         }
 
diff --git a/net/netfilter/xt_NFQUEUE.c b/net/netfilter/xt_NFQUEUE.c
index 7babe7d68716..817f9e9f2b16 100644
--- a/net/netfilter/xt_NFQUEUE.c
+++ b/net/netfilter/xt_NFQUEUE.c
@@ -43,7 +43,7 @@ static u32 hash_v4(const struct sk_buff *skb)
         const struct iphdr *iph = ip_hdr(skb);
 
         /* packets in either direction go into same queue */
-        if (iph->saddr < iph->daddr)
+        if ((__force u32)iph->saddr < (__force u32)iph->daddr)
                 return jhash_3words((__force u32)iph->saddr,
                         (__force u32)iph->daddr, iph->protocol, jhash_initval);
 
@@ -57,7 +57,8 @@ static u32 hash_v6(const struct sk_buff *skb)
         const struct ipv6hdr *ip6h = ipv6_hdr(skb);
         u32 a, b, c;
 
-        if (ip6h->saddr.s6_addr32[3] < ip6h->daddr.s6_addr32[3]) {
+        if ((__force u32)ip6h->saddr.s6_addr32[3] <
+            (__force u32)ip6h->daddr.s6_addr32[3]) {
                 a = (__force u32) ip6h->saddr.s6_addr32[3];
                 b = (__force u32) ip6h->daddr.s6_addr32[3];
         } else {
@@ -65,7 +66,8 @@ static u32 hash_v6(const struct sk_buff *skb)
                 a = (__force u32) ip6h->daddr.s6_addr32[3];
         }
 
-        if (ip6h->saddr.s6_addr32[1] < ip6h->daddr.s6_addr32[1])
+        if ((__force u32)ip6h->saddr.s6_addr32[1] <
+            (__force u32)ip6h->daddr.s6_addr32[1])
                 c = (__force u32) ip6h->saddr.s6_addr32[1];
         else
                 c = (__force u32) ip6h->daddr.s6_addr32[1];
diff --git a/net/netfilter/xt_NOTRACK.c b/net/netfilter/xt_NOTRACK.c
deleted file mode 100644
index 9d782181b6c8..000000000000
--- a/net/netfilter/xt_NOTRACK.c
+++ /dev/null
@@ -1,53 +0,0 @@
-/* This is a module which is used for setting up fake conntracks
- * on packets so that they are not seen by the conntrack/NAT code.
- */
-#include <linux/module.h>
-#include <linux/skbuff.h>
-
-#include <linux/netfilter/x_tables.h>
-#include <net/netfilter/nf_conntrack.h>
-
-MODULE_DESCRIPTION("Xtables: Disabling connection tracking for packets");
-MODULE_LICENSE("GPL");
-MODULE_ALIAS("ipt_NOTRACK");
-MODULE_ALIAS("ip6t_NOTRACK");
-
-static unsigned int
-notrack_tg(struct sk_buff *skb, const struct xt_action_param *par)
-{
-        /* Previously seen (loopback)? Ignore. */
-        if (skb->nfct != NULL)
-                return XT_CONTINUE;
-
-        /* Attach fake conntrack entry.
-           If there is a real ct entry correspondig to this packet,
-           it'll hang aroun till timing out. We don't deal with it
-           for performance reasons. JK */
-        skb->nfct = &nf_ct_untracked_get()->ct_general;
-        skb->nfctinfo = IP_CT_NEW;
-        nf_conntrack_get(skb->nfct);
-
-        return XT_CONTINUE;
-}
-
-static struct xt_target notrack_tg_reg __read_mostly = {
-        .name     = "NOTRACK",
-        .revision = 0,
-        .family   = NFPROTO_UNSPEC,
-        .target   = notrack_tg,
-        .table    = "raw",
-        .me       = THIS_MODULE,
-};
-
-static int __init notrack_tg_init(void)
-{
-        return xt_register_target(&notrack_tg_reg);
-}
-
-static void __exit notrack_tg_exit(void)
-{
-        xt_unregister_target(&notrack_tg_reg);
-}
-
-module_init(notrack_tg_init);
-module_exit(notrack_tg_exit);
diff --git a/net/netfilter/xt_nat.c b/net/netfilter/xt_nat.c
new file mode 100644
index 000000000000..81aafa8e4fef
--- /dev/null
+++ b/net/netfilter/xt_nat.c
@@ -0,0 +1,170 @@
+/*
+ * (C) 1999-2001 Paul `Rusty' Russell
+ * (C) 2002-2006 Netfilter Core Team <coreteam@netfilter.org>
+ * (C) 2011 Patrick McHardy <kaber@trash.net>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+
+#include <linux/module.h>
+#include <linux/skbuff.h>
+#include <linux/netfilter.h>
+#include <linux/netfilter/x_tables.h>
+#include <net/netfilter/nf_nat_core.h>
+
+static int xt_nat_checkentry_v0(const struct xt_tgchk_param *par)
+{
+        const struct nf_nat_ipv4_multi_range_compat *mr = par->targinfo;
+
+        if (mr->rangesize != 1) {
+                pr_info("%s: multiple ranges no longer supported\n",
+                        par->target->name);
+                return -EINVAL;
+        }
+        return 0;
+}
+
+static void xt_nat_convert_range(struct nf_nat_range *dst,
+                                 const struct nf_nat_ipv4_range *src)
+{
+        memset(&dst->min_addr, 0, sizeof(dst->min_addr));
+        memset(&dst->max_addr, 0, sizeof(dst->max_addr));
+
+        dst->flags       = src->flags;
+        dst->min_addr.ip = src->min_ip;
+        dst->max_addr.ip = src->max_ip;
+        dst->min_proto   = src->min;
+        dst->max_proto   = src->max;
+}
+
+static unsigned int
+xt_snat_target_v0(struct sk_buff *skb, const struct xt_action_param *par)
+{
+        const struct nf_nat_ipv4_multi_range_compat *mr = par->targinfo;
+        struct nf_nat_range range;
+        enum ip_conntrack_info ctinfo;
+        struct nf_conn *ct;
+
+        ct = nf_ct_get(skb, &ctinfo);
+        NF_CT_ASSERT(ct != NULL &&
+                     (ctinfo == IP_CT_NEW || ctinfo == IP_CT_RELATED ||
+                      ctinfo == IP_CT_RELATED_REPLY));
+
+        xt_nat_convert_range(&range, &mr->range[0]);
+        return nf_nat_setup_info(ct, &range, NF_NAT_MANIP_SRC);
+}
+
+static unsigned int
+xt_dnat_target_v0(struct sk_buff *skb, const struct xt_action_param *par)
+{
+        const struct nf_nat_ipv4_multi_range_compat *mr = par->targinfo;
+        struct nf_nat_range range;
+        enum ip_conntrack_info ctinfo;
+        struct nf_conn *ct;
+
+        ct = nf_ct_get(skb, &ctinfo);
+        NF_CT_ASSERT(ct != NULL &&
+                     (ctinfo == IP_CT_NEW || ctinfo == IP_CT_RELATED));
+
+        xt_nat_convert_range(&range, &mr->range[0]);
+        return nf_nat_setup_info(ct, &range, NF_NAT_MANIP_DST);
+}
+
+static unsigned int
+xt_snat_target_v1(struct sk_buff *skb, const struct xt_action_param *par)
+{
+        const struct nf_nat_range *range = par->targinfo;
+        enum ip_conntrack_info ctinfo;
+        struct nf_conn *ct;
+
+        ct = nf_ct_get(skb, &ctinfo);
+        NF_CT_ASSERT(ct != NULL &&
+                     (ctinfo == IP_CT_NEW || ctinfo == IP_CT_RELATED ||
+                      ctinfo == IP_CT_RELATED_REPLY));
+
+        return nf_nat_setup_info(ct, range, NF_NAT_MANIP_SRC);
+}
+
+static unsigned int
+xt_dnat_target_v1(struct sk_buff *skb, const struct xt_action_param *par)
+{
+        const struct nf_nat_range *range = par->targinfo;
+        enum ip_conntrack_info ctinfo;
+        struct nf_conn *ct;
+
+        ct = nf_ct_get(skb, &ctinfo);
+        NF_CT_ASSERT(ct != NULL &&
+                     (ctinfo == IP_CT_NEW || ctinfo == IP_CT_RELATED));
+
+        return nf_nat_setup_info(ct, range, NF_NAT_MANIP_DST);
+}
+
+static struct xt_target xt_nat_target_reg[] __read_mostly = {
+        {
+                .name           = "SNAT",
+                .revision       = 0,
+                .checkentry     = xt_nat_checkentry_v0,
+                .target         = xt_snat_target_v0,
+                .targetsize     = sizeof(struct nf_nat_ipv4_multi_range_compat),
+                .family         = NFPROTO_IPV4,
+                .table          = "nat",
+                .hooks          = (1 << NF_INET_POST_ROUTING) |
+                                  (1 << NF_INET_LOCAL_OUT),
+                .me             = THIS_MODULE,
+        },
+        {
+                .name           = "DNAT",
+                .revision       = 0,
+                .checkentry     = xt_nat_checkentry_v0,
+                .target         = xt_dnat_target_v0,
+                .targetsize     = sizeof(struct nf_nat_ipv4_multi_range_compat),
+                .family         = NFPROTO_IPV4,
+                .table          = "nat",
+                .hooks          = (1 << NF_INET_PRE_ROUTING) |
+                                  (1 << NF_INET_LOCAL_IN),
+                .me             = THIS_MODULE,
+        },
+        {
+                .name           = "SNAT",
+                .revision       = 1,
+                .target         = xt_snat_target_v1,
+                .targetsize     = sizeof(struct nf_nat_range),
+                .table          = "nat",
+                .hooks          = (1 << NF_INET_POST_ROUTING) |
+                                  (1 << NF_INET_LOCAL_OUT),
+                .me             = THIS_MODULE,
+        },
+        {
+                .name           = "DNAT",
+                .revision       = 1,
+                .target         = xt_dnat_target_v1,
+                .targetsize     = sizeof(struct nf_nat_range),
+                .table          = "nat",
+                .hooks          = (1 << NF_INET_PRE_ROUTING) |
+                                  (1 << NF_INET_LOCAL_IN),
+                .me             = THIS_MODULE,
+        },
+};
+
+static int __init xt_nat_init(void)
+{
+        return xt_register_targets(xt_nat_target_reg,
+                                   ARRAY_SIZE(xt_nat_target_reg));
+}
+
+static void __exit xt_nat_exit(void)
+{
+        xt_unregister_targets(xt_nat_target_reg, ARRAY_SIZE(xt_nat_target_reg));
+}
+
+module_init(xt_nat_init);
+module_exit(xt_nat_exit);
+
+MODULE_LICENSE("GPL");
+MODULE_AUTHOR("Patrick McHardy <kaber@trash.net>");
+MODULE_ALIAS("ipt_SNAT");
+MODULE_ALIAS("ipt_DNAT");
+MODULE_ALIAS("ip6t_SNAT");
+MODULE_ALIAS("ip6t_DNAT");
diff --git a/net/netfilter/xt_osf.c b/net/netfilter/xt_osf.c
index 846f895cb656..a5e673d32bda 100644
--- a/net/netfilter/xt_osf.c
+++ b/net/netfilter/xt_osf.c
@@ -269,7 +269,7 @@ xt_osf_match_packet(const struct sk_buff *skb, struct xt_action_param *p)
                                                 mss <<= 8;
                                                 mss |= optp[2];
 
-                                                mss = ntohs(mss);
+                                                mss = ntohs((__force __be16)mss);
                                                 break;
                                         case OSFOPT_TS:
                                                 loop_cont = 1;
diff --git a/net/netfilter/xt_owner.c b/net/netfilter/xt_owner.c
index 772d7389b337..ca2e577ed8ac 100644
--- a/net/netfilter/xt_owner.c
+++ b/net/netfilter/xt_owner.c
@@ -17,6 +17,17 @@
 #include <linux/netfilter/x_tables.h>
 #include <linux/netfilter/xt_owner.h>
 
+static int owner_check(const struct xt_mtchk_param *par)
+{
+        struct xt_owner_match_info *info = par->matchinfo;
+
+        /* For now only allow adding matches from the initial user namespace */
+        if ((info->match & (XT_OWNER_UID|XT_OWNER_GID)) &&
+            (current_user_ns() != &init_user_ns))
+                return -EINVAL;
+        return 0;
+}
+
 static bool
 owner_mt(const struct sk_buff *skb, struct xt_action_param *par)
 {
@@ -37,17 +48,23 @@ owner_mt(const struct sk_buff *skb, struct xt_action_param *par)
                 return ((info->match ^ info->invert) &
                        (XT_OWNER_UID | XT_OWNER_GID)) == 0;
 
-        if (info->match & XT_OWNER_UID)
-                if ((filp->f_cred->fsuid >= info->uid_min &&
-                    filp->f_cred->fsuid <= info->uid_max) ^
+        if (info->match & XT_OWNER_UID) {
+                kuid_t uid_min = make_kuid(&init_user_ns, info->uid_min);
+                kuid_t uid_max = make_kuid(&init_user_ns, info->uid_max);
+                if ((uid_gte(filp->f_cred->fsuid, uid_min) &&
+                     uid_lte(filp->f_cred->fsuid, uid_max)) ^
                     !(info->invert & XT_OWNER_UID))
                         return false;
+        }
 
-        if (info->match & XT_OWNER_GID)
-                if ((filp->f_cred->fsgid >= info->gid_min &&
-                    filp->f_cred->fsgid <= info->gid_max) ^
+        if (info->match & XT_OWNER_GID) {
+                kgid_t gid_min = make_kgid(&init_user_ns, info->gid_min);
+                kgid_t gid_max = make_kgid(&init_user_ns, info->gid_max);
+                if ((gid_gte(filp->f_cred->fsgid, gid_min) &&
+                     gid_lte(filp->f_cred->fsgid, gid_max)) ^
                     !(info->invert & XT_OWNER_GID))
                         return false;
+        }
 
         return true;
 }
@@ -56,6 +73,7 @@ static struct xt_match owner_mt_reg __read_mostly = {
         .name       = "owner",
         .revision   = 1,
         .family     = NFPROTO_UNSPEC,
+        .checkentry = owner_check,
         .match      = owner_mt,
         .matchsize  = sizeof(struct xt_owner_match_info),
         .hooks      = (1 << NF_INET_LOCAL_OUT) |
diff --git a/net/netfilter/xt_recent.c b/net/netfilter/xt_recent.c
index ae2ad1eec8d0..4635c9b00459 100644
--- a/net/netfilter/xt_recent.c
+++ b/net/netfilter/xt_recent.c
@@ -317,6 +317,8 @@ static int recent_mt_check(const struct xt_mtchk_param *par,
         struct recent_table *t;
 #ifdef CONFIG_PROC_FS
         struct proc_dir_entry *pde;
+        kuid_t uid;
+        kgid_t gid;
 #endif
         unsigned int i;
         int ret = -EINVAL;
@@ -372,6 +374,13 @@ static int recent_mt_check(const struct xt_mtchk_param *par,
         for (i = 0; i < ip_list_hash_size; i++)
                 INIT_LIST_HEAD(&t->iphash[i]);
 #ifdef CONFIG_PROC_FS
+        uid = make_kuid(&init_user_ns, ip_list_uid);
+        gid = make_kgid(&init_user_ns, ip_list_gid);
+        if (!uid_valid(uid) || !gid_valid(gid)) {
+                kfree(t);
+                ret = -EINVAL;
+                goto out;
+        }
         pde = proc_create_data(t->name, ip_list_perms, recent_net->xt_recent,
                   &recent_mt_fops, t);
         if (pde == NULL) {
@@ -379,8 +388,8 @@ static int recent_mt_check(const struct xt_mtchk_param *par,
                 ret = -ENOMEM;
                 goto out;
         }
-        pde->uid = ip_list_uid;
-        pde->gid = ip_list_gid;
+        pde->uid = uid;
+        pde->gid = gid;
 #endif
         spin_lock_bh(&recent_lock);
         list_add_tail(&t->list, &recent_net->tables);
diff --git a/net/netfilter/xt_socket.c b/net/netfilter/xt_socket.c
index 9ea482d08cf7..63b2bdb59e95 100644
--- a/net/netfilter/xt_socket.c
+++ b/net/netfilter/xt_socket.c
@@ -108,9 +108,9 @@ socket_match(const struct sk_buff *skb, struct xt_action_param *par,
         const struct iphdr *iph = ip_hdr(skb);
         struct udphdr _hdr, *hp = NULL;
         struct sock *sk;
-        __be32 daddr, saddr;
-        __be16 dport, sport;
-        u8 protocol;
+        __be32 uninitialized_var(daddr), uninitialized_var(saddr);
+        __be16 uninitialized_var(dport), uninitialized_var(sport);
+        u8 uninitialized_var(protocol);
 #ifdef XT_SOCKET_HAVE_CONNTRACK
         struct nf_conn const *ct;
         enum ip_conntrack_info ctinfo;
@@ -261,9 +261,9 @@ socket_mt6_v1(const struct sk_buff *skb, struct xt_action_param *par)
         struct ipv6hdr *iph = ipv6_hdr(skb);
         struct udphdr _hdr, *hp = NULL;
         struct sock *sk;
-        struct in6_addr *daddr, *saddr;
-        __be16 dport, sport;
-        int thoff = 0, tproto;
+        struct in6_addr *daddr = NULL, *saddr = NULL;
+        __be16 uninitialized_var(dport), uninitialized_var(sport);
+        int thoff = 0, uninitialized_var(tproto);
         const struct xt_socket_mtinfo1 *info = (struct xt_socket_mtinfo1 *) par->matchinfo;
 
         tproto = ipv6_find_hdr(skb, &thoff, -1, NULL, NULL);
diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c
index 5463969da45b..382119917166 100644
--- a/net/netlink/af_netlink.c
+++ b/net/netlink/af_netlink.c
@@ -912,7 +912,8 @@ static void netlink_rcv_wake(struct sock *sk)
                 wake_up_interruptible(&nlk->wait);
 }
 
-static int netlink_unicast_kernel(struct sock *sk, struct sk_buff *skb)
+static int netlink_unicast_kernel(struct sock *sk, struct sk_buff *skb,
+                                  struct sock *ssk)
 {
         int ret;
         struct netlink_sock *nlk = nlk_sk(sk);
@@ -921,6 +922,7 @@ static int netlink_unicast_kernel(struct sock *sk, struct sk_buff *skb)
         if (nlk->netlink_rcv != NULL) {
                 ret = skb->len;
                 skb_set_owner_r(skb, sk);
+                NETLINK_CB(skb).ssk = ssk;
                 nlk->netlink_rcv(skb);
                 consume_skb(skb);
         } else {
@@ -947,7 +949,7 @@ retry:
                 return PTR_ERR(sk);
         }
         if (netlink_is_kernel(sk))
-                return netlink_unicast_kernel(sk, skb);
+                return netlink_unicast_kernel(sk, skb, ssk);
 
         if (sk_filter(sk, skb)) {
                 err = skb->len;
@@ -1362,7 +1364,7 @@ static int netlink_sendmsg(struct kiocb *kiocb, struct socket *sock,
         if (NULL == siocb->scm)
                 siocb->scm = &scm;
 
-        err = scm_send(sock, msg, siocb->scm);
+        err = scm_send(sock, msg, siocb->scm, true);
         if (err < 0)
                 return err;
 
@@ -1373,7 +1375,8 @@ static int netlink_sendmsg(struct kiocb *kiocb, struct socket *sock,
                 dst_pid = addr->nl_pid;
                 dst_group = ffs(addr->nl_groups);
                 err =  -EPERM;
-                if (dst_group && !netlink_capable(sock, NL_NONROOT_SEND))
+                if ((dst_group || dst_pid) &&
+                    !netlink_capable(sock, NL_NONROOT_SEND))
                         goto out;
         } else {
                 dst_pid = nlk->dst_pid;
@@ -2147,6 +2150,7 @@ static void __init netlink_add_usersock_entry(void)
         rcu_assign_pointer(nl_table[NETLINK_USERSOCK].listeners, listeners);
         nl_table[NETLINK_USERSOCK].module = THIS_MODULE;
         nl_table[NETLINK_USERSOCK].registered = 1;
+        nl_table[NETLINK_USERSOCK].nl_nonroot = NL_NONROOT_SEND;
 
         netlink_table_ungrab();
 }
diff --git a/net/openvswitch/flow.c b/net/openvswitch/flow.c
index f9f211d95ebe..98c70630ad06 100644
--- a/net/openvswitch/flow.c
+++ b/net/openvswitch/flow.c
@@ -424,19 +424,11 @@ void ovs_flow_deferred_free(struct sw_flow *flow)
         call_rcu(&flow->rcu, rcu_free_flow_callback);
 }
 
-/* RCU callback used by ovs_flow_deferred_free_acts. */
-static void rcu_free_acts_callback(struct rcu_head *rcu)
-{
-        struct sw_flow_actions *sf_acts = container_of(rcu,
-                        struct sw_flow_actions, rcu);
-        kfree(sf_acts);
-}
-
 /* Schedules 'sf_acts' to be freed after the next RCU grace period.
  * The caller must hold rcu_read_lock for this to be sensible. */
 void ovs_flow_deferred_free_acts(struct sw_flow_actions *sf_acts)
 {
-        call_rcu(&sf_acts->rcu, rcu_free_acts_callback);
+        kfree_rcu(sf_acts, rcu);
 }
 
 static int parse_vlan(struct sk_buff *skb, struct sw_flow_key *key)
diff --git a/net/packet/Kconfig b/net/packet/Kconfig
index 0060e3b396b7..cc55b35f80e5 100644
--- a/net/packet/Kconfig
+++ b/net/packet/Kconfig
@@ -14,3 +14,11 @@ config PACKET
           be called af_packet.
 
           If unsure, say Y.
+
+config PACKET_DIAG
+        tristate "Packet: sockets monitoring interface"
+        depends on PACKET
+        default n
+        ---help---
+          Support for PF_PACKET sockets monitoring interface used by the ss tool.
+          If unsure, say Y.
diff --git a/net/packet/Makefile b/net/packet/Makefile
index 81183eabfdec..9df61347a3c3 100644
--- a/net/packet/Makefile
+++ b/net/packet/Makefile
@@ -3,3 +3,5 @@
 #
 
 obj-$(CONFIG_PACKET) += af_packet.o
+obj-$(CONFIG_PACKET_DIAG) += af_packet_diag.o
+af_packet_diag-y += diag.o
diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
index ceaca7c134a0..94060edbbd70 100644
--- a/net/packet/af_packet.c
+++ b/net/packet/af_packet.c
@@ -93,6 +93,8 @@
 #include <net/inet_common.h>
 #endif
 
+#include "internal.h"
+
 /*
    Assumptions:
    - if device has no dev->hard_header routine, it adds and removes ll header
@@ -146,14 +148,6 @@ dev->hard_header == NULL (ll header is added by device, we cannot control it)
 
 /* Private packet socket structures. */
 
-struct packet_mclist {
-        struct packet_mclist    *next;
-        int                     ifindex;
-        int                     count;
-        unsigned short          type;
-        unsigned short          alen;
-        unsigned char           addr[MAX_ADDR_LEN];
-};
 /* identical to struct packet_mreq except it has
  * a longer address field.
  */
@@ -175,63 +169,7 @@ static int packet_set_ring(struct sock *sk, union tpacket_req_u *req_u,
 #define BLK_PLUS_PRIV(sz_of_priv) \
         (BLK_HDR_LEN + ALIGN((sz_of_priv), V3_ALIGNMENT))
 
-/* kbdq - kernel block descriptor queue */
-struct tpacket_kbdq_core {
-        struct pgv      *pkbdq;
-        unsigned int    feature_req_word;
-        unsigned int    hdrlen;
-        unsigned char   reset_pending_on_curr_blk;
-        unsigned char   delete_blk_timer;
-        unsigned short  kactive_blk_num;
-        unsigned short  blk_sizeof_priv;
-
-        /* last_kactive_blk_num:
-         * trick to see if user-space has caught up
-         * in order to avoid refreshing timer when every single pkt arrives.
-         */
-        unsigned short  last_kactive_blk_num;
-
-        char            *pkblk_start;
-        char            *pkblk_end;
-        int             kblk_size;
-        unsigned int    knum_blocks;
-        uint64_t        knxt_seq_num;
-        char            *prev;
-        char            *nxt_offset;
-        struct sk_buff  *skb;
-
-        atomic_t        blk_fill_in_prog;
-
-        /* Default is set to 8ms */
-#define DEFAULT_PRB_RETIRE_TOV  (8)
-
-        unsigned short  retire_blk_tov;
-        unsigned short  version;
-        unsigned long   tov_in_jiffies;
-
-        /* timer to retire an outstanding block */
-        struct timer_list retire_blk_timer;
-};
-
 #define PGV_FROM_VMALLOC 1
-struct pgv {
-        char *buffer;
-};
-
-struct packet_ring_buffer {
-        struct pgv              *pg_vec;
-        unsigned int            head;
-        unsigned int            frames_per_block;
-        unsigned int            frame_size;
-        unsigned int            frame_max;
-
-        unsigned int            pg_vec_order;
-        unsigned int            pg_vec_pages;
-        unsigned int            pg_vec_len;
-
-        struct tpacket_kbdq_core        prb_bdqc;
-        atomic_t                pending;
-};
 
 #define BLOCK_STATUS(x) ((x)->hdr.bh1.block_status)
 #define BLOCK_NUM_PKTS(x)       ((x)->hdr.bh1.num_pkts)
@@ -269,52 +207,6 @@ static void prb_fill_vlan_info(struct tpacket_kbdq_core *,
                 struct tpacket3_hdr *);
 static void packet_flush_mclist(struct sock *sk);
 
-struct packet_fanout;
-struct packet_sock {
-        /* struct sock has to be the first member of packet_sock */
-        struct sock             sk;
-        struct packet_fanout    *fanout;
-        struct tpacket_stats    stats;
-        union  tpacket_stats_u  stats_u;
-        struct packet_ring_buffer       rx_ring;
-        struct packet_ring_buffer       tx_ring;
-        int                     copy_thresh;
-        spinlock_t              bind_lock;
-        struct mutex            pg_vec_lock;
-        unsigned int            running:1,      /* prot_hook is attached*/
-                                auxdata:1,
-                                origdev:1,
-                                has_vnet_hdr:1;
-        int                     ifindex;        /* bound device         */
-        __be16                  num;
-        struct packet_mclist    *mclist;
-        atomic_t                mapped;
-        enum tpacket_versions   tp_version;
-        unsigned int            tp_hdrlen;
-        unsigned int            tp_reserve;
-        unsigned int            tp_loss:1;
-        unsigned int            tp_tstamp;
-        struct packet_type      prot_hook ____cacheline_aligned_in_smp;
-};
-
-#define PACKET_FANOUT_MAX       256
-
-struct packet_fanout {
-#ifdef CONFIG_NET_NS
-        struct net              *net;
-#endif
-        unsigned int            num_members;
-        u16                     id;
-        u8                      type;
-        u8                      defrag;
-        atomic_t                rr_cur;
-        struct list_head        list;
-        struct sock             *arr[PACKET_FANOUT_MAX];
-        spinlock_t              lock;
-        atomic_t                sk_ref;
-        struct packet_type      prot_hook ____cacheline_aligned_in_smp;
-};
-
 struct packet_skb_cb {
         unsigned int origlen;
         union {
@@ -334,11 +226,6 @@ struct packet_skb_cb {
         (((x)->kactive_blk_num < ((x)->knum_blocks-1)) ? \
         ((x)->kactive_blk_num+1) : 0)
 
-static struct packet_sock *pkt_sk(struct sock *sk)
-{
-        return (struct packet_sock *)sk;
-}
-
 static void __fanout_unlink(struct sock *sk, struct packet_sock *po);
 static void __fanout_link(struct sock *sk, struct packet_sock *po);
 
@@ -968,7 +855,8 @@ static void prb_fill_vlan_info(struct tpacket_kbdq_core *pkc,
                 ppd->hv1.tp_vlan_tci = vlan_tx_tag_get(pkc->skb);
                 ppd->tp_status = TP_STATUS_VLAN_VALID;
         } else {
-                ppd->hv1.tp_vlan_tci = ppd->tp_status = 0;
+                ppd->hv1.tp_vlan_tci = 0;
+                ppd->tp_status = TP_STATUS_AVAILABLE;
         }
 }
 
@@ -1079,7 +967,7 @@ static void *packet_current_rx_frame(struct packet_sock *po,
         default:
                 WARN(1, "TPACKET version not supported\n");
                 BUG();
-                return 0;
+                return NULL;
         }
 }
 
@@ -1243,7 +1131,8 @@ static int packet_rcv_fanout(struct sk_buff *skb, struct net_device *dev,
         return po->prot_hook.func(skb, dev, &po->prot_hook, orig_dev);
 }
 
-static DEFINE_MUTEX(fanout_mutex);
+DEFINE_MUTEX(fanout_mutex);
+EXPORT_SYMBOL_GPL(fanout_mutex);
 static LIST_HEAD(fanout_list);
 
 static void __fanout_link(struct sock *sk, struct packet_sock *po)
@@ -1273,6 +1162,14 @@ static void __fanout_unlink(struct sock *sk, struct packet_sock *po)
         spin_unlock(&f->lock);
 }
 
+static bool match_fanout_group(struct packet_type *ptype, struct sock * sk)
+{
+        if (ptype->af_packet_priv == (void*)((struct packet_sock *)sk)->fanout)
+                return true;
+
+        return false;
+}
+
 static int fanout_add(struct sock *sk, u16 id, u16 type_flags)
 {
         struct packet_sock *po = pkt_sk(sk);
@@ -1325,6 +1222,7 @@ static int fanout_add(struct sock *sk, u16 id, u16 type_flags)
                 match->prot_hook.dev = po->prot_hook.dev;
                 match->prot_hook.func = packet_rcv_fanout;
                 match->prot_hook.af_packet_priv = match;
+                match->prot_hook.id_match = match_fanout_group;
                 dev_add_pack(&match->prot_hook);
                 list_add(&match->list, &fanout_list);
         }
@@ -1355,9 +1253,9 @@ static void fanout_release(struct sock *sk)
         if (!f)
                 return;
 
+        mutex_lock(&fanout_mutex);
         po->fanout = NULL;
 
-        mutex_lock(&fanout_mutex);
         if (atomic_dec_and_test(&f->sk_ref)) {
                 list_del(&f->list);
                 dev_remove_pack(&f->prot_hook);
@@ -1936,7 +1834,6 @@ static void tpacket_destruct_skb(struct sk_buff *skb)
 
         if (likely(po->tx_ring.pg_vec)) {
                 ph = skb_shinfo(skb)->destructor_arg;
-                BUG_ON(__packet_get_status(po, ph) != TP_STATUS_SENDING);
                 BUG_ON(atomic_read(&po->tx_ring.pending) == 0);
                 atomic_dec(&po->tx_ring.pending);
                 __packet_set_status(po, ph, TP_STATUS_AVAILABLE);
@@ -2055,7 +1952,7 @@ static int tpacket_snd(struct packet_sock *po, struct msghdr *msg)
         int tp_len, size_max;
         unsigned char *addr;
         int len_sum = 0;
-        int status = 0;
+        int status = TP_STATUS_AVAILABLE;
         int hlen, tlen;
 
         mutex_lock(&po->pg_vec_lock);
@@ -2420,10 +2317,13 @@ static int packet_release(struct socket *sock)
         net = sock_net(sk);
         po = pkt_sk(sk);
 
-        spin_lock_bh(&net->packet.sklist_lock);
+        mutex_lock(&net->packet.sklist_lock);
         sk_del_node_init_rcu(sk);
+        mutex_unlock(&net->packet.sklist_lock);
+
+        preempt_disable();
         sock_prot_inuse_add(net, sk->sk_prot, -1);
-        spin_unlock_bh(&net->packet.sklist_lock);
+        preempt_enable();
 
         spin_lock(&po->bind_lock);
         unregister_prot_hook(sk, false);
@@ -2622,10 +2522,13 @@ static int packet_create(struct net *net, struct socket *sock, int protocol,
                 register_prot_hook(sk);
         }
 
-        spin_lock_bh(&net->packet.sklist_lock);
+        mutex_lock(&net->packet.sklist_lock);
         sk_add_node_rcu(sk, &net->packet.sklist);
+        mutex_unlock(&net->packet.sklist_lock);
+
+        preempt_disable();
         sock_prot_inuse_add(net, &packet_proto, 1);
-        spin_unlock_bh(&net->packet.sklist_lock);
+        preempt_enable();
 
         return 0;
 out:
@@ -3846,7 +3749,7 @@ static int packet_seq_show(struct seq_file *seq, void *v)
                            po->ifindex,
                            po->running,
                            atomic_read(&s->sk_rmem_alloc),
-                           sock_i_uid(s),
+                           from_kuid_munged(seq_user_ns(seq), sock_i_uid(s)),
                            sock_i_ino(s));
         }
 
@@ -3878,7 +3781,7 @@ static const struct file_operations packet_seq_fops = {
 
 static int __net_init packet_net_init(struct net *net)
 {
-        spin_lock_init(&net->packet.sklist_lock);
+        mutex_init(&net->packet.sklist_lock);
         INIT_HLIST_HEAD(&net->packet.sklist);
 
         if (!proc_net_fops_create(net, "packet", 0, &packet_seq_fops))
diff --git a/net/packet/diag.c b/net/packet/diag.c
new file mode 100644
index 000000000000..39bce0d50df9
--- /dev/null
+++ b/net/packet/diag.c
@@ -0,0 +1,242 @@
+#include <linux/module.h>
+#include <linux/sock_diag.h>
+#include <linux/net.h>
+#include <linux/netdevice.h>
+#include <linux/packet_diag.h>
+#include <net/net_namespace.h>
+#include <net/sock.h>
+
+#include "internal.h"
+
+static int pdiag_put_info(const struct packet_sock *po, struct sk_buff *nlskb)
+{
+        struct packet_diag_info pinfo;
+
+        pinfo.pdi_index = po->ifindex;
+        pinfo.pdi_version = po->tp_version;
+        pinfo.pdi_reserve = po->tp_reserve;
+        pinfo.pdi_copy_thresh = po->copy_thresh;
+        pinfo.pdi_tstamp = po->tp_tstamp;
+
+        pinfo.pdi_flags = 0;
+        if (po->running)
+                pinfo.pdi_flags |= PDI_RUNNING;
+        if (po->auxdata)
+                pinfo.pdi_flags |= PDI_AUXDATA;
+        if (po->origdev)
+                pinfo.pdi_flags |= PDI_ORIGDEV;
+        if (po->has_vnet_hdr)
+                pinfo.pdi_flags |= PDI_VNETHDR;
+        if (po->tp_loss)
+                pinfo.pdi_flags |= PDI_LOSS;
+
+        return nla_put(nlskb, PACKET_DIAG_INFO, sizeof(pinfo), &pinfo);
+}
+
+static int pdiag_put_mclist(const struct packet_sock *po, struct sk_buff *nlskb)
+{
+        struct nlattr *mca;
+        struct packet_mclist *ml;
+
+        mca = nla_nest_start(nlskb, PACKET_DIAG_MCLIST);
+        if (!mca)
+                return -EMSGSIZE;
+
+        rtnl_lock();
+        for (ml = po->mclist; ml; ml = ml->next) {
+                struct packet_diag_mclist *dml;
+
+                dml = nla_reserve_nohdr(nlskb, sizeof(*dml));
+                if (!dml) {
+                        rtnl_unlock();
+                        nla_nest_cancel(nlskb, mca);
+                        return -EMSGSIZE;
+                }
+
+                dml->pdmc_index = ml->ifindex;
+                dml->pdmc_type = ml->type;
+                dml->pdmc_alen = ml->alen;
+                dml->pdmc_count = ml->count;
+                BUILD_BUG_ON(sizeof(dml->pdmc_addr) != sizeof(ml->addr));
+                memcpy(dml->pdmc_addr, ml->addr, sizeof(ml->addr));
+        }
+
+        rtnl_unlock();
+        nla_nest_end(nlskb, mca);
+
+        return 0;
+}
+
+static int pdiag_put_ring(struct packet_ring_buffer *ring, int ver, int nl_type,
+                struct sk_buff *nlskb)
+{
+        struct packet_diag_ring pdr;
+
+        if (!ring->pg_vec || ((ver > TPACKET_V2) &&
+                                (nl_type == PACKET_DIAG_TX_RING)))
+                return 0;
+
+        pdr.pdr_block_size = ring->pg_vec_pages << PAGE_SHIFT;
+        pdr.pdr_block_nr = ring->pg_vec_len;
+        pdr.pdr_frame_size = ring->frame_size;
+        pdr.pdr_frame_nr = ring->frame_max + 1;
+
+        if (ver > TPACKET_V2) {
+                pdr.pdr_retire_tmo = ring->prb_bdqc.retire_blk_tov;
+                pdr.pdr_sizeof_priv = ring->prb_bdqc.blk_sizeof_priv;
+                pdr.pdr_features = ring->prb_bdqc.feature_req_word;
+        } else {
+                pdr.pdr_retire_tmo = 0;
+                pdr.pdr_sizeof_priv = 0;
+                pdr.pdr_features = 0;
+        }
+
+        return nla_put(nlskb, nl_type, sizeof(pdr), &pdr);
+}
+
+static int pdiag_put_rings_cfg(struct packet_sock *po, struct sk_buff *skb)
+{
+        int ret;
+
+        mutex_lock(&po->pg_vec_lock);
+        ret = pdiag_put_ring(&po->rx_ring, po->tp_version,
+                        PACKET_DIAG_RX_RING, skb);
+        if (!ret)
+                ret = pdiag_put_ring(&po->tx_ring, po->tp_version,
+                                PACKET_DIAG_TX_RING, skb);
+        mutex_unlock(&po->pg_vec_lock);
+
+        return ret;
+}
+
+static int pdiag_put_fanout(struct packet_sock *po, struct sk_buff *nlskb)
+{
+        int ret = 0;
+
+        mutex_lock(&fanout_mutex);
+        if (po->fanout) {
+                u32 val;
+
+                val = (u32)po->fanout->id | ((u32)po->fanout->type << 16);
+                ret = nla_put_u32(nlskb, PACKET_DIAG_FANOUT, val);
+        }
+        mutex_unlock(&fanout_mutex);
+
+        return ret;
+}
+
+static int sk_diag_fill(struct sock *sk, struct sk_buff *skb, struct packet_diag_req *req,
+                u32 pid, u32 seq, u32 flags, int sk_ino)
+{
+        struct nlmsghdr *nlh;
+        struct packet_diag_msg *rp;
+        struct packet_sock *po = pkt_sk(sk);
+
+        nlh = nlmsg_put(skb, pid, seq, SOCK_DIAG_BY_FAMILY, sizeof(*rp), flags);
+        if (!nlh)
+                return -EMSGSIZE;
+
+        rp = nlmsg_data(nlh);
+        rp->pdiag_family = AF_PACKET;
+        rp->pdiag_type = sk->sk_type;
+        rp->pdiag_num = ntohs(po->num);
+        rp->pdiag_ino = sk_ino;
+        sock_diag_save_cookie(sk, rp->pdiag_cookie);
+
+        if ((req->pdiag_show & PACKET_SHOW_INFO) &&
+                        pdiag_put_info(po, skb))
+                goto out_nlmsg_trim;
+
+        if ((req->pdiag_show & PACKET_SHOW_MCLIST) &&
+                        pdiag_put_mclist(po, skb))
+                goto out_nlmsg_trim;
+
+        if ((req->pdiag_show & PACKET_SHOW_RING_CFG) &&
+                        pdiag_put_rings_cfg(po, skb))
+                goto out_nlmsg_trim;
+
+        if ((req->pdiag_show & PACKET_SHOW_FANOUT) &&
+                        pdiag_put_fanout(po, skb))
+                goto out_nlmsg_trim;
+
+        return nlmsg_end(skb, nlh);
+
+out_nlmsg_trim:
+        nlmsg_cancel(skb, nlh);
+        return -EMSGSIZE;
+}
+
+static int packet_diag_dump(struct sk_buff *skb, struct netlink_callback *cb)
+{
+        int num = 0, s_num = cb->args[0];
+        struct packet_diag_req *req;
+        struct net *net;
+        struct sock *sk;
+        struct hlist_node *node;
+
+        net = sock_net(skb->sk);
+        req = nlmsg_data(cb->nlh);
+
+        mutex_lock(&net->packet.sklist_lock);
+        sk_for_each(sk, node, &net->packet.sklist) {
+                if (!net_eq(sock_net(sk), net))
+                        continue;
+                if (num < s_num)
+                        goto next;
+
+                if (sk_diag_fill(sk, skb, req, NETLINK_CB(cb->skb).pid,
+                                        cb->nlh->nlmsg_seq, NLM_F_MULTI,
+                                        sock_i_ino(sk)) < 0)
+                        goto done;
+next:
+                num++;
+        }
+done:
+        mutex_unlock(&net->packet.sklist_lock);
+        cb->args[0] = num;
+
+        return skb->len;
+}
+
+static int packet_diag_handler_dump(struct sk_buff *skb, struct nlmsghdr *h)
+{
+        int hdrlen = sizeof(struct packet_diag_req);
+        struct net *net = sock_net(skb->sk);
+        struct packet_diag_req *req;
+
+        if (nlmsg_len(h) < hdrlen)
+                return -EINVAL;
+
+        req = nlmsg_data(h);
+        /* Make it possible to support protocol filtering later */
+        if (req->sdiag_protocol)
+                return -EINVAL;
+
+        if (h->nlmsg_flags & NLM_F_DUMP) {
+                struct netlink_dump_control c = {
+                        .dump = packet_diag_dump,
+                };
+                return netlink_dump_start(net->diag_nlsk, skb, h, &c);
+        } else
+                return -EOPNOTSUPP;
+}
+
+static const struct sock_diag_handler packet_diag_handler = {
+        .family = AF_PACKET,
+        .dump = packet_diag_handler_dump,
+};
+
+static int __init packet_diag_init(void)
+{
+        return sock_diag_register(&packet_diag_handler);
+}
+
+static void __exit packet_diag_exit(void)
+{
+        sock_diag_unregister(&packet_diag_handler);
+}
+
+module_init(packet_diag_init);
+module_exit(packet_diag_exit);
+MODULE_LICENSE("GPL");
+MODULE_ALIAS_NET_PF_PROTO_TYPE(PF_NETLINK, NETLINK_SOCK_DIAG, 17 /* AF_PACKET */);
diff --git a/net/packet/internal.h b/net/packet/internal.h
new file mode 100644
index 000000000000..44945f6b7252
--- /dev/null
+++ b/net/packet/internal.h
@@ -0,0 +1,121 @@
+#ifndef __PACKET_INTERNAL_H__
+#define __PACKET_INTERNAL_H__
+
+struct packet_mclist {
+        struct packet_mclist    *next;
+        int                     ifindex;
+        int                     count;
+        unsigned short          type;
+        unsigned short          alen;
+        unsigned char           addr[MAX_ADDR_LEN];
+};
+
+/* kbdq - kernel block descriptor queue */
+struct tpacket_kbdq_core {
+        struct pgv      *pkbdq;
+        unsigned int    feature_req_word;
+        unsigned int    hdrlen;
+        unsigned char   reset_pending_on_curr_blk;
+        unsigned char   delete_blk_timer;
+        unsigned short  kactive_blk_num;
+        unsigned short  blk_sizeof_priv;
+
+        /* last_kactive_blk_num:
+         * trick to see if user-space has caught up
+         * in order to avoid refreshing timer when every single pkt arrives.
+         */
+        unsigned short  last_kactive_blk_num;
+
+        char            *pkblk_start;
+        char            *pkblk_end;
+        int             kblk_size;
+        unsigned int    knum_blocks;
+        uint64_t        knxt_seq_num;
+        char            *prev;
+        char            *nxt_offset;
+        struct sk_buff  *skb;
+
+        atomic_t        blk_fill_in_prog;
+
+        /* Default is set to 8ms */
+#define DEFAULT_PRB_RETIRE_TOV  (8)
+
+        unsigned short  retire_blk_tov;
+        unsigned short  version;
+        unsigned long   tov_in_jiffies;
+
+        /* timer to retire an outstanding block */
+        struct timer_list retire_blk_timer;
+};
+
+struct pgv {
+        char *buffer;
+};
+
+struct packet_ring_buffer {
+        struct pgv              *pg_vec;
+        unsigned int            head;
+        unsigned int            frames_per_block;
+        unsigned int            frame_size;
+        unsigned int            frame_max;
+
+        unsigned int            pg_vec_order;
+        unsigned int            pg_vec_pages;
+        unsigned int            pg_vec_len;
+
+        struct tpacket_kbdq_core        prb_bdqc;
+        atomic_t                pending;
+};
+
+extern struct mutex fanout_mutex;
+#define PACKET_FANOUT_MAX       256
+
+struct packet_fanout {
+#ifdef CONFIG_NET_NS
+        struct net              *net;
+#endif
+        unsigned int            num_members;
+        u16                     id;
+        u8                      type;
+        u8                      defrag;
+        atomic_t                rr_cur;
+        struct list_head        list;
+        struct sock             *arr[PACKET_FANOUT_MAX];
+        spinlock_t              lock;
+        atomic_t                sk_ref;
+        struct packet_type      prot_hook ____cacheline_aligned_in_smp;
+};
+
+struct packet_sock {
+        /* struct sock has to be the first member of packet_sock */
+        struct sock             sk;
+        struct packet_fanout    *fanout;
+        struct tpacket_stats    stats;
+        union  tpacket_stats_u  stats_u;
+        struct packet_ring_buffer       rx_ring;
+        struct packet_ring_buffer       tx_ring;
+        int                     copy_thresh;
+        spinlock_t              bind_lock;
+        struct mutex            pg_vec_lock;
+        unsigned int            running:1,      /* prot_hook is attached*/
+                                auxdata:1,
+                                origdev:1,
+                                has_vnet_hdr:1;
+        int                     ifindex;        /* bound device         */
+        __be16                  num;
+        struct packet_mclist    *mclist;
+        atomic_t                mapped;
+        enum tpacket_versions   tp_version;
+        unsigned int            tp_hdrlen;
+        unsigned int            tp_reserve;
+        unsigned int            tp_loss:1;
+        unsigned int            tp_tstamp;
+        struct packet_type      prot_hook ____cacheline_aligned_in_smp;
+};
+
+static struct packet_sock *pkt_sk(struct sock *sk)
+{
+        return (struct packet_sock *)sk;
+}
+
+#endif
diff --git a/net/phonet/socket.c b/net/phonet/socket.c
index 0acc943f713a..b7e982782255 100644
--- a/net/phonet/socket.c
+++ b/net/phonet/socket.c
@@ -612,7 +612,8 @@ static int pn_sock_seq_show(struct seq_file *seq, void *v)
                         sk->sk_protocol, pn->sobject, pn->dobject,
                         pn->resource, sk->sk_state,
                         sk_wmem_alloc_get(sk), sk_rmem_alloc_get(sk),
-                        sock_i_uid(sk), sock_i_ino(sk),
+                        from_kuid_munged(seq_user_ns(seq), sock_i_uid(sk)),
+                        sock_i_ino(sk),
                         atomic_read(&sk->sk_refcnt), sk,
                         atomic_read(&sk->sk_drops), &len);
         }
@@ -796,7 +797,8 @@ static int pn_res_seq_show(struct seq_file *seq, void *v)
                 struct sock *sk = *psk;
 
                 seq_printf(seq, "%02X %5d %lu%n",
-                           (int) (psk - pnres.sk), sock_i_uid(sk),
+                           (int) (psk - pnres.sk),
+                           from_kuid_munged(seq_user_ns(seq), sock_i_uid(sk)),
                            sock_i_ino(sk), &len);
         }
         seq_printf(seq, "%*s\n", 63 - len, "");
diff --git a/net/rds/tcp_connect.c b/net/rds/tcp_connect.c
index af95c8e058fc..a65ee78db0c5 100644
--- a/net/rds/tcp_connect.c
+++ b/net/rds/tcp_connect.c
@@ -43,7 +43,7 @@ void rds_tcp_state_change(struct sock *sk)
         struct rds_connection *conn;
         struct rds_tcp_connection *tc;
 
-        read_lock_bh(&sk->sk_callback_lock);
+        read_lock(&sk->sk_callback_lock);
         conn = sk->sk_user_data;
         if (!conn) {
                 state_change = sk->sk_state_change;
@@ -68,7 +68,7 @@ void rds_tcp_state_change(struct sock *sk)
                         break;
         }
 out:
-        read_unlock_bh(&sk->sk_callback_lock);
+        read_unlock(&sk->sk_callback_lock);
         state_change(sk);
 }
 
diff --git a/net/rds/tcp_listen.c b/net/rds/tcp_listen.c
index 72981375f47c..7787537e9c2e 100644
--- a/net/rds/tcp_listen.c
+++ b/net/rds/tcp_listen.c
@@ -114,7 +114,7 @@ void rds_tcp_listen_data_ready(struct sock *sk, int bytes)
 
         rdsdebug("listen data ready sk %p\n", sk);
 
-        read_lock_bh(&sk->sk_callback_lock);
+        read_lock(&sk->sk_callback_lock);
         ready = sk->sk_user_data;
         if (!ready) { /* check for teardown race */
                 ready = sk->sk_data_ready;
@@ -131,7 +131,7 @@ void rds_tcp_listen_data_ready(struct sock *sk, int bytes)
                 queue_work(rds_wq, &rds_tcp_listen_work);
 
 out:
-        read_unlock_bh(&sk->sk_callback_lock);
+        read_unlock(&sk->sk_callback_lock);
         ready(sk, bytes);
 }
 
diff --git a/net/rds/tcp_recv.c b/net/rds/tcp_recv.c
index 6243258f840f..4fac4f2bb9dc 100644
--- a/net/rds/tcp_recv.c
+++ b/net/rds/tcp_recv.c
@@ -322,7 +322,7 @@ void rds_tcp_data_ready(struct sock *sk, int bytes)
 
         rdsdebug("data ready sk %p bytes %d\n", sk, bytes);
 
-        read_lock_bh(&sk->sk_callback_lock);
+        read_lock(&sk->sk_callback_lock);
         conn = sk->sk_user_data;
         if (!conn) { /* check for teardown race */
                 ready = sk->sk_data_ready;
@@ -336,7 +336,7 @@ void rds_tcp_data_ready(struct sock *sk, int bytes)
         if (rds_tcp_read_sock(conn, GFP_ATOMIC) == -ENOMEM)
                 queue_delayed_work(rds_wq, &conn->c_recv_w, 0);
 out:
-        read_unlock_bh(&sk->sk_callback_lock);
+        read_unlock(&sk->sk_callback_lock);
         ready(sk, bytes);
 }
 
diff --git a/net/rds/tcp_send.c b/net/rds/tcp_send.c
index 1b4fd68f0c7c..81cf5a4c5e40 100644
--- a/net/rds/tcp_send.c
+++ b/net/rds/tcp_send.c
@@ -174,7 +174,7 @@ void rds_tcp_write_space(struct sock *sk)
         struct rds_connection *conn;
         struct rds_tcp_connection *tc;
 
-        read_lock_bh(&sk->sk_callback_lock);
+        read_lock(&sk->sk_callback_lock);
         conn = sk->sk_user_data;
         if (!conn) {
                 write_space = sk->sk_write_space;
@@ -194,7 +194,7 @@ void rds_tcp_write_space(struct sock *sk)
                 queue_delayed_work(rds_wq, &conn->c_send_w, 0);
 
 out:
-        read_unlock_bh(&sk->sk_callback_lock);
+        read_unlock(&sk->sk_callback_lock);
 
         /*
          * write_space is only called when data leaves tcp's send queue if
diff --git a/net/rfkill/core.c b/net/rfkill/core.c
index 752b72360ebc..c275bad12068 100644
--- a/net/rfkill/core.c
+++ b/net/rfkill/core.c
@@ -150,6 +150,20 @@ static void rfkill_led_trigger_activate(struct led_classdev *led)
         rfkill_led_trigger_event(rfkill);
 }
 
+const char *rfkill_get_led_trigger_name(struct rfkill *rfkill)
+{
+        return rfkill->led_trigger.name;
+}
+EXPORT_SYMBOL(rfkill_get_led_trigger_name);
+
+void rfkill_set_led_trigger_name(struct rfkill *rfkill, const char *name)
+{
+        BUG_ON(!rfkill);
+
+        rfkill->ledtrigname = name;
+}
+EXPORT_SYMBOL(rfkill_set_led_trigger_name);
+
 static int rfkill_led_trigger_register(struct rfkill *rfkill)
 {
         rfkill->led_trigger.name = rfkill->ledtrigname
diff --git a/net/sched/act_gact.c b/net/sched/act_gact.c
index f10fb8256442..05d60859d8e3 100644
--- a/net/sched/act_gact.c
+++ b/net/sched/act_gact.c
@@ -67,6 +67,9 @@ static int tcf_gact_init(struct nlattr *nla, struct nlattr *est,
         struct tcf_common *pc;
         int ret = 0;
         int err;
+#ifdef CONFIG_GACT_PROB
+        struct tc_gact_p *p_parm = NULL;
+#endif
 
         if (nla == NULL)
                 return -EINVAL;
@@ -82,6 +85,12 @@ static int tcf_gact_init(struct nlattr *nla, struct nlattr *est,
 #ifndef CONFIG_GACT_PROB
         if (tb[TCA_GACT_PROB] != NULL)
                 return -EOPNOTSUPP;
+#else
+        if (tb[TCA_GACT_PROB]) {
+                p_parm = nla_data(tb[TCA_GACT_PROB]);
+                if (p_parm->ptype >= MAX_RAND)
+                        return -EINVAL;
+        }
 #endif
 
         pc = tcf_hash_check(parm->index, a, bind, &gact_hash_info);
@@ -103,8 +112,7 @@ static int tcf_gact_init(struct nlattr *nla, struct nlattr *est,
         spin_lock_bh(&gact->tcf_lock);
         gact->tcf_action = parm->action;
 #ifdef CONFIG_GACT_PROB
-        if (tb[TCA_GACT_PROB] != NULL) {
-                struct tc_gact_p *p_parm = nla_data(tb[TCA_GACT_PROB]);
+        if (p_parm) {
                 gact->tcfg_paction = p_parm->paction;
                 gact->tcfg_pval    = p_parm->pval;
                 gact->tcfg_ptype   = p_parm->ptype;
@@ -133,7 +141,7 @@ static int tcf_gact(struct sk_buff *skb, const struct tc_action *a,
 
         spin_lock(&gact->tcf_lock);
 #ifdef CONFIG_GACT_PROB
-        if (gact->tcfg_ptype && gact_rand[gact->tcfg_ptype] != NULL)
+        if (gact->tcfg_ptype)
                 action = gact_rand[gact->tcfg_ptype](gact);
         else
                 action = gact->tcf_action;
diff --git a/net/sched/act_ipt.c b/net/sched/act_ipt.c
index 60e281ad0f07..58fb3c7aab9e 100644
--- a/net/sched/act_ipt.c
+++ b/net/sched/act_ipt.c
@@ -185,7 +185,12 @@ err3:
 err2:
         kfree(tname);
 err1:
-        kfree(pc);
+        if (ret == ACT_P_CREATED) {
+                if (est)
+                        gen_kill_estimator(&pc->tcfc_bstats,
+                                           &pc->tcfc_rate_est);
+                kfree_rcu(pc, tcfc_rcu);
+        }
         return err;
 }
 
diff --git a/net/sched/act_mirred.c b/net/sched/act_mirred.c
index fe81cc18e9e0..9c0fd0c78814 100644
--- a/net/sched/act_mirred.c
+++ b/net/sched/act_mirred.c
@@ -200,13 +200,12 @@ static int tcf_mirred(struct sk_buff *skb, const struct tc_action *a,
 out:
         if (err) {
                 m->tcf_qstats.overlimits++;
-                /* should we be asking for packet to be dropped?
-                 * may make sense for redirect case only
-                 */
-                retval = TC_ACT_SHOT;
-        } else {
+                if (m->tcfm_eaction != TCA_EGRESS_MIRROR)
+                        retval = TC_ACT_SHOT;
+                else
+                        retval = m->tcf_action;
+        } else
                 retval = m->tcf_action;
-        }
         spin_unlock(&m->tcf_lock);
 
         return retval;
diff --git a/net/sched/act_pedit.c b/net/sched/act_pedit.c
index 26aa2f6ce257..45c53ab067a6 100644
--- a/net/sched/act_pedit.c
+++ b/net/sched/act_pedit.c
@@ -74,7 +74,10 @@ static int tcf_pedit_init(struct nlattr *nla, struct nlattr *est,
                 p = to_pedit(pc);
                 keys = kmalloc(ksize, GFP_KERNEL);
                 if (keys == NULL) {
-                        kfree(pc);
+                        if (est)
+                                gen_kill_estimator(&pc->tcfc_bstats,
+                                                   &pc->tcfc_rate_est);
+                        kfree_rcu(pc, tcfc_rcu);
                         return -ENOMEM;
                 }
                 ret = ACT_P_CREATED;
diff --git a/net/sched/act_simple.c b/net/sched/act_simple.c
index 3922f2a2821b..3714f60f0b3c 100644
--- a/net/sched/act_simple.c
+++ b/net/sched/act_simple.c
@@ -131,7 +131,10 @@ static int tcf_simp_init(struct nlattr *nla, struct nlattr *est,
                 d = to_defact(pc);
                 ret = alloc_defdata(d, defdata);
                 if (ret < 0) {
-                        kfree(pc);
+                        if (est)
+                                gen_kill_estimator(&pc->tcfc_bstats,
+                                                   &pc->tcfc_rate_est);
+                        kfree_rcu(pc, tcfc_rcu);
                         return ret;
                 }
                 d->tcf_action = parm->action;
diff --git a/net/sched/cls_api.c b/net/sched/cls_api.c
index 6dd1131f2ec1..dc3ef5aef355 100644
--- a/net/sched/cls_api.c
+++ b/net/sched/cls_api.c
@@ -319,7 +319,7 @@ replay:
                 }
         }
 
-        err = tp->ops->change(tp, cl, t->tcm_handle, tca, &fh);
+        err = tp->ops->change(skb, tp, cl, t->tcm_handle, tca, &fh);
         if (err == 0) {
                 if (tp_created) {
                         spin_lock_bh(root_lock);
diff --git a/net/sched/cls_basic.c b/net/sched/cls_basic.c
index 590960a22a77..344a11b342e5 100644
--- a/net/sched/cls_basic.c
+++ b/net/sched/cls_basic.c
@@ -162,7 +162,8 @@ errout:
         return err;
 }
 
-static int basic_change(struct tcf_proto *tp, unsigned long base, u32 handle,
+static int basic_change(struct sk_buff *in_skb,
+                        struct tcf_proto *tp, unsigned long base, u32 handle,
                         struct nlattr **tca, unsigned long *arg)
 {
         int err;
diff --git a/net/sched/cls_cgroup.c b/net/sched/cls_cgroup.c
index 7743ea8d1d38..91de66695b4a 100644
--- a/net/sched/cls_cgroup.c
+++ b/net/sched/cls_cgroup.c
@@ -151,7 +151,8 @@ static const struct nla_policy cgroup_policy[TCA_CGROUP_MAX + 1] = {
         [TCA_CGROUP_EMATCHES]   = { .type = NLA_NESTED },
 };
 
-static int cls_cgroup_change(struct tcf_proto *tp, unsigned long base,
+static int cls_cgroup_change(struct sk_buff *in_skb,
+                             struct tcf_proto *tp, unsigned long base,
                              u32 handle, struct nlattr **tca,
                              unsigned long *arg)
 {
diff --git a/net/sched/cls_flow.c b/net/sched/cls_flow.c
index ccd08c8dc6a7..ce82d0cb1b47 100644
--- a/net/sched/cls_flow.c
+++ b/net/sched/cls_flow.c
@@ -193,15 +193,19 @@ static u32 flow_get_rtclassid(const struct sk_buff *skb)
 
 static u32 flow_get_skuid(const struct sk_buff *skb)
 {
-        if (skb->sk && skb->sk->sk_socket && skb->sk->sk_socket->file)
-                return skb->sk->sk_socket->file->f_cred->fsuid;
+        if (skb->sk && skb->sk->sk_socket && skb->sk->sk_socket->file) {
+                kuid_t skuid = skb->sk->sk_socket->file->f_cred->fsuid;
+                return from_kuid(&init_user_ns, skuid);
+        }
         return 0;
 }
 
 static u32 flow_get_skgid(const struct sk_buff *skb)
 {
-        if (skb->sk && skb->sk->sk_socket && skb->sk->sk_socket->file)
-                return skb->sk->sk_socket->file->f_cred->fsgid;
+        if (skb->sk && skb->sk->sk_socket && skb->sk->sk_socket->file) {
+                kgid_t skgid = skb->sk->sk_socket->file->f_cred->fsgid;
+                return from_kgid(&init_user_ns, skgid);
+        }
         return 0;
 }
 
@@ -347,7 +351,8 @@ static const struct nla_policy flow_policy[TCA_FLOW_MAX + 1] = {
         [TCA_FLOW_PERTURB]      = { .type = NLA_U32 },
 };
 
-static int flow_change(struct tcf_proto *tp, unsigned long base,
+static int flow_change(struct sk_buff *in_skb, 
+                       struct tcf_proto *tp, unsigned long base,
                        u32 handle, struct nlattr **tca,
                        unsigned long *arg)
 {
@@ -386,6 +391,10 @@ static int flow_change(struct tcf_proto *tp, unsigned long base,
 
                 if (fls(keymask) - 1 > FLOW_KEY_MAX)
                         return -EOPNOTSUPP;
+
+                if ((keymask & (FLOW_KEY_SKUID|FLOW_KEY_SKGID)) &&
+                    sk_user_ns(NETLINK_CB(in_skb).ssk) != &init_user_ns)
+                        return -EOPNOTSUPP;
         }
 
         err = tcf_exts_validate(tp, tb, tca[TCA_RATE], &e, &flow_ext_map);
diff --git a/net/sched/cls_fw.c b/net/sched/cls_fw.c
index 8384a4797240..4075a0aef2aa 100644
--- a/net/sched/cls_fw.c
+++ b/net/sched/cls_fw.c
@@ -233,7 +233,8 @@ errout:
         return err;
 }
 
-static int fw_change(struct tcf_proto *tp, unsigned long base,
+static int fw_change(struct sk_buff *in_skb,
+                     struct tcf_proto *tp, unsigned long base,
                      u32 handle,
                      struct nlattr **tca,
                      unsigned long *arg)
diff --git a/net/sched/cls_route.c b/net/sched/cls_route.c
index 44f405cb9aaf..c10d57bf98f2 100644
--- a/net/sched/cls_route.c
+++ b/net/sched/cls_route.c
@@ -427,7 +427,8 @@ errout:
         return err;
 }
 
-static int route4_change(struct tcf_proto *tp, unsigned long base,
+static int route4_change(struct sk_buff *in_skb,
+                       struct tcf_proto *tp, unsigned long base,
                        u32 handle,
                        struct nlattr **tca,
                        unsigned long *arg)
diff --git a/net/sched/cls_rsvp.h b/net/sched/cls_rsvp.h
index 18ab93ec8d7e..494bbb90924a 100644
--- a/net/sched/cls_rsvp.h
+++ b/net/sched/cls_rsvp.h
@@ -416,7 +416,8 @@ static const struct nla_policy rsvp_policy[TCA_RSVP_MAX + 1] = {
         [TCA_RSVP_PINFO]        = { .len = sizeof(struct tc_rsvp_pinfo) },
 };
 
-static int rsvp_change(struct tcf_proto *tp, unsigned long base,
+static int rsvp_change(struct sk_buff *in_skb,
+                       struct tcf_proto *tp, unsigned long base,
                        u32 handle,
                        struct nlattr **tca,
                        unsigned long *arg)
diff --git a/net/sched/cls_tcindex.c b/net/sched/cls_tcindex.c
index fe29420d0b0e..a1293b4ab7a1 100644
--- a/net/sched/cls_tcindex.c
+++ b/net/sched/cls_tcindex.c
@@ -332,7 +332,8 @@ errout:
 }
 
 static int
-tcindex_change(struct tcf_proto *tp, unsigned long base, u32 handle,
+tcindex_change(struct sk_buff *in_skb,
+               struct tcf_proto *tp, unsigned long base, u32 handle,
                struct nlattr **tca, unsigned long *arg)
 {
         struct nlattr *opt = tca[TCA_OPTIONS];
diff --git a/net/sched/cls_u32.c b/net/sched/cls_u32.c
index d45373fb00b9..c7c27bc91b5a 100644
--- a/net/sched/cls_u32.c
+++ b/net/sched/cls_u32.c
@@ -544,7 +544,8 @@ errout:
         return err;
 }
 
-static int u32_change(struct tcf_proto *tp, unsigned long base, u32 handle,
+static int u32_change(struct sk_buff *in_skb,
+                      struct tcf_proto *tp, unsigned long base, u32 handle,
                       struct nlattr **tca,
                       unsigned long *arg)
 {
diff --git a/net/sched/sch_generic.c b/net/sched/sch_generic.c
index 511323e89cec..6c4d5fe53ce8 100644
--- a/net/sched/sch_generic.c
+++ b/net/sched/sch_generic.c
@@ -324,24 +324,6 @@ void netif_carrier_off(struct net_device *dev)
 }
 EXPORT_SYMBOL(netif_carrier_off);
 
-/**
- *      netif_notify_peers - notify network peers about existence of @dev
- *      @dev: network device
- *
- * Generate traffic such that interested network peers are aware of
- * @dev, such as by generating a gratuitous ARP. This may be used when
- * a device wants to inform the rest of the network about some sort of
- * reconfiguration such as a failover event or virtual machine
- * migration.
- */
-void netif_notify_peers(struct net_device *dev)
-{
-        rtnl_lock();
-        call_netdevice_notifiers(NETDEV_NOTIFY_PEERS, dev);
-        rtnl_unlock();
-}
-EXPORT_SYMBOL(netif_notify_peers);
-
 /* "NOOP" scheduler: the best scheduler, recommended for all interfaces
    under all circumstances. It is difficult to invent anything faster or
    cheaper.
diff --git a/net/sched/sch_qfq.c b/net/sched/sch_qfq.c
index 9af01f3df18c..e4723d31fdd5 100644
--- a/net/sched/sch_qfq.c
+++ b/net/sched/sch_qfq.c
@@ -203,6 +203,34 @@ out:
         return index;
 }
 
+/* Length of the next packet (0 if the queue is empty). */
+static unsigned int qdisc_peek_len(struct Qdisc *sch)
+{
+        struct sk_buff *skb;
+
+        skb = sch->ops->peek(sch);
+        return skb ? qdisc_pkt_len(skb) : 0;
+}
+
+static void qfq_deactivate_class(struct qfq_sched *, struct qfq_class *);
+static void qfq_activate_class(struct qfq_sched *q, struct qfq_class *cl,
+                               unsigned int len);
+
+static void qfq_update_class_params(struct qfq_sched *q, struct qfq_class *cl,
+                                    u32 lmax, u32 inv_w, int delta_w)
+{
+        int i;
+
+        /* update qfq-specific data */
+        cl->lmax = lmax;
+        cl->inv_w = inv_w;
+        i = qfq_calc_index(cl->inv_w, cl->lmax);
+
+        cl->grp = &q->groups[i];
+
+        q->wsum += delta_w;
+}
+
 static int qfq_change_class(struct Qdisc *sch, u32 classid, u32 parentid,
                             struct nlattr **tca, unsigned long *arg)
 {
@@ -250,6 +278,8 @@ static int qfq_change_class(struct Qdisc *sch, u32 classid, u32 parentid,
                 lmax = 1UL << QFQ_MTU_SHIFT;
 
         if (cl != NULL) {
+                bool need_reactivation = false;
+
                 if (tca[TCA_RATE]) {
                         err = gen_replace_estimator(&cl->bstats, &cl->rate_est,
                                                     qdisc_root_sleeping_lock(sch),
@@ -258,12 +288,29 @@ static int qfq_change_class(struct Qdisc *sch, u32 classid, u32 parentid,
                                 return err;
                 }
 
-                if (inv_w != cl->inv_w) {
-                        sch_tree_lock(sch);
-                        q->wsum += delta_w;
-                        cl->inv_w = inv_w;
-                        sch_tree_unlock(sch);
+                if (lmax == cl->lmax && inv_w == cl->inv_w)
+                        return 0; /* nothing to update */
+
+                i = qfq_calc_index(inv_w, lmax);
+                sch_tree_lock(sch);
+                if (&q->groups[i] != cl->grp && cl->qdisc->q.qlen > 0) {
+                        /*
+                         * shift cl->F back, to not charge the
+                         * class for the not-yet-served head
+                         * packet
+                         */
+                        cl->F = cl->S;
+                        /* remove class from its slot in the old group */
+                        qfq_deactivate_class(q, cl);
+                        need_reactivation = true;
                 }
+
+                qfq_update_class_params(q, cl, lmax, inv_w, delta_w);
+
+                if (need_reactivation) /* activate in new group */
+                        qfq_activate_class(q, cl, qdisc_peek_len(cl->qdisc));
+                sch_tree_unlock(sch);
+
                 return 0;
         }
 
@@ -273,11 +320,8 @@ static int qfq_change_class(struct Qdisc *sch, u32 classid, u32 parentid,
 
         cl->refcnt = 1;
         cl->common.classid = classid;
-        cl->lmax = lmax;
-        cl->inv_w = inv_w;
-        i = qfq_calc_index(cl->inv_w, cl->lmax);
 
-        cl->grp = &q->groups[i];
+        qfq_update_class_params(q, cl, lmax, inv_w, delta_w);
 
         cl->qdisc = qdisc_create_dflt(sch->dev_queue,
                                       &pfifo_qdisc_ops, classid);
@@ -294,7 +338,6 @@ static int qfq_change_class(struct Qdisc *sch, u32 classid, u32 parentid,
                         return err;
                 }
         }
-        q->wsum += weight;
 
         sch_tree_lock(sch);
         qdisc_class_hash_insert(&q->clhash, &cl->common);
@@ -711,15 +754,6 @@ static void qfq_update_eligible(struct qfq_sched *q, u64 old_V)
         }
 }
 
-/* What is length of next packet in queue (0 if queue is empty) */
-static unsigned int qdisc_peek_len(struct Qdisc *sch)
-{
-        struct sk_buff *skb;
-
-        skb = sch->ops->peek(sch);
-        return skb ? qdisc_pkt_len(skb) : 0;
-}
-
 /*
  * Updates the class, returns true if also the group needs to be updated.
  */
@@ -843,11 +877,8 @@ static void qfq_update_start(struct qfq_sched *q, struct qfq_class *cl)
 static int qfq_enqueue(struct sk_buff *skb, struct Qdisc *sch)
 {
         struct qfq_sched *q = qdisc_priv(sch);
-        struct qfq_group *grp;
         struct qfq_class *cl;
         int err;
-        u64 roundedS;
-        int s;
 
         cl = qfq_classify(skb, sch, &err);
         if (cl == NULL) {
@@ -876,11 +907,25 @@ static int qfq_enqueue(struct sk_buff *skb, struct Qdisc *sch)
                 return err;
 
         /* If reach this point, queue q was idle */
-        grp = cl->grp;
+        qfq_activate_class(q, cl, qdisc_pkt_len(skb));
+
+        return err;
+}
+
+/*
+ * Handle class switch from idle to backlogged.
+ */
+static void qfq_activate_class(struct qfq_sched *q, struct qfq_class *cl,
+                               unsigned int pkt_len)
+{
+        struct qfq_group *grp = cl->grp;
+        u64 roundedS;
+        int s;
+
         qfq_update_start(q, cl);
 
         /* compute new finish time and rounded start. */
-        cl->F = cl->S + (u64)qdisc_pkt_len(skb) * cl->inv_w;
+        cl->F = cl->S + (u64)pkt_len * cl->inv_w;
         roundedS = qfq_round_down(cl->S, grp->slot_shift);
 
         /*
@@ -917,8 +962,6 @@ static int qfq_enqueue(struct sk_buff *skb, struct Qdisc *sch)
 
 skip_update:
         qfq_slot_insert(grp, cl, roundedS);
-
-        return err;
 }
 
 
diff --git a/net/sctp/associola.c b/net/sctp/associola.c
index ebaef3ed6065..b1ef3bc301a5 100644
--- a/net/sctp/associola.c
+++ b/net/sctp/associola.c
@@ -82,6 +82,7 @@ static struct sctp_association *sctp_association_init(struct sctp_association *a
                                           sctp_scope_t scope,
                                           gfp_t gfp)
 {
+        struct net *net = sock_net(sk);
         struct sctp_sock *sp;
         int i;
         sctp_paramhdr_t *p;
@@ -124,7 +125,7 @@ static struct sctp_association *sctp_association_init(struct sctp_association *a
          * socket values.
          */
         asoc->max_retrans = sp->assocparams.sasoc_asocmaxrxt;
-        asoc->pf_retrans  = sctp_pf_retrans;
+        asoc->pf_retrans  = net->sctp.pf_retrans;
 
         asoc->rto_initial = msecs_to_jiffies(sp->rtoinfo.srto_initial);
         asoc->rto_max = msecs_to_jiffies(sp->rtoinfo.srto_max);
@@ -175,7 +176,7 @@ static struct sctp_association *sctp_association_init(struct sctp_association *a
         asoc->timeouts[SCTP_EVENT_TIMEOUT_HEARTBEAT] = 0;
         asoc->timeouts[SCTP_EVENT_TIMEOUT_SACK] = asoc->sackdelay;
         asoc->timeouts[SCTP_EVENT_TIMEOUT_AUTOCLOSE] =
-                min_t(unsigned long, sp->autoclose, sctp_max_autoclose) * HZ;
+                min_t(unsigned long, sp->autoclose, net->sctp.max_autoclose) * HZ;
 
         /* Initializes the timers */
         for (i = SCTP_EVENT_TIMEOUT_NONE; i < SCTP_NUM_TIMEOUT_TYPES; ++i)
@@ -281,7 +282,7 @@ static struct sctp_association *sctp_association_init(struct sctp_association *a
          * and will revert old behavior.
          */
         asoc->peer.asconf_capable = 0;
-        if (sctp_addip_noauth)
+        if (net->sctp.addip_noauth)
                 asoc->peer.asconf_capable = 1;
         asoc->asconf_addr_del_pending = NULL;
         asoc->src_out_of_asoc_ok = 0;
@@ -641,6 +642,7 @@ struct sctp_transport *sctp_assoc_add_peer(struct sctp_association *asoc,
                                            const gfp_t gfp,
                                            const int peer_state)
 {
+        struct net *net = sock_net(asoc->base.sk);
         struct sctp_transport *peer;
         struct sctp_sock *sp;
         unsigned short port;
@@ -674,7 +676,7 @@ struct sctp_transport *sctp_assoc_add_peer(struct sctp_association *asoc,
                 return peer;
         }
 
-        peer = sctp_transport_new(addr, gfp);
+        peer = sctp_transport_new(net, addr, gfp);
         if (!peer)
                 return NULL;
 
@@ -1089,13 +1091,15 @@ out:
 
 /* Is this the association we are looking for? */
 struct sctp_transport *sctp_assoc_is_match(struct sctp_association *asoc,
+                                           struct net *net,
                                            const union sctp_addr *laddr,
                                            const union sctp_addr *paddr)
 {
         struct sctp_transport *transport;
 
         if ((htons(asoc->base.bind_addr.port) == laddr->v4.sin_port) &&
-            (htons(asoc->peer.port) == paddr->v4.sin_port)) {
+            (htons(asoc->peer.port) == paddr->v4.sin_port) &&
+            net_eq(sock_net(asoc->base.sk), net)) {
                 transport = sctp_assoc_lookup_paddr(asoc, paddr);
                 if (!transport)
                         goto out;
@@ -1116,6 +1120,7 @@ static void sctp_assoc_bh_rcv(struct work_struct *work)
         struct sctp_association *asoc =
                 container_of(work, struct sctp_association,
                              base.inqueue.immediate);
+        struct net *net = sock_net(asoc->base.sk);
         struct sctp_endpoint *ep;
         struct sctp_chunk *chunk;
         struct sctp_inq *inqueue;
@@ -1148,13 +1153,13 @@ static void sctp_assoc_bh_rcv(struct work_struct *work)
                 if (sctp_chunk_is_data(chunk))
                         asoc->peer.last_data_from = chunk->transport;
                 else
-                        SCTP_INC_STATS(SCTP_MIB_INCTRLCHUNKS);
+                        SCTP_INC_STATS(net, SCTP_MIB_INCTRLCHUNKS);
 
                 if (chunk->transport)
                         chunk->transport->last_time_heard = jiffies;
 
                 /* Run through the state machine. */
-                error = sctp_do_sm(SCTP_EVENT_T_CHUNK, subtype,
+                error = sctp_do_sm(net, SCTP_EVENT_T_CHUNK, subtype,
                                    state, ep, asoc, chunk, GFP_ATOMIC);
 
                 /* Check to see if the association is freed in response to
@@ -1414,6 +1419,7 @@ void sctp_assoc_sync_pmtu(struct sock *sk, struct sctp_association *asoc)
 /* Should we send a SACK to update our peer? */
 static inline int sctp_peer_needs_update(struct sctp_association *asoc)
 {
+        struct net *net = sock_net(asoc->base.sk);
         switch (asoc->state) {
         case SCTP_STATE_ESTABLISHED:
         case SCTP_STATE_SHUTDOWN_PENDING:
@@ -1421,7 +1427,7 @@ static inline int sctp_peer_needs_update(struct sctp_association *asoc)
         case SCTP_STATE_SHUTDOWN_SENT:
                 if ((asoc->rwnd > asoc->a_rwnd) &&
                     ((asoc->rwnd - asoc->a_rwnd) >= max_t(__u32,
-                           (asoc->base.sk->sk_rcvbuf >> sctp_rwnd_upd_shift),
+                           (asoc->base.sk->sk_rcvbuf >> net->sctp.rwnd_upd_shift),
                            asoc->pathmtu)))
                         return 1;
                 break;
@@ -1542,7 +1548,8 @@ int sctp_assoc_set_bind_addr_from_ep(struct sctp_association *asoc,
         if (asoc->peer.ipv6_address)
                 flags |= SCTP_ADDR6_PEERSUPP;
 
-        return sctp_bind_addr_copy(&asoc->base.bind_addr,
+        return sctp_bind_addr_copy(sock_net(asoc->base.sk),
+                                   &asoc->base.bind_addr,
                                    &asoc->ep->base.bind_addr,
                                    scope, gfp, flags);
 }
diff --git a/net/sctp/auth.c b/net/sctp/auth.c
index bf812048cf6f..159b9bc5d633 100644
--- a/net/sctp/auth.c
+++ b/net/sctp/auth.c
@@ -392,13 +392,14 @@ nomem:
  */
 int sctp_auth_asoc_init_active_key(struct sctp_association *asoc, gfp_t gfp)
 {
+        struct net *net = sock_net(asoc->base.sk);
         struct sctp_auth_bytes  *secret;
         struct sctp_shared_key *ep_key;
 
         /* If we don't support AUTH, or peer is not capable
          * we don't need to do anything.
          */
-        if (!sctp_auth_enable || !asoc->peer.auth_capable)
+        if (!net->sctp.auth_enable || !asoc->peer.auth_capable)
                 return 0;
 
         /* If the key_id is non-zero and we couldn't find an
@@ -445,11 +446,12 @@ struct sctp_shared_key *sctp_auth_get_shkey(
  */
 int sctp_auth_init_hmacs(struct sctp_endpoint *ep, gfp_t gfp)
 {
+        struct net *net = sock_net(ep->base.sk);
         struct crypto_hash *tfm = NULL;
         __u16   id;
 
         /* if the transforms are already allocted, we are done */
-        if (!sctp_auth_enable) {
+        if (!net->sctp.auth_enable) {
                 ep->auth_hmacs = NULL;
                 return 0;
         }
@@ -674,7 +676,12 @@ static int __sctp_auth_cid(sctp_cid_t chunk, struct sctp_chunks_param *param)
 /* Check if peer requested that this chunk is authenticated */
 int sctp_auth_send_cid(sctp_cid_t chunk, const struct sctp_association *asoc)
 {
-        if (!sctp_auth_enable || !asoc || !asoc->peer.auth_capable)
+        struct net  *net;
+        if (!asoc)
+                return 0;
+
+        net = sock_net(asoc->base.sk);
+        if (!net->sctp.auth_enable || !asoc->peer.auth_capable)
                 return 0;
 
         return __sctp_auth_cid(chunk, asoc->peer.peer_chunks);
@@ -683,7 +690,12 @@ int sctp_auth_send_cid(sctp_cid_t chunk, const struct sctp_association *asoc)
 /* Check if we requested that peer authenticate this chunk. */
 int sctp_auth_recv_cid(sctp_cid_t chunk, const struct sctp_association *asoc)
 {
-        if (!sctp_auth_enable || !asoc)
+        struct net *net;
+        if (!asoc)
+                return 0;
+
+        net = sock_net(asoc->base.sk);
+        if (!net->sctp.auth_enable)
                 return 0;
 
         return __sctp_auth_cid(chunk,
diff --git a/net/sctp/bind_addr.c b/net/sctp/bind_addr.c
index 4ece451c8d27..d886b3bf84f5 100644
--- a/net/sctp/bind_addr.c
+++ b/net/sctp/bind_addr.c
@@ -52,8 +52,8 @@
 #include <net/sctp/sm.h>
 
 /* Forward declarations for internal helpers. */
-static int sctp_copy_one_addr(struct sctp_bind_addr *, union sctp_addr *,
-                              sctp_scope_t scope, gfp_t gfp,
+static int sctp_copy_one_addr(struct net *, struct sctp_bind_addr *,
+                              union sctp_addr *, sctp_scope_t scope, gfp_t gfp,
                               int flags);
 static void sctp_bind_addr_clean(struct sctp_bind_addr *);
 
@@ -62,7 +62,7 @@ static void sctp_bind_addr_clean(struct sctp_bind_addr *);
 /* Copy 'src' to 'dest' taking 'scope' into account.  Omit addresses
  * in 'src' which have a broader scope than 'scope'.
  */
-int sctp_bind_addr_copy(struct sctp_bind_addr *dest,
+int sctp_bind_addr_copy(struct net *net, struct sctp_bind_addr *dest,
                         const struct sctp_bind_addr *src,
                         sctp_scope_t scope, gfp_t gfp,
                         int flags)
@@ -75,7 +75,7 @@ int sctp_bind_addr_copy(struct sctp_bind_addr *dest,
 
         /* Extract the addresses which are relevant for this scope.  */
         list_for_each_entry(addr, &src->address_list, list) {
-                error = sctp_copy_one_addr(dest, &addr->a, scope,
+                error = sctp_copy_one_addr(net, dest, &addr->a, scope,
                                            gfp, flags);
                 if (error < 0)
                         goto out;
@@ -87,7 +87,7 @@ int sctp_bind_addr_copy(struct sctp_bind_addr *dest,
          */
         if (list_empty(&dest->address_list) && (SCTP_SCOPE_GLOBAL == scope)) {
                 list_for_each_entry(addr, &src->address_list, list) {
-                        error = sctp_copy_one_addr(dest, &addr->a,
+                        error = sctp_copy_one_addr(net, dest, &addr->a,
                                                    SCTP_SCOPE_LINK, gfp,
                                                    flags);
                         if (error < 0)
@@ -448,7 +448,7 @@ union sctp_addr *sctp_find_unmatch_addr(struct sctp_bind_addr	*bp,
 }
 
 /* Copy out addresses from the global local address list. */
-static int sctp_copy_one_addr(struct sctp_bind_addr *dest,
+static int sctp_copy_one_addr(struct net *net, struct sctp_bind_addr *dest,
                               union sctp_addr *addr,
                               sctp_scope_t scope, gfp_t gfp,
                               int flags)
@@ -456,8 +456,8 @@ static int sctp_copy_one_addr(struct sctp_bind_addr *dest,
         int error = 0;
 
         if (sctp_is_any(NULL, addr)) {
-                error = sctp_copy_local_addr_list(dest, scope, gfp, flags);
-        } else if (sctp_in_scope(addr, scope)) {
+                error = sctp_copy_local_addr_list(net, dest, scope, gfp, flags);
+        } else if (sctp_in_scope(net, addr, scope)) {
                 /* Now that the address is in scope, check to see if
                  * the address type is supported by local sock as
                  * well as the remote peer.
@@ -494,7 +494,7 @@ int sctp_is_any(struct sock *sk, const union sctp_addr *addr)
 }
 
 /* Is 'addr' valid for 'scope'?  */
-int sctp_in_scope(const union sctp_addr *addr, sctp_scope_t scope)
+int sctp_in_scope(struct net *net, const union sctp_addr *addr, sctp_scope_t scope)
 {
         sctp_scope_t addr_scope = sctp_scope(addr);
 
@@ -512,7 +512,7 @@ int sctp_in_scope(const union sctp_addr *addr, sctp_scope_t scope)
          * Address scoping can be selectively controlled via sysctl
          * option
          */
-        switch (sctp_scope_policy) {
+        switch (net->sctp.scope_policy) {
         case SCTP_SCOPE_POLICY_DISABLE:
                 return 1;
         case SCTP_SCOPE_POLICY_ENABLE:
diff --git a/net/sctp/chunk.c b/net/sctp/chunk.c
index 6c8556459a75..7c2df9c33df3 100644
--- a/net/sctp/chunk.c
+++ b/net/sctp/chunk.c
@@ -257,7 +257,7 @@ struct sctp_datamsg *sctp_datamsg_from_user(struct sctp_association *asoc,
         offset = 0;
 
         if ((whole > 1) || (whole && over))
-                SCTP_INC_STATS_USER(SCTP_MIB_FRAGUSRMSGS);
+                SCTP_INC_STATS_USER(sock_net(asoc->base.sk), SCTP_MIB_FRAGUSRMSGS);
 
         /* Create chunks for all the full sized DATA chunks. */
         for (i=0, len=first_len; i < whole; i++) {
diff --git a/net/sctp/endpointola.c b/net/sctp/endpointola.c
index 68a385d7c3bd..1859e2bc83d1 100644
--- a/net/sctp/endpointola.c
+++ b/net/sctp/endpointola.c
@@ -65,6 +65,7 @@ static struct sctp_endpoint *sctp_endpoint_init(struct sctp_endpoint *ep,
                                                 struct sock *sk,
                                                 gfp_t gfp)
 {
+        struct net *net = sock_net(sk);
         struct sctp_hmac_algo_param *auth_hmacs = NULL;
         struct sctp_chunks_param *auth_chunks = NULL;
         struct sctp_shared_key *null_key;
@@ -74,7 +75,7 @@ static struct sctp_endpoint *sctp_endpoint_init(struct sctp_endpoint *ep,
         if (!ep->digest)
                 return NULL;
 
-        if (sctp_auth_enable) {
+        if (net->sctp.auth_enable) {
                 /* Allocate space for HMACS and CHUNKS authentication
                  * variables.  There are arrays that we encode directly
                  * into parameters to make the rest of the operations easier.
@@ -106,7 +107,7 @@ static struct sctp_endpoint *sctp_endpoint_init(struct sctp_endpoint *ep,
                 /* If the Add-IP functionality is enabled, we must
                  * authenticate, ASCONF and ASCONF-ACK chunks
                  */
-                if (sctp_addip_enable) {
+                if (net->sctp.addip_enable) {
                         auth_chunks->chunks[0] = SCTP_CID_ASCONF;
                         auth_chunks->chunks[1] = SCTP_CID_ASCONF_ACK;
                         auth_chunks->param_hdr.length =
@@ -140,14 +141,14 @@ static struct sctp_endpoint *sctp_endpoint_init(struct sctp_endpoint *ep,
         INIT_LIST_HEAD(&ep->asocs);
 
         /* Use SCTP specific send buffer space queues.  */
-        ep->sndbuf_policy = sctp_sndbuf_policy;
+        ep->sndbuf_policy = net->sctp.sndbuf_policy;
 
         sk->sk_data_ready = sctp_data_ready;
         sk->sk_write_space = sctp_write_space;
         sock_set_flag(sk, SOCK_USE_WRITE_QUEUE);
 
         /* Get the receive buffer policy for this endpoint */
-        ep->rcvbuf_policy = sctp_rcvbuf_policy;
+        ep->rcvbuf_policy = net->sctp.rcvbuf_policy;
 
         /* Initialize the secret key used with cookie. */
         get_random_bytes(&ep->secret_key[0], SCTP_SECRET_SIZE);
@@ -302,11 +303,13 @@ void sctp_endpoint_put(struct sctp_endpoint *ep)
 
 /* Is this the endpoint we are looking for?  */
 struct sctp_endpoint *sctp_endpoint_is_match(struct sctp_endpoint *ep,
+                                               struct net *net,
                                                const union sctp_addr *laddr)
 {
         struct sctp_endpoint *retval = NULL;
 
-        if (htons(ep->base.bind_addr.port) == laddr->v4.sin_port) {
+        if ((htons(ep->base.bind_addr.port) == laddr->v4.sin_port) &&
+            net_eq(sock_net(ep->base.sk), net)) {
                 if (sctp_bind_addr_match(&ep->base.bind_addr, laddr,
                                          sctp_sk(ep->base.sk)))
                         retval = ep;
@@ -343,7 +346,8 @@ static struct sctp_association *__sctp_endpoint_lookup_assoc(
 
         rport = ntohs(paddr->v4.sin_port);
 
-        hash = sctp_assoc_hashfn(ep->base.bind_addr.port, rport);
+        hash = sctp_assoc_hashfn(sock_net(ep->base.sk), ep->base.bind_addr.port,
+                                 rport);
         head = &sctp_assoc_hashtable[hash];
         read_lock(&head->lock);
         sctp_for_each_hentry(epb, node, &head->chain) {
@@ -386,13 +390,14 @@ int sctp_endpoint_is_peeled_off(struct sctp_endpoint *ep,
 {
         struct sctp_sockaddr_entry *addr;
         struct sctp_bind_addr *bp;
+        struct net *net = sock_net(ep->base.sk);
 
         bp = &ep->base.bind_addr;
         /* This function is called with the socket lock held,
          * so the address_list can not change.
          */
         list_for_each_entry(addr, &bp->address_list, list) {
-                if (sctp_has_association(&addr->a, paddr))
+                if (sctp_has_association(net, &addr->a, paddr))
                         return 1;
         }
 
@@ -409,6 +414,7 @@ static void sctp_endpoint_bh_rcv(struct work_struct *work)
                              base.inqueue.immediate);
         struct sctp_association *asoc;
         struct sock *sk;
+        struct net *net;
         struct sctp_transport *transport;
         struct sctp_chunk *chunk;
         struct sctp_inq *inqueue;
@@ -423,6 +429,7 @@ static void sctp_endpoint_bh_rcv(struct work_struct *work)
         asoc = NULL;
         inqueue = &ep->base.inqueue;
         sk = ep->base.sk;
+        net = sock_net(sk);
 
         while (NULL != (chunk = sctp_inq_pop(inqueue))) {
                 subtype = SCTP_ST_CHUNK(chunk->chunk_hdr->type);
@@ -474,12 +481,12 @@ normal:
                 if (asoc && sctp_chunk_is_data(chunk))
                         asoc->peer.last_data_from = chunk->transport;
                 else
-                        SCTP_INC_STATS(SCTP_MIB_INCTRLCHUNKS);
+                        SCTP_INC_STATS(sock_net(ep->base.sk), SCTP_MIB_INCTRLCHUNKS);
 
                 if (chunk->transport)
                         chunk->transport->last_time_heard = jiffies;
 
-                error = sctp_do_sm(SCTP_EVENT_T_CHUNK, subtype, state,
+                error = sctp_do_sm(net, SCTP_EVENT_T_CHUNK, subtype, state,
                                    ep, asoc, chunk, GFP_ATOMIC);
 
                 if (error && chunk)
diff --git a/net/sctp/input.c b/net/sctp/input.c
index e64d5210ed13..25dfe7380479 100644
--- a/net/sctp/input.c
+++ b/net/sctp/input.c
@@ -66,12 +66,15 @@
 
 /* Forward declarations for internal helpers. */
 static int sctp_rcv_ootb(struct sk_buff *);
-static struct sctp_association *__sctp_rcv_lookup(struct sk_buff *skb,
+static struct sctp_association *__sctp_rcv_lookup(struct net *net,
+                                      struct sk_buff *skb,
                                       const union sctp_addr *laddr,
                                       const union sctp_addr *paddr,
                                       struct sctp_transport **transportp);
-static struct sctp_endpoint *__sctp_rcv_lookup_endpoint(const union sctp_addr *laddr);
+static struct sctp_endpoint *__sctp_rcv_lookup_endpoint(struct net *net,
+                                                const union sctp_addr *laddr);
 static struct sctp_association *__sctp_lookup_association(
+                                        struct net *net,
                                         const union sctp_addr *local,
                                         const union sctp_addr *peer,
                                         struct sctp_transport **pt);
@@ -80,7 +83,7 @@ static int sctp_add_backlog(struct sock *sk, struct sk_buff *skb);
 
 
 /* Calculate the SCTP checksum of an SCTP packet.  */
-static inline int sctp_rcv_checksum(struct sk_buff *skb)
+static inline int sctp_rcv_checksum(struct net *net, struct sk_buff *skb)
 {
         struct sctphdr *sh = sctp_hdr(skb);
         __le32 cmp = sh->checksum;
@@ -96,7 +99,7 @@ static inline int sctp_rcv_checksum(struct sk_buff *skb)
 
         if (val != cmp) {
                 /* CRC failure, dump it. */
-                SCTP_INC_STATS_BH(SCTP_MIB_CHECKSUMERRORS);
+                SCTP_INC_STATS_BH(net, SCTP_MIB_CHECKSUMERRORS);
                 return -1;
         }
         return 0;
@@ -129,11 +132,12 @@ int sctp_rcv(struct sk_buff *skb)
         union sctp_addr dest;
         int family;
         struct sctp_af *af;
+        struct net *net = dev_net(skb->dev);
 
         if (skb->pkt_type!=PACKET_HOST)
                 goto discard_it;
 
-        SCTP_INC_STATS_BH(SCTP_MIB_INSCTPPACKS);
+        SCTP_INC_STATS_BH(net, SCTP_MIB_INSCTPPACKS);
 
         if (skb_linearize(skb))
                 goto discard_it;
@@ -145,7 +149,7 @@ int sctp_rcv(struct sk_buff *skb)
         if (skb->len < sizeof(struct sctphdr))
                 goto discard_it;
         if (!sctp_checksum_disable && !skb_csum_unnecessary(skb) &&
-                  sctp_rcv_checksum(skb) < 0)
+                  sctp_rcv_checksum(net, skb) < 0)
                 goto discard_it;
 
         skb_pull(skb, sizeof(struct sctphdr));
@@ -178,10 +182,10 @@ int sctp_rcv(struct sk_buff *skb)
             !af->addr_valid(&dest, NULL, skb))
                 goto discard_it;
 
-        asoc = __sctp_rcv_lookup(skb, &src, &dest, &transport);
+        asoc = __sctp_rcv_lookup(net, skb, &src, &dest, &transport);
 
         if (!asoc)
-                ep = __sctp_rcv_lookup_endpoint(&dest);
+                ep = __sctp_rcv_lookup_endpoint(net, &dest);
 
         /* Retrieve the common input handling substructure. */
         rcvr = asoc ? &asoc->base : &ep->base;
@@ -200,7 +204,7 @@ int sctp_rcv(struct sk_buff *skb)
                         sctp_endpoint_put(ep);
                         ep = NULL;
                 }
-                sk = sctp_get_ctl_sock();
+                sk = net->sctp.ctl_sock;
                 ep = sctp_sk(sk)->ep;
                 sctp_endpoint_hold(ep);
                 rcvr = &ep->base;
@@ -216,7 +220,7 @@ int sctp_rcv(struct sk_buff *skb)
          */
         if (!asoc) {
                 if (sctp_rcv_ootb(skb)) {
-                        SCTP_INC_STATS_BH(SCTP_MIB_OUTOFBLUES);
+                        SCTP_INC_STATS_BH(net, SCTP_MIB_OUTOFBLUES);
                         goto discard_release;
                 }
         }
@@ -272,9 +276,9 @@ int sctp_rcv(struct sk_buff *skb)
                         skb = NULL; /* sctp_chunk_free already freed the skb */
                         goto discard_release;
                 }
-                SCTP_INC_STATS_BH(SCTP_MIB_IN_PKT_BACKLOG);
+                SCTP_INC_STATS_BH(net, SCTP_MIB_IN_PKT_BACKLOG);
         } else {
-                SCTP_INC_STATS_BH(SCTP_MIB_IN_PKT_SOFTIRQ);
+                SCTP_INC_STATS_BH(net, SCTP_MIB_IN_PKT_SOFTIRQ);
                 sctp_inq_push(&chunk->rcvr->inqueue, chunk);
         }
 
@@ -289,7 +293,7 @@ int sctp_rcv(struct sk_buff *skb)
         return 0;
 
 discard_it:
-        SCTP_INC_STATS_BH(SCTP_MIB_IN_PKT_DISCARDS);
+        SCTP_INC_STATS_BH(net, SCTP_MIB_IN_PKT_DISCARDS);
         kfree_skb(skb);
         return 0;
 
@@ -462,11 +466,13 @@ void sctp_icmp_proto_unreachable(struct sock *sk,
                 }
                         
         } else {
+                struct net *net = sock_net(sk);
+
                 if (timer_pending(&t->proto_unreach_timer) &&
                     del_timer(&t->proto_unreach_timer))
                         sctp_association_put(asoc);
 
-                sctp_do_sm(SCTP_EVENT_T_OTHER,
+                sctp_do_sm(net, SCTP_EVENT_T_OTHER,
                            SCTP_ST_OTHER(SCTP_EVENT_ICMP_PROTO_UNREACH),
                            asoc->state, asoc->ep, asoc, t,
                            GFP_ATOMIC);
@@ -474,7 +480,7 @@ void sctp_icmp_proto_unreachable(struct sock *sk,
 }
 
 /* Common lookup code for icmp/icmpv6 error handler. */
-struct sock *sctp_err_lookup(int family, struct sk_buff *skb,
+struct sock *sctp_err_lookup(struct net *net, int family, struct sk_buff *skb,
                              struct sctphdr *sctphdr,
                              struct sctp_association **app,
                              struct sctp_transport **tpp)
@@ -503,7 +509,7 @@ struct sock *sctp_err_lookup(int family, struct sk_buff *skb,
         /* Look for an association that matches the incoming ICMP error
          * packet.
          */
-        asoc = __sctp_lookup_association(&saddr, &daddr, &transport);
+        asoc = __sctp_lookup_association(net, &saddr, &daddr, &transport);
         if (!asoc)
                 return NULL;
 
@@ -539,7 +545,7 @@ struct sock *sctp_err_lookup(int family, struct sk_buff *skb,
          * servers this needs to be solved differently.
          */
         if (sock_owned_by_user(sk))
-                NET_INC_STATS_BH(&init_net, LINUX_MIB_LOCKDROPPEDICMPS);
+                NET_INC_STATS_BH(net, LINUX_MIB_LOCKDROPPEDICMPS);
 
         *app = asoc;
         *tpp = transport;
@@ -586,9 +592,10 @@ void sctp_v4_err(struct sk_buff *skb, __u32 info)
         struct inet_sock *inet;
         sk_buff_data_t saveip, savesctp;
         int err;
+        struct net *net = dev_net(skb->dev);
 
         if (skb->len < ihlen + 8) {
-                ICMP_INC_STATS_BH(&init_net, ICMP_MIB_INERRORS);
+                ICMP_INC_STATS_BH(net, ICMP_MIB_INERRORS);
                 return;
         }
 
@@ -597,12 +604,12 @@ void sctp_v4_err(struct sk_buff *skb, __u32 info)
         savesctp = skb->transport_header;
         skb_reset_network_header(skb);
         skb_set_transport_header(skb, ihlen);
-        sk = sctp_err_lookup(AF_INET, skb, sctp_hdr(skb), &asoc, &transport);
+        sk = sctp_err_lookup(net, AF_INET, skb, sctp_hdr(skb), &asoc, &transport);
         /* Put back, the original values. */
         skb->network_header = saveip;
         skb->transport_header = savesctp;
         if (!sk) {
-                ICMP_INC_STATS_BH(&init_net, ICMP_MIB_INERRORS);
+                ICMP_INC_STATS_BH(net, ICMP_MIB_INERRORS);
                 return;
         }
         /* Warning:  The sock lock is held.  Remember to call
@@ -723,12 +730,13 @@ discard:
 /* Insert endpoint into the hash table.  */
 static void __sctp_hash_endpoint(struct sctp_endpoint *ep)
 {
+        struct net *net = sock_net(ep->base.sk);
         struct sctp_ep_common *epb;
         struct sctp_hashbucket *head;
 
         epb = &ep->base;
 
-        epb->hashent = sctp_ep_hashfn(epb->bind_addr.port);
+        epb->hashent = sctp_ep_hashfn(net, epb->bind_addr.port);
         head = &sctp_ep_hashtable[epb->hashent];
 
         sctp_write_lock(&head->lock);
@@ -747,12 +755,13 @@ void sctp_hash_endpoint(struct sctp_endpoint *ep)
 /* Remove endpoint from the hash table.  */
 static void __sctp_unhash_endpoint(struct sctp_endpoint *ep)
 {
+        struct net *net = sock_net(ep->base.sk);
         struct sctp_hashbucket *head;
         struct sctp_ep_common *epb;
 
         epb = &ep->base;
 
-        epb->hashent = sctp_ep_hashfn(epb->bind_addr.port);
+        epb->hashent = sctp_ep_hashfn(net, epb->bind_addr.port);
 
         head = &sctp_ep_hashtable[epb->hashent];
 
@@ -770,7 +779,8 @@ void sctp_unhash_endpoint(struct sctp_endpoint *ep)
 }
 
 /* Look up an endpoint. */
-static struct sctp_endpoint *__sctp_rcv_lookup_endpoint(const union sctp_addr *laddr)
+static struct sctp_endpoint *__sctp_rcv_lookup_endpoint(struct net *net,
+                                                const union sctp_addr *laddr)
 {
         struct sctp_hashbucket *head;
         struct sctp_ep_common *epb;
@@ -778,16 +788,16 @@ static struct sctp_endpoint *__sctp_rcv_lookup_endpoint(const union sctp_addr *l
         struct hlist_node *node;
         int hash;
 
-        hash = sctp_ep_hashfn(ntohs(laddr->v4.sin_port));
+        hash = sctp_ep_hashfn(net, ntohs(laddr->v4.sin_port));
         head = &sctp_ep_hashtable[hash];
         read_lock(&head->lock);
         sctp_for_each_hentry(epb, node, &head->chain) {
                 ep = sctp_ep(epb);
-                if (sctp_endpoint_is_match(ep, laddr))
+                if (sctp_endpoint_is_match(ep, net, laddr))
                         goto hit;
         }
 
-        ep = sctp_sk((sctp_get_ctl_sock()))->ep;
+        ep = sctp_sk(net->sctp.ctl_sock)->ep;
 
 hit:
         sctp_endpoint_hold(ep);
@@ -798,13 +808,15 @@ hit:
 /* Insert association into the hash table.  */
 static void __sctp_hash_established(struct sctp_association *asoc)
 {
+        struct net *net = sock_net(asoc->base.sk);
         struct sctp_ep_common *epb;
         struct sctp_hashbucket *head;
 
         epb = &asoc->base;
 
         /* Calculate which chain this entry will belong to. */
-        epb->hashent = sctp_assoc_hashfn(epb->bind_addr.port, asoc->peer.port);
+        epb->hashent = sctp_assoc_hashfn(net, epb->bind_addr.port,
+                                         asoc->peer.port);
 
         head = &sctp_assoc_hashtable[epb->hashent];
 
@@ -827,12 +839,13 @@ void sctp_hash_established(struct sctp_association *asoc)
 /* Remove association from the hash table.  */
 static void __sctp_unhash_established(struct sctp_association *asoc)
 {
+        struct net *net = sock_net(asoc->base.sk);
         struct sctp_hashbucket *head;
         struct sctp_ep_common *epb;
 
         epb = &asoc->base;
 
-        epb->hashent = sctp_assoc_hashfn(epb->bind_addr.port,
+        epb->hashent = sctp_assoc_hashfn(net, epb->bind_addr.port,
                                          asoc->peer.port);
 
         head = &sctp_assoc_hashtable[epb->hashent];
@@ -855,6 +868,7 @@ void sctp_unhash_established(struct sctp_association *asoc)
 
 /* Look up an association. */
 static struct sctp_association *__sctp_lookup_association(
+                                        struct net *net,
                                         const union sctp_addr *local,
                                         const union sctp_addr *peer,
                                         struct sctp_transport **pt)
@@ -869,12 +883,13 @@ static struct sctp_association *__sctp_lookup_association(
         /* Optimize here for direct hit, only listening connections can
          * have wildcards anyways.
          */
-        hash = sctp_assoc_hashfn(ntohs(local->v4.sin_port), ntohs(peer->v4.sin_port));
+        hash = sctp_assoc_hashfn(net, ntohs(local->v4.sin_port),
+                                 ntohs(peer->v4.sin_port));
         head = &sctp_assoc_hashtable[hash];
         read_lock(&head->lock);
         sctp_for_each_hentry(epb, node, &head->chain) {
                 asoc = sctp_assoc(epb);
-                transport = sctp_assoc_is_match(asoc, local, peer);
+                transport = sctp_assoc_is_match(asoc, net, local, peer);
                 if (transport)
                         goto hit;
         }
@@ -892,27 +907,29 @@ hit:
 
 /* Look up an association. BH-safe. */
 SCTP_STATIC
-struct sctp_association *sctp_lookup_association(const union sctp_addr *laddr,
+struct sctp_association *sctp_lookup_association(struct net *net,
+                                                 const union sctp_addr *laddr,
                                                  const union sctp_addr *paddr,
                                             struct sctp_transport **transportp)
 {
         struct sctp_association *asoc;
 
         sctp_local_bh_disable();
-        asoc = __sctp_lookup_association(laddr, paddr, transportp);
+        asoc = __sctp_lookup_association(net, laddr, paddr, transportp);
         sctp_local_bh_enable();
 
         return asoc;
 }
 
 /* Is there an association matching the given local and peer addresses? */
-int sctp_has_association(const union sctp_addr *laddr,
+int sctp_has_association(struct net *net,
+                         const union sctp_addr *laddr,
                          const union sctp_addr *paddr)
 {
         struct sctp_association *asoc;
         struct sctp_transport *transport;
 
-        if ((asoc = sctp_lookup_association(laddr, paddr, &transport))) {
+        if ((asoc = sctp_lookup_association(net, laddr, paddr, &transport))) {
                 sctp_association_put(asoc);
                 return 1;
         }
@@ -938,7 +955,8 @@ int sctp_has_association(const union sctp_addr *laddr,
  * in certain circumstances.
  *
  */
-static struct sctp_association *__sctp_rcv_init_lookup(struct sk_buff *skb,
+static struct sctp_association *__sctp_rcv_init_lookup(struct net *net,
+        struct sk_buff *skb,
         const union sctp_addr *laddr, struct sctp_transport **transportp)
 {
         struct sctp_association *asoc;
@@ -978,7 +996,7 @@ static struct sctp_association *__sctp_rcv_init_lookup(struct sk_buff *skb,
 
                 af->from_addr_param(paddr, params.addr, sh->source, 0);
 
-                asoc = __sctp_lookup_association(laddr, paddr, &transport);
+                asoc = __sctp_lookup_association(net, laddr, paddr, &transport);
                 if (asoc)
                         return asoc;
         }
@@ -1001,6 +1019,7 @@ static struct sctp_association *__sctp_rcv_init_lookup(struct sk_buff *skb,
  * subsequent ASCONF Chunks. If found, proceed to rule D4.
  */
 static struct sctp_association *__sctp_rcv_asconf_lookup(
+                                        struct net *net,
                                         sctp_chunkhdr_t *ch,
                                         const union sctp_addr *laddr,
                                         __be16 peer_port,
@@ -1020,7 +1039,7 @@ static struct sctp_association *__sctp_rcv_asconf_lookup(
 
         af->from_addr_param(&paddr, param, peer_port, 0);
 
-        return __sctp_lookup_association(laddr, &paddr, transportp);
+        return __sctp_lookup_association(net, laddr, &paddr, transportp);
 }
 
 
@@ -1033,7 +1052,8 @@ static struct sctp_association *__sctp_rcv_asconf_lookup(
 * This means that any chunks that can help us identify the association need
 * to be looked at to find this association.
 */
-static struct sctp_association *__sctp_rcv_walk_lookup(struct sk_buff *skb,
+static struct sctp_association *__sctp_rcv_walk_lookup(struct net *net,
+                                      struct sk_buff *skb,
                                       const union sctp_addr *laddr,
                                       struct sctp_transport **transportp)
 {
@@ -1074,8 +1094,9 @@ static struct sctp_association *__sctp_rcv_walk_lookup(struct sk_buff *skb,
                             break;
 
                     case SCTP_CID_ASCONF:
-                            if (have_auth || sctp_addip_noauth)
-                                    asoc = __sctp_rcv_asconf_lookup(ch, laddr,
+                            if (have_auth || net->sctp.addip_noauth)
+                                    asoc = __sctp_rcv_asconf_lookup(
+                                                        net, ch, laddr,
                                                         sctp_hdr(skb)->source,
                                                         transportp);
                     default:
@@ -1098,7 +1119,8 @@ static struct sctp_association *__sctp_rcv_walk_lookup(struct sk_buff *skb,
  * include looking inside of INIT/INIT-ACK chunks or after the AUTH
  * chunks.
  */
-static struct sctp_association *__sctp_rcv_lookup_harder(struct sk_buff *skb,
+static struct sctp_association *__sctp_rcv_lookup_harder(struct net *net,
+                                      struct sk_buff *skb,
                                       const union sctp_addr *laddr,
                                       struct sctp_transport **transportp)
 {
@@ -1118,11 +1140,11 @@ static struct sctp_association *__sctp_rcv_lookup_harder(struct sk_buff *skb,
         switch (ch->type) {
         case SCTP_CID_INIT:
         case SCTP_CID_INIT_ACK:
-                return __sctp_rcv_init_lookup(skb, laddr, transportp);
+                return __sctp_rcv_init_lookup(net, skb, laddr, transportp);
                 break;
 
         default:
-                return __sctp_rcv_walk_lookup(skb, laddr, transportp);
+                return __sctp_rcv_walk_lookup(net, skb, laddr, transportp);
                 break;
         }
 
@@ -1131,21 +1153,22 @@ static struct sctp_association *__sctp_rcv_lookup_harder(struct sk_buff *skb,
 }
 
 /* Lookup an association for an inbound skb. */
-static struct sctp_association *__sctp_rcv_lookup(struct sk_buff *skb,
+static struct sctp_association *__sctp_rcv_lookup(struct net *net,
+                                      struct sk_buff *skb,
                                       const union sctp_addr *paddr,
                                       const union sctp_addr *laddr,
                                       struct sctp_transport **transportp)
 {
         struct sctp_association *asoc;
 
-        asoc = __sctp_lookup_association(laddr, paddr, transportp);
+        asoc = __sctp_lookup_association(net, laddr, paddr, transportp);
 
         /* Further lookup for INIT/INIT-ACK packets.
          * SCTP Implementors Guide, 2.18 Handling of address
          * parameters within the INIT or INIT-ACK.
          */
         if (!asoc)
-                asoc = __sctp_rcv_lookup_harder(skb, laddr, transportp);
+                asoc = __sctp_rcv_lookup_harder(net, skb, laddr, transportp);
 
         return asoc;
 }
diff --git a/net/sctp/ipv6.c b/net/sctp/ipv6.c
index ed7139ea7978..ea14cb445295 100644
--- a/net/sctp/ipv6.c
+++ b/net/sctp/ipv6.c
@@ -99,6 +99,7 @@ static int sctp_inet6addr_event(struct notifier_block *this, unsigned long ev,
         struct inet6_ifaddr *ifa = (struct inet6_ifaddr *)ptr;
         struct sctp_sockaddr_entry *addr = NULL;
         struct sctp_sockaddr_entry *temp;
+        struct net *net = dev_net(ifa->idev->dev);
         int found = 0;
 
         switch (ev) {
@@ -110,27 +111,27 @@ static int sctp_inet6addr_event(struct notifier_block *this, unsigned long ev,
                         addr->a.v6.sin6_addr = ifa->addr;
                         addr->a.v6.sin6_scope_id = ifa->idev->dev->ifindex;
                         addr->valid = 1;
-                        spin_lock_bh(&sctp_local_addr_lock);
-                        list_add_tail_rcu(&addr->list, &sctp_local_addr_list);
-                        sctp_addr_wq_mgmt(addr, SCTP_ADDR_NEW);
-                        spin_unlock_bh(&sctp_local_addr_lock);
+                        spin_lock_bh(&net->sctp.local_addr_lock);
+                        list_add_tail_rcu(&addr->list, &net->sctp.local_addr_list);
+                        sctp_addr_wq_mgmt(net, addr, SCTP_ADDR_NEW);
+                        spin_unlock_bh(&net->sctp.local_addr_lock);
                 }
                 break;
         case NETDEV_DOWN:
-                spin_lock_bh(&sctp_local_addr_lock);
+                spin_lock_bh(&net->sctp.local_addr_lock);
                 list_for_each_entry_safe(addr, temp,
-                                        &sctp_local_addr_list, list) {
+                                        &net->sctp.local_addr_list, list) {
                         if (addr->a.sa.sa_family == AF_INET6 &&
                                         ipv6_addr_equal(&addr->a.v6.sin6_addr,
                                                 &ifa->addr)) {
-                                sctp_addr_wq_mgmt(addr, SCTP_ADDR_DEL);
+                                sctp_addr_wq_mgmt(net, addr, SCTP_ADDR_DEL);
                                 found = 1;
                                 addr->valid = 0;
                                 list_del_rcu(&addr->list);
                                 break;
                         }
                 }
-                spin_unlock_bh(&sctp_local_addr_lock);
+                spin_unlock_bh(&net->sctp.local_addr_lock);
                 if (found)
                         kfree_rcu(addr, rcu);
                 break;
@@ -154,6 +155,7 @@ SCTP_STATIC void sctp_v6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
         struct ipv6_pinfo *np;
         sk_buff_data_t saveip, savesctp;
         int err;
+        struct net *net = dev_net(skb->dev);
 
         idev = in6_dev_get(skb->dev);
 
@@ -162,12 +164,12 @@ SCTP_STATIC void sctp_v6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
         savesctp = skb->transport_header;
         skb_reset_network_header(skb);
         skb_set_transport_header(skb, offset);
-        sk = sctp_err_lookup(AF_INET6, skb, sctp_hdr(skb), &asoc, &transport);
+        sk = sctp_err_lookup(net, AF_INET6, skb, sctp_hdr(skb), &asoc, &transport);
         /* Put back, the original pointers. */
         skb->network_header   = saveip;
         skb->transport_header = savesctp;
         if (!sk) {
-                ICMP6_INC_STATS_BH(dev_net(skb->dev), idev, ICMP6_MIB_INERRORS);
+                ICMP6_INC_STATS_BH(net, idev, ICMP6_MIB_INERRORS);
                 goto out;
         }
 
@@ -241,7 +243,7 @@ static int sctp_v6_xmit(struct sk_buff *skb, struct sctp_transport *transport)
                           __func__, skb, skb->len,
                           &fl6.saddr, &fl6.daddr);
 
-        SCTP_INC_STATS(SCTP_MIB_OUTSCTPPACKS);
+        SCTP_INC_STATS(sock_net(sk), SCTP_MIB_OUTSCTPPACKS);
 
         if (!(transport->param_flags & SPP_PMTUD_ENABLE))
                 skb->local_df = 1;
@@ -580,7 +582,7 @@ static int sctp_v6_available(union sctp_addr *addr, struct sctp_sock *sp)
         if (!(type & IPV6_ADDR_UNICAST))
                 return 0;
 
-        return ipv6_chk_addr(&init_net, in6, NULL, 0);
+        return ipv6_chk_addr(sock_net(&sp->inet.sk), in6, NULL, 0);
 }
 
 /* This function checks if the address is a valid address to be used for
@@ -857,14 +859,14 @@ static int sctp_inet6_bind_verify(struct sctp_sock *opt, union sctp_addr *addr)
                 struct net_device *dev;
 
                 if (type & IPV6_ADDR_LINKLOCAL) {
+                        struct net *net;
                         if (!addr->v6.sin6_scope_id)
                                 return 0;
+                        net = sock_net(&opt->inet.sk);
                         rcu_read_lock();
-                        dev = dev_get_by_index_rcu(&init_net,
-                                                   addr->v6.sin6_scope_id);
+                        dev = dev_get_by_index_rcu(net, addr->v6.sin6_scope_id);
                         if (!dev ||
-                            !ipv6_chk_addr(&init_net, &addr->v6.sin6_addr,
-                                           dev, 0)) {
+                            !ipv6_chk_addr(net, &addr->v6.sin6_addr, dev, 0)) {
                                 rcu_read_unlock();
                                 return 0;
                         }
@@ -897,7 +899,7 @@ static int sctp_inet6_send_verify(struct sctp_sock *opt, union sctp_addr *addr)
                         if (!addr->v6.sin6_scope_id)
                                 return 0;
                         rcu_read_lock();
-                        dev = dev_get_by_index_rcu(&init_net,
+                        dev = dev_get_by_index_rcu(sock_net(&opt->inet.sk),
                                                    addr->v6.sin6_scope_id);
                         rcu_read_unlock();
                         if (!dev)
diff --git a/net/sctp/objcnt.c b/net/sctp/objcnt.c
index 8ef8e7d9eb61..fe012c44f8df 100644
--- a/net/sctp/objcnt.c
+++ b/net/sctp/objcnt.c
@@ -129,20 +129,20 @@ static const struct file_operations sctp_objcnt_ops = {
 };
 
 /* Initialize the objcount in the proc filesystem.  */
-void sctp_dbg_objcnt_init(void)
+void sctp_dbg_objcnt_init(struct net *net)
 {
         struct proc_dir_entry *ent;
 
         ent = proc_create("sctp_dbg_objcnt", 0,
-                          proc_net_sctp, &sctp_objcnt_ops);
+                          net->sctp.proc_net_sctp, &sctp_objcnt_ops);
         if (!ent)
                 pr_warn("sctp_dbg_objcnt: Unable to create /proc entry.\n");
 }
 
 /* Cleanup the objcount entry in the proc filesystem.  */
-void sctp_dbg_objcnt_exit(void)
+void sctp_dbg_objcnt_exit(struct net *net)
 {
-        remove_proc_entry("sctp_dbg_objcnt", proc_net_sctp);
+        remove_proc_entry("sctp_dbg_objcnt", net->sctp.proc_net_sctp);
 }
 
 
diff --git a/net/sctp/output.c b/net/sctp/output.c
index 838e18b4d7ea..0c6359bb973c 100644
--- a/net/sctp/output.c
+++ b/net/sctp/output.c
@@ -597,7 +597,7 @@ out:
         return err;
 no_route:
         kfree_skb(nskb);
-        IP_INC_STATS_BH(&init_net, IPSTATS_MIB_OUTNOROUTES);
+        IP_INC_STATS_BH(sock_net(asoc->base.sk), IPSTATS_MIB_OUTNOROUTES);
 
         /* FIXME: Returning the 'err' will effect all the associations
          * associated with a socket, although only one of the paths of the
diff --git a/net/sctp/outqueue.c b/net/sctp/outqueue.c
index e7aa177c9522..d16632e1503a 100644
--- a/net/sctp/outqueue.c
+++ b/net/sctp/outqueue.c
@@ -299,6 +299,7 @@ void sctp_outq_free(struct sctp_outq *q)
 /* Put a new chunk in an sctp_outq.  */
 int sctp_outq_tail(struct sctp_outq *q, struct sctp_chunk *chunk)
 {
+        struct net *net = sock_net(q->asoc->base.sk);
         int error = 0;
 
         SCTP_DEBUG_PRINTK("sctp_outq_tail(%p, %p[%s])\n",
@@ -337,15 +338,15 @@ int sctp_outq_tail(struct sctp_outq *q, struct sctp_chunk *chunk)
 
                         sctp_outq_tail_data(q, chunk);
                         if (chunk->chunk_hdr->flags & SCTP_DATA_UNORDERED)
-                                SCTP_INC_STATS(SCTP_MIB_OUTUNORDERCHUNKS);
+                                SCTP_INC_STATS(net, SCTP_MIB_OUTUNORDERCHUNKS);
                         else
-                                SCTP_INC_STATS(SCTP_MIB_OUTORDERCHUNKS);
+                                SCTP_INC_STATS(net, SCTP_MIB_OUTORDERCHUNKS);
                         q->empty = 0;
                         break;
                 }
         } else {
                 list_add_tail(&chunk->list, &q->control_chunk_list);
-                SCTP_INC_STATS(SCTP_MIB_OUTCTRLCHUNKS);
+                SCTP_INC_STATS(net, SCTP_MIB_OUTCTRLCHUNKS);
         }
 
         if (error < 0)
@@ -478,11 +479,12 @@ void sctp_retransmit_mark(struct sctp_outq *q,
 void sctp_retransmit(struct sctp_outq *q, struct sctp_transport *transport,
                      sctp_retransmit_reason_t reason)
 {
+        struct net *net = sock_net(q->asoc->base.sk);
         int error = 0;
 
         switch(reason) {
         case SCTP_RTXR_T3_RTX:
-                SCTP_INC_STATS(SCTP_MIB_T3_RETRANSMITS);
+                SCTP_INC_STATS(net, SCTP_MIB_T3_RETRANSMITS);
                 sctp_transport_lower_cwnd(transport, SCTP_LOWER_CWND_T3_RTX);
                 /* Update the retran path if the T3-rtx timer has expired for
                  * the current retran path.
@@ -493,15 +495,15 @@ void sctp_retransmit(struct sctp_outq *q, struct sctp_transport *transport,
                         transport->asoc->unack_data;
                 break;
         case SCTP_RTXR_FAST_RTX:
-                SCTP_INC_STATS(SCTP_MIB_FAST_RETRANSMITS);
+                SCTP_INC_STATS(net, SCTP_MIB_FAST_RETRANSMITS);
                 sctp_transport_lower_cwnd(transport, SCTP_LOWER_CWND_FAST_RTX);
                 q->fast_rtx = 1;
                 break;
         case SCTP_RTXR_PMTUD:
-                SCTP_INC_STATS(SCTP_MIB_PMTUD_RETRANSMITS);
+                SCTP_INC_STATS(net, SCTP_MIB_PMTUD_RETRANSMITS);
                 break;
         case SCTP_RTXR_T1_RTX:
-                SCTP_INC_STATS(SCTP_MIB_T1_RETRANSMITS);
+                SCTP_INC_STATS(net, SCTP_MIB_T1_RETRANSMITS);
                 transport->asoc->init_retries++;
                 break;
         default:
@@ -589,9 +591,8 @@ static int sctp_outq_flush_rtx(struct sctp_outq *q, struct sctp_packet *pkt,
                  * next chunk.
                  */
                 if (chunk->tsn_gap_acked) {
-                        list_del(&chunk->transmitted_list);
-                        list_add_tail(&chunk->transmitted_list,
-                                        &transport->transmitted);
+                        list_move_tail(&chunk->transmitted_list,
+                                       &transport->transmitted);
                         continue;
                 }
 
@@ -655,9 +656,8 @@ redo:
                         /* The append was successful, so add this chunk to
                          * the transmitted list.
                          */
-                        list_del(&chunk->transmitted_list);
-                        list_add_tail(&chunk->transmitted_list,
-                                        &transport->transmitted);
+                        list_move_tail(&chunk->transmitted_list,
+                                       &transport->transmitted);
 
                         /* Mark the chunk as ineligible for fast retransmit
                          * after it is retransmitted.
@@ -1914,6 +1914,6 @@ static void sctp_generate_fwdtsn(struct sctp_outq *q, __u32 ctsn)
 
         if (ftsn_chunk) {
                 list_add_tail(&ftsn_chunk->list, &q->control_chunk_list);
-                SCTP_INC_STATS(SCTP_MIB_OUTCTRLCHUNKS);
+                SCTP_INC_STATS(sock_net(asoc->base.sk), SCTP_MIB_OUTCTRLCHUNKS);
         }
 }
diff --git a/net/sctp/primitive.c b/net/sctp/primitive.c
index 534c7eae9d15..794bb14decde 100644
--- a/net/sctp/primitive.c
+++ b/net/sctp/primitive.c
@@ -57,7 +57,7 @@
 
 #define DECLARE_PRIMITIVE(name) \
 /* This is called in the code as sctp_primitive_ ## name.  */ \
-int sctp_primitive_ ## name(struct sctp_association *asoc, \
+int sctp_primitive_ ## name(struct net *net, struct sctp_association *asoc, \
                             void *arg) { \
         int error = 0; \
         sctp_event_t event_type; sctp_subtype_t subtype; \
@@ -69,7 +69,7 @@ int sctp_primitive_ ## name(struct sctp_association *asoc, \
         state = asoc ? asoc->state : SCTP_STATE_CLOSED; \
         ep = asoc ? asoc->ep : NULL; \
         \
-        error = sctp_do_sm(event_type, subtype, state, ep, asoc, \
+        error = sctp_do_sm(net, event_type, subtype, state, ep, asoc,   \
                            arg, GFP_KERNEL); \
         return error; \
 }
diff --git a/net/sctp/proc.c b/net/sctp/proc.c
index 1e2eee88c3ea..c3bea269faf4 100644
--- a/net/sctp/proc.c
+++ b/net/sctp/proc.c
@@ -80,11 +80,12 @@ static const struct snmp_mib sctp_snmp_list[] = {
 /* Display sctp snmp mib statistics(/proc/net/sctp/snmp). */
 static int sctp_snmp_seq_show(struct seq_file *seq, void *v)
 {
+        struct net *net = seq->private;
         int i;
 
         for (i = 0; sctp_snmp_list[i].name != NULL; i++)
                 seq_printf(seq, "%-32s\t%ld\n", sctp_snmp_list[i].name,
-                           snmp_fold_field((void __percpu **)sctp_statistics,
+                           snmp_fold_field((void __percpu **)net->sctp.sctp_statistics,
                                       sctp_snmp_list[i].entry));
 
         return 0;
@@ -93,7 +94,7 @@ static int sctp_snmp_seq_show(struct seq_file *seq, void *v)
 /* Initialize the seq file operations for 'snmp' object. */
 static int sctp_snmp_seq_open(struct inode *inode, struct file *file)
 {
-        return single_open(file, sctp_snmp_seq_show, NULL);
+        return single_open_net(inode, file, sctp_snmp_seq_show);
 }
 
 static const struct file_operations sctp_snmp_seq_fops = {
@@ -105,11 +106,12 @@ static const struct file_operations sctp_snmp_seq_fops = {
 };
 
 /* Set up the proc fs entry for 'snmp' object. */
-int __init sctp_snmp_proc_init(void)
+int __net_init sctp_snmp_proc_init(struct net *net)
 {
         struct proc_dir_entry *p;
 
-        p = proc_create("snmp", S_IRUGO, proc_net_sctp, &sctp_snmp_seq_fops);
+        p = proc_create("snmp", S_IRUGO, net->sctp.proc_net_sctp,
+                        &sctp_snmp_seq_fops);
         if (!p)
                 return -ENOMEM;
 
@@ -117,9 +119,9 @@ int __init sctp_snmp_proc_init(void)
 }
 
 /* Cleanup the proc fs entry for 'snmp' object. */
-void sctp_snmp_proc_exit(void)
+void sctp_snmp_proc_exit(struct net *net)
 {
-        remove_proc_entry("snmp", proc_net_sctp);
+        remove_proc_entry("snmp", net->sctp.proc_net_sctp);
 }
 
 /* Dump local addresses of an association/endpoint. */
@@ -213,10 +215,13 @@ static int sctp_eps_seq_show(struct seq_file *seq, void *v)
         sctp_for_each_hentry(epb, node, &head->chain) {
                 ep = sctp_ep(epb);
                 sk = epb->sk;
+                if (!net_eq(sock_net(sk), seq_file_net(seq)))
+                        continue;
                 seq_printf(seq, "%8pK %8pK %-3d %-3d %-4d %-5d %5d %5lu ", ep, sk,
                            sctp_sk(sk)->type, sk->sk_state, hash,
                            epb->bind_addr.port,
-                           sock_i_uid(sk), sock_i_ino(sk));
+                           from_kuid_munged(seq_user_ns(seq), sock_i_uid(sk)),
+                           sock_i_ino(sk));
 
                 sctp_seq_dump_local_addrs(seq, epb);
                 seq_printf(seq, "\n");
@@ -238,7 +243,8 @@ static const struct seq_operations sctp_eps_ops = {
 /* Initialize the seq file operations for 'eps' object. */
 static int sctp_eps_seq_open(struct inode *inode, struct file *file)
 {
-        return seq_open(file, &sctp_eps_ops);
+        return seq_open_net(inode, file, &sctp_eps_ops,
+                            sizeof(struct seq_net_private));
 }
 
 static const struct file_operations sctp_eps_seq_fops = {
@@ -249,11 +255,12 @@ static const struct file_operations sctp_eps_seq_fops = {
 };
 
 /* Set up the proc fs entry for 'eps' object. */
-int __init sctp_eps_proc_init(void)
+int __net_init sctp_eps_proc_init(struct net *net)
 {
         struct proc_dir_entry *p;
 
-        p = proc_create("eps", S_IRUGO, proc_net_sctp, &sctp_eps_seq_fops);
+        p = proc_create("eps", S_IRUGO, net->sctp.proc_net_sctp,
+                        &sctp_eps_seq_fops);
         if (!p)
                 return -ENOMEM;
 
@@ -261,9 +268,9 @@ int __init sctp_eps_proc_init(void)
 }
 
 /* Cleanup the proc fs entry for 'eps' object. */
-void sctp_eps_proc_exit(void)
+void sctp_eps_proc_exit(struct net *net)
 {
-        remove_proc_entry("eps", proc_net_sctp);
+        remove_proc_entry("eps", net->sctp.proc_net_sctp);
 }
 
 
@@ -316,6 +323,8 @@ static int sctp_assocs_seq_show(struct seq_file *seq, void *v)
         sctp_for_each_hentry(epb, node, &head->chain) {
                 assoc = sctp_assoc(epb);
                 sk = epb->sk;
+                if (!net_eq(sock_net(sk), seq_file_net(seq)))
+                        continue;
                 seq_printf(seq,
                            "%8pK %8pK %-3d %-3d %-2d %-4d "
                            "%4d %8d %8d %7d %5lu %-5d %5d ",
@@ -324,7 +333,8 @@ static int sctp_assocs_seq_show(struct seq_file *seq, void *v)
                            assoc->assoc_id,
                            assoc->sndbuf_used,
                            atomic_read(&assoc->rmem_alloc),
-                           sock_i_uid(sk), sock_i_ino(sk),
+                           from_kuid_munged(seq_user_ns(seq), sock_i_uid(sk)),
+                           sock_i_ino(sk),
                            epb->bind_addr.port,
                            assoc->peer.port);
                 seq_printf(seq, " ");
@@ -354,7 +364,8 @@ static const struct seq_operations sctp_assoc_ops = {
 /* Initialize the seq file operations for 'assocs' object. */
 static int sctp_assocs_seq_open(struct inode *inode, struct file *file)
 {
-        return seq_open(file, &sctp_assoc_ops);
+        return seq_open_net(inode, file, &sctp_assoc_ops,
+                            sizeof(struct seq_net_private));
 }
 
 static const struct file_operations sctp_assocs_seq_fops = {
@@ -365,11 +376,11 @@ static const struct file_operations sctp_assocs_seq_fops = {
 };
 
 /* Set up the proc fs entry for 'assocs' object. */
-int __init sctp_assocs_proc_init(void)
+int __net_init sctp_assocs_proc_init(struct net *net)
 {
         struct proc_dir_entry *p;
 
-        p = proc_create("assocs", S_IRUGO, proc_net_sctp,
+        p = proc_create("assocs", S_IRUGO, net->sctp.proc_net_sctp,
                         &sctp_assocs_seq_fops);
         if (!p)
                 return -ENOMEM;
@@ -378,9 +389,9 @@ int __init sctp_assocs_proc_init(void)
 }
 
 /* Cleanup the proc fs entry for 'assocs' object. */
-void sctp_assocs_proc_exit(void)
+void sctp_assocs_proc_exit(struct net *net)
 {
-        remove_proc_entry("assocs", proc_net_sctp);
+        remove_proc_entry("assocs", net->sctp.proc_net_sctp);
 }
 
 static void *sctp_remaddr_seq_start(struct seq_file *seq, loff_t *pos)
@@ -426,6 +437,8 @@ static int sctp_remaddr_seq_show(struct seq_file *seq, void *v)
         sctp_local_bh_disable();
         read_lock(&head->lock);
         sctp_for_each_hentry(epb, node, &head->chain) {
+                if (!net_eq(sock_net(epb->sk), seq_file_net(seq)))
+                        continue;
                 assoc = sctp_assoc(epb);
                 list_for_each_entry(tsp, &assoc->peer.transport_addr_list,
                                         transports) {
@@ -489,14 +502,15 @@ static const struct seq_operations sctp_remaddr_ops = {
 };
 
 /* Cleanup the proc fs entry for 'remaddr' object. */
-void sctp_remaddr_proc_exit(void)
+void sctp_remaddr_proc_exit(struct net *net)
 {
-        remove_proc_entry("remaddr", proc_net_sctp);
+        remove_proc_entry("remaddr", net->sctp.proc_net_sctp);
 }
 
 static int sctp_remaddr_seq_open(struct inode *inode, struct file *file)
 {
-        return seq_open(file, &sctp_remaddr_ops);
+        return seq_open_net(inode, file, &sctp_remaddr_ops,
+                            sizeof(struct seq_net_private));
 }
 
 static const struct file_operations sctp_remaddr_seq_fops = {
@@ -506,11 +520,12 @@ static const struct file_operations sctp_remaddr_seq_fops = {
         .release = seq_release,
 };
 
-int __init sctp_remaddr_proc_init(void)
+int __net_init sctp_remaddr_proc_init(struct net *net)
 {
         struct proc_dir_entry *p;
 
-        p = proc_create("remaddr", S_IRUGO, proc_net_sctp, &sctp_remaddr_seq_fops);
+        p = proc_create("remaddr", S_IRUGO, net->sctp.proc_net_sctp,
+                        &sctp_remaddr_seq_fops);
         if (!p)
                 return -ENOMEM;
         return 0;
diff --git a/net/sctp/protocol.c b/net/sctp/protocol.c
index 1f89c4e69645..2d518425d598 100644
--- a/net/sctp/protocol.c
+++ b/net/sctp/protocol.c
@@ -69,21 +69,10 @@
 
 /* Global data structures. */
 struct sctp_globals sctp_globals __read_mostly;
-DEFINE_SNMP_STAT(struct sctp_mib, sctp_statistics) __read_mostly;
-
-#ifdef CONFIG_PROC_FS
-struct proc_dir_entry   *proc_net_sctp;
-#endif
 
 struct idr sctp_assocs_id;
 DEFINE_SPINLOCK(sctp_assocs_id_lock);
 
-/* This is the global socket data structure used for responding to
- * the Out-of-the-blue (OOTB) packets.  A control sock will be created
- * for this socket at the initialization time.
- */
-static struct sock *sctp_ctl_sock;
-
 static struct sctp_pf *sctp_pf_inet6_specific;
 static struct sctp_pf *sctp_pf_inet_specific;
 static struct sctp_af *sctp_af_v4_specific;
@@ -96,74 +85,54 @@ long sysctl_sctp_mem[3];
 int sysctl_sctp_rmem[3];
 int sysctl_sctp_wmem[3];
 
-/* Return the address of the control sock. */
-struct sock *sctp_get_ctl_sock(void)
-{
-        return sctp_ctl_sock;
-}
-
 /* Set up the proc fs entry for the SCTP protocol. */
-static __init int sctp_proc_init(void)
+static __net_init int sctp_proc_init(struct net *net)
 {
-        if (percpu_counter_init(&sctp_sockets_allocated, 0))
-                goto out_nomem;
 #ifdef CONFIG_PROC_FS
-        if (!proc_net_sctp) {
-                proc_net_sctp = proc_mkdir("sctp", init_net.proc_net);
-                if (!proc_net_sctp)
-                        goto out_free_percpu;
-        }
-
-        if (sctp_snmp_proc_init())
+        net->sctp.proc_net_sctp = proc_net_mkdir(net, "sctp", net->proc_net);
+        if (!net->sctp.proc_net_sctp)
+                goto out_proc_net_sctp;
+        if (sctp_snmp_proc_init(net))
                 goto out_snmp_proc_init;
-        if (sctp_eps_proc_init())
+        if (sctp_eps_proc_init(net))
                 goto out_eps_proc_init;
-        if (sctp_assocs_proc_init())
+        if (sctp_assocs_proc_init(net))
                 goto out_assocs_proc_init;
-        if (sctp_remaddr_proc_init())
+        if (sctp_remaddr_proc_init(net))
                 goto out_remaddr_proc_init;
 
         return 0;
 
 out_remaddr_proc_init:
-        sctp_assocs_proc_exit();
+        sctp_assocs_proc_exit(net);
 out_assocs_proc_init:
-        sctp_eps_proc_exit();
+        sctp_eps_proc_exit(net);
 out_eps_proc_init:
-        sctp_snmp_proc_exit();
+        sctp_snmp_proc_exit(net);
 out_snmp_proc_init:
-        if (proc_net_sctp) {
-                proc_net_sctp = NULL;
-                remove_proc_entry("sctp", init_net.proc_net);
-        }
-out_free_percpu:
-        percpu_counter_destroy(&sctp_sockets_allocated);
-#else
-        return 0;
-#endif /* CONFIG_PROC_FS */
-
-out_nomem:
+        remove_proc_entry("sctp", net->proc_net);
+        net->sctp.proc_net_sctp = NULL;
+out_proc_net_sctp:
         return -ENOMEM;
+#endif /* CONFIG_PROC_FS */
+        return 0;
 }
 
 /* Clean up the proc fs entry for the SCTP protocol.
  * Note: Do not make this __exit as it is used in the init error
  * path.
  */
-static void sctp_proc_exit(void)
+static void sctp_proc_exit(struct net *net)
 {
 #ifdef CONFIG_PROC_FS
-        sctp_snmp_proc_exit();
-        sctp_eps_proc_exit();
-        sctp_assocs_proc_exit();
-        sctp_remaddr_proc_exit();
-
-        if (proc_net_sctp) {
-                proc_net_sctp = NULL;
-                remove_proc_entry("sctp", init_net.proc_net);
-        }
+        sctp_snmp_proc_exit(net);
+        sctp_eps_proc_exit(net);
+        sctp_assocs_proc_exit(net);
+        sctp_remaddr_proc_exit(net);
+
+        remove_proc_entry("sctp", net->proc_net);
+        net->sctp.proc_net_sctp = NULL;
 #endif
-        percpu_counter_destroy(&sctp_sockets_allocated);
 }
 
 /* Private helper to extract ipv4 address and stash them in
@@ -201,29 +170,29 @@ static void sctp_v4_copy_addrlist(struct list_head *addrlist,
 /* Extract our IP addresses from the system and stash them in the
  * protocol structure.
  */
-static void sctp_get_local_addr_list(void)
+static void sctp_get_local_addr_list(struct net *net)
 {
         struct net_device *dev;
         struct list_head *pos;
         struct sctp_af *af;
 
         rcu_read_lock();
-        for_each_netdev_rcu(&init_net, dev) {
+        for_each_netdev_rcu(net, dev) {
                 __list_for_each(pos, &sctp_address_families) {
                         af = list_entry(pos, struct sctp_af, list);
-                        af->copy_addrlist(&sctp_local_addr_list, dev);
+                        af->copy_addrlist(&net->sctp.local_addr_list, dev);
                 }
         }
         rcu_read_unlock();
 }
 
 /* Free the existing local addresses.  */
-static void sctp_free_local_addr_list(void)
+static void sctp_free_local_addr_list(struct net *net)
 {
         struct sctp_sockaddr_entry *addr;
         struct list_head *pos, *temp;
 
-        list_for_each_safe(pos, temp, &sctp_local_addr_list) {
+        list_for_each_safe(pos, temp, &net->sctp.local_addr_list) {
                 addr = list_entry(pos, struct sctp_sockaddr_entry, list);
                 list_del(pos);
                 kfree(addr);
@@ -231,17 +200,17 @@ static void sctp_free_local_addr_list(void)
 }
 
 /* Copy the local addresses which are valid for 'scope' into 'bp'.  */
-int sctp_copy_local_addr_list(struct sctp_bind_addr *bp, sctp_scope_t scope,
-                              gfp_t gfp, int copy_flags)
+int sctp_copy_local_addr_list(struct net *net, struct sctp_bind_addr *bp,
+                              sctp_scope_t scope, gfp_t gfp, int copy_flags)
 {
         struct sctp_sockaddr_entry *addr;
         int error = 0;
 
         rcu_read_lock();
-        list_for_each_entry_rcu(addr, &sctp_local_addr_list, list) {
+        list_for_each_entry_rcu(addr, &net->sctp.local_addr_list, list) {
                 if (!addr->valid)
                         continue;
-                if (sctp_in_scope(&addr->a, scope)) {
+                if (sctp_in_scope(net, &addr->a, scope)) {
                         /* Now that the address is in scope, check to see if
                          * the address type is really supported by the local
                          * sock as well as the remote peer.
@@ -397,7 +366,8 @@ static int sctp_v4_addr_valid(union sctp_addr *addr,
 /* Should this be available for binding?   */
 static int sctp_v4_available(union sctp_addr *addr, struct sctp_sock *sp)
 {
-        int ret = inet_addr_type(&init_net, addr->v4.sin_addr.s_addr);
+        struct net *net = sock_net(&sp->inet.sk);
+        int ret = inet_addr_type(net, addr->v4.sin_addr.s_addr);
 
 
         if (addr->v4.sin_addr.s_addr != htonl(INADDR_ANY) &&
@@ -484,7 +454,7 @@ static void sctp_v4_get_dst(struct sctp_transport *t, union sctp_addr *saddr,
         SCTP_DEBUG_PRINTK("%s: DST:%pI4, SRC:%pI4 - ",
                           __func__, &fl4->daddr, &fl4->saddr);
 
-        rt = ip_route_output_key(&init_net, fl4);
+        rt = ip_route_output_key(sock_net(sk), fl4);
         if (!IS_ERR(rt))
                 dst = &rt->dst;
 
@@ -530,7 +500,7 @@ static void sctp_v4_get_dst(struct sctp_transport *t, union sctp_addr *saddr,
                     (AF_INET == laddr->a.sa.sa_family)) {
                         fl4->saddr = laddr->a.v4.sin_addr.s_addr;
                         fl4->fl4_sport = laddr->a.v4.sin_port;
-                        rt = ip_route_output_key(&init_net, fl4);
+                        rt = ip_route_output_key(sock_net(sk), fl4);
                         if (!IS_ERR(rt)) {
                                 dst = &rt->dst;
                                 goto out_unlock;
@@ -627,14 +597,15 @@ static void sctp_v4_ecn_capable(struct sock *sk)
 
 void sctp_addr_wq_timeout_handler(unsigned long arg)
 {
+        struct net *net = (struct net *)arg;
         struct sctp_sockaddr_entry *addrw, *temp;
         struct sctp_sock *sp;
 
-        spin_lock_bh(&sctp_addr_wq_lock);
+        spin_lock_bh(&net->sctp.addr_wq_lock);
 
-        list_for_each_entry_safe(addrw, temp, &sctp_addr_waitq, list) {
+        list_for_each_entry_safe(addrw, temp, &net->sctp.addr_waitq, list) {
                 SCTP_DEBUG_PRINTK_IPADDR("sctp_addrwq_timo_handler: the first ent in wq %p is ",
-                    " for cmd %d at entry %p\n", &sctp_addr_waitq, &addrw->a, addrw->state,
+                    " for cmd %d at entry %p\n", &net->sctp.addr_waitq, &addrw->a, addrw->state,
                     addrw);
 
 #if IS_ENABLED(CONFIG_IPV6)
@@ -648,7 +619,7 @@ void sctp_addr_wq_timeout_handler(unsigned long arg)
                                 goto free_next;
 
                         in6 = (struct in6_addr *)&addrw->a.v6.sin6_addr;
-                        if (ipv6_chk_addr(&init_net, in6, NULL, 0) == 0 &&
+                        if (ipv6_chk_addr(net, in6, NULL, 0) == 0 &&
                             addrw->state == SCTP_ADDR_NEW) {
                                 unsigned long timeo_val;
 
@@ -656,12 +627,12 @@ void sctp_addr_wq_timeout_handler(unsigned long arg)
                                     SCTP_ADDRESS_TICK_DELAY);
                                 timeo_val = jiffies;
                                 timeo_val += msecs_to_jiffies(SCTP_ADDRESS_TICK_DELAY);
-                                mod_timer(&sctp_addr_wq_timer, timeo_val);
+                                mod_timer(&net->sctp.addr_wq_timer, timeo_val);
                                 break;
                         }
                 }
 #endif
-                list_for_each_entry(sp, &sctp_auto_asconf_splist, auto_asconf_list) {
+                list_for_each_entry(sp, &net->sctp.auto_asconf_splist, auto_asconf_list) {
                         struct sock *sk;
 
                         sk = sctp_opt2sk(sp);
@@ -679,31 +650,32 @@ free_next:
                 list_del(&addrw->list);
                 kfree(addrw);
         }
-        spin_unlock_bh(&sctp_addr_wq_lock);
+        spin_unlock_bh(&net->sctp.addr_wq_lock);
 }
 
-static void sctp_free_addr_wq(void)
+static void sctp_free_addr_wq(struct net *net)
 {
         struct sctp_sockaddr_entry *addrw;
         struct sctp_sockaddr_entry *temp;
 
-        spin_lock_bh(&sctp_addr_wq_lock);
-        del_timer(&sctp_addr_wq_timer);
-        list_for_each_entry_safe(addrw, temp, &sctp_addr_waitq, list) {
+        spin_lock_bh(&net->sctp.addr_wq_lock);
+        del_timer(&net->sctp.addr_wq_timer);
+        list_for_each_entry_safe(addrw, temp, &net->sctp.addr_waitq, list) {
                 list_del(&addrw->list);
                 kfree(addrw);
         }
-        spin_unlock_bh(&sctp_addr_wq_lock);
+        spin_unlock_bh(&net->sctp.addr_wq_lock);
 }
 
 /* lookup the entry for the same address in the addr_waitq
  * sctp_addr_wq MUST be locked
  */
-static struct sctp_sockaddr_entry *sctp_addr_wq_lookup(struct sctp_sockaddr_entry *addr)
+static struct sctp_sockaddr_entry *sctp_addr_wq_lookup(struct net *net,
+                                        struct sctp_sockaddr_entry *addr)
 {
         struct sctp_sockaddr_entry *addrw;
 
-        list_for_each_entry(addrw, &sctp_addr_waitq, list) {
+        list_for_each_entry(addrw, &net->sctp.addr_waitq, list) {
                 if (addrw->a.sa.sa_family != addr->a.sa.sa_family)
                         continue;
                 if (addrw->a.sa.sa_family == AF_INET) {
@@ -719,7 +691,7 @@ static struct sctp_sockaddr_entry *sctp_addr_wq_lookup(struct sctp_sockaddr_entr
         return NULL;
 }
 
-void sctp_addr_wq_mgmt(struct sctp_sockaddr_entry *addr, int cmd)
+void sctp_addr_wq_mgmt(struct net *net, struct sctp_sockaddr_entry *addr, int cmd)
 {
         struct sctp_sockaddr_entry *addrw;
         unsigned long timeo_val;
@@ -730,38 +702,38 @@ void sctp_addr_wq_mgmt(struct sctp_sockaddr_entry *addr, int cmd)
          * new address after a couple of addition and deletion of that address
          */
 
-        spin_lock_bh(&sctp_addr_wq_lock);
+        spin_lock_bh(&net->sctp.addr_wq_lock);
         /* Offsets existing events in addr_wq */
-        addrw = sctp_addr_wq_lookup(addr);
+        addrw = sctp_addr_wq_lookup(net, addr);
         if (addrw) {
                 if (addrw->state != cmd) {
                         SCTP_DEBUG_PRINTK_IPADDR("sctp_addr_wq_mgmt offsets existing entry for %d ",
                             " in wq %p\n", addrw->state, &addrw->a,
-                            &sctp_addr_waitq);
+                            &net->sctp.addr_waitq);
                         list_del(&addrw->list);
                         kfree(addrw);
                 }
-                spin_unlock_bh(&sctp_addr_wq_lock);
+                spin_unlock_bh(&net->sctp.addr_wq_lock);
                 return;
         }
 
         /* OK, we have to add the new address to the wait queue */
         addrw = kmemdup(addr, sizeof(struct sctp_sockaddr_entry), GFP_ATOMIC);
         if (addrw == NULL) {
-                spin_unlock_bh(&sctp_addr_wq_lock);
+                spin_unlock_bh(&net->sctp.addr_wq_lock);
                 return;
         }
         addrw->state = cmd;
-        list_add_tail(&addrw->list, &sctp_addr_waitq);
+        list_add_tail(&addrw->list, &net->sctp.addr_waitq);
         SCTP_DEBUG_PRINTK_IPADDR("sctp_addr_wq_mgmt add new entry for cmd:%d ",
-            " in wq %p\n", addrw->state, &addrw->a, &sctp_addr_waitq);
+            " in wq %p\n", addrw->state, &addrw->a, &net->sctp.addr_waitq);
 
-        if (!timer_pending(&sctp_addr_wq_timer)) {
+        if (!timer_pending(&net->sctp.addr_wq_timer)) {
                 timeo_val = jiffies;
                 timeo_val += msecs_to_jiffies(SCTP_ADDRESS_TICK_DELAY);
-                mod_timer(&sctp_addr_wq_timer, timeo_val);
+                mod_timer(&net->sctp.addr_wq_timer, timeo_val);
         }
-        spin_unlock_bh(&sctp_addr_wq_lock);
+        spin_unlock_bh(&net->sctp.addr_wq_lock);
 }
 
 /* Event handler for inet address addition/deletion events.
@@ -776,11 +748,9 @@ static int sctp_inetaddr_event(struct notifier_block *this, unsigned long ev,
         struct in_ifaddr *ifa = (struct in_ifaddr *)ptr;
         struct sctp_sockaddr_entry *addr = NULL;
         struct sctp_sockaddr_entry *temp;
+        struct net *net = dev_net(ifa->ifa_dev->dev);
         int found = 0;
 
-        if (!net_eq(dev_net(ifa->ifa_dev->dev), &init_net))
-                return NOTIFY_DONE;
-
         switch (ev) {
         case NETDEV_UP:
                 addr = kmalloc(sizeof(struct sctp_sockaddr_entry), GFP_ATOMIC);
@@ -789,27 +759,27 @@ static int sctp_inetaddr_event(struct notifier_block *this, unsigned long ev,
                         addr->a.v4.sin_port = 0;
                         addr->a.v4.sin_addr.s_addr = ifa->ifa_local;
                         addr->valid = 1;
-                        spin_lock_bh(&sctp_local_addr_lock);
-                        list_add_tail_rcu(&addr->list, &sctp_local_addr_list);
-                        sctp_addr_wq_mgmt(addr, SCTP_ADDR_NEW);
-                        spin_unlock_bh(&sctp_local_addr_lock);
+                        spin_lock_bh(&net->sctp.local_addr_lock);
+                        list_add_tail_rcu(&addr->list, &net->sctp.local_addr_list);
+                        sctp_addr_wq_mgmt(net, addr, SCTP_ADDR_NEW);
+                        spin_unlock_bh(&net->sctp.local_addr_lock);
                 }
                 break;
         case NETDEV_DOWN:
-                spin_lock_bh(&sctp_local_addr_lock);
+                spin_lock_bh(&net->sctp.local_addr_lock);
                 list_for_each_entry_safe(addr, temp,
-                                        &sctp_local_addr_list, list) {
+                                        &net->sctp.local_addr_list, list) {
                         if (addr->a.sa.sa_family == AF_INET &&
                                         addr->a.v4.sin_addr.s_addr ==
                                         ifa->ifa_local) {
-                                sctp_addr_wq_mgmt(addr, SCTP_ADDR_DEL);
+                                sctp_addr_wq_mgmt(net, addr, SCTP_ADDR_DEL);
                                 found = 1;
                                 addr->valid = 0;
                                 list_del_rcu(&addr->list);
                                 break;
                         }
                 }
-                spin_unlock_bh(&sctp_local_addr_lock);
+                spin_unlock_bh(&net->sctp.local_addr_lock);
                 if (found)
                         kfree_rcu(addr, rcu);
                 break;
@@ -822,7 +792,7 @@ static int sctp_inetaddr_event(struct notifier_block *this, unsigned long ev,
  * Initialize the control inode/socket with a control endpoint data
  * structure.  This endpoint is reserved exclusively for the OOTB processing.
  */
-static int sctp_ctl_sock_init(void)
+static int sctp_ctl_sock_init(struct net *net)
 {
         int err;
         sa_family_t family = PF_INET;
@@ -830,14 +800,14 @@ static int sctp_ctl_sock_init(void)
         if (sctp_get_pf_specific(PF_INET6))
                 family = PF_INET6;
 
-        err = inet_ctl_sock_create(&sctp_ctl_sock, family,
-                                   SOCK_SEQPACKET, IPPROTO_SCTP, &init_net);
+        err = inet_ctl_sock_create(&net->sctp.ctl_sock, family,
+                                   SOCK_SEQPACKET, IPPROTO_SCTP, net);
 
         /* If IPv6 socket could not be created, try the IPv4 socket */
         if (err < 0 && family == PF_INET6)
-                err = inet_ctl_sock_create(&sctp_ctl_sock, AF_INET,
+                err = inet_ctl_sock_create(&net->sctp.ctl_sock, AF_INET,
                                            SOCK_SEQPACKET, IPPROTO_SCTP,
-                                           &init_net);
+                                           net);
 
         if (err < 0) {
                 pr_err("Failed to create the SCTP control socket\n");
@@ -990,7 +960,7 @@ static inline int sctp_v4_xmit(struct sk_buff *skb,
         inet->pmtudisc = transport->param_flags & SPP_PMTUD_ENABLE ?
                          IP_PMTUDISC_DO : IP_PMTUDISC_DONT;
 
-        SCTP_INC_STATS(SCTP_MIB_OUTSCTPPACKS);
+        SCTP_INC_STATS(sock_net(&inet->sk), SCTP_MIB_OUTSCTPPACKS);
         return ip_queue_xmit(skb, &transport->fl);
 }
 
@@ -1063,6 +1033,7 @@ static const struct net_protocol sctp_protocol = {
         .handler     = sctp_rcv,
         .err_handler = sctp_v4_err,
         .no_policy   = 1,
+        .netns_ok    = 1,
 };
 
 /* IPv4 address related functions.  */
@@ -1130,16 +1101,16 @@ int sctp_register_pf(struct sctp_pf *pf, sa_family_t family)
         return 1;
 }
 
-static inline int init_sctp_mibs(void)
+static inline int init_sctp_mibs(struct net *net)
 {
-        return snmp_mib_init((void __percpu **)sctp_statistics,
+        return snmp_mib_init((void __percpu **)net->sctp.sctp_statistics,
                              sizeof(struct sctp_mib),
                              __alignof__(struct sctp_mib));
 }
 
-static inline void cleanup_sctp_mibs(void)
+static inline void cleanup_sctp_mibs(struct net *net)
 {
-        snmp_mib_free((void __percpu **)sctp_statistics);
+        snmp_mib_free((void __percpu **)net->sctp.sctp_statistics);
 }
 
 static void sctp_v4_pf_init(void)
@@ -1194,6 +1165,143 @@ static void sctp_v4_del_protocol(void)
         unregister_inetaddr_notifier(&sctp_inetaddr_notifier);
 }
 
+static int sctp_net_init(struct net *net)
+{
+        int status;
+
+        /*
+         * 14. Suggested SCTP Protocol Parameter Values
+         */
+        /* The following protocol parameters are RECOMMENDED:  */
+        /* RTO.Initial              - 3  seconds */
+        net->sctp.rto_initial                   = SCTP_RTO_INITIAL;
+        /* RTO.Min                  - 1  second */
+        net->sctp.rto_min                       = SCTP_RTO_MIN;
+        /* RTO.Max                 -  60 seconds */
+        net->sctp.rto_max                       = SCTP_RTO_MAX;
+        /* RTO.Alpha                - 1/8 */
+        net->sctp.rto_alpha                     = SCTP_RTO_ALPHA;
+        /* RTO.Beta                 - 1/4 */
+        net->sctp.rto_beta                      = SCTP_RTO_BETA;
+
+        /* Valid.Cookie.Life        - 60  seconds */
+        net->sctp.valid_cookie_life             = SCTP_DEFAULT_COOKIE_LIFE;
+
+        /* Whether Cookie Preservative is enabled(1) or not(0) */
+        net->sctp.cookie_preserve_enable        = 1;
+
+        /* Max.Burst                - 4 */
+        net->sctp.max_burst                     = SCTP_DEFAULT_MAX_BURST;
+
+        /* Association.Max.Retrans  - 10 attempts
+         * Path.Max.Retrans         - 5  attempts (per destination address)
+         * Max.Init.Retransmits     - 8  attempts
+         */
+        net->sctp.max_retrans_association       = 10;
+        net->sctp.max_retrans_path              = 5;
+        net->sctp.max_retrans_init              = 8;
+
+        /* Sendbuffer growth        - do per-socket accounting */
+        net->sctp.sndbuf_policy                 = 0;
+
+        /* Rcvbuffer growth         - do per-socket accounting */
+        net->sctp.rcvbuf_policy                 = 0;
+
+        /* HB.interval              - 30 seconds */
+        net->sctp.hb_interval                   = SCTP_DEFAULT_TIMEOUT_HEARTBEAT;
+
+        /* delayed SACK timeout */
+        net->sctp.sack_timeout                  = SCTP_DEFAULT_TIMEOUT_SACK;
+
+        /* Disable ADDIP by default. */
+        net->sctp.addip_enable = 0;
+        net->sctp.addip_noauth = 0;
+        net->sctp.default_auto_asconf = 0;
+
+        /* Enable PR-SCTP by default. */
+        net->sctp.prsctp_enable = 1;
+
+        /* Disable AUTH by default. */
+        net->sctp.auth_enable = 0;
+
+        /* Set SCOPE policy to enabled */
+        net->sctp.scope_policy = SCTP_SCOPE_POLICY_ENABLE;
+
+        /* Set the default rwnd update threshold */
+        net->sctp.rwnd_upd_shift = SCTP_DEFAULT_RWND_SHIFT;
+
+        /* Initialize maximum autoclose timeout. */
+        net->sctp.max_autoclose         = INT_MAX / HZ;
+
+        status = sctp_sysctl_net_register(net);
+        if (status)
+                goto err_sysctl_register;
+
+        /* Allocate and initialise sctp mibs.  */
+        status = init_sctp_mibs(net);
+        if (status)
+                goto err_init_mibs;
+
+        /* Initialize proc fs directory.  */
+        status = sctp_proc_init(net);
+        if (status)
+                goto err_init_proc;
+
+        sctp_dbg_objcnt_init(net);
+
+        /* Initialize the control inode/socket for handling OOTB packets.  */
+        if ((status = sctp_ctl_sock_init(net))) {
+                pr_err("Failed to initialize the SCTP control sock\n");
+                goto err_ctl_sock_init;
+        }
+
+        /* Initialize the local address list. */
+        INIT_LIST_HEAD(&net->sctp.local_addr_list);
+        spin_lock_init(&net->sctp.local_addr_lock);
+        sctp_get_local_addr_list(net);
+
+        /* Initialize the address event list */
+        INIT_LIST_HEAD(&net->sctp.addr_waitq);
+        INIT_LIST_HEAD(&net->sctp.auto_asconf_splist);
+        spin_lock_init(&net->sctp.addr_wq_lock);
+        net->sctp.addr_wq_timer.expires = 0;
+        setup_timer(&net->sctp.addr_wq_timer, sctp_addr_wq_timeout_handler,
+                    (unsigned long)net);
+
+        return 0;
+
+err_ctl_sock_init:
+        sctp_dbg_objcnt_exit(net);
+        sctp_proc_exit(net);
+err_init_proc:
+        cleanup_sctp_mibs(net);
+err_init_mibs:
+        sctp_sysctl_net_unregister(net);
+err_sysctl_register:
+        return status;
+}
+
+static void sctp_net_exit(struct net *net)
+{
+        /* Free the local address list */
+        sctp_free_addr_wq(net);
+        sctp_free_local_addr_list(net);
+
+        /* Free the control endpoint.  */
+        inet_ctl_sock_destroy(net->sctp.ctl_sock);
+
+        sctp_dbg_objcnt_exit(net);
+
+        sctp_proc_exit(net);
+        cleanup_sctp_mibs(net);
+        sctp_sysctl_net_unregister(net);
+}
+
+static struct pernet_operations sctp_net_ops = {
+        .init = sctp_net_init,
+        .exit = sctp_net_exit,
+};
+
 /* Initialize the universe into something sensible.  */
 SCTP_STATIC __init int sctp_init(void)
 {
@@ -1224,62 +1332,9 @@ SCTP_STATIC __init int sctp_init(void)
         if (!sctp_chunk_cachep)
                 goto err_chunk_cachep;
 
-        /* Allocate and initialise sctp mibs.  */
-        status = init_sctp_mibs();
+        status = percpu_counter_init(&sctp_sockets_allocated, 0);
         if (status)
-                goto err_init_mibs;
-
-        /* Initialize proc fs directory.  */
-        status = sctp_proc_init();
-        if (status)
-                goto err_init_proc;
-
-        /* Initialize object count debugging.  */
-        sctp_dbg_objcnt_init();
-
-        /*
-         * 14. Suggested SCTP Protocol Parameter Values
-         */
-        /* The following protocol parameters are RECOMMENDED:  */
-        /* RTO.Initial              - 3  seconds */
-        sctp_rto_initial                = SCTP_RTO_INITIAL;
-        /* RTO.Min                  - 1  second */
-        sctp_rto_min                    = SCTP_RTO_MIN;
-        /* RTO.Max                 -  60 seconds */
-        sctp_rto_max                    = SCTP_RTO_MAX;
-        /* RTO.Alpha                - 1/8 */
-        sctp_rto_alpha                  = SCTP_RTO_ALPHA;
-        /* RTO.Beta                 - 1/4 */
-        sctp_rto_beta                   = SCTP_RTO_BETA;
-
-        /* Valid.Cookie.Life        - 60  seconds */
-        sctp_valid_cookie_life          = SCTP_DEFAULT_COOKIE_LIFE;
-
-        /* Whether Cookie Preservative is enabled(1) or not(0) */
-        sctp_cookie_preserve_enable     = 1;
-
-        /* Max.Burst                - 4 */
-        sctp_max_burst                  = SCTP_DEFAULT_MAX_BURST;
-
-        /* Association.Max.Retrans  - 10 attempts
-         * Path.Max.Retrans         - 5  attempts (per destination address)
-         * Max.Init.Retransmits     - 8  attempts
-         */
-        sctp_max_retrans_association    = 10;
-        sctp_max_retrans_path           = 5;
-        sctp_max_retrans_init           = 8;
-
-        /* Sendbuffer growth        - do per-socket accounting */
-        sctp_sndbuf_policy              = 0;
-
-        /* Rcvbuffer growth         - do per-socket accounting */
-        sctp_rcvbuf_policy              = 0;
-
-        /* HB.interval              - 30 seconds */
-        sctp_hb_interval                = SCTP_DEFAULT_TIMEOUT_HEARTBEAT;
-
-        /* delayed SACK timeout */
-        sctp_sack_timeout               = SCTP_DEFAULT_TIMEOUT_SACK;
+                goto err_percpu_counter_init;
 
         /* Implementation specific variables. */
 
@@ -1287,9 +1342,6 @@ SCTP_STATIC __init int sctp_init(void)
         sctp_max_instreams              = SCTP_DEFAULT_INSTREAMS;
         sctp_max_outstreams             = SCTP_DEFAULT_OUTSTREAMS;
 
-        /* Initialize maximum autoclose timeout. */
-        sctp_max_autoclose              = INT_MAX / HZ;
-
         /* Initialize handle used for association ids. */
         idr_init(&sctp_assocs_id);
 
@@ -1376,41 +1428,12 @@ SCTP_STATIC __init int sctp_init(void)
         pr_info("Hash tables configured (established %d bind %d)\n",
                 sctp_assoc_hashsize, sctp_port_hashsize);
 
-        /* Disable ADDIP by default. */
-        sctp_addip_enable = 0;
-        sctp_addip_noauth = 0;
-        sctp_default_auto_asconf = 0;
-
-        /* Enable PR-SCTP by default. */
-        sctp_prsctp_enable = 1;
-
-        /* Disable AUTH by default. */
-        sctp_auth_enable = 0;
-
-        /* Set SCOPE policy to enabled */
-        sctp_scope_policy = SCTP_SCOPE_POLICY_ENABLE;
-
-        /* Set the default rwnd update threshold */
-        sctp_rwnd_upd_shift             = SCTP_DEFAULT_RWND_SHIFT;
-
         sctp_sysctl_register();
 
         INIT_LIST_HEAD(&sctp_address_families);
         sctp_v4_pf_init();
         sctp_v6_pf_init();
 
-        /* Initialize the local address list. */
-        INIT_LIST_HEAD(&sctp_local_addr_list);
-        spin_lock_init(&sctp_local_addr_lock);
-        sctp_get_local_addr_list();
-
-        /* Initialize the address event list */
-        INIT_LIST_HEAD(&sctp_addr_waitq);
-        INIT_LIST_HEAD(&sctp_auto_asconf_splist);
-        spin_lock_init(&sctp_addr_wq_lock);
-        sctp_addr_wq_timer.expires = 0;
-        setup_timer(&sctp_addr_wq_timer, sctp_addr_wq_timeout_handler, 0);
-
         status = sctp_v4_protosw_init();
 
         if (status)
@@ -1420,11 +1443,9 @@ SCTP_STATIC __init int sctp_init(void)
         if (status)
                 goto err_v6_protosw_init;
 
-        /* Initialize the control inode/socket for handling OOTB packets.  */
-        if ((status = sctp_ctl_sock_init())) {
-                pr_err("Failed to initialize the SCTP control sock\n");
-                goto err_ctl_sock_init;
-        }
+        status = register_pernet_subsys(&sctp_net_ops);
+        if (status)
+                goto err_register_pernet_subsys;
 
         status = sctp_v4_add_protocol();
         if (status)
@@ -1441,13 +1462,12 @@ out:
 err_v6_add_protocol:
         sctp_v4_del_protocol();
 err_add_protocol:
-        inet_ctl_sock_destroy(sctp_ctl_sock);
-err_ctl_sock_init:
+        unregister_pernet_subsys(&sctp_net_ops);
+err_register_pernet_subsys:
         sctp_v6_protosw_exit();
 err_v6_protosw_init:
         sctp_v4_protosw_exit();
 err_protosw_init:
-        sctp_free_local_addr_list();
         sctp_v4_pf_exit();
         sctp_v6_pf_exit();
         sctp_sysctl_unregister();
@@ -1461,11 +1481,8 @@ err_ehash_alloc:
                    get_order(sctp_assoc_hashsize *
                              sizeof(struct sctp_hashbucket)));
 err_ahash_alloc:
-        sctp_dbg_objcnt_exit();
-        sctp_proc_exit();
-err_init_proc:
-        cleanup_sctp_mibs();
-err_init_mibs:
+        percpu_counter_destroy(&sctp_sockets_allocated);
+err_percpu_counter_init:
         kmem_cache_destroy(sctp_chunk_cachep);
 err_chunk_cachep:
         kmem_cache_destroy(sctp_bucket_cachep);
@@ -1482,18 +1499,13 @@ SCTP_STATIC __exit void sctp_exit(void)
         /* Unregister with inet6/inet layers. */
         sctp_v6_del_protocol();
         sctp_v4_del_protocol();
-        sctp_free_addr_wq();
 
-        /* Free the control endpoint.  */
-        inet_ctl_sock_destroy(sctp_ctl_sock);
+        unregister_pernet_subsys(&sctp_net_ops);
 
         /* Free protosw registrations */
         sctp_v6_protosw_exit();
         sctp_v4_protosw_exit();
 
-        /* Free the local address list.  */
-        sctp_free_local_addr_list();
-
         /* Unregister with socket layer. */
         sctp_v6_pf_exit();
         sctp_v4_pf_exit();
@@ -1508,9 +1520,7 @@ SCTP_STATIC __exit void sctp_exit(void)
                    get_order(sctp_port_hashsize *
                              sizeof(struct sctp_bind_hashbucket)));
 
-        sctp_dbg_objcnt_exit();
-        sctp_proc_exit();
-        cleanup_sctp_mibs();
+        percpu_counter_destroy(&sctp_sockets_allocated);
 
         rcu_barrier(); /* Wait for completion of call_rcu()'s */
 
diff --git a/net/sctp/sm_make_chunk.c b/net/sctp/sm_make_chunk.c
index 479a70ef6ff8..fbe1636309a7 100644
--- a/net/sctp/sm_make_chunk.c
+++ b/net/sctp/sm_make_chunk.c
@@ -198,6 +198,7 @@ struct sctp_chunk *sctp_make_init(const struct sctp_association *asoc,
                              const struct sctp_bind_addr *bp,
                              gfp_t gfp, int vparam_len)
 {
+        struct net *net = sock_net(asoc->base.sk);
         sctp_inithdr_t init;
         union sctp_params addrs;
         size_t chunksize;
@@ -237,7 +238,7 @@ struct sctp_chunk *sctp_make_init(const struct sctp_association *asoc,
         chunksize += WORD_ROUND(SCTP_SAT_LEN(num_types));
         chunksize += sizeof(ecap_param);
 
-        if (sctp_prsctp_enable)
+        if (net->sctp.prsctp_enable)
                 chunksize += sizeof(prsctp_param);
 
         /* ADDIP: Section 4.2.7:
@@ -245,7 +246,7 @@ struct sctp_chunk *sctp_make_init(const struct sctp_association *asoc,
          *  the ASCONF,the ASCONF-ACK, and the AUTH  chunks in its INIT and
          *  INIT-ACK parameters.
          */
-        if (sctp_addip_enable) {
+        if (net->sctp.addip_enable) {
                 extensions[num_ext] = SCTP_CID_ASCONF;
                 extensions[num_ext+1] = SCTP_CID_ASCONF_ACK;
                 num_ext += 2;
@@ -257,7 +258,7 @@ struct sctp_chunk *sctp_make_init(const struct sctp_association *asoc,
         chunksize += vparam_len;
 
         /* Account for AUTH related parameters */
-        if (sctp_auth_enable) {
+        if (net->sctp.auth_enable) {
                 /* Add random parameter length*/
                 chunksize += sizeof(asoc->c.auth_random);
 
@@ -331,7 +332,7 @@ struct sctp_chunk *sctp_make_init(const struct sctp_association *asoc,
                 sctp_addto_param(retval, num_ext, extensions);
         }
 
-        if (sctp_prsctp_enable)
+        if (net->sctp.prsctp_enable)
                 sctp_addto_chunk(retval, sizeof(prsctp_param), &prsctp_param);
 
         if (sp->adaptation_ind) {
@@ -342,7 +343,7 @@ struct sctp_chunk *sctp_make_init(const struct sctp_association *asoc,
         }
 
         /* Add SCTP-AUTH chunks to the parameter list */
-        if (sctp_auth_enable) {
+        if (net->sctp.auth_enable) {
                 sctp_addto_chunk(retval, sizeof(asoc->c.auth_random),
                                  asoc->c.auth_random);
                 if (auth_hmacs)
@@ -1940,7 +1941,7 @@ static int sctp_process_hn_param(const struct sctp_association *asoc,
         return 0;
 }
 
-static int sctp_verify_ext_param(union sctp_params param)
+static int sctp_verify_ext_param(struct net *net, union sctp_params param)
 {
         __u16 num_ext = ntohs(param.p->length) - sizeof(sctp_paramhdr_t);
         int have_auth = 0;
@@ -1964,10 +1965,10 @@ static int sctp_verify_ext_param(union sctp_params param)
          * only if ADD-IP is turned on and we are not backward-compatible
          * mode.
          */
-        if (sctp_addip_noauth)
+        if (net->sctp.addip_noauth)
                 return 1;
 
-        if (sctp_addip_enable && !have_auth && have_asconf)
+        if (net->sctp.addip_enable && !have_auth && have_asconf)
                 return 0;
 
         return 1;
@@ -1976,13 +1977,14 @@ static int sctp_verify_ext_param(union sctp_params param)
 static void sctp_process_ext_param(struct sctp_association *asoc,
                                     union sctp_params param)
 {
+        struct net *net = sock_net(asoc->base.sk);
         __u16 num_ext = ntohs(param.p->length) - sizeof(sctp_paramhdr_t);
         int i;
 
         for (i = 0; i < num_ext; i++) {
                 switch (param.ext->chunks[i]) {
                     case SCTP_CID_FWD_TSN:
-                            if (sctp_prsctp_enable &&
+                            if (net->sctp.prsctp_enable &&
                                 !asoc->peer.prsctp_capable)
                                     asoc->peer.prsctp_capable = 1;
                             break;
@@ -1990,12 +1992,12 @@ static void sctp_process_ext_param(struct sctp_association *asoc,
                             /* if the peer reports AUTH, assume that he
                              * supports AUTH.
                              */
-                            if (sctp_auth_enable)
+                            if (net->sctp.auth_enable)
                                     asoc->peer.auth_capable = 1;
                             break;
                     case SCTP_CID_ASCONF:
                     case SCTP_CID_ASCONF_ACK:
-                            if (sctp_addip_enable)
+                            if (net->sctp.addip_enable)
                                     asoc->peer.asconf_capable = 1;
                             break;
                     default:
@@ -2081,7 +2083,8 @@ static sctp_ierror_t sctp_process_unk_param(const struct sctp_association *asoc,
  *      SCTP_IERROR_ERROR - stop processing, trigger an ERROR
  *      SCTP_IERROR_NO_ERROR - continue with the chunk
  */
-static sctp_ierror_t sctp_verify_param(const struct sctp_association *asoc,
+static sctp_ierror_t sctp_verify_param(struct net *net,
+                                        const struct sctp_association *asoc,
                                         union sctp_params param,
                                         sctp_cid_t cid,
                                         struct sctp_chunk *chunk,
@@ -2110,12 +2113,12 @@ static sctp_ierror_t sctp_verify_param(const struct sctp_association *asoc,
                 break;
 
         case SCTP_PARAM_SUPPORTED_EXT:
-                if (!sctp_verify_ext_param(param))
+                if (!sctp_verify_ext_param(net, param))
                         return SCTP_IERROR_ABORT;
                 break;
 
         case SCTP_PARAM_SET_PRIMARY:
-                if (sctp_addip_enable)
+                if (net->sctp.addip_enable)
                         break;
                 goto fallthrough;
 
@@ -2126,12 +2129,12 @@ static sctp_ierror_t sctp_verify_param(const struct sctp_association *asoc,
                 break;
 
         case SCTP_PARAM_FWD_TSN_SUPPORT:
-                if (sctp_prsctp_enable)
+                if (net->sctp.prsctp_enable)
                         break;
                 goto fallthrough;
 
         case SCTP_PARAM_RANDOM:
-                if (!sctp_auth_enable)
+                if (!net->sctp.auth_enable)
                         goto fallthrough;
 
                 /* SCTP-AUTH: Secion 6.1
@@ -2148,7 +2151,7 @@ static sctp_ierror_t sctp_verify_param(const struct sctp_association *asoc,
                 break;
 
         case SCTP_PARAM_CHUNKS:
-                if (!sctp_auth_enable)
+                if (!net->sctp.auth_enable)
                         goto fallthrough;
 
                 /* SCTP-AUTH: Section 3.2
@@ -2164,7 +2167,7 @@ static sctp_ierror_t sctp_verify_param(const struct sctp_association *asoc,
                 break;
 
         case SCTP_PARAM_HMAC_ALGO:
-                if (!sctp_auth_enable)
+                if (!net->sctp.auth_enable)
                         goto fallthrough;
 
                 hmacs = (struct sctp_hmac_algo_param *)param.p;
@@ -2198,7 +2201,7 @@ fallthrough:
 }
 
 /* Verify the INIT packet before we process it.  */
-int sctp_verify_init(const struct sctp_association *asoc,
+int sctp_verify_init(struct net *net, const struct sctp_association *asoc,
                      sctp_cid_t cid,
                      sctp_init_chunk_t *peer_init,
                      struct sctp_chunk *chunk,
@@ -2245,7 +2248,7 @@ int sctp_verify_init(const struct sctp_association *asoc,
         /* Verify all the variable length parameters */
         sctp_walk_params(param, peer_init, init_hdr.params) {
 
-                result = sctp_verify_param(asoc, param, cid, chunk, errp);
+                result = sctp_verify_param(net, asoc, param, cid, chunk, errp);
                 switch (result) {
                     case SCTP_IERROR_ABORT:
                     case SCTP_IERROR_NOMEM:
@@ -2270,6 +2273,7 @@ int sctp_process_init(struct sctp_association *asoc, struct sctp_chunk *chunk,
                       const union sctp_addr *peer_addr,
                       sctp_init_chunk_t *peer_init, gfp_t gfp)
 {
+        struct net *net = sock_net(asoc->base.sk);
         union sctp_params param;
         struct sctp_transport *transport;
         struct list_head *pos, *temp;
@@ -2326,7 +2330,7 @@ int sctp_process_init(struct sctp_association *asoc, struct sctp_chunk *chunk,
          * also give us an option to silently ignore the packet, which
          * is what we'll do here.
          */
-        if (!sctp_addip_noauth &&
+        if (!net->sctp.addip_noauth &&
              (asoc->peer.asconf_capable && !asoc->peer.auth_capable)) {
                 asoc->peer.addip_disabled_mask |= (SCTP_PARAM_ADD_IP |
                                                   SCTP_PARAM_DEL_IP |
@@ -2466,6 +2470,7 @@ static int sctp_process_param(struct sctp_association *asoc,
                               const union sctp_addr *peer_addr,
                               gfp_t gfp)
 {
+        struct net *net = sock_net(asoc->base.sk);
         union sctp_addr addr;
         int i;
         __u16 sat;
@@ -2494,13 +2499,13 @@ do_addr_param:
                 af = sctp_get_af_specific(param_type2af(param.p->type));
                 af->from_addr_param(&addr, param.addr, htons(asoc->peer.port), 0);
                 scope = sctp_scope(peer_addr);
-                if (sctp_in_scope(&addr, scope))
+                if (sctp_in_scope(net, &addr, scope))
                         if (!sctp_assoc_add_peer(asoc, &addr, gfp, SCTP_UNCONFIRMED))
                                 return 0;
                 break;
 
         case SCTP_PARAM_COOKIE_PRESERVATIVE:
-                if (!sctp_cookie_preserve_enable)
+                if (!net->sctp.cookie_preserve_enable)
                         break;
 
                 stale = ntohl(param.life->lifespan_increment);
@@ -2580,7 +2585,7 @@ do_addr_param:
                 break;
 
         case SCTP_PARAM_SET_PRIMARY:
-                if (!sctp_addip_enable)
+                if (!net->sctp.addip_enable)
                         goto fall_through;
 
                 addr_param = param.v + sizeof(sctp_addip_param_t);
@@ -2607,7 +2612,7 @@ do_addr_param:
                 break;
 
         case SCTP_PARAM_FWD_TSN_SUPPORT:
-                if (sctp_prsctp_enable) {
+                if (net->sctp.prsctp_enable) {
                         asoc->peer.prsctp_capable = 1;
                         break;
                 }
@@ -2615,7 +2620,7 @@ do_addr_param:
                 goto fall_through;
 
         case SCTP_PARAM_RANDOM:
-                if (!sctp_auth_enable)
+                if (!net->sctp.auth_enable)
                         goto fall_through;
 
                 /* Save peer's random parameter */
@@ -2628,7 +2633,7 @@ do_addr_param:
                 break;
 
         case SCTP_PARAM_HMAC_ALGO:
-                if (!sctp_auth_enable)
+                if (!net->sctp.auth_enable)
                         goto fall_through;
 
                 /* Save peer's HMAC list */
@@ -2644,7 +2649,7 @@ do_addr_param:
                 break;
 
         case SCTP_PARAM_CHUNKS:
-                if (!sctp_auth_enable)
+                if (!net->sctp.auth_enable)
                         goto fall_through;
 
                 asoc->peer.peer_chunks = kmemdup(param.p,
diff --git a/net/sctp/sm_sideeffect.c b/net/sctp/sm_sideeffect.c
index fe99628e1257..bcfebb91559d 100644
--- a/net/sctp/sm_sideeffect.c
+++ b/net/sctp/sm_sideeffect.c
@@ -251,6 +251,7 @@ void sctp_generate_t3_rtx_event(unsigned long peer)
         int error;
         struct sctp_transport *transport = (struct sctp_transport *) peer;
         struct sctp_association *asoc = transport->asoc;
+        struct net *net = sock_net(asoc->base.sk);
 
         /* Check whether a task is in the sock.  */
 
@@ -271,7 +272,7 @@ void sctp_generate_t3_rtx_event(unsigned long peer)
                 goto out_unlock;
 
         /* Run through the state machine.  */
-        error = sctp_do_sm(SCTP_EVENT_T_TIMEOUT,
+        error = sctp_do_sm(net, SCTP_EVENT_T_TIMEOUT,
                            SCTP_ST_TIMEOUT(SCTP_EVENT_TIMEOUT_T3_RTX),
                            asoc->state,
                            asoc->ep, asoc,
@@ -291,6 +292,7 @@ out_unlock:
 static void sctp_generate_timeout_event(struct sctp_association *asoc,
                                         sctp_event_timeout_t timeout_type)
 {
+        struct net *net = sock_net(asoc->base.sk);
         int error = 0;
 
         sctp_bh_lock_sock(asoc->base.sk);
@@ -312,7 +314,7 @@ static void sctp_generate_timeout_event(struct sctp_association *asoc,
                 goto out_unlock;
 
         /* Run through the state machine.  */
-        error = sctp_do_sm(SCTP_EVENT_T_TIMEOUT,
+        error = sctp_do_sm(net, SCTP_EVENT_T_TIMEOUT,
                            SCTP_ST_TIMEOUT(timeout_type),
                            asoc->state, asoc->ep, asoc,
                            (void *)timeout_type, GFP_ATOMIC);
@@ -371,6 +373,7 @@ void sctp_generate_heartbeat_event(unsigned long data)
         int error = 0;
         struct sctp_transport *transport = (struct sctp_transport *) data;
         struct sctp_association *asoc = transport->asoc;
+        struct net *net = sock_net(asoc->base.sk);
 
         sctp_bh_lock_sock(asoc->base.sk);
         if (sock_owned_by_user(asoc->base.sk)) {
@@ -388,7 +391,7 @@ void sctp_generate_heartbeat_event(unsigned long data)
         if (transport->dead)
                 goto out_unlock;
 
-        error = sctp_do_sm(SCTP_EVENT_T_TIMEOUT,
+        error = sctp_do_sm(net, SCTP_EVENT_T_TIMEOUT,
                            SCTP_ST_TIMEOUT(SCTP_EVENT_TIMEOUT_HEARTBEAT),
                            asoc->state, asoc->ep, asoc,
                            transport, GFP_ATOMIC);
@@ -408,6 +411,7 @@ void sctp_generate_proto_unreach_event(unsigned long data)
 {
         struct sctp_transport *transport = (struct sctp_transport *) data;
         struct sctp_association *asoc = transport->asoc;
+        struct net *net = sock_net(asoc->base.sk);
         
         sctp_bh_lock_sock(asoc->base.sk);
         if (sock_owned_by_user(asoc->base.sk)) {
@@ -426,7 +430,7 @@ void sctp_generate_proto_unreach_event(unsigned long data)
         if (asoc->base.dead)
                 goto out_unlock;
 
-        sctp_do_sm(SCTP_EVENT_T_OTHER,
+        sctp_do_sm(net, SCTP_EVENT_T_OTHER,
                    SCTP_ST_OTHER(SCTP_EVENT_ICMP_PROTO_UNREACH),
                    asoc->state, asoc->ep, asoc, transport, GFP_ATOMIC);
 
@@ -753,8 +757,10 @@ static int sctp_cmd_process_sack(sctp_cmd_seq_t *cmds,
         int err = 0;
 
         if (sctp_outq_sack(&asoc->outqueue, sackh)) {
+                struct net *net = sock_net(asoc->base.sk);
+
                 /* There are no more TSNs awaiting SACK.  */
-                err = sctp_do_sm(SCTP_EVENT_T_OTHER,
+                err = sctp_do_sm(net, SCTP_EVENT_T_OTHER,
                                  SCTP_ST_OTHER(SCTP_EVENT_NO_PENDING_TSN),
                                  asoc->state, asoc->ep, asoc, NULL,
                                  GFP_ATOMIC);
@@ -1042,6 +1048,8 @@ static int sctp_cmd_send_msg(struct sctp_association *asoc,
  */
 static void sctp_cmd_send_asconf(struct sctp_association *asoc)
 {
+        struct net *net = sock_net(asoc->base.sk);
+
         /* Send the next asconf chunk from the addip chunk
          * queue.
          */
@@ -1053,7 +1061,7 @@ static void sctp_cmd_send_asconf(struct sctp_association *asoc)
 
                 /* Hold the chunk until an ASCONF_ACK is received. */
                 sctp_chunk_hold(asconf);
-                if (sctp_primitive_ASCONF(asoc, asconf))
+                if (sctp_primitive_ASCONF(net, asoc, asconf))
                         sctp_chunk_free(asconf);
                 else
                         asoc->addip_last_asconf = asconf;
@@ -1089,7 +1097,7 @@ static void sctp_cmd_send_asconf(struct sctp_association *asoc)
  * If you want to understand all of lksctp, this is a
  * good place to start.
  */
-int sctp_do_sm(sctp_event_t event_type, sctp_subtype_t subtype,
+int sctp_do_sm(struct net *net, sctp_event_t event_type, sctp_subtype_t subtype,
                sctp_state_t state,
                struct sctp_endpoint *ep,
                struct sctp_association *asoc,
@@ -1110,12 +1118,12 @@ int sctp_do_sm(sctp_event_t event_type, sctp_subtype_t subtype,
         /* Look up the state function, run it, and then process the
          * side effects.  These three steps are the heart of lksctp.
          */
-        state_fn = sctp_sm_lookup_event(event_type, state, subtype);
+        state_fn = sctp_sm_lookup_event(net, event_type, state, subtype);
 
         sctp_init_cmd_seq(&commands);
 
         DEBUG_PRE;
-        status = (*state_fn->fn)(ep, asoc, subtype, event_arg, &commands);
+        status = (*state_fn->fn)(net, ep, asoc, subtype, event_arg, &commands);
         DEBUG_POST;
 
         error = sctp_side_effects(event_type, subtype, state,
diff --git a/net/sctp/sm_statefuns.c b/net/sctp/sm_statefuns.c
index 9fca10357350..094813b6c3c3 100644
--- a/net/sctp/sm_statefuns.c
+++ b/net/sctp/sm_statefuns.c
@@ -66,7 +66,8 @@
 #include <net/sctp/sm.h>
 #include <net/sctp/structs.h>
 
-static struct sctp_packet *sctp_abort_pkt_new(const struct sctp_endpoint *ep,
+static struct sctp_packet *sctp_abort_pkt_new(struct net *net,
+                                  const struct sctp_endpoint *ep,
                                   const struct sctp_association *asoc,
                                   struct sctp_chunk *chunk,
                                   const void *payload,
@@ -74,36 +75,43 @@ static struct sctp_packet *sctp_abort_pkt_new(const struct sctp_endpoint *ep,
 static int sctp_eat_data(const struct sctp_association *asoc,
                          struct sctp_chunk *chunk,
                          sctp_cmd_seq_t *commands);
-static struct sctp_packet *sctp_ootb_pkt_new(const struct sctp_association *asoc,
+static struct sctp_packet *sctp_ootb_pkt_new(struct net *net,
+                                             const struct sctp_association *asoc,
                                              const struct sctp_chunk *chunk);
-static void sctp_send_stale_cookie_err(const struct sctp_endpoint *ep,
+static void sctp_send_stale_cookie_err(struct net *net,
+                                       const struct sctp_endpoint *ep,
                                        const struct sctp_association *asoc,
                                        const struct sctp_chunk *chunk,
                                        sctp_cmd_seq_t *commands,
                                        struct sctp_chunk *err_chunk);
-static sctp_disposition_t sctp_sf_do_5_2_6_stale(const struct sctp_endpoint *ep,
+static sctp_disposition_t sctp_sf_do_5_2_6_stale(struct net *net,
+                                                 const struct sctp_endpoint *ep,
                                                  const struct sctp_association *asoc,
                                                  const sctp_subtype_t type,
                                                  void *arg,
                                                  sctp_cmd_seq_t *commands);
-static sctp_disposition_t sctp_sf_shut_8_4_5(const struct sctp_endpoint *ep,
+static sctp_disposition_t sctp_sf_shut_8_4_5(struct net *net,
+                                             const struct sctp_endpoint *ep,
                                              const struct sctp_association *asoc,
                                              const sctp_subtype_t type,
                                              void *arg,
                                              sctp_cmd_seq_t *commands);
-static sctp_disposition_t sctp_sf_tabort_8_4_8(const struct sctp_endpoint *ep,
+static sctp_disposition_t sctp_sf_tabort_8_4_8(struct net *net,
+                                        const struct sctp_endpoint *ep,
                                         const struct sctp_association *asoc,
                                         const sctp_subtype_t type,
                                         void *arg,
                                         sctp_cmd_seq_t *commands);
 static struct sctp_sackhdr *sctp_sm_pull_sack(struct sctp_chunk *chunk);
 
-static sctp_disposition_t sctp_stop_t1_and_abort(sctp_cmd_seq_t *commands,
+static sctp_disposition_t sctp_stop_t1_and_abort(struct net *net,
+                                           sctp_cmd_seq_t *commands,
                                            __be16 error, int sk_err,
                                            const struct sctp_association *asoc,
                                            struct sctp_transport *transport);
 
 static sctp_disposition_t sctp_sf_abort_violation(
+                                     struct net *net,
                                      const struct sctp_endpoint *ep,
                                      const struct sctp_association *asoc,
                                      void *arg,
@@ -112,6 +120,7 @@ static sctp_disposition_t sctp_sf_abort_violation(
                                      const size_t paylen);
 
 static sctp_disposition_t sctp_sf_violation_chunklen(
+                                     struct net *net,
                                      const struct sctp_endpoint *ep,
                                      const struct sctp_association *asoc,
                                      const sctp_subtype_t type,
@@ -119,6 +128,7 @@ static sctp_disposition_t sctp_sf_violation_chunklen(
                                      sctp_cmd_seq_t *commands);
 
 static sctp_disposition_t sctp_sf_violation_paramlen(
+                                     struct net *net,
                                      const struct sctp_endpoint *ep,
                                      const struct sctp_association *asoc,
                                      const sctp_subtype_t type,
@@ -126,6 +136,7 @@ static sctp_disposition_t sctp_sf_violation_paramlen(
                                      sctp_cmd_seq_t *commands);
 
 static sctp_disposition_t sctp_sf_violation_ctsn(
+                                     struct net *net,
                                      const struct sctp_endpoint *ep,
                                      const struct sctp_association *asoc,
                                      const sctp_subtype_t type,
@@ -133,18 +144,21 @@ static sctp_disposition_t sctp_sf_violation_ctsn(
                                      sctp_cmd_seq_t *commands);
 
 static sctp_disposition_t sctp_sf_violation_chunk(
+                                     struct net *net,
                                      const struct sctp_endpoint *ep,
                                      const struct sctp_association *asoc,
                                      const sctp_subtype_t type,
                                      void *arg,
                                      sctp_cmd_seq_t *commands);
 
-static sctp_ierror_t sctp_sf_authenticate(const struct sctp_endpoint *ep,
+static sctp_ierror_t sctp_sf_authenticate(struct net *net,
+                                    const struct sctp_endpoint *ep,
                                     const struct sctp_association *asoc,
                                     const sctp_subtype_t type,
                                     struct sctp_chunk *chunk);
 
-static sctp_disposition_t __sctp_sf_do_9_1_abort(const struct sctp_endpoint *ep,
+static sctp_disposition_t __sctp_sf_do_9_1_abort(struct net *net,
+                                        const struct sctp_endpoint *ep,
                                         const struct sctp_association *asoc,
                                         const sctp_subtype_t type,
                                         void *arg,
@@ -204,7 +218,8 @@ sctp_chunk_length_valid(struct sctp_chunk *chunk,
  *
  * The return value is the disposition of the chunk.
  */
-sctp_disposition_t sctp_sf_do_4_C(const struct sctp_endpoint *ep,
+sctp_disposition_t sctp_sf_do_4_C(struct net *net,
+                                  const struct sctp_endpoint *ep,
                                   const struct sctp_association *asoc,
                                   const sctp_subtype_t type,
                                   void *arg,
@@ -214,7 +229,7 @@ sctp_disposition_t sctp_sf_do_4_C(const struct sctp_endpoint *ep,
         struct sctp_ulpevent *ev;
 
         if (!sctp_vtag_verify_either(chunk, asoc))
-                return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
+                return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
 
         /* RFC 2960 6.10 Bundling
          *
@@ -222,11 +237,11 @@ sctp_disposition_t sctp_sf_do_4_C(const struct sctp_endpoint *ep,
          * SHUTDOWN COMPLETE with any other chunks.
          */
         if (!chunk->singleton)
-                return sctp_sf_violation_chunk(ep, asoc, type, arg, commands);
+                return sctp_sf_violation_chunk(net, ep, asoc, type, arg, commands);
 
         /* Make sure that the SHUTDOWN_COMPLETE chunk has a valid length. */
         if (!sctp_chunk_length_valid(chunk, sizeof(sctp_chunkhdr_t)))
-                return sctp_sf_violation_chunklen(ep, asoc, type, arg,
+                return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
                                                   commands);
 
         /* RFC 2960 10.2 SCTP-to-ULP
@@ -259,8 +274,8 @@ sctp_disposition_t sctp_sf_do_4_C(const struct sctp_endpoint *ep,
         sctp_add_cmd_sf(commands, SCTP_CMD_NEW_STATE,
                         SCTP_STATE(SCTP_STATE_CLOSED));
 
-        SCTP_INC_STATS(SCTP_MIB_SHUTDOWNS);
-        SCTP_DEC_STATS(SCTP_MIB_CURRESTAB);
+        SCTP_INC_STATS(net, SCTP_MIB_SHUTDOWNS);
+        SCTP_DEC_STATS(net, SCTP_MIB_CURRESTAB);
 
         sctp_add_cmd_sf(commands, SCTP_CMD_DELETE_TCB, SCTP_NULL());
 
@@ -289,7 +304,8 @@ sctp_disposition_t sctp_sf_do_4_C(const struct sctp_endpoint *ep,
  *
  * The return value is the disposition of the chunk.
  */
-sctp_disposition_t sctp_sf_do_5_1B_init(const struct sctp_endpoint *ep,
+sctp_disposition_t sctp_sf_do_5_1B_init(struct net *net,
+                                        const struct sctp_endpoint *ep,
                                         const struct sctp_association *asoc,
                                         const sctp_subtype_t type,
                                         void *arg,
@@ -313,21 +329,21 @@ sctp_disposition_t sctp_sf_do_5_1B_init(const struct sctp_endpoint *ep,
          * with an INIT chunk that is bundled with other chunks.
          */
         if (!chunk->singleton)
-                return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
+                return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
 
         /* If the packet is an OOTB packet which is temporarily on the
          * control endpoint, respond with an ABORT.
          */
-        if (ep == sctp_sk((sctp_get_ctl_sock()))->ep) {
-                SCTP_INC_STATS(SCTP_MIB_OUTOFBLUES);
-                return sctp_sf_tabort_8_4_8(ep, asoc, type, arg, commands);
+        if (ep == sctp_sk(net->sctp.ctl_sock)->ep) {
+                SCTP_INC_STATS(net, SCTP_MIB_OUTOFBLUES);
+                return sctp_sf_tabort_8_4_8(net, ep, asoc, type, arg, commands);
         }
 
         /* 3.1 A packet containing an INIT chunk MUST have a zero Verification
          * Tag.
          */
         if (chunk->sctp_hdr->vtag != 0)
-                return sctp_sf_tabort_8_4_8(ep, asoc, type, arg, commands);
+                return sctp_sf_tabort_8_4_8(net, ep, asoc, type, arg, commands);
 
         /* Make sure that the INIT chunk has a valid length.
          * Normally, this would cause an ABORT with a Protocol Violation
@@ -335,7 +351,7 @@ sctp_disposition_t sctp_sf_do_5_1B_init(const struct sctp_endpoint *ep,
          * just discard the packet.
          */
         if (!sctp_chunk_length_valid(chunk, sizeof(sctp_init_chunk_t)))
-                return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
+                return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
 
         /* If the INIT is coming toward a closing socket, we'll send back
          * and ABORT.  Essentially, this catches the race of INIT being
@@ -344,18 +360,18 @@ sctp_disposition_t sctp_sf_do_5_1B_init(const struct sctp_endpoint *ep,
          * can treat this OOTB
          */
         if (sctp_sstate(ep->base.sk, CLOSING))
-                return sctp_sf_tabort_8_4_8(ep, asoc, type, arg, commands);
+                return sctp_sf_tabort_8_4_8(net, ep, asoc, type, arg, commands);
 
         /* Verify the INIT chunk before processing it. */
         err_chunk = NULL;
-        if (!sctp_verify_init(asoc, chunk->chunk_hdr->type,
+        if (!sctp_verify_init(net, asoc, chunk->chunk_hdr->type,
                               (sctp_init_chunk_t *)chunk->chunk_hdr, chunk,
                               &err_chunk)) {
                 /* This chunk contains fatal error. It is to be discarded.
                  * Send an ABORT, with causes if there is any.
                  */
                 if (err_chunk) {
-                        packet = sctp_abort_pkt_new(ep, asoc, arg,
+                        packet = sctp_abort_pkt_new(net, ep, asoc, arg,
                                         (__u8 *)(err_chunk->chunk_hdr) +
                                         sizeof(sctp_chunkhdr_t),
                                         ntohs(err_chunk->chunk_hdr->length) -
@@ -366,13 +382,13 @@ sctp_disposition_t sctp_sf_do_5_1B_init(const struct sctp_endpoint *ep,
                         if (packet) {
                                 sctp_add_cmd_sf(commands, SCTP_CMD_SEND_PKT,
                                                 SCTP_PACKET(packet));
-                                SCTP_INC_STATS(SCTP_MIB_OUTCTRLCHUNKS);
+                                SCTP_INC_STATS(net, SCTP_MIB_OUTCTRLCHUNKS);
                                 return SCTP_DISPOSITION_CONSUME;
                         } else {
                                 return SCTP_DISPOSITION_NOMEM;
                         }
                 } else {
-                        return sctp_sf_tabort_8_4_8(ep, asoc, type, arg,
+                        return sctp_sf_tabort_8_4_8(net, ep, asoc, type, arg,
                                                     commands);
                 }
         }
@@ -484,7 +500,8 @@ nomem:
  *
  * The return value is the disposition of the chunk.
  */
-sctp_disposition_t sctp_sf_do_5_1C_ack(const struct sctp_endpoint *ep,
+sctp_disposition_t sctp_sf_do_5_1C_ack(struct net *net,
+                                       const struct sctp_endpoint *ep,
                                        const struct sctp_association *asoc,
                                        const sctp_subtype_t type,
                                        void *arg,
@@ -496,25 +513,25 @@ sctp_disposition_t sctp_sf_do_5_1C_ack(const struct sctp_endpoint *ep,
         struct sctp_packet *packet;
 
         if (!sctp_vtag_verify(chunk, asoc))
-                return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
+                return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
 
         /* 6.10 Bundling
          * An endpoint MUST NOT bundle INIT, INIT ACK or
          * SHUTDOWN COMPLETE with any other chunks.
          */
         if (!chunk->singleton)
-                return sctp_sf_violation_chunk(ep, asoc, type, arg, commands);
+                return sctp_sf_violation_chunk(net, ep, asoc, type, arg, commands);
 
         /* Make sure that the INIT-ACK chunk has a valid length */
         if (!sctp_chunk_length_valid(chunk, sizeof(sctp_initack_chunk_t)))
-                return sctp_sf_violation_chunklen(ep, asoc, type, arg,
+                return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
                                                   commands);
         /* Grab the INIT header.  */
         chunk->subh.init_hdr = (sctp_inithdr_t *) chunk->skb->data;
 
         /* Verify the INIT chunk before processing it. */
         err_chunk = NULL;
-        if (!sctp_verify_init(asoc, chunk->chunk_hdr->type,
+        if (!sctp_verify_init(net, asoc, chunk->chunk_hdr->type,
                               (sctp_init_chunk_t *)chunk->chunk_hdr, chunk,
                               &err_chunk)) {
 
@@ -526,7 +543,7 @@ sctp_disposition_t sctp_sf_do_5_1C_ack(const struct sctp_endpoint *ep,
                  * the association.
                  */
                 if (err_chunk) {
-                        packet = sctp_abort_pkt_new(ep, asoc, arg,
+                        packet = sctp_abort_pkt_new(net, ep, asoc, arg,
                                         (__u8 *)(err_chunk->chunk_hdr) +
                                         sizeof(sctp_chunkhdr_t),
                                         ntohs(err_chunk->chunk_hdr->length) -
@@ -537,7 +554,7 @@ sctp_disposition_t sctp_sf_do_5_1C_ack(const struct sctp_endpoint *ep,
                         if (packet) {
                                 sctp_add_cmd_sf(commands, SCTP_CMD_SEND_PKT,
                                                 SCTP_PACKET(packet));
-                                SCTP_INC_STATS(SCTP_MIB_OUTCTRLCHUNKS);
+                                SCTP_INC_STATS(net, SCTP_MIB_OUTCTRLCHUNKS);
                                 error = SCTP_ERROR_INV_PARAM;
                         }
                 }
@@ -554,10 +571,10 @@ sctp_disposition_t sctp_sf_do_5_1C_ack(const struct sctp_endpoint *ep,
                  * was malformed.
                  */
                 if (sctp_auth_recv_cid(SCTP_CID_ABORT, asoc))
-                        return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
+                        return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
 
-                SCTP_INC_STATS(SCTP_MIB_ABORTEDS);
-                return sctp_stop_t1_and_abort(commands, error, ECONNREFUSED,
+                SCTP_INC_STATS(net, SCTP_MIB_ABORTEDS);
+                return sctp_stop_t1_and_abort(net, commands, error, ECONNREFUSED,
                                                 asoc, chunk->transport);
         }
 
@@ -633,7 +650,8 @@ sctp_disposition_t sctp_sf_do_5_1C_ack(const struct sctp_endpoint *ep,
  *
  * The return value is the disposition of the chunk.
  */
-sctp_disposition_t sctp_sf_do_5_1D_ce(const struct sctp_endpoint *ep,
+sctp_disposition_t sctp_sf_do_5_1D_ce(struct net *net,
+                                      const struct sctp_endpoint *ep,
                                       const struct sctp_association *asoc,
                                       const sctp_subtype_t type, void *arg,
                                       sctp_cmd_seq_t *commands)
@@ -650,9 +668,9 @@ sctp_disposition_t sctp_sf_do_5_1D_ce(const struct sctp_endpoint *ep,
         /* If the packet is an OOTB packet which is temporarily on the
          * control endpoint, respond with an ABORT.
          */
-        if (ep == sctp_sk((sctp_get_ctl_sock()))->ep) {
-                SCTP_INC_STATS(SCTP_MIB_OUTOFBLUES);
-                return sctp_sf_tabort_8_4_8(ep, asoc, type, arg, commands);
+        if (ep == sctp_sk(net->sctp.ctl_sock)->ep) {
+                SCTP_INC_STATS(net, SCTP_MIB_OUTOFBLUES);
+                return sctp_sf_tabort_8_4_8(net, ep, asoc, type, arg, commands);
         }
 
         /* Make sure that the COOKIE_ECHO chunk has a valid length.
@@ -661,7 +679,7 @@ sctp_disposition_t sctp_sf_do_5_1D_ce(const struct sctp_endpoint *ep,
          * in sctp_unpack_cookie().
          */
         if (!sctp_chunk_length_valid(chunk, sizeof(sctp_chunkhdr_t)))
-                return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
+                return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
 
         /* If the endpoint is not listening or if the number of associations
          * on the TCP-style socket exceed the max backlog, respond with an
@@ -670,7 +688,7 @@ sctp_disposition_t sctp_sf_do_5_1D_ce(const struct sctp_endpoint *ep,
         sk = ep->base.sk;
         if (!sctp_sstate(sk, LISTENING) ||
             (sctp_style(sk, TCP) && sk_acceptq_is_full(sk)))
-                return sctp_sf_tabort_8_4_8(ep, asoc, type, arg, commands);
+                return sctp_sf_tabort_8_4_8(net, ep, asoc, type, arg, commands);
 
         /* "Decode" the chunk.  We have no optional parameters so we
          * are in good shape.
@@ -703,13 +721,13 @@ sctp_disposition_t sctp_sf_do_5_1D_ce(const struct sctp_endpoint *ep,
                         goto nomem;
 
                 case -SCTP_IERROR_STALE_COOKIE:
-                        sctp_send_stale_cookie_err(ep, asoc, chunk, commands,
+                        sctp_send_stale_cookie_err(net, ep, asoc, chunk, commands,
                                                    err_chk_p);
-                        return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
+                        return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
 
                 case -SCTP_IERROR_BAD_SIG:
                 default:
-                        return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
+                        return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
                 }
         }
 
@@ -756,14 +774,14 @@ sctp_disposition_t sctp_sf_do_5_1D_ce(const struct sctp_endpoint *ep,
                 skb_pull(chunk->auth_chunk, sizeof(sctp_chunkhdr_t));
                 auth.transport = chunk->transport;
 
-                ret = sctp_sf_authenticate(ep, new_asoc, type, &auth);
+                ret = sctp_sf_authenticate(net, ep, new_asoc, type, &auth);
 
                 /* We can now safely free the auth_chunk clone */
                 kfree_skb(chunk->auth_chunk);
 
                 if (ret != SCTP_IERROR_NO_ERROR) {
                         sctp_association_free(new_asoc);
-                        return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
+                        return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
                 }
         }
 
@@ -804,8 +822,8 @@ sctp_disposition_t sctp_sf_do_5_1D_ce(const struct sctp_endpoint *ep,
         sctp_add_cmd_sf(commands, SCTP_CMD_NEW_ASOC, SCTP_ASOC(new_asoc));
         sctp_add_cmd_sf(commands, SCTP_CMD_NEW_STATE,
                         SCTP_STATE(SCTP_STATE_ESTABLISHED));
-        SCTP_INC_STATS(SCTP_MIB_CURRESTAB);
-        SCTP_INC_STATS(SCTP_MIB_PASSIVEESTABS);
+        SCTP_INC_STATS(net, SCTP_MIB_CURRESTAB);
+        SCTP_INC_STATS(net, SCTP_MIB_PASSIVEESTABS);
         sctp_add_cmd_sf(commands, SCTP_CMD_HB_TIMERS_START, SCTP_NULL());
 
         if (new_asoc->autoclose)
@@ -856,7 +874,8 @@ nomem:
  *
  * The return value is the disposition of the chunk.
  */
-sctp_disposition_t sctp_sf_do_5_1E_ca(const struct sctp_endpoint *ep,
+sctp_disposition_t sctp_sf_do_5_1E_ca(struct net *net,
+                                      const struct sctp_endpoint *ep,
                                       const struct sctp_association *asoc,
                                       const sctp_subtype_t type, void *arg,
                                       sctp_cmd_seq_t *commands)
@@ -865,13 +884,13 @@ sctp_disposition_t sctp_sf_do_5_1E_ca(const struct sctp_endpoint *ep,
         struct sctp_ulpevent *ev;
 
         if (!sctp_vtag_verify(chunk, asoc))
-                return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
+                return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
 
         /* Verify that the chunk length for the COOKIE-ACK is OK.
          * If we don't do this, any bundled chunks may be junked.
          */
         if (!sctp_chunk_length_valid(chunk, sizeof(sctp_chunkhdr_t)))
-                return sctp_sf_violation_chunklen(ep, asoc, type, arg,
+                return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
                                                   commands);
 
         /* Reset init error count upon receipt of COOKIE-ACK,
@@ -892,8 +911,8 @@ sctp_disposition_t sctp_sf_do_5_1E_ca(const struct sctp_endpoint *ep,
                         SCTP_TO(SCTP_EVENT_TIMEOUT_T1_COOKIE));
         sctp_add_cmd_sf(commands, SCTP_CMD_NEW_STATE,
                         SCTP_STATE(SCTP_STATE_ESTABLISHED));
-        SCTP_INC_STATS(SCTP_MIB_CURRESTAB);
-        SCTP_INC_STATS(SCTP_MIB_ACTIVEESTABS);
+        SCTP_INC_STATS(net, SCTP_MIB_CURRESTAB);
+        SCTP_INC_STATS(net, SCTP_MIB_ACTIVEESTABS);
         sctp_add_cmd_sf(commands, SCTP_CMD_HB_TIMERS_START, SCTP_NULL());
         if (asoc->autoclose)
                 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_START,
@@ -958,7 +977,8 @@ static sctp_disposition_t sctp_sf_heartbeat(const struct sctp_endpoint *ep,
 }
 
 /* Generate a HEARTBEAT packet on the given transport.  */
-sctp_disposition_t sctp_sf_sendbeat_8_3(const struct sctp_endpoint *ep,
+sctp_disposition_t sctp_sf_sendbeat_8_3(struct net *net,
+                                        const struct sctp_endpoint *ep,
                                         const struct sctp_association *asoc,
                                         const sctp_subtype_t type,
                                         void *arg,
@@ -972,8 +992,8 @@ sctp_disposition_t sctp_sf_sendbeat_8_3(const struct sctp_endpoint *ep,
                 /* CMD_ASSOC_FAILED calls CMD_DELETE_TCB. */
                 sctp_add_cmd_sf(commands, SCTP_CMD_ASSOC_FAILED,
                                 SCTP_PERR(SCTP_ERROR_NO_ERROR));
-                SCTP_INC_STATS(SCTP_MIB_ABORTEDS);
-                SCTP_DEC_STATS(SCTP_MIB_CURRESTAB);
+                SCTP_INC_STATS(net, SCTP_MIB_ABORTEDS);
+                SCTP_DEC_STATS(net, SCTP_MIB_CURRESTAB);
                 return SCTP_DISPOSITION_DELETE_TCB;
         }
 
@@ -1028,7 +1048,8 @@ sctp_disposition_t sctp_sf_sendbeat_8_3(const struct sctp_endpoint *ep,
  *
  * The return value is the disposition of the chunk.
  */
-sctp_disposition_t sctp_sf_beat_8_3(const struct sctp_endpoint *ep,
+sctp_disposition_t sctp_sf_beat_8_3(struct net *net,
+                                    const struct sctp_endpoint *ep,
                                     const struct sctp_association *asoc,
                                     const sctp_subtype_t type,
                                     void *arg,
@@ -1039,11 +1060,11 @@ sctp_disposition_t sctp_sf_beat_8_3(const struct sctp_endpoint *ep,
         size_t paylen = 0;
 
         if (!sctp_vtag_verify(chunk, asoc))
-                return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
+                return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
 
         /* Make sure that the HEARTBEAT chunk has a valid length. */
         if (!sctp_chunk_length_valid(chunk, sizeof(sctp_heartbeat_chunk_t)))
-                return sctp_sf_violation_chunklen(ep, asoc, type, arg,
+                return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
                                                   commands);
 
         /* 8.3 The receiver of the HEARTBEAT should immediately
@@ -1095,7 +1116,8 @@ nomem:
  *
  * The return value is the disposition of the chunk.
  */
-sctp_disposition_t sctp_sf_backbeat_8_3(const struct sctp_endpoint *ep,
+sctp_disposition_t sctp_sf_backbeat_8_3(struct net *net,
+                                        const struct sctp_endpoint *ep,
                                         const struct sctp_association *asoc,
                                         const sctp_subtype_t type,
                                         void *arg,
@@ -1108,12 +1130,12 @@ sctp_disposition_t sctp_sf_backbeat_8_3(const struct sctp_endpoint *ep,
         unsigned long max_interval;
 
         if (!sctp_vtag_verify(chunk, asoc))
-                return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
+                return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
 
         /* Make sure that the HEARTBEAT-ACK chunk has a valid length.  */
         if (!sctp_chunk_length_valid(chunk, sizeof(sctp_chunkhdr_t) +
                                             sizeof(sctp_sender_hb_info_t)))
-                return sctp_sf_violation_chunklen(ep, asoc, type, arg,
+                return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
                                                   commands);
 
         hbinfo = (sctp_sender_hb_info_t *) chunk->skb->data;
@@ -1171,7 +1193,7 @@ sctp_disposition_t sctp_sf_backbeat_8_3(const struct sctp_endpoint *ep,
 /* Helper function to send out an abort for the restart
  * condition.
  */
-static int sctp_sf_send_restart_abort(union sctp_addr *ssa,
+static int sctp_sf_send_restart_abort(struct net *net, union sctp_addr *ssa,
                                       struct sctp_chunk *init,
                                       sctp_cmd_seq_t *commands)
 {
@@ -1197,18 +1219,18 @@ static int sctp_sf_send_restart_abort(union sctp_addr *ssa,
         errhdr->length = htons(len);
 
         /* Assign to the control socket. */
-        ep = sctp_sk((sctp_get_ctl_sock()))->ep;
+        ep = sctp_sk(net->sctp.ctl_sock)->ep;
 
         /* Association is NULL since this may be a restart attack and we
          * want to send back the attacker's vtag.
          */
-        pkt = sctp_abort_pkt_new(ep, NULL, init, errhdr, len);
+        pkt = sctp_abort_pkt_new(net, ep, NULL, init, errhdr, len);
 
         if (!pkt)
                 goto out;
         sctp_add_cmd_sf(commands, SCTP_CMD_SEND_PKT, SCTP_PACKET(pkt));
 
-        SCTP_INC_STATS(SCTP_MIB_OUTCTRLCHUNKS);
+        SCTP_INC_STATS(net, SCTP_MIB_OUTCTRLCHUNKS);
 
         /* Discard the rest of the inbound packet. */
         sctp_add_cmd_sf(commands, SCTP_CMD_DISCARD_PACKET, SCTP_NULL());
@@ -1240,6 +1262,7 @@ static int sctp_sf_check_restart_addrs(const struct sctp_association *new_asoc,
                                        struct sctp_chunk *init,
                                        sctp_cmd_seq_t *commands)
 {
+        struct net *net = sock_net(new_asoc->base.sk);
         struct sctp_transport *new_addr;
         int ret = 1;
 
@@ -1258,7 +1281,7 @@ static int sctp_sf_check_restart_addrs(const struct sctp_association *new_asoc,
                             transports) {
                 if (!list_has_sctp_addr(&asoc->peer.transport_addr_list,
                                         &new_addr->ipaddr)) {
-                        sctp_sf_send_restart_abort(&new_addr->ipaddr, init,
+                        sctp_sf_send_restart_abort(net, &new_addr->ipaddr, init,
                                                    commands);
                         ret = 0;
                         break;
@@ -1358,6 +1381,7 @@ static char sctp_tietags_compare(struct sctp_association *new_asoc,
  * chunk handling.
  */
 static sctp_disposition_t sctp_sf_do_unexpected_init(
+        struct net *net,
         const struct sctp_endpoint *ep,
         const struct sctp_association *asoc,
         const sctp_subtype_t type,
@@ -1382,20 +1406,20 @@ static sctp_disposition_t sctp_sf_do_unexpected_init(
          * with an INIT chunk that is bundled with other chunks.
          */
         if (!chunk->singleton)
-                return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
+                return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
 
         /* 3.1 A packet containing an INIT chunk MUST have a zero Verification
          * Tag.
          */
         if (chunk->sctp_hdr->vtag != 0)
-                return sctp_sf_tabort_8_4_8(ep, asoc, type, arg, commands);
+                return sctp_sf_tabort_8_4_8(net, ep, asoc, type, arg, commands);
 
         /* Make sure that the INIT chunk has a valid length.
          * In this case, we generate a protocol violation since we have
          * an association established.
          */
         if (!sctp_chunk_length_valid(chunk, sizeof(sctp_init_chunk_t)))
-                return sctp_sf_violation_chunklen(ep, asoc, type, arg,
+                return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
                                                   commands);
         /* Grab the INIT header.  */
         chunk->subh.init_hdr = (sctp_inithdr_t *) chunk->skb->data;
@@ -1405,14 +1429,14 @@ static sctp_disposition_t sctp_sf_do_unexpected_init(
 
         /* Verify the INIT chunk before processing it. */
         err_chunk = NULL;
-        if (!sctp_verify_init(asoc, chunk->chunk_hdr->type,
+        if (!sctp_verify_init(net, asoc, chunk->chunk_hdr->type,
                               (sctp_init_chunk_t *)chunk->chunk_hdr, chunk,
                               &err_chunk)) {
                 /* This chunk contains fatal error. It is to be discarded.
                  * Send an ABORT, with causes if there is any.
                  */
                 if (err_chunk) {
-                        packet = sctp_abort_pkt_new(ep, asoc, arg,
+                        packet = sctp_abort_pkt_new(net, ep, asoc, arg,
                                         (__u8 *)(err_chunk->chunk_hdr) +
                                         sizeof(sctp_chunkhdr_t),
                                         ntohs(err_chunk->chunk_hdr->length) -
@@ -1421,14 +1445,14 @@ static sctp_disposition_t sctp_sf_do_unexpected_init(
                         if (packet) {
                                 sctp_add_cmd_sf(commands, SCTP_CMD_SEND_PKT,
                                                 SCTP_PACKET(packet));
-                                SCTP_INC_STATS(SCTP_MIB_OUTCTRLCHUNKS);
+                                SCTP_INC_STATS(net, SCTP_MIB_OUTCTRLCHUNKS);
                                 retval = SCTP_DISPOSITION_CONSUME;
                         } else {
                                 retval = SCTP_DISPOSITION_NOMEM;
                         }
                         goto cleanup;
                 } else {
-                        return sctp_sf_tabort_8_4_8(ep, asoc, type, arg,
+                        return sctp_sf_tabort_8_4_8(net, ep, asoc, type, arg,
                                                     commands);
                 }
         }
@@ -1570,7 +1594,8 @@ cleanup:
  *
  * The return value is the disposition of the chunk.
  */
-sctp_disposition_t sctp_sf_do_5_2_1_siminit(const struct sctp_endpoint *ep,
+sctp_disposition_t sctp_sf_do_5_2_1_siminit(struct net *net,
+                                    const struct sctp_endpoint *ep,
                                     const struct sctp_association *asoc,
                                     const sctp_subtype_t type,
                                     void *arg,
@@ -1579,7 +1604,7 @@ sctp_disposition_t sctp_sf_do_5_2_1_siminit(const struct sctp_endpoint *ep,
         /* Call helper to do the real work for both simulataneous and
          * duplicate INIT chunk handling.
          */
-        return sctp_sf_do_unexpected_init(ep, asoc, type, arg, commands);
+        return sctp_sf_do_unexpected_init(net, ep, asoc, type, arg, commands);
 }
 
 /*
@@ -1623,7 +1648,8 @@ sctp_disposition_t sctp_sf_do_5_2_1_siminit(const struct sctp_endpoint *ep,
  *
  * The return value is the disposition of the chunk.
  */
-sctp_disposition_t sctp_sf_do_5_2_2_dupinit(const struct sctp_endpoint *ep,
+sctp_disposition_t sctp_sf_do_5_2_2_dupinit(struct net *net,
+                                        const struct sctp_endpoint *ep,
                                         const struct sctp_association *asoc,
                                         const sctp_subtype_t type,
                                         void *arg,
@@ -1632,7 +1658,7 @@ sctp_disposition_t sctp_sf_do_5_2_2_dupinit(const struct sctp_endpoint *ep,
         /* Call helper to do the real work for both simulataneous and
          * duplicate INIT chunk handling.
          */
-        return sctp_sf_do_unexpected_init(ep, asoc, type, arg, commands);
+        return sctp_sf_do_unexpected_init(net, ep, asoc, type, arg, commands);
 }
 
 
@@ -1645,7 +1671,8 @@ sctp_disposition_t sctp_sf_do_5_2_2_dupinit(const struct sctp_endpoint *ep,
  * An unexpected INIT ACK usually indicates the processing of an old or
  * duplicated INIT chunk.
 */
-sctp_disposition_t sctp_sf_do_5_2_3_initack(const struct sctp_endpoint *ep,
+sctp_disposition_t sctp_sf_do_5_2_3_initack(struct net *net,
+                                            const struct sctp_endpoint *ep,
                                             const struct sctp_association *asoc,
                                             const sctp_subtype_t type,
                                             void *arg, sctp_cmd_seq_t *commands)
@@ -1653,10 +1680,10 @@ sctp_disposition_t sctp_sf_do_5_2_3_initack(const struct sctp_endpoint *ep,
         /* Per the above section, we'll discard the chunk if we have an
          * endpoint.  If this is an OOTB INIT-ACK, treat it as such.
          */
-        if (ep == sctp_sk((sctp_get_ctl_sock()))->ep)
-                return sctp_sf_ootb(ep, asoc, type, arg, commands);
+        if (ep == sctp_sk(net->sctp.ctl_sock)->ep)
+                return sctp_sf_ootb(net, ep, asoc, type, arg, commands);
         else
-                return sctp_sf_discard_chunk(ep, asoc, type, arg, commands);
+                return sctp_sf_discard_chunk(net, ep, asoc, type, arg, commands);
 }
 
 /* Unexpected COOKIE-ECHO handler for peer restart (Table 2, action 'A')
@@ -1664,7 +1691,8 @@ sctp_disposition_t sctp_sf_do_5_2_3_initack(const struct sctp_endpoint *ep,
  * Section 5.2.4
  *  A)  In this case, the peer may have restarted.
  */
-static sctp_disposition_t sctp_sf_do_dupcook_a(const struct sctp_endpoint *ep,
+static sctp_disposition_t sctp_sf_do_dupcook_a(struct net *net,
+                                        const struct sctp_endpoint *ep,
                                         const struct sctp_association *asoc,
                                         struct sctp_chunk *chunk,
                                         sctp_cmd_seq_t *commands,
@@ -1700,7 +1728,7 @@ static sctp_disposition_t sctp_sf_do_dupcook_a(const struct sctp_endpoint *ep,
          * its peer.
         */
         if (sctp_state(asoc, SHUTDOWN_ACK_SENT)) {
-                disposition = sctp_sf_do_9_2_reshutack(ep, asoc,
+                disposition = sctp_sf_do_9_2_reshutack(net, ep, asoc,
                                 SCTP_ST_CHUNK(chunk->chunk_hdr->type),
                                 chunk, commands);
                 if (SCTP_DISPOSITION_NOMEM == disposition)
@@ -1763,7 +1791,8 @@ nomem:
  *      after responding to the local endpoint's INIT
  */
 /* This case represents an initialization collision.  */
-static sctp_disposition_t sctp_sf_do_dupcook_b(const struct sctp_endpoint *ep,
+static sctp_disposition_t sctp_sf_do_dupcook_b(struct net *net,
+                                        const struct sctp_endpoint *ep,
                                         const struct sctp_association *asoc,
                                         struct sctp_chunk *chunk,
                                         sctp_cmd_seq_t *commands,
@@ -1784,7 +1813,7 @@ static sctp_disposition_t sctp_sf_do_dupcook_b(const struct sctp_endpoint *ep,
         sctp_add_cmd_sf(commands, SCTP_CMD_UPDATE_ASSOC, SCTP_ASOC(new_asoc));
         sctp_add_cmd_sf(commands, SCTP_CMD_NEW_STATE,
                         SCTP_STATE(SCTP_STATE_ESTABLISHED));
-        SCTP_INC_STATS(SCTP_MIB_CURRESTAB);
+        SCTP_INC_STATS(net, SCTP_MIB_CURRESTAB);
         sctp_add_cmd_sf(commands, SCTP_CMD_HB_TIMERS_START, SCTP_NULL());
 
         repl = sctp_make_cookie_ack(new_asoc, chunk);
@@ -1833,7 +1862,8 @@ nomem:
  *     but a new tag of its own.
  */
 /* This case represents an initialization collision.  */
-static sctp_disposition_t sctp_sf_do_dupcook_c(const struct sctp_endpoint *ep,
+static sctp_disposition_t sctp_sf_do_dupcook_c(struct net *net,
+                                        const struct sctp_endpoint *ep,
                                         const struct sctp_association *asoc,
                                         struct sctp_chunk *chunk,
                                         sctp_cmd_seq_t *commands,
@@ -1854,7 +1884,8 @@ static sctp_disposition_t sctp_sf_do_dupcook_c(const struct sctp_endpoint *ep,
  *    enter the ESTABLISHED state, if it has not already done so.
  */
 /* This case represents an initialization collision.  */
-static sctp_disposition_t sctp_sf_do_dupcook_d(const struct sctp_endpoint *ep,
+static sctp_disposition_t sctp_sf_do_dupcook_d(struct net *net,
+                                        const struct sctp_endpoint *ep,
                                         const struct sctp_association *asoc,
                                         struct sctp_chunk *chunk,
                                         sctp_cmd_seq_t *commands,
@@ -1876,7 +1907,7 @@ static sctp_disposition_t sctp_sf_do_dupcook_d(const struct sctp_endpoint *ep,
                                 SCTP_TO(SCTP_EVENT_TIMEOUT_T1_COOKIE));
                 sctp_add_cmd_sf(commands, SCTP_CMD_NEW_STATE,
                                 SCTP_STATE(SCTP_STATE_ESTABLISHED));
-                SCTP_INC_STATS(SCTP_MIB_CURRESTAB);
+                SCTP_INC_STATS(net, SCTP_MIB_CURRESTAB);
                 sctp_add_cmd_sf(commands, SCTP_CMD_HB_TIMERS_START,
                                 SCTP_NULL());
 
@@ -1948,7 +1979,8 @@ nomem:
  *
  * The return value is the disposition of the chunk.
  */
-sctp_disposition_t sctp_sf_do_5_2_4_dupcook(const struct sctp_endpoint *ep,
+sctp_disposition_t sctp_sf_do_5_2_4_dupcook(struct net *net,
+                                        const struct sctp_endpoint *ep,
                                         const struct sctp_association *asoc,
                                         const sctp_subtype_t type,
                                         void *arg,
@@ -1967,7 +1999,7 @@ sctp_disposition_t sctp_sf_do_5_2_4_dupcook(const struct sctp_endpoint *ep,
          * done later.
          */
         if (!sctp_chunk_length_valid(chunk, sizeof(sctp_chunkhdr_t)))
-                return sctp_sf_violation_chunklen(ep, asoc, type, arg,
+                return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
                                                   commands);
 
         /* "Decode" the chunk.  We have no optional parameters so we
@@ -2001,12 +2033,12 @@ sctp_disposition_t sctp_sf_do_5_2_4_dupcook(const struct sctp_endpoint *ep,
                         goto nomem;
 
                 case -SCTP_IERROR_STALE_COOKIE:
-                        sctp_send_stale_cookie_err(ep, asoc, chunk, commands,
+                        sctp_send_stale_cookie_err(net, ep, asoc, chunk, commands,
                                                    err_chk_p);
-                        return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
+                        return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
                 case -SCTP_IERROR_BAD_SIG:
                 default:
-                        return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
+                        return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
                 }
         }
 
@@ -2017,27 +2049,27 @@ sctp_disposition_t sctp_sf_do_5_2_4_dupcook(const struct sctp_endpoint *ep,
 
         switch (action) {
         case 'A': /* Association restart. */
-                retval = sctp_sf_do_dupcook_a(ep, asoc, chunk, commands,
+                retval = sctp_sf_do_dupcook_a(net, ep, asoc, chunk, commands,
                                               new_asoc);
                 break;
 
         case 'B': /* Collision case B. */
-                retval = sctp_sf_do_dupcook_b(ep, asoc, chunk, commands,
+                retval = sctp_sf_do_dupcook_b(net, ep, asoc, chunk, commands,
                                               new_asoc);
                 break;
 
         case 'C': /* Collision case C. */
-                retval = sctp_sf_do_dupcook_c(ep, asoc, chunk, commands,
+                retval = sctp_sf_do_dupcook_c(net, ep, asoc, chunk, commands,
                                               new_asoc);
                 break;
 
         case 'D': /* Collision case D. */
-                retval = sctp_sf_do_dupcook_d(ep, asoc, chunk, commands,
+                retval = sctp_sf_do_dupcook_d(net, ep, asoc, chunk, commands,
                                               new_asoc);
                 break;
 
         default: /* Discard packet for all others. */
-                retval = sctp_sf_pdiscard(ep, asoc, type, arg, commands);
+                retval = sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
                 break;
         }
 
@@ -2063,6 +2095,7 @@ nomem:
  * See sctp_sf_do_9_1_abort().
  */
 sctp_disposition_t sctp_sf_shutdown_pending_abort(
+        struct net *net,
         const struct sctp_endpoint *ep,
         const struct sctp_association *asoc,
         const sctp_subtype_t type,
@@ -2072,7 +2105,7 @@ sctp_disposition_t sctp_sf_shutdown_pending_abort(
         struct sctp_chunk *chunk = arg;
 
         if (!sctp_vtag_verify_either(chunk, asoc))
-                return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
+                return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
 
         /* Make sure that the ABORT chunk has a valid length.
          * Since this is an ABORT chunk, we have to discard it
@@ -2085,7 +2118,7 @@ sctp_disposition_t sctp_sf_shutdown_pending_abort(
          * packet.
          */
         if (!sctp_chunk_length_valid(chunk, sizeof(sctp_abort_chunk_t)))
-                return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
+                return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
 
         /* ADD-IP: Special case for ABORT chunks
          * F4)  One special consideration is that ABORT Chunks arriving
@@ -2094,9 +2127,9 @@ sctp_disposition_t sctp_sf_shutdown_pending_abort(
          */
         if (SCTP_ADDR_DEL ==
                     sctp_bind_addr_state(&asoc->base.bind_addr, &chunk->dest))
-                return sctp_sf_discard_chunk(ep, asoc, type, arg, commands);
+                return sctp_sf_discard_chunk(net, ep, asoc, type, arg, commands);
 
-        return __sctp_sf_do_9_1_abort(ep, asoc, type, arg, commands);
+        return __sctp_sf_do_9_1_abort(net, ep, asoc, type, arg, commands);
 }
 
 /*
@@ -2104,7 +2137,8 @@ sctp_disposition_t sctp_sf_shutdown_pending_abort(
  *
  * See sctp_sf_do_9_1_abort().
  */
-sctp_disposition_t sctp_sf_shutdown_sent_abort(const struct sctp_endpoint *ep,
+sctp_disposition_t sctp_sf_shutdown_sent_abort(struct net *net,
+                                        const struct sctp_endpoint *ep,
                                         const struct sctp_association *asoc,
                                         const sctp_subtype_t type,
                                         void *arg,
@@ -2113,7 +2147,7 @@ sctp_disposition_t sctp_sf_shutdown_sent_abort(const struct sctp_endpoint *ep,
         struct sctp_chunk *chunk = arg;
 
         if (!sctp_vtag_verify_either(chunk, asoc))
-                return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
+                return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
 
         /* Make sure that the ABORT chunk has a valid length.
          * Since this is an ABORT chunk, we have to discard it
@@ -2126,7 +2160,7 @@ sctp_disposition_t sctp_sf_shutdown_sent_abort(const struct sctp_endpoint *ep,
          * packet.
          */
         if (!sctp_chunk_length_valid(chunk, sizeof(sctp_abort_chunk_t)))
-                return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
+                return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
 
         /* ADD-IP: Special case for ABORT chunks
          * F4)  One special consideration is that ABORT Chunks arriving
@@ -2135,7 +2169,7 @@ sctp_disposition_t sctp_sf_shutdown_sent_abort(const struct sctp_endpoint *ep,
          */
         if (SCTP_ADDR_DEL ==
                     sctp_bind_addr_state(&asoc->base.bind_addr, &chunk->dest))
-                return sctp_sf_discard_chunk(ep, asoc, type, arg, commands);
+                return sctp_sf_discard_chunk(net, ep, asoc, type, arg, commands);
 
         /* Stop the T2-shutdown timer. */
         sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP,
@@ -2145,7 +2179,7 @@ sctp_disposition_t sctp_sf_shutdown_sent_abort(const struct sctp_endpoint *ep,
         sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP,
                         SCTP_TO(SCTP_EVENT_TIMEOUT_T5_SHUTDOWN_GUARD));
 
-        return __sctp_sf_do_9_1_abort(ep, asoc, type, arg, commands);
+        return __sctp_sf_do_9_1_abort(net, ep, asoc, type, arg, commands);
 }
 
 /*
@@ -2154,6 +2188,7 @@ sctp_disposition_t sctp_sf_shutdown_sent_abort(const struct sctp_endpoint *ep,
  * See sctp_sf_do_9_1_abort().
  */
 sctp_disposition_t sctp_sf_shutdown_ack_sent_abort(
+        struct net *net,
         const struct sctp_endpoint *ep,
         const struct sctp_association *asoc,
         const sctp_subtype_t type,
@@ -2163,7 +2198,7 @@ sctp_disposition_t sctp_sf_shutdown_ack_sent_abort(
         /* The same T2 timer, so we should be able to use
          * common function with the SHUTDOWN-SENT state.
          */
-        return sctp_sf_shutdown_sent_abort(ep, asoc, type, arg, commands);
+        return sctp_sf_shutdown_sent_abort(net, ep, asoc, type, arg, commands);
 }
 
 /*
@@ -2180,7 +2215,8 @@ sctp_disposition_t sctp_sf_shutdown_ack_sent_abort(
  *
  * The return value is the disposition of the chunk.
  */
-sctp_disposition_t sctp_sf_cookie_echoed_err(const struct sctp_endpoint *ep,
+sctp_disposition_t sctp_sf_cookie_echoed_err(struct net *net,
+                                        const struct sctp_endpoint *ep,
                                         const struct sctp_association *asoc,
                                         const sctp_subtype_t type,
                                         void *arg,
@@ -2190,13 +2226,13 @@ sctp_disposition_t sctp_sf_cookie_echoed_err(const struct sctp_endpoint *ep,
         sctp_errhdr_t *err;
 
         if (!sctp_vtag_verify(chunk, asoc))
-                return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
+                return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
 
         /* Make sure that the ERROR chunk has a valid length.
          * The parameter walking depends on this as well.
          */
         if (!sctp_chunk_length_valid(chunk, sizeof(sctp_operr_chunk_t)))
-                return sctp_sf_violation_chunklen(ep, asoc, type, arg,
+                return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
                                                   commands);
 
         /* Process the error here */
@@ -2206,7 +2242,7 @@ sctp_disposition_t sctp_sf_cookie_echoed_err(const struct sctp_endpoint *ep,
          */
         sctp_walk_errors(err, chunk->chunk_hdr) {
                 if (SCTP_ERROR_STALE_COOKIE == err->cause)
-                        return sctp_sf_do_5_2_6_stale(ep, asoc, type,
+                        return sctp_sf_do_5_2_6_stale(net, ep, asoc, type,
                                                         arg, commands);
         }
 
@@ -2215,7 +2251,7 @@ sctp_disposition_t sctp_sf_cookie_echoed_err(const struct sctp_endpoint *ep,
          * we are discarding the packet, there should be no adverse
          * affects.
          */
-        return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
+        return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
 }
 
 /*
@@ -2243,7 +2279,8 @@ sctp_disposition_t sctp_sf_cookie_echoed_err(const struct sctp_endpoint *ep,
  *
  * The return value is the disposition of the chunk.
  */
-static sctp_disposition_t sctp_sf_do_5_2_6_stale(const struct sctp_endpoint *ep,
+static sctp_disposition_t sctp_sf_do_5_2_6_stale(struct net *net,
+                                                 const struct sctp_endpoint *ep,
                                                  const struct sctp_association *asoc,
                                                  const sctp_subtype_t type,
                                                  void *arg,
@@ -2365,7 +2402,8 @@ nomem:
  *
  * The return value is the disposition of the chunk.
  */
-sctp_disposition_t sctp_sf_do_9_1_abort(const struct sctp_endpoint *ep,
+sctp_disposition_t sctp_sf_do_9_1_abort(struct net *net,
+                                        const struct sctp_endpoint *ep,
                                         const struct sctp_association *asoc,
                                         const sctp_subtype_t type,
                                         void *arg,
@@ -2374,7 +2412,7 @@ sctp_disposition_t sctp_sf_do_9_1_abort(const struct sctp_endpoint *ep,
         struct sctp_chunk *chunk = arg;
 
         if (!sctp_vtag_verify_either(chunk, asoc))
-                return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
+                return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
 
         /* Make sure that the ABORT chunk has a valid length.
          * Since this is an ABORT chunk, we have to discard it
@@ -2387,7 +2425,7 @@ sctp_disposition_t sctp_sf_do_9_1_abort(const struct sctp_endpoint *ep,
          * packet.
          */
         if (!sctp_chunk_length_valid(chunk, sizeof(sctp_abort_chunk_t)))
-                return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
+                return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
 
         /* ADD-IP: Special case for ABORT chunks
          * F4)  One special consideration is that ABORT Chunks arriving
@@ -2396,12 +2434,13 @@ sctp_disposition_t sctp_sf_do_9_1_abort(const struct sctp_endpoint *ep,
          */
         if (SCTP_ADDR_DEL ==
                     sctp_bind_addr_state(&asoc->base.bind_addr, &chunk->dest))
-                return sctp_sf_discard_chunk(ep, asoc, type, arg, commands);
+                return sctp_sf_discard_chunk(net, ep, asoc, type, arg, commands);
 
-        return __sctp_sf_do_9_1_abort(ep, asoc, type, arg, commands);
+        return __sctp_sf_do_9_1_abort(net, ep, asoc, type, arg, commands);
 }
 
-static sctp_disposition_t __sctp_sf_do_9_1_abort(const struct sctp_endpoint *ep,
+static sctp_disposition_t __sctp_sf_do_9_1_abort(struct net *net,
+                                        const struct sctp_endpoint *ep,
                                         const struct sctp_association *asoc,
                                         const sctp_subtype_t type,
                                         void *arg,
@@ -2418,7 +2457,7 @@ static sctp_disposition_t __sctp_sf_do_9_1_abort(const struct sctp_endpoint *ep,
                 sctp_errhdr_t *err;
                 sctp_walk_errors(err, chunk->chunk_hdr);
                 if ((void *)err != (void *)chunk->chunk_end)
-                        return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
+                        return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
 
                 error = ((sctp_errhdr_t *)chunk->skb->data)->cause;
         }
@@ -2426,8 +2465,8 @@ static sctp_disposition_t __sctp_sf_do_9_1_abort(const struct sctp_endpoint *ep,
         sctp_add_cmd_sf(commands, SCTP_CMD_SET_SK_ERR, SCTP_ERROR(ECONNRESET));
         /* ASSOC_FAILED will DELETE_TCB. */
         sctp_add_cmd_sf(commands, SCTP_CMD_ASSOC_FAILED, SCTP_PERR(error));
-        SCTP_INC_STATS(SCTP_MIB_ABORTEDS);
-        SCTP_DEC_STATS(SCTP_MIB_CURRESTAB);
+        SCTP_INC_STATS(net, SCTP_MIB_ABORTEDS);
+        SCTP_DEC_STATS(net, SCTP_MIB_CURRESTAB);
 
         return SCTP_DISPOSITION_ABORT;
 }
@@ -2437,7 +2476,8 @@ static sctp_disposition_t __sctp_sf_do_9_1_abort(const struct sctp_endpoint *ep,
  *
  * See sctp_sf_do_9_1_abort() above.
  */
-sctp_disposition_t sctp_sf_cookie_wait_abort(const struct sctp_endpoint *ep,
+sctp_disposition_t sctp_sf_cookie_wait_abort(struct net *net,
+                                     const struct sctp_endpoint *ep,
                                      const struct sctp_association *asoc,
                                      const sctp_subtype_t type,
                                      void *arg,
@@ -2448,7 +2488,7 @@ sctp_disposition_t sctp_sf_cookie_wait_abort(const struct sctp_endpoint *ep,
         __be16 error = SCTP_ERROR_NO_ERROR;
 
         if (!sctp_vtag_verify_either(chunk, asoc))
-                return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
+                return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
 
         /* Make sure that the ABORT chunk has a valid length.
          * Since this is an ABORT chunk, we have to discard it
@@ -2461,27 +2501,28 @@ sctp_disposition_t sctp_sf_cookie_wait_abort(const struct sctp_endpoint *ep,
          * packet.
          */
         if (!sctp_chunk_length_valid(chunk, sizeof(sctp_abort_chunk_t)))
-                return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
+                return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
 
         /* See if we have an error cause code in the chunk.  */
         len = ntohs(chunk->chunk_hdr->length);
         if (len >= sizeof(struct sctp_chunkhdr) + sizeof(struct sctp_errhdr))
                 error = ((sctp_errhdr_t *)chunk->skb->data)->cause;
 
-        return sctp_stop_t1_and_abort(commands, error, ECONNREFUSED, asoc,
+        return sctp_stop_t1_and_abort(net, commands, error, ECONNREFUSED, asoc,
                                       chunk->transport);
 }
 
 /*
  * Process an incoming ICMP as an ABORT.  (COOKIE-WAIT state)
  */
-sctp_disposition_t sctp_sf_cookie_wait_icmp_abort(const struct sctp_endpoint *ep,
+sctp_disposition_t sctp_sf_cookie_wait_icmp_abort(struct net *net,
+                                        const struct sctp_endpoint *ep,
                                         const struct sctp_association *asoc,
                                         const sctp_subtype_t type,
                                         void *arg,
                                         sctp_cmd_seq_t *commands)
 {
-        return sctp_stop_t1_and_abort(commands, SCTP_ERROR_NO_ERROR,
+        return sctp_stop_t1_and_abort(net, commands, SCTP_ERROR_NO_ERROR,
                                       ENOPROTOOPT, asoc,
                                       (struct sctp_transport *)arg);
 }
@@ -2489,7 +2530,8 @@ sctp_disposition_t sctp_sf_cookie_wait_icmp_abort(const struct sctp_endpoint *ep
 /*
  * Process an ABORT.  (COOKIE-ECHOED state)
  */
-sctp_disposition_t sctp_sf_cookie_echoed_abort(const struct sctp_endpoint *ep,
+sctp_disposition_t sctp_sf_cookie_echoed_abort(struct net *net,
+                                               const struct sctp_endpoint *ep,
                                                const struct sctp_association *asoc,
                                                const sctp_subtype_t type,
                                                void *arg,
@@ -2498,7 +2540,7 @@ sctp_disposition_t sctp_sf_cookie_echoed_abort(const struct sctp_endpoint *ep,
         /* There is a single T1 timer, so we should be able to use
          * common function with the COOKIE-WAIT state.
          */
-        return sctp_sf_cookie_wait_abort(ep, asoc, type, arg, commands);
+        return sctp_sf_cookie_wait_abort(net, ep, asoc, type, arg, commands);
 }
 
 /*
@@ -2506,7 +2548,8 @@ sctp_disposition_t sctp_sf_cookie_echoed_abort(const struct sctp_endpoint *ep,
  *
  * This is common code called by several sctp_sf_*_abort() functions above.
  */
-static sctp_disposition_t sctp_stop_t1_and_abort(sctp_cmd_seq_t *commands,
+static sctp_disposition_t sctp_stop_t1_and_abort(struct net *net,
+                                           sctp_cmd_seq_t *commands,
                                            __be16 error, int sk_err,
                                            const struct sctp_association *asoc,
                                            struct sctp_transport *transport)
@@ -2514,7 +2557,7 @@ static sctp_disposition_t sctp_stop_t1_and_abort(sctp_cmd_seq_t *commands,
         SCTP_DEBUG_PRINTK("ABORT received (INIT).\n");
         sctp_add_cmd_sf(commands, SCTP_CMD_NEW_STATE,
                         SCTP_STATE(SCTP_STATE_CLOSED));
-        SCTP_INC_STATS(SCTP_MIB_ABORTEDS);
+        SCTP_INC_STATS(net, SCTP_MIB_ABORTEDS);
         sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP,
                         SCTP_TO(SCTP_EVENT_TIMEOUT_T1_INIT));
         sctp_add_cmd_sf(commands, SCTP_CMD_SET_SK_ERR, SCTP_ERROR(sk_err));
@@ -2557,7 +2600,8 @@ static sctp_disposition_t sctp_stop_t1_and_abort(sctp_cmd_seq_t *commands,
  *
  * The return value is the disposition of the chunk.
  */
-sctp_disposition_t sctp_sf_do_9_2_shutdown(const struct sctp_endpoint *ep,
+sctp_disposition_t sctp_sf_do_9_2_shutdown(struct net *net,
+                                           const struct sctp_endpoint *ep,
                                            const struct sctp_association *asoc,
                                            const sctp_subtype_t type,
                                            void *arg,
@@ -2570,12 +2614,12 @@ sctp_disposition_t sctp_sf_do_9_2_shutdown(const struct sctp_endpoint *ep,
         __u32 ctsn;
 
         if (!sctp_vtag_verify(chunk, asoc))
-                return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
+                return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
 
         /* Make sure that the SHUTDOWN chunk has a valid length. */
         if (!sctp_chunk_length_valid(chunk,
                                       sizeof(struct sctp_shutdown_chunk_t)))
-                return sctp_sf_violation_chunklen(ep, asoc, type, arg,
+                return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
                                                   commands);
 
         /* Convert the elaborate header.  */
@@ -2595,7 +2639,7 @@ sctp_disposition_t sctp_sf_do_9_2_shutdown(const struct sctp_endpoint *ep,
          * sender with an ABORT.
          */
         if (!TSN_lt(ctsn, asoc->next_tsn))
-                return sctp_sf_violation_ctsn(ep, asoc, type, arg, commands);
+                return sctp_sf_violation_ctsn(net, ep, asoc, type, arg, commands);
 
         /* API 5.3.1.5 SCTP_SHUTDOWN_EVENT
          * When a peer sends a SHUTDOWN, SCTP delivers this notification to
@@ -2619,7 +2663,7 @@ sctp_disposition_t sctp_sf_do_9_2_shutdown(const struct sctp_endpoint *ep,
         disposition = SCTP_DISPOSITION_CONSUME;
 
         if (sctp_outq_is_empty(&asoc->outqueue)) {
-                disposition = sctp_sf_do_9_2_shutdown_ack(ep, asoc, type,
+                disposition = sctp_sf_do_9_2_shutdown_ack(net, ep, asoc, type,
                                                           arg, commands);
         }
 
@@ -2645,7 +2689,8 @@ out:
  * The Cumulative TSN Ack of the received SHUTDOWN chunk
  * MUST be processed.
  */
-sctp_disposition_t sctp_sf_do_9_2_shut_ctsn(const struct sctp_endpoint *ep,
+sctp_disposition_t sctp_sf_do_9_2_shut_ctsn(struct net *net,
+                                           const struct sctp_endpoint *ep,
                                            const struct sctp_association *asoc,
                                            const sctp_subtype_t type,
                                            void *arg,
@@ -2656,12 +2701,12 @@ sctp_disposition_t sctp_sf_do_9_2_shut_ctsn(const struct sctp_endpoint *ep,
         __u32 ctsn;
 
         if (!sctp_vtag_verify(chunk, asoc))
-                return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
+                return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
 
         /* Make sure that the SHUTDOWN chunk has a valid length. */
         if (!sctp_chunk_length_valid(chunk,
                                       sizeof(struct sctp_shutdown_chunk_t)))
-                return sctp_sf_violation_chunklen(ep, asoc, type, arg,
+                return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
                                                   commands);
 
         sdh = (sctp_shutdownhdr_t *)chunk->skb->data;
@@ -2678,7 +2723,7 @@ sctp_disposition_t sctp_sf_do_9_2_shut_ctsn(const struct sctp_endpoint *ep,
          * sender with an ABORT.
          */
         if (!TSN_lt(ctsn, asoc->next_tsn))
-                return sctp_sf_violation_ctsn(ep, asoc, type, arg, commands);
+                return sctp_sf_violation_ctsn(net, ep, asoc, type, arg, commands);
 
         /* verify, by checking the Cumulative TSN Ack field of the
          * chunk, that all its outstanding DATA chunks have been
@@ -2697,7 +2742,8 @@ sctp_disposition_t sctp_sf_do_9_2_shut_ctsn(const struct sctp_endpoint *ep,
  * that belong to this association, it should discard the INIT chunk and
  * retransmit the SHUTDOWN ACK chunk.
  */
-sctp_disposition_t sctp_sf_do_9_2_reshutack(const struct sctp_endpoint *ep,
+sctp_disposition_t sctp_sf_do_9_2_reshutack(struct net *net,
+                                    const struct sctp_endpoint *ep,
                                     const struct sctp_association *asoc,
                                     const sctp_subtype_t type,
                                     void *arg,
@@ -2708,7 +2754,7 @@ sctp_disposition_t sctp_sf_do_9_2_reshutack(const struct sctp_endpoint *ep,
 
         /* Make sure that the chunk has a valid length */
         if (!sctp_chunk_length_valid(chunk, sizeof(sctp_chunkhdr_t)))
-                return sctp_sf_violation_chunklen(ep, asoc, type, arg,
+                return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
                                                   commands);
 
         /* Since we are not going to really process this INIT, there
@@ -2760,7 +2806,8 @@ nomem:
  *
  * The return value is the disposition of the chunk.
  */
-sctp_disposition_t sctp_sf_do_ecn_cwr(const struct sctp_endpoint *ep,
+sctp_disposition_t sctp_sf_do_ecn_cwr(struct net *net,
+                                      const struct sctp_endpoint *ep,
                                       const struct sctp_association *asoc,
                                       const sctp_subtype_t type,
                                       void *arg,
@@ -2771,10 +2818,10 @@ sctp_disposition_t sctp_sf_do_ecn_cwr(const struct sctp_endpoint *ep,
         u32 lowest_tsn;
 
         if (!sctp_vtag_verify(chunk, asoc))
-                return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
+                return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
 
         if (!sctp_chunk_length_valid(chunk, sizeof(sctp_ecne_chunk_t)))
-                return sctp_sf_violation_chunklen(ep, asoc, type, arg,
+                return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
                                                   commands);
 
         cwr = (sctp_cwrhdr_t *) chunk->skb->data;
@@ -2815,7 +2862,8 @@ sctp_disposition_t sctp_sf_do_ecn_cwr(const struct sctp_endpoint *ep,
  *
  * The return value is the disposition of the chunk.
  */
-sctp_disposition_t sctp_sf_do_ecne(const struct sctp_endpoint *ep,
+sctp_disposition_t sctp_sf_do_ecne(struct net *net,
+                                   const struct sctp_endpoint *ep,
                                    const struct sctp_association *asoc,
                                    const sctp_subtype_t type,
                                    void *arg,
@@ -2825,10 +2873,10 @@ sctp_disposition_t sctp_sf_do_ecne(const struct sctp_endpoint *ep,
         struct sctp_chunk *chunk = arg;
 
         if (!sctp_vtag_verify(chunk, asoc))
-                return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
+                return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
 
         if (!sctp_chunk_length_valid(chunk, sizeof(sctp_ecne_chunk_t)))
-                return sctp_sf_violation_chunklen(ep, asoc, type, arg,
+                return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
                                                   commands);
 
         ecne = (sctp_ecnehdr_t *) chunk->skb->data;
@@ -2871,7 +2919,8 @@ sctp_disposition_t sctp_sf_do_ecne(const struct sctp_endpoint *ep,
  *
  * The return value is the disposition of the chunk.
  */
-sctp_disposition_t sctp_sf_eat_data_6_2(const struct sctp_endpoint *ep,
+sctp_disposition_t sctp_sf_eat_data_6_2(struct net *net,
+                                        const struct sctp_endpoint *ep,
                                         const struct sctp_association *asoc,
                                         const sctp_subtype_t type,
                                         void *arg,
@@ -2884,11 +2933,11 @@ sctp_disposition_t sctp_sf_eat_data_6_2(const struct sctp_endpoint *ep,
         if (!sctp_vtag_verify(chunk, asoc)) {
                 sctp_add_cmd_sf(commands, SCTP_CMD_REPORT_BAD_TAG,
                                 SCTP_NULL());
-                return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
+                return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
         }
 
         if (!sctp_chunk_length_valid(chunk, sizeof(sctp_data_chunk_t)))
-                return sctp_sf_violation_chunklen(ep, asoc, type, arg,
+                return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
                                                   commands);
 
         error = sctp_eat_data(asoc, chunk, commands );
@@ -2897,16 +2946,16 @@ sctp_disposition_t sctp_sf_eat_data_6_2(const struct sctp_endpoint *ep,
                 break;
         case SCTP_IERROR_HIGH_TSN:
         case SCTP_IERROR_BAD_STREAM:
-                SCTP_INC_STATS(SCTP_MIB_IN_DATA_CHUNK_DISCARDS);
+                SCTP_INC_STATS(net, SCTP_MIB_IN_DATA_CHUNK_DISCARDS);
                 goto discard_noforce;
         case SCTP_IERROR_DUP_TSN:
         case SCTP_IERROR_IGNORE_TSN:
-                SCTP_INC_STATS(SCTP_MIB_IN_DATA_CHUNK_DISCARDS);
+                SCTP_INC_STATS(net, SCTP_MIB_IN_DATA_CHUNK_DISCARDS);
                 goto discard_force;
         case SCTP_IERROR_NO_DATA:
                 goto consume;
         case SCTP_IERROR_PROTO_VIOLATION:
-                return sctp_sf_abort_violation(ep, asoc, chunk, commands,
+                return sctp_sf_abort_violation(net, ep, asoc, chunk, commands,
                         (u8 *)chunk->subh.data_hdr, sizeof(sctp_datahdr_t));
         default:
                 BUG();
@@ -2992,7 +3041,8 @@ consume:
  *
  * The return value is the disposition of the chunk.
  */
-sctp_disposition_t sctp_sf_eat_data_fast_4_4(const struct sctp_endpoint *ep,
+sctp_disposition_t sctp_sf_eat_data_fast_4_4(struct net *net,
+                                     const struct sctp_endpoint *ep,
                                      const struct sctp_association *asoc,
                                      const sctp_subtype_t type,
                                      void *arg,
@@ -3004,11 +3054,11 @@ sctp_disposition_t sctp_sf_eat_data_fast_4_4(const struct sctp_endpoint *ep,
         if (!sctp_vtag_verify(chunk, asoc)) {
                 sctp_add_cmd_sf(commands, SCTP_CMD_REPORT_BAD_TAG,
                                 SCTP_NULL());
-                return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
+                return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
         }
 
         if (!sctp_chunk_length_valid(chunk, sizeof(sctp_data_chunk_t)))
-                return sctp_sf_violation_chunklen(ep, asoc, type, arg,
+                return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
                                                   commands);
 
         error = sctp_eat_data(asoc, chunk, commands );
@@ -3022,7 +3072,7 @@ sctp_disposition_t sctp_sf_eat_data_fast_4_4(const struct sctp_endpoint *ep,
         case SCTP_IERROR_NO_DATA:
                 goto consume;
         case SCTP_IERROR_PROTO_VIOLATION:
-                return sctp_sf_abort_violation(ep, asoc, chunk, commands,
+                return sctp_sf_abort_violation(net, ep, asoc, chunk, commands,
                         (u8 *)chunk->subh.data_hdr, sizeof(sctp_datahdr_t));
         default:
                 BUG();
@@ -3082,7 +3132,8 @@ consume:
  *
  * The return value is the disposition of the chunk.
  */
-sctp_disposition_t sctp_sf_eat_sack_6_2(const struct sctp_endpoint *ep,
+sctp_disposition_t sctp_sf_eat_sack_6_2(struct net *net,
+                                        const struct sctp_endpoint *ep,
                                         const struct sctp_association *asoc,
                                         const sctp_subtype_t type,
                                         void *arg,
@@ -3093,18 +3144,18 @@ sctp_disposition_t sctp_sf_eat_sack_6_2(const struct sctp_endpoint *ep,
         __u32 ctsn;
 
         if (!sctp_vtag_verify(chunk, asoc))
-                return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
+                return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
 
         /* Make sure that the SACK chunk has a valid length. */
         if (!sctp_chunk_length_valid(chunk, sizeof(sctp_sack_chunk_t)))
-                return sctp_sf_violation_chunklen(ep, asoc, type, arg,
+                return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
                                                   commands);
 
         /* Pull the SACK chunk from the data buffer */
         sackh = sctp_sm_pull_sack(chunk);
         /* Was this a bogus SACK? */
         if (!sackh)
-                return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
+                return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
         chunk->subh.sack_hdr = sackh;
         ctsn = ntohl(sackh->cum_tsn_ack);
 
@@ -3125,7 +3176,7 @@ sctp_disposition_t sctp_sf_eat_sack_6_2(const struct sctp_endpoint *ep,
          * sender with an ABORT.
          */
         if (!TSN_lt(ctsn, asoc->next_tsn))
-                return sctp_sf_violation_ctsn(ep, asoc, type, arg, commands);
+                return sctp_sf_violation_ctsn(net, ep, asoc, type, arg, commands);
 
         /* Return this SACK for further processing.  */
         sctp_add_cmd_sf(commands, SCTP_CMD_PROCESS_SACK, SCTP_SACKH(sackh));
@@ -3154,7 +3205,8 @@ sctp_disposition_t sctp_sf_eat_sack_6_2(const struct sctp_endpoint *ep,
  *
  * The return value is the disposition of the chunk.
 */
-static sctp_disposition_t sctp_sf_tabort_8_4_8(const struct sctp_endpoint *ep,
+static sctp_disposition_t sctp_sf_tabort_8_4_8(struct net *net,
+                                        const struct sctp_endpoint *ep,
                                         const struct sctp_association *asoc,
                                         const sctp_subtype_t type,
                                         void *arg,
@@ -3164,7 +3216,7 @@ static sctp_disposition_t sctp_sf_tabort_8_4_8(const struct sctp_endpoint *ep,
         struct sctp_chunk *chunk = arg;
         struct sctp_chunk *abort;
 
-        packet = sctp_ootb_pkt_new(asoc, chunk);
+        packet = sctp_ootb_pkt_new(net, asoc, chunk);
 
         if (packet) {
                 /* Make an ABORT. The T bit will be set if the asoc
@@ -3188,9 +3240,9 @@ static sctp_disposition_t sctp_sf_tabort_8_4_8(const struct sctp_endpoint *ep,
                 sctp_add_cmd_sf(commands, SCTP_CMD_SEND_PKT,
                                 SCTP_PACKET(packet));
 
-                SCTP_INC_STATS(SCTP_MIB_OUTCTRLCHUNKS);
+                SCTP_INC_STATS(net, SCTP_MIB_OUTCTRLCHUNKS);
 
-                sctp_sf_pdiscard(ep, asoc, type, arg, commands);
+                sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
                 return SCTP_DISPOSITION_CONSUME;
         }
 
@@ -3205,7 +3257,8 @@ static sctp_disposition_t sctp_sf_tabort_8_4_8(const struct sctp_endpoint *ep,
  *
  * The return value is the disposition of the chunk.
 */
-sctp_disposition_t sctp_sf_operr_notify(const struct sctp_endpoint *ep,
+sctp_disposition_t sctp_sf_operr_notify(struct net *net,
+                                        const struct sctp_endpoint *ep,
                                         const struct sctp_association *asoc,
                                         const sctp_subtype_t type,
                                         void *arg,
@@ -3215,15 +3268,15 @@ sctp_disposition_t sctp_sf_operr_notify(const struct sctp_endpoint *ep,
         sctp_errhdr_t *err;
 
         if (!sctp_vtag_verify(chunk, asoc))
-                return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
+                return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
 
         /* Make sure that the ERROR chunk has a valid length. */
         if (!sctp_chunk_length_valid(chunk, sizeof(sctp_operr_chunk_t)))
-                return sctp_sf_violation_chunklen(ep, asoc, type, arg,
+                return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
                                                   commands);
         sctp_walk_errors(err, chunk->chunk_hdr);
         if ((void *)err != (void *)chunk->chunk_end)
-                return sctp_sf_violation_paramlen(ep, asoc, type, arg,
+                return sctp_sf_violation_paramlen(net, ep, asoc, type, arg,
                                                   (void *)err, commands);
 
         sctp_add_cmd_sf(commands, SCTP_CMD_PROCESS_OPERR,
@@ -3242,7 +3295,8 @@ sctp_disposition_t sctp_sf_operr_notify(const struct sctp_endpoint *ep,
  *
  * The return value is the disposition.
  */
-sctp_disposition_t sctp_sf_do_9_2_final(const struct sctp_endpoint *ep,
+sctp_disposition_t sctp_sf_do_9_2_final(struct net *net,
+                                        const struct sctp_endpoint *ep,
                                         const struct sctp_association *asoc,
                                         const sctp_subtype_t type,
                                         void *arg,
@@ -3253,11 +3307,11 @@ sctp_disposition_t sctp_sf_do_9_2_final(const struct sctp_endpoint *ep,
         struct sctp_ulpevent *ev;
 
         if (!sctp_vtag_verify(chunk, asoc))
-                return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
+                return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
 
         /* Make sure that the SHUTDOWN_ACK chunk has a valid length. */
         if (!sctp_chunk_length_valid(chunk, sizeof(sctp_chunkhdr_t)))
-                return sctp_sf_violation_chunklen(ep, asoc, type, arg,
+                return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
                                                   commands);
         /* 10.2 H) SHUTDOWN COMPLETE notification
          *
@@ -3290,8 +3344,8 @@ sctp_disposition_t sctp_sf_do_9_2_final(const struct sctp_endpoint *ep,
 
         sctp_add_cmd_sf(commands, SCTP_CMD_NEW_STATE,
                         SCTP_STATE(SCTP_STATE_CLOSED));
-        SCTP_INC_STATS(SCTP_MIB_SHUTDOWNS);
-        SCTP_DEC_STATS(SCTP_MIB_CURRESTAB);
+        SCTP_INC_STATS(net, SCTP_MIB_SHUTDOWNS);
+        SCTP_DEC_STATS(net, SCTP_MIB_CURRESTAB);
         sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(reply));
 
         /* ...and remove all record of the association. */
@@ -3324,7 +3378,8 @@ nomem:
  *    receiver of the OOTB packet shall discard the OOTB packet and take
  *    no further action.
  */
-sctp_disposition_t sctp_sf_ootb(const struct sctp_endpoint *ep,
+sctp_disposition_t sctp_sf_ootb(struct net *net,
+                                const struct sctp_endpoint *ep,
                                 const struct sctp_association *asoc,
                                 const sctp_subtype_t type,
                                 void *arg,
@@ -3338,13 +3393,13 @@ sctp_disposition_t sctp_sf_ootb(const struct sctp_endpoint *ep,
         int ootb_shut_ack = 0;
         int ootb_cookie_ack = 0;
 
-        SCTP_INC_STATS(SCTP_MIB_OUTOFBLUES);
+        SCTP_INC_STATS(net, SCTP_MIB_OUTOFBLUES);
 
         ch = (sctp_chunkhdr_t *) chunk->chunk_hdr;
         do {
                 /* Report violation if the chunk is less then minimal */
                 if (ntohs(ch->length) < sizeof(sctp_chunkhdr_t))
-                        return sctp_sf_violation_chunklen(ep, asoc, type, arg,
+                        return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
                                                   commands);
 
                 /* Now that we know we at least have a chunk header,
@@ -3359,7 +3414,7 @@ sctp_disposition_t sctp_sf_ootb(const struct sctp_endpoint *ep,
                  *   sending an ABORT of its own.
                  */
                 if (SCTP_CID_ABORT == ch->type)
-                        return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
+                        return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
 
                 /* RFC 8.4, 7) If the packet contains a "Stale cookie" ERROR
                  * or a COOKIE ACK the SCTP Packet should be silently
@@ -3381,18 +3436,18 @@ sctp_disposition_t sctp_sf_ootb(const struct sctp_endpoint *ep,
                 /* Report violation if chunk len overflows */
                 ch_end = ((__u8 *)ch) + WORD_ROUND(ntohs(ch->length));
                 if (ch_end > skb_tail_pointer(skb))
-                        return sctp_sf_violation_chunklen(ep, asoc, type, arg,
+                        return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
                                                   commands);
 
                 ch = (sctp_chunkhdr_t *) ch_end;
         } while (ch_end < skb_tail_pointer(skb));
 
         if (ootb_shut_ack)
-                return sctp_sf_shut_8_4_5(ep, asoc, type, arg, commands);
+                return sctp_sf_shut_8_4_5(net, ep, asoc, type, arg, commands);
         else if (ootb_cookie_ack)
-                return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
+                return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
         else
-                return sctp_sf_tabort_8_4_8(ep, asoc, type, arg, commands);
+                return sctp_sf_tabort_8_4_8(net, ep, asoc, type, arg, commands);
 }
 
 /*
@@ -3416,7 +3471,8 @@ sctp_disposition_t sctp_sf_ootb(const struct sctp_endpoint *ep,
  *
  * The return value is the disposition of the chunk.
  */
-static sctp_disposition_t sctp_sf_shut_8_4_5(const struct sctp_endpoint *ep,
+static sctp_disposition_t sctp_sf_shut_8_4_5(struct net *net,
+                                             const struct sctp_endpoint *ep,
                                              const struct sctp_association *asoc,
                                              const sctp_subtype_t type,
                                              void *arg,
@@ -3426,7 +3482,7 @@ static sctp_disposition_t sctp_sf_shut_8_4_5(const struct sctp_endpoint *ep,
         struct sctp_chunk *chunk = arg;
         struct sctp_chunk *shut;
 
-        packet = sctp_ootb_pkt_new(asoc, chunk);
+        packet = sctp_ootb_pkt_new(net, asoc, chunk);
 
         if (packet) {
                 /* Make an SHUTDOWN_COMPLETE.
@@ -3450,19 +3506,19 @@ static sctp_disposition_t sctp_sf_shut_8_4_5(const struct sctp_endpoint *ep,
                 sctp_add_cmd_sf(commands, SCTP_CMD_SEND_PKT,
                                 SCTP_PACKET(packet));
 
-                SCTP_INC_STATS(SCTP_MIB_OUTCTRLCHUNKS);
+                SCTP_INC_STATS(net, SCTP_MIB_OUTCTRLCHUNKS);
 
                 /* If the chunk length is invalid, we don't want to process
                  * the reset of the packet.
                  */
                 if (!sctp_chunk_length_valid(chunk, sizeof(sctp_chunkhdr_t)))
-                        return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
+                        return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
 
                 /* We need to discard the rest of the packet to prevent
                  * potential bomming attacks from additional bundled chunks.
                  * This is documented in SCTP Threats ID.
                  */
-                return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
+                return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
         }
 
         return SCTP_DISPOSITION_NOMEM;
@@ -3479,7 +3535,8 @@ static sctp_disposition_t sctp_sf_shut_8_4_5(const struct sctp_endpoint *ep,
  *   chunks. --piggy ]
  *
  */
-sctp_disposition_t sctp_sf_do_8_5_1_E_sa(const struct sctp_endpoint *ep,
+sctp_disposition_t sctp_sf_do_8_5_1_E_sa(struct net *net,
+                                      const struct sctp_endpoint *ep,
                                       const struct sctp_association *asoc,
                                       const sctp_subtype_t type,
                                       void *arg,
@@ -3489,7 +3546,7 @@ sctp_disposition_t sctp_sf_do_8_5_1_E_sa(const struct sctp_endpoint *ep,
 
         /* Make sure that the SHUTDOWN_ACK chunk has a valid length. */
         if (!sctp_chunk_length_valid(chunk, sizeof(sctp_chunkhdr_t)))
-                return sctp_sf_violation_chunklen(ep, asoc, type, arg,
+                return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
                                                   commands);
 
         /* Although we do have an association in this case, it corresponds
@@ -3497,13 +3554,14 @@ sctp_disposition_t sctp_sf_do_8_5_1_E_sa(const struct sctp_endpoint *ep,
          * packet and the state function that handles OOTB SHUTDOWN_ACK is
          * called with a NULL association.
          */
-        SCTP_INC_STATS(SCTP_MIB_OUTOFBLUES);
+        SCTP_INC_STATS(net, SCTP_MIB_OUTOFBLUES);
 
-        return sctp_sf_shut_8_4_5(ep, NULL, type, arg, commands);
+        return sctp_sf_shut_8_4_5(net, ep, NULL, type, arg, commands);
 }
 
 /* ADDIP Section 4.2 Upon reception of an ASCONF Chunk.  */
-sctp_disposition_t sctp_sf_do_asconf(const struct sctp_endpoint *ep,
+sctp_disposition_t sctp_sf_do_asconf(struct net *net,
+                                     const struct sctp_endpoint *ep,
                                      const struct sctp_association *asoc,
                                      const sctp_subtype_t type, void *arg,
                                      sctp_cmd_seq_t *commands)
@@ -3519,7 +3577,7 @@ sctp_disposition_t sctp_sf_do_asconf(const struct sctp_endpoint *ep,
         if (!sctp_vtag_verify(chunk, asoc)) {
                 sctp_add_cmd_sf(commands, SCTP_CMD_REPORT_BAD_TAG,
                                 SCTP_NULL());
-                return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
+                return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
         }
 
         /* ADD-IP: Section 4.1.1
@@ -3528,12 +3586,12 @@ sctp_disposition_t sctp_sf_do_asconf(const struct sctp_endpoint *ep,
          * is received unauthenticated it MUST be silently discarded as
          * described in [I-D.ietf-tsvwg-sctp-auth].
          */
-        if (!sctp_addip_noauth && !chunk->auth)
-                return sctp_sf_discard_chunk(ep, asoc, type, arg, commands);
+        if (!net->sctp.addip_noauth && !chunk->auth)
+                return sctp_sf_discard_chunk(net, ep, asoc, type, arg, commands);
 
         /* Make sure that the ASCONF ADDIP chunk has a valid length.  */
         if (!sctp_chunk_length_valid(chunk, sizeof(sctp_addip_chunk_t)))
-                return sctp_sf_violation_chunklen(ep, asoc, type, arg,
+                return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
                                                   commands);
 
         hdr = (sctp_addiphdr_t *)chunk->skb->data;
@@ -3542,7 +3600,7 @@ sctp_disposition_t sctp_sf_do_asconf(const struct sctp_endpoint *ep,
         addr_param = (union sctp_addr_param *)hdr->params;
         length = ntohs(addr_param->p.length);
         if (length < sizeof(sctp_paramhdr_t))
-                return sctp_sf_violation_paramlen(ep, asoc, type, arg,
+                return sctp_sf_violation_paramlen(net, ep, asoc, type, arg,
                            (void *)addr_param, commands);
 
         /* Verify the ASCONF chunk before processing it. */
@@ -3550,7 +3608,7 @@ sctp_disposition_t sctp_sf_do_asconf(const struct sctp_endpoint *ep,
                             (sctp_paramhdr_t *)((void *)addr_param + length),
                             (void *)chunk->chunk_end,
                             &err_param))
-                return sctp_sf_violation_paramlen(ep, asoc, type, arg,
+                return sctp_sf_violation_paramlen(net, ep, asoc, type, arg,
                                                   (void *)err_param, commands);
 
         /* ADDIP 5.2 E1) Compare the value of the serial number to the value
@@ -3630,7 +3688,8 @@ sctp_disposition_t sctp_sf_do_asconf(const struct sctp_endpoint *ep,
  * When building TLV parameters for the ASCONF Chunk that will add or
  * delete IP addresses the D0 to D13 rules should be applied:
  */
-sctp_disposition_t sctp_sf_do_asconf_ack(const struct sctp_endpoint *ep,
+sctp_disposition_t sctp_sf_do_asconf_ack(struct net *net,
+                                         const struct sctp_endpoint *ep,
                                          const struct sctp_association *asoc,
                                          const sctp_subtype_t type, void *arg,
                                          sctp_cmd_seq_t *commands)
@@ -3645,7 +3704,7 @@ sctp_disposition_t sctp_sf_do_asconf_ack(const struct sctp_endpoint *ep,
         if (!sctp_vtag_verify(asconf_ack, asoc)) {
                 sctp_add_cmd_sf(commands, SCTP_CMD_REPORT_BAD_TAG,
                                 SCTP_NULL());
-                return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
+                return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
         }
 
         /* ADD-IP, Section 4.1.2:
@@ -3654,12 +3713,12 @@ sctp_disposition_t sctp_sf_do_asconf_ack(const struct sctp_endpoint *ep,
          * is received unauthenticated it MUST be silently discarded as
          * described in [I-D.ietf-tsvwg-sctp-auth].
          */
-        if (!sctp_addip_noauth && !asconf_ack->auth)
-                return sctp_sf_discard_chunk(ep, asoc, type, arg, commands);
+        if (!net->sctp.addip_noauth && !asconf_ack->auth)
+                return sctp_sf_discard_chunk(net, ep, asoc, type, arg, commands);
 
         /* Make sure that the ADDIP chunk has a valid length.  */
         if (!sctp_chunk_length_valid(asconf_ack, sizeof(sctp_addip_chunk_t)))
-                return sctp_sf_violation_chunklen(ep, asoc, type, arg,
+                return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
                                                   commands);
 
         addip_hdr = (sctp_addiphdr_t *)asconf_ack->skb->data;
@@ -3670,7 +3729,7 @@ sctp_disposition_t sctp_sf_do_asconf_ack(const struct sctp_endpoint *ep,
             (sctp_paramhdr_t *)addip_hdr->params,
             (void *)asconf_ack->chunk_end,
             &err_param))
-                return sctp_sf_violation_paramlen(ep, asoc, type, arg,
+                return sctp_sf_violation_paramlen(net, ep, asoc, type, arg,
                            (void *)err_param, commands);
 
         if (last_asconf) {
@@ -3705,8 +3764,8 @@ sctp_disposition_t sctp_sf_do_asconf_ack(const struct sctp_endpoint *ep,
                                 SCTP_ERROR(ECONNABORTED));
                 sctp_add_cmd_sf(commands, SCTP_CMD_ASSOC_FAILED,
                                 SCTP_PERR(SCTP_ERROR_ASCONF_ACK));
-                SCTP_INC_STATS(SCTP_MIB_ABORTEDS);
-                SCTP_DEC_STATS(SCTP_MIB_CURRESTAB);
+                SCTP_INC_STATS(net, SCTP_MIB_ABORTEDS);
+                SCTP_DEC_STATS(net, SCTP_MIB_CURRESTAB);
                 return SCTP_DISPOSITION_ABORT;
         }
 
@@ -3739,8 +3798,8 @@ sctp_disposition_t sctp_sf_do_asconf_ack(const struct sctp_endpoint *ep,
                                 SCTP_ERROR(ECONNABORTED));
                 sctp_add_cmd_sf(commands, SCTP_CMD_ASSOC_FAILED,
                                 SCTP_PERR(SCTP_ERROR_ASCONF_ACK));
-                SCTP_INC_STATS(SCTP_MIB_ABORTEDS);
-                SCTP_DEC_STATS(SCTP_MIB_CURRESTAB);
+                SCTP_INC_STATS(net, SCTP_MIB_ABORTEDS);
+                SCTP_DEC_STATS(net, SCTP_MIB_CURRESTAB);
                 return SCTP_DISPOSITION_ABORT;
         }
 
@@ -3761,7 +3820,8 @@ sctp_disposition_t sctp_sf_do_asconf_ack(const struct sctp_endpoint *ep,
  *
  * The return value is the disposition of the chunk.
  */
-sctp_disposition_t sctp_sf_eat_fwd_tsn(const struct sctp_endpoint *ep,
+sctp_disposition_t sctp_sf_eat_fwd_tsn(struct net *net,
+                                       const struct sctp_endpoint *ep,
                                        const struct sctp_association *asoc,
                                        const sctp_subtype_t type,
                                        void *arg,
@@ -3776,12 +3836,12 @@ sctp_disposition_t sctp_sf_eat_fwd_tsn(const struct sctp_endpoint *ep,
         if (!sctp_vtag_verify(chunk, asoc)) {
                 sctp_add_cmd_sf(commands, SCTP_CMD_REPORT_BAD_TAG,
                                 SCTP_NULL());
-                return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
+                return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
         }
 
         /* Make sure that the FORWARD_TSN chunk has valid length.  */
         if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_fwdtsn_chunk)))
-                return sctp_sf_violation_chunklen(ep, asoc, type, arg,
+                return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
                                                   commands);
 
         fwdtsn_hdr = (struct sctp_fwdtsn_hdr *)chunk->skb->data;
@@ -3828,6 +3888,7 @@ discard_noforce:
 }
 
 sctp_disposition_t sctp_sf_eat_fwd_tsn_fast(
+        struct net *net,
         const struct sctp_endpoint *ep,
         const struct sctp_association *asoc,
         const sctp_subtype_t type,
@@ -3843,12 +3904,12 @@ sctp_disposition_t sctp_sf_eat_fwd_tsn_fast(
         if (!sctp_vtag_verify(chunk, asoc)) {
                 sctp_add_cmd_sf(commands, SCTP_CMD_REPORT_BAD_TAG,
                                 SCTP_NULL());
-                return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
+                return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
         }
 
         /* Make sure that the FORWARD_TSN chunk has a valid length.  */
         if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_fwdtsn_chunk)))
-                return sctp_sf_violation_chunklen(ep, asoc, type, arg,
+                return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
                                                   commands);
 
         fwdtsn_hdr = (struct sctp_fwdtsn_hdr *)chunk->skb->data;
@@ -3915,7 +3976,8 @@ gen_shutdown:
  *
  * The return value is the disposition of the chunk.
  */
-static sctp_ierror_t sctp_sf_authenticate(const struct sctp_endpoint *ep,
+static sctp_ierror_t sctp_sf_authenticate(struct net *net,
+                                    const struct sctp_endpoint *ep,
                                     const struct sctp_association *asoc,
                                     const sctp_subtype_t type,
                                     struct sctp_chunk *chunk)
@@ -3988,7 +4050,8 @@ nomem:
         return SCTP_IERROR_NOMEM;
 }
 
-sctp_disposition_t sctp_sf_eat_auth(const struct sctp_endpoint *ep,
+sctp_disposition_t sctp_sf_eat_auth(struct net *net,
+                                    const struct sctp_endpoint *ep,
                                     const struct sctp_association *asoc,
                                     const sctp_subtype_t type,
                                     void *arg,
@@ -4001,21 +4064,21 @@ sctp_disposition_t sctp_sf_eat_auth(const struct sctp_endpoint *ep,
 
         /* Make sure that the peer has AUTH capable */
         if (!asoc->peer.auth_capable)
-                return sctp_sf_unk_chunk(ep, asoc, type, arg, commands);
+                return sctp_sf_unk_chunk(net, ep, asoc, type, arg, commands);
 
         if (!sctp_vtag_verify(chunk, asoc)) {
                 sctp_add_cmd_sf(commands, SCTP_CMD_REPORT_BAD_TAG,
                                 SCTP_NULL());
-                return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
+                return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
         }
 
         /* Make sure that the AUTH chunk has valid length.  */
         if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_auth_chunk)))
-                return sctp_sf_violation_chunklen(ep, asoc, type, arg,
+                return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
                                                   commands);
 
         auth_hdr = (struct sctp_authhdr *)chunk->skb->data;
-        error = sctp_sf_authenticate(ep, asoc, type, chunk);
+        error = sctp_sf_authenticate(net, ep, asoc, type, chunk);
         switch (error) {
         case SCTP_IERROR_AUTH_BAD_HMAC:
                 /* Generate the ERROR chunk and discard the rest
@@ -4032,10 +4095,10 @@ sctp_disposition_t sctp_sf_eat_auth(const struct sctp_endpoint *ep,
                 /* Fall Through */
         case SCTP_IERROR_AUTH_BAD_KEYID:
         case SCTP_IERROR_BAD_SIG:
-                return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
+                return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
 
         case SCTP_IERROR_PROTO_VIOLATION:
-                return sctp_sf_violation_chunklen(ep, asoc, type, arg,
+                return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
                                                   commands);
 
         case SCTP_IERROR_NOMEM:
@@ -4084,7 +4147,8 @@ sctp_disposition_t sctp_sf_eat_auth(const struct sctp_endpoint *ep,
  *
  * The return value is the disposition of the chunk.
  */
-sctp_disposition_t sctp_sf_unk_chunk(const struct sctp_endpoint *ep,
+sctp_disposition_t sctp_sf_unk_chunk(struct net *net,
+                                     const struct sctp_endpoint *ep,
                                      const struct sctp_association *asoc,
                                      const sctp_subtype_t type,
                                      void *arg,
@@ -4097,20 +4161,20 @@ sctp_disposition_t sctp_sf_unk_chunk(const struct sctp_endpoint *ep,
         SCTP_DEBUG_PRINTK("Processing the unknown chunk id %d.\n", type.chunk);
 
         if (!sctp_vtag_verify(unk_chunk, asoc))
-                return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
+                return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
 
         /* Make sure that the chunk has a valid length.
          * Since we don't know the chunk type, we use a general
          * chunkhdr structure to make a comparison.
          */
         if (!sctp_chunk_length_valid(unk_chunk, sizeof(sctp_chunkhdr_t)))
-                return sctp_sf_violation_chunklen(ep, asoc, type, arg,
+                return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
                                                   commands);
 
         switch (type.chunk & SCTP_CID_ACTION_MASK) {
         case SCTP_CID_ACTION_DISCARD:
                 /* Discard the packet.  */
-                return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
+                return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
                 break;
         case SCTP_CID_ACTION_DISCARD_ERR:
                 /* Generate an ERROR chunk as response. */
@@ -4125,7 +4189,7 @@ sctp_disposition_t sctp_sf_unk_chunk(const struct sctp_endpoint *ep,
                 }
 
                 /* Discard the packet.  */
-                sctp_sf_pdiscard(ep, asoc, type, arg, commands);
+                sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
                 return SCTP_DISPOSITION_CONSUME;
                 break;
         case SCTP_CID_ACTION_SKIP:
@@ -4167,7 +4231,8 @@ sctp_disposition_t sctp_sf_unk_chunk(const struct sctp_endpoint *ep,
  *
  * The return value is the disposition of the chunk.
  */
-sctp_disposition_t sctp_sf_discard_chunk(const struct sctp_endpoint *ep,
+sctp_disposition_t sctp_sf_discard_chunk(struct net *net,
+                                         const struct sctp_endpoint *ep,
                                          const struct sctp_association *asoc,
                                          const sctp_subtype_t type,
                                          void *arg,
@@ -4180,7 +4245,7 @@ sctp_disposition_t sctp_sf_discard_chunk(const struct sctp_endpoint *ep,
          * chunkhdr structure to make a comparison.
          */
         if (!sctp_chunk_length_valid(chunk, sizeof(sctp_chunkhdr_t)))
-                return sctp_sf_violation_chunklen(ep, asoc, type, arg,
+                return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
                                                   commands);
 
         SCTP_DEBUG_PRINTK("Chunk %d is discarded\n", type.chunk);
@@ -4205,13 +4270,14 @@ sctp_disposition_t sctp_sf_discard_chunk(const struct sctp_endpoint *ep,
  *
  * The return value is the disposition of the chunk.
  */
-sctp_disposition_t sctp_sf_pdiscard(const struct sctp_endpoint *ep,
+sctp_disposition_t sctp_sf_pdiscard(struct net *net,
+                                    const struct sctp_endpoint *ep,
                                     const struct sctp_association *asoc,
                                     const sctp_subtype_t type,
                                     void *arg,
                                     sctp_cmd_seq_t *commands)
 {
-        SCTP_INC_STATS(SCTP_MIB_IN_PKT_DISCARDS);
+        SCTP_INC_STATS(net, SCTP_MIB_IN_PKT_DISCARDS);
         sctp_add_cmd_sf(commands, SCTP_CMD_DISCARD_PACKET, SCTP_NULL());
 
         return SCTP_DISPOSITION_CONSUME;
@@ -4232,7 +4298,8 @@ sctp_disposition_t sctp_sf_pdiscard(const struct sctp_endpoint *ep,
  * We simply tag the chunk as a violation.  The state machine will log
  * the violation and continue.
  */
-sctp_disposition_t sctp_sf_violation(const struct sctp_endpoint *ep,
+sctp_disposition_t sctp_sf_violation(struct net *net,
+                                     const struct sctp_endpoint *ep,
                                      const struct sctp_association *asoc,
                                      const sctp_subtype_t type,
                                      void *arg,
@@ -4242,7 +4309,7 @@ sctp_disposition_t sctp_sf_violation(const struct sctp_endpoint *ep,
 
         /* Make sure that the chunk has a valid length. */
         if (!sctp_chunk_length_valid(chunk, sizeof(sctp_chunkhdr_t)))
-                return sctp_sf_violation_chunklen(ep, asoc, type, arg,
+                return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
                                                   commands);
 
         return SCTP_DISPOSITION_VIOLATION;
@@ -4252,6 +4319,7 @@ sctp_disposition_t sctp_sf_violation(const struct sctp_endpoint *ep,
  * Common function to handle a protocol violation.
  */
 static sctp_disposition_t sctp_sf_abort_violation(
+                                     struct net *net,
                                      const struct sctp_endpoint *ep,
                                      const struct sctp_association *asoc,
                                      void *arg,
@@ -4302,7 +4370,7 @@ static sctp_disposition_t sctp_sf_abort_violation(
                 }
 
                 sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(abort));
-                SCTP_INC_STATS(SCTP_MIB_OUTCTRLCHUNKS);
+                SCTP_INC_STATS(net, SCTP_MIB_OUTCTRLCHUNKS);
 
                 if (asoc->state <= SCTP_STATE_COOKIE_ECHOED) {
                         sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP,
@@ -4316,10 +4384,10 @@ static sctp_disposition_t sctp_sf_abort_violation(
                                         SCTP_ERROR(ECONNABORTED));
                         sctp_add_cmd_sf(commands, SCTP_CMD_ASSOC_FAILED,
                                         SCTP_PERR(SCTP_ERROR_PROTO_VIOLATION));
-                        SCTP_DEC_STATS(SCTP_MIB_CURRESTAB);
+                        SCTP_DEC_STATS(net, SCTP_MIB_CURRESTAB);
                 }
         } else {
-                packet = sctp_ootb_pkt_new(asoc, chunk);
+                packet = sctp_ootb_pkt_new(net, asoc, chunk);
 
                 if (!packet)
                         goto nomem_pkt;
@@ -4334,13 +4402,13 @@ static sctp_disposition_t sctp_sf_abort_violation(
                 sctp_add_cmd_sf(commands, SCTP_CMD_SEND_PKT,
                         SCTP_PACKET(packet));
 
-                SCTP_INC_STATS(SCTP_MIB_OUTCTRLCHUNKS);
+                SCTP_INC_STATS(net, SCTP_MIB_OUTCTRLCHUNKS);
         }
 
-        SCTP_INC_STATS(SCTP_MIB_ABORTEDS);
+        SCTP_INC_STATS(net, SCTP_MIB_ABORTEDS);
 
 discard:
-        sctp_sf_pdiscard(ep, asoc, SCTP_ST_CHUNK(0), arg, commands);
+        sctp_sf_pdiscard(net, ep, asoc, SCTP_ST_CHUNK(0), arg, commands);
         return SCTP_DISPOSITION_ABORT;
 
 nomem_pkt:
@@ -4369,6 +4437,7 @@ nomem:
  * Generate an  ABORT chunk and terminate the association.
  */
 static sctp_disposition_t sctp_sf_violation_chunklen(
+                                     struct net *net,
                                      const struct sctp_endpoint *ep,
                                      const struct sctp_association *asoc,
                                      const sctp_subtype_t type,
@@ -4377,7 +4446,7 @@ static sctp_disposition_t sctp_sf_violation_chunklen(
 {
         static const char err_str[]="The following chunk had invalid length:";
 
-        return sctp_sf_abort_violation(ep, asoc, arg, commands, err_str,
+        return sctp_sf_abort_violation(net, ep, asoc, arg, commands, err_str,
                                         sizeof(err_str));
 }
 
@@ -4388,6 +4457,7 @@ static sctp_disposition_t sctp_sf_violation_chunklen(
  * the length is considered as invalid.
  */
 static sctp_disposition_t sctp_sf_violation_paramlen(
+                                     struct net *net,
                                      const struct sctp_endpoint *ep,
                                      const struct sctp_association *asoc,
                                      const sctp_subtype_t type,
@@ -4407,17 +4477,17 @@ static sctp_disposition_t sctp_sf_violation_paramlen(
                 goto nomem;
 
         sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(abort));
-        SCTP_INC_STATS(SCTP_MIB_OUTCTRLCHUNKS);
+        SCTP_INC_STATS(net, SCTP_MIB_OUTCTRLCHUNKS);
 
         sctp_add_cmd_sf(commands, SCTP_CMD_SET_SK_ERR,
                         SCTP_ERROR(ECONNABORTED));
         sctp_add_cmd_sf(commands, SCTP_CMD_ASSOC_FAILED,
                         SCTP_PERR(SCTP_ERROR_PROTO_VIOLATION));
-        SCTP_DEC_STATS(SCTP_MIB_CURRESTAB);
-        SCTP_INC_STATS(SCTP_MIB_ABORTEDS);
+        SCTP_DEC_STATS(net, SCTP_MIB_CURRESTAB);
+        SCTP_INC_STATS(net, SCTP_MIB_ABORTEDS);
 
 discard:
-        sctp_sf_pdiscard(ep, asoc, SCTP_ST_CHUNK(0), arg, commands);
+        sctp_sf_pdiscard(net, ep, asoc, SCTP_ST_CHUNK(0), arg, commands);
         return SCTP_DISPOSITION_ABORT;
 nomem:
         return SCTP_DISPOSITION_NOMEM;
@@ -4430,6 +4500,7 @@ nomem:
  * error code.
  */
 static sctp_disposition_t sctp_sf_violation_ctsn(
+                                     struct net *net,
                                      const struct sctp_endpoint *ep,
                                      const struct sctp_association *asoc,
                                      const sctp_subtype_t type,
@@ -4438,7 +4509,7 @@ static sctp_disposition_t sctp_sf_violation_ctsn(
 {
         static const char err_str[]="The cumulative tsn ack beyond the max tsn currently sent:";
 
-        return sctp_sf_abort_violation(ep, asoc, arg, commands, err_str,
+        return sctp_sf_abort_violation(net, ep, asoc, arg, commands, err_str,
                                         sizeof(err_str));
 }
 
@@ -4449,6 +4520,7 @@ static sctp_disposition_t sctp_sf_violation_ctsn(
  * on the path and we may not want to continue this communication.
  */
 static sctp_disposition_t sctp_sf_violation_chunk(
+                                     struct net *net,
                                      const struct sctp_endpoint *ep,
                                      const struct sctp_association *asoc,
                                      const sctp_subtype_t type,
@@ -4458,9 +4530,9 @@ static sctp_disposition_t sctp_sf_violation_chunk(
         static const char err_str[]="The following chunk violates protocol:";
 
         if (!asoc)
-                return sctp_sf_violation(ep, asoc, type, arg, commands);
+                return sctp_sf_violation(net, ep, asoc, type, arg, commands);
 
-        return sctp_sf_abort_violation(ep, asoc, arg, commands, err_str,
+        return sctp_sf_abort_violation(net, ep, asoc, arg, commands, err_str,
                                         sizeof(err_str));
 }
 /***************************************************************************
@@ -4523,7 +4595,8 @@ static sctp_disposition_t sctp_sf_violation_chunk(
  *
  * The return value is a disposition.
  */
-sctp_disposition_t sctp_sf_do_prm_asoc(const struct sctp_endpoint *ep,
+sctp_disposition_t sctp_sf_do_prm_asoc(struct net *net,
+                                       const struct sctp_endpoint *ep,
                                        const struct sctp_association *asoc,
                                        const sctp_subtype_t type,
                                        void *arg,
@@ -4634,7 +4707,8 @@ nomem:
  *
  * The return value is the disposition.
  */
-sctp_disposition_t sctp_sf_do_prm_send(const struct sctp_endpoint *ep,
+sctp_disposition_t sctp_sf_do_prm_send(struct net *net,
+                                       const struct sctp_endpoint *ep,
                                        const struct sctp_association *asoc,
                                        const sctp_subtype_t type,
                                        void *arg,
@@ -4673,6 +4747,7 @@ sctp_disposition_t sctp_sf_do_prm_send(const struct sctp_endpoint *ep,
  * The return value is the disposition.
  */
 sctp_disposition_t sctp_sf_do_9_2_prm_shutdown(
+        struct net *net,
         const struct sctp_endpoint *ep,
         const struct sctp_association *asoc,
         const sctp_subtype_t type,
@@ -4694,7 +4769,7 @@ sctp_disposition_t sctp_sf_do_9_2_prm_shutdown(
 
         disposition = SCTP_DISPOSITION_CONSUME;
         if (sctp_outq_is_empty(&asoc->outqueue)) {
-                disposition = sctp_sf_do_9_2_start_shutdown(ep, asoc, type,
+                disposition = sctp_sf_do_9_2_start_shutdown(net, ep, asoc, type,
                                                             arg, commands);
         }
         return disposition;
@@ -4728,6 +4803,7 @@ sctp_disposition_t sctp_sf_do_9_2_prm_shutdown(
  * The return value is the disposition.
  */
 sctp_disposition_t sctp_sf_do_9_1_prm_abort(
+        struct net *net,
         const struct sctp_endpoint *ep,
         const struct sctp_association *asoc,
         const sctp_subtype_t type,
@@ -4759,14 +4835,15 @@ sctp_disposition_t sctp_sf_do_9_1_prm_abort(
         sctp_add_cmd_sf(commands, SCTP_CMD_ASSOC_FAILED,
                         SCTP_PERR(SCTP_ERROR_USER_ABORT));
 
-        SCTP_INC_STATS(SCTP_MIB_ABORTEDS);
-        SCTP_DEC_STATS(SCTP_MIB_CURRESTAB);
+        SCTP_INC_STATS(net, SCTP_MIB_ABORTEDS);
+        SCTP_DEC_STATS(net, SCTP_MIB_CURRESTAB);
 
         return retval;
 }
 
 /* We tried an illegal operation on an association which is closed.  */
-sctp_disposition_t sctp_sf_error_closed(const struct sctp_endpoint *ep,
+sctp_disposition_t sctp_sf_error_closed(struct net *net,
+                                        const struct sctp_endpoint *ep,
                                         const struct sctp_association *asoc,
                                         const sctp_subtype_t type,
                                         void *arg,
@@ -4779,7 +4856,8 @@ sctp_disposition_t sctp_sf_error_closed(const struct sctp_endpoint *ep,
 /* We tried an illegal operation on an association which is shutting
  * down.
  */
-sctp_disposition_t sctp_sf_error_shutdown(const struct sctp_endpoint *ep,
+sctp_disposition_t sctp_sf_error_shutdown(struct net *net,
+                                          const struct sctp_endpoint *ep,
                                           const struct sctp_association *asoc,
                                           const sctp_subtype_t type,
                                           void *arg,
@@ -4805,6 +4883,7 @@ sctp_disposition_t sctp_sf_error_shutdown(const struct sctp_endpoint *ep,
  * (timers)
  */
 sctp_disposition_t sctp_sf_cookie_wait_prm_shutdown(
+        struct net *net,
         const struct sctp_endpoint *ep,
         const struct sctp_association *asoc,
         const sctp_subtype_t type,
@@ -4817,7 +4896,7 @@ sctp_disposition_t sctp_sf_cookie_wait_prm_shutdown(
         sctp_add_cmd_sf(commands, SCTP_CMD_NEW_STATE,
                         SCTP_STATE(SCTP_STATE_CLOSED));
 
-        SCTP_INC_STATS(SCTP_MIB_SHUTDOWNS);
+        SCTP_INC_STATS(net, SCTP_MIB_SHUTDOWNS);
 
         sctp_add_cmd_sf(commands, SCTP_CMD_DELETE_TCB, SCTP_NULL());
 
@@ -4839,6 +4918,7 @@ sctp_disposition_t sctp_sf_cookie_wait_prm_shutdown(
  * (timers)
  */
 sctp_disposition_t sctp_sf_cookie_echoed_prm_shutdown(
+        struct net *net,
         const struct sctp_endpoint *ep,
         const struct sctp_association *asoc,
         const sctp_subtype_t type,
@@ -4847,7 +4927,7 @@ sctp_disposition_t sctp_sf_cookie_echoed_prm_shutdown(
         /* There is a single T1 timer, so we should be able to use
          * common function with the COOKIE-WAIT state.
          */
-        return sctp_sf_cookie_wait_prm_shutdown(ep, asoc, type, arg, commands);
+        return sctp_sf_cookie_wait_prm_shutdown(net, ep, asoc, type, arg, commands);
 }
 
 /*
@@ -4865,6 +4945,7 @@ sctp_disposition_t sctp_sf_cookie_echoed_prm_shutdown(
  * (timers)
  */
 sctp_disposition_t sctp_sf_cookie_wait_prm_abort(
+        struct net *net,
         const struct sctp_endpoint *ep,
         const struct sctp_association *asoc,
         const sctp_subtype_t type,
@@ -4884,7 +4965,7 @@ sctp_disposition_t sctp_sf_cookie_wait_prm_abort(
         sctp_add_cmd_sf(commands, SCTP_CMD_NEW_STATE,
                         SCTP_STATE(SCTP_STATE_CLOSED));
 
-        SCTP_INC_STATS(SCTP_MIB_ABORTEDS);
+        SCTP_INC_STATS(net, SCTP_MIB_ABORTEDS);
 
         /* Even if we can't send the ABORT due to low memory delete the
          * TCB.  This is a departure from our typical NOMEM handling.
@@ -4914,6 +4995,7 @@ sctp_disposition_t sctp_sf_cookie_wait_prm_abort(
  * (timers)
  */
 sctp_disposition_t sctp_sf_cookie_echoed_prm_abort(
+        struct net *net,
         const struct sctp_endpoint *ep,
         const struct sctp_association *asoc,
         const sctp_subtype_t type,
@@ -4923,7 +5005,7 @@ sctp_disposition_t sctp_sf_cookie_echoed_prm_abort(
         /* There is a single T1 timer, so we should be able to use
          * common function with the COOKIE-WAIT state.
          */
-        return sctp_sf_cookie_wait_prm_abort(ep, asoc, type, arg, commands);
+        return sctp_sf_cookie_wait_prm_abort(net, ep, asoc, type, arg, commands);
 }
 
 /*
@@ -4939,6 +5021,7 @@ sctp_disposition_t sctp_sf_cookie_echoed_prm_abort(
  * (timers)
  */
 sctp_disposition_t sctp_sf_shutdown_pending_prm_abort(
+        struct net *net,
         const struct sctp_endpoint *ep,
         const struct sctp_association *asoc,
         const sctp_subtype_t type,
@@ -4949,7 +5032,7 @@ sctp_disposition_t sctp_sf_shutdown_pending_prm_abort(
         sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP,
                         SCTP_TO(SCTP_EVENT_TIMEOUT_T5_SHUTDOWN_GUARD));
 
-        return sctp_sf_do_9_1_prm_abort(ep, asoc, type, arg, commands);
+        return sctp_sf_do_9_1_prm_abort(net, ep, asoc, type, arg, commands);
 }
 
 /*
@@ -4965,6 +5048,7 @@ sctp_disposition_t sctp_sf_shutdown_pending_prm_abort(
  * (timers)
  */
 sctp_disposition_t sctp_sf_shutdown_sent_prm_abort(
+        struct net *net,
         const struct sctp_endpoint *ep,
         const struct sctp_association *asoc,
         const sctp_subtype_t type,
@@ -4979,7 +5063,7 @@ sctp_disposition_t sctp_sf_shutdown_sent_prm_abort(
         sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP,
                         SCTP_TO(SCTP_EVENT_TIMEOUT_T5_SHUTDOWN_GUARD));
 
-        return sctp_sf_do_9_1_prm_abort(ep, asoc, type, arg, commands);
+        return sctp_sf_do_9_1_prm_abort(net, ep, asoc, type, arg, commands);
 }
 
 /*
@@ -4995,6 +5079,7 @@ sctp_disposition_t sctp_sf_shutdown_sent_prm_abort(
  * (timers)
  */
 sctp_disposition_t sctp_sf_shutdown_ack_sent_prm_abort(
+        struct net *net,
         const struct sctp_endpoint *ep,
         const struct sctp_association *asoc,
         const sctp_subtype_t type,
@@ -5004,7 +5089,7 @@ sctp_disposition_t sctp_sf_shutdown_ack_sent_prm_abort(
         /* The same T2 timer, so we should be able to use
          * common function with the SHUTDOWN-SENT state.
          */
-        return sctp_sf_shutdown_sent_prm_abort(ep, asoc, type, arg, commands);
+        return sctp_sf_shutdown_sent_prm_abort(net, ep, asoc, type, arg, commands);
 }
 
 /*
@@ -5030,6 +5115,7 @@ sctp_disposition_t sctp_sf_shutdown_ack_sent_prm_abort(
  *   association on which a heartbeat should be issued.
  */
 sctp_disposition_t sctp_sf_do_prm_requestheartbeat(
+                                        struct net *net,
                                         const struct sctp_endpoint *ep,
                                         const struct sctp_association *asoc,
                                         const sctp_subtype_t type,
@@ -5061,7 +5147,8 @@ sctp_disposition_t sctp_sf_do_prm_requestheartbeat(
  * When an endpoint has an ASCONF signaled change to be sent to the
  * remote endpoint it should do A1 to A9
  */
-sctp_disposition_t sctp_sf_do_prm_asconf(const struct sctp_endpoint *ep,
+sctp_disposition_t sctp_sf_do_prm_asconf(struct net *net,
+                                        const struct sctp_endpoint *ep,
                                         const struct sctp_association *asoc,
                                         const sctp_subtype_t type,
                                         void *arg,
@@ -5082,6 +5169,7 @@ sctp_disposition_t sctp_sf_do_prm_asconf(const struct sctp_endpoint *ep,
  * The return value is the disposition of the primitive.
  */
 sctp_disposition_t sctp_sf_ignore_primitive(
+        struct net *net,
         const struct sctp_endpoint *ep,
         const struct sctp_association *asoc,
         const sctp_subtype_t type,
@@ -5103,6 +5191,7 @@ sctp_disposition_t sctp_sf_ignore_primitive(
  * retransmit, the stack will immediately send up this notification.
  */
 sctp_disposition_t sctp_sf_do_no_pending_tsn(
+        struct net *net,
         const struct sctp_endpoint *ep,
         const struct sctp_association *asoc,
         const sctp_subtype_t type,
@@ -5134,6 +5223,7 @@ sctp_disposition_t sctp_sf_do_no_pending_tsn(
  * The return value is the disposition.
  */
 sctp_disposition_t sctp_sf_do_9_2_start_shutdown(
+        struct net *net,
         const struct sctp_endpoint *ep,
         const struct sctp_association *asoc,
         const sctp_subtype_t type,
@@ -5203,6 +5293,7 @@ nomem:
  * The return value is the disposition.
  */
 sctp_disposition_t sctp_sf_do_9_2_shutdown_ack(
+        struct net *net,
         const struct sctp_endpoint *ep,
         const struct sctp_association *asoc,
         const sctp_subtype_t type,
@@ -5221,11 +5312,11 @@ sctp_disposition_t sctp_sf_do_9_2_shutdown_ack(
          */
         if (chunk) {
                 if (!sctp_vtag_verify(chunk, asoc))
-                        return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
+                        return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
 
                 /* Make sure that the SHUTDOWN chunk has a valid length. */
                 if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_shutdown_chunk_t)))
-                        return sctp_sf_violation_chunklen(ep, asoc, type, arg,
+                        return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
                                                           commands);
         }
 
@@ -5273,7 +5364,8 @@ nomem:
  *
  * The return value is the disposition of the event.
  */
-sctp_disposition_t sctp_sf_ignore_other(const struct sctp_endpoint *ep,
+sctp_disposition_t sctp_sf_ignore_other(struct net *net,
+                                        const struct sctp_endpoint *ep,
                                         const struct sctp_association *asoc,
                                         const sctp_subtype_t type,
                                         void *arg,
@@ -5298,7 +5390,8 @@ sctp_disposition_t sctp_sf_ignore_other(const struct sctp_endpoint *ep,
  *
  * The return value is the disposition of the chunk.
  */
-sctp_disposition_t sctp_sf_do_6_3_3_rtx(const struct sctp_endpoint *ep,
+sctp_disposition_t sctp_sf_do_6_3_3_rtx(struct net *net,
+                                        const struct sctp_endpoint *ep,
                                         const struct sctp_association *asoc,
                                         const sctp_subtype_t type,
                                         void *arg,
@@ -5306,7 +5399,7 @@ sctp_disposition_t sctp_sf_do_6_3_3_rtx(const struct sctp_endpoint *ep,
 {
         struct sctp_transport *transport = arg;
 
-        SCTP_INC_STATS(SCTP_MIB_T3_RTX_EXPIREDS);
+        SCTP_INC_STATS(net, SCTP_MIB_T3_RTX_EXPIREDS);
 
         if (asoc->overall_error_count >= asoc->max_retrans) {
                 if (asoc->state == SCTP_STATE_SHUTDOWN_PENDING) {
@@ -5327,8 +5420,8 @@ sctp_disposition_t sctp_sf_do_6_3_3_rtx(const struct sctp_endpoint *ep,
                         /* CMD_ASSOC_FAILED calls CMD_DELETE_TCB. */
                         sctp_add_cmd_sf(commands, SCTP_CMD_ASSOC_FAILED,
                                         SCTP_PERR(SCTP_ERROR_NO_ERROR));
-                        SCTP_INC_STATS(SCTP_MIB_ABORTEDS);
-                        SCTP_DEC_STATS(SCTP_MIB_CURRESTAB);
+                        SCTP_INC_STATS(net, SCTP_MIB_ABORTEDS);
+                        SCTP_DEC_STATS(net, SCTP_MIB_CURRESTAB);
                         return SCTP_DISPOSITION_DELETE_TCB;
                 }
         }
@@ -5384,13 +5477,14 @@ sctp_disposition_t sctp_sf_do_6_3_3_rtx(const struct sctp_endpoint *ep,
  * allow. However, an SCTP transmitter MUST NOT be more aggressive than
  * the following algorithms allow.
  */
-sctp_disposition_t sctp_sf_do_6_2_sack(const struct sctp_endpoint *ep,
+sctp_disposition_t sctp_sf_do_6_2_sack(struct net *net,
+                                       const struct sctp_endpoint *ep,
                                        const struct sctp_association *asoc,
                                        const sctp_subtype_t type,
                                        void *arg,
                                        sctp_cmd_seq_t *commands)
 {
-        SCTP_INC_STATS(SCTP_MIB_DELAY_SACK_EXPIREDS);
+        SCTP_INC_STATS(net, SCTP_MIB_DELAY_SACK_EXPIREDS);
         sctp_add_cmd_sf(commands, SCTP_CMD_GEN_SACK, SCTP_FORCE());
         return SCTP_DISPOSITION_CONSUME;
 }
@@ -5414,7 +5508,8 @@ sctp_disposition_t sctp_sf_do_6_2_sack(const struct sctp_endpoint *ep,
  * (timers, events)
  *
  */
-sctp_disposition_t sctp_sf_t1_init_timer_expire(const struct sctp_endpoint *ep,
+sctp_disposition_t sctp_sf_t1_init_timer_expire(struct net *net,
+                                           const struct sctp_endpoint *ep,
                                            const struct sctp_association *asoc,
                                            const sctp_subtype_t type,
                                            void *arg,
@@ -5425,7 +5520,7 @@ sctp_disposition_t sctp_sf_t1_init_timer_expire(const struct sctp_endpoint *ep,
         int attempts = asoc->init_err_counter + 1;
 
         SCTP_DEBUG_PRINTK("Timer T1 expired (INIT).\n");
-        SCTP_INC_STATS(SCTP_MIB_T1_INIT_EXPIREDS);
+        SCTP_INC_STATS(net, SCTP_MIB_T1_INIT_EXPIREDS);
 
         if (attempts <= asoc->max_init_attempts) {
                 bp = (struct sctp_bind_addr *) &asoc->base.bind_addr;
@@ -5475,7 +5570,8 @@ sctp_disposition_t sctp_sf_t1_init_timer_expire(const struct sctp_endpoint *ep,
  * (timers, events)
  *
  */
-sctp_disposition_t sctp_sf_t1_cookie_timer_expire(const struct sctp_endpoint *ep,
+sctp_disposition_t sctp_sf_t1_cookie_timer_expire(struct net *net,
+                                           const struct sctp_endpoint *ep,
                                            const struct sctp_association *asoc,
                                            const sctp_subtype_t type,
                                            void *arg,
@@ -5485,7 +5581,7 @@ sctp_disposition_t sctp_sf_t1_cookie_timer_expire(const struct sctp_endpoint *ep
         int attempts = asoc->init_err_counter + 1;
 
         SCTP_DEBUG_PRINTK("Timer T1 expired (COOKIE-ECHO).\n");
-        SCTP_INC_STATS(SCTP_MIB_T1_COOKIE_EXPIREDS);
+        SCTP_INC_STATS(net, SCTP_MIB_T1_COOKIE_EXPIREDS);
 
         if (attempts <= asoc->max_init_attempts) {
                 repl = sctp_make_cookie_echo(asoc, NULL);
@@ -5523,7 +5619,8 @@ sctp_disposition_t sctp_sf_t1_cookie_timer_expire(const struct sctp_endpoint *ep
  * the T2-Shutdown timer,  giving its peer ample opportunity to transmit
  * all of its queued DATA chunks that have not yet been sent.
  */
-sctp_disposition_t sctp_sf_t2_timer_expire(const struct sctp_endpoint *ep,
+sctp_disposition_t sctp_sf_t2_timer_expire(struct net *net,
+                                           const struct sctp_endpoint *ep,
                                            const struct sctp_association *asoc,
                                            const sctp_subtype_t type,
                                            void *arg,
@@ -5532,7 +5629,7 @@ sctp_disposition_t sctp_sf_t2_timer_expire(const struct sctp_endpoint *ep,
         struct sctp_chunk *reply = NULL;
 
         SCTP_DEBUG_PRINTK("Timer T2 expired.\n");
-        SCTP_INC_STATS(SCTP_MIB_T2_SHUTDOWN_EXPIREDS);
+        SCTP_INC_STATS(net, SCTP_MIB_T2_SHUTDOWN_EXPIREDS);
 
         ((struct sctp_association *)asoc)->shutdown_retries++;
 
@@ -5542,8 +5639,8 @@ sctp_disposition_t sctp_sf_t2_timer_expire(const struct sctp_endpoint *ep,
                 /* Note:  CMD_ASSOC_FAILED calls CMD_DELETE_TCB. */
                 sctp_add_cmd_sf(commands, SCTP_CMD_ASSOC_FAILED,
                                 SCTP_PERR(SCTP_ERROR_NO_ERROR));
-                SCTP_INC_STATS(SCTP_MIB_ABORTEDS);
-                SCTP_DEC_STATS(SCTP_MIB_CURRESTAB);
+                SCTP_INC_STATS(net, SCTP_MIB_ABORTEDS);
+                SCTP_DEC_STATS(net, SCTP_MIB_CURRESTAB);
                 return SCTP_DISPOSITION_DELETE_TCB;
         }
 
@@ -5592,6 +5689,7 @@ nomem:
  * If the T4 RTO timer expires the endpoint should do B1 to B5
  */
 sctp_disposition_t sctp_sf_t4_timer_expire(
+        struct net *net,
         const struct sctp_endpoint *ep,
         const struct sctp_association *asoc,
         const sctp_subtype_t type,
@@ -5601,7 +5699,7 @@ sctp_disposition_t sctp_sf_t4_timer_expire(
         struct sctp_chunk *chunk = asoc->addip_last_asconf;
         struct sctp_transport *transport = chunk->transport;
 
-        SCTP_INC_STATS(SCTP_MIB_T4_RTO_EXPIREDS);
+        SCTP_INC_STATS(net, SCTP_MIB_T4_RTO_EXPIREDS);
 
         /* ADDIP 4.1 B1) Increment the error counters and perform path failure
          * detection on the appropriate destination address as defined in
@@ -5626,8 +5724,8 @@ sctp_disposition_t sctp_sf_t4_timer_expire(
                                 SCTP_ERROR(ETIMEDOUT));
                 sctp_add_cmd_sf(commands, SCTP_CMD_ASSOC_FAILED,
                                 SCTP_PERR(SCTP_ERROR_NO_ERROR));
-                SCTP_INC_STATS(SCTP_MIB_ABORTEDS);
-                SCTP_DEC_STATS(SCTP_MIB_CURRESTAB);
+                SCTP_INC_STATS(net, SCTP_MIB_ABORTEDS);
+                SCTP_DEC_STATS(net, SCTP_MIB_CURRESTAB);
                 return SCTP_DISPOSITION_ABORT;
         }
 
@@ -5662,7 +5760,8 @@ sctp_disposition_t sctp_sf_t4_timer_expire(
  * At the expiration of this timer the sender SHOULD abort the association
  * by sending an ABORT chunk.
  */
-sctp_disposition_t sctp_sf_t5_timer_expire(const struct sctp_endpoint *ep,
+sctp_disposition_t sctp_sf_t5_timer_expire(struct net *net,
+                                           const struct sctp_endpoint *ep,
                                            const struct sctp_association *asoc,
                                            const sctp_subtype_t type,
                                            void *arg,
@@ -5671,7 +5770,7 @@ sctp_disposition_t sctp_sf_t5_timer_expire(const struct sctp_endpoint *ep,
         struct sctp_chunk *reply = NULL;
 
         SCTP_DEBUG_PRINTK("Timer T5 expired.\n");
-        SCTP_INC_STATS(SCTP_MIB_T5_SHUTDOWN_GUARD_EXPIREDS);
+        SCTP_INC_STATS(net, SCTP_MIB_T5_SHUTDOWN_GUARD_EXPIREDS);
 
         reply = sctp_make_abort(asoc, NULL, 0);
         if (!reply)
@@ -5683,8 +5782,8 @@ sctp_disposition_t sctp_sf_t5_timer_expire(const struct sctp_endpoint *ep,
         sctp_add_cmd_sf(commands, SCTP_CMD_ASSOC_FAILED,
                         SCTP_PERR(SCTP_ERROR_NO_ERROR));
 
-        SCTP_INC_STATS(SCTP_MIB_ABORTEDS);
-        SCTP_DEC_STATS(SCTP_MIB_CURRESTAB);
+        SCTP_INC_STATS(net, SCTP_MIB_ABORTEDS);
+        SCTP_DEC_STATS(net, SCTP_MIB_CURRESTAB);
 
         return SCTP_DISPOSITION_DELETE_TCB;
 nomem:
@@ -5697,6 +5796,7 @@ nomem:
  * the user.  So this routine looks same as sctp_sf_do_9_2_prm_shutdown().
  */
 sctp_disposition_t sctp_sf_autoclose_timer_expire(
+        struct net *net,
         const struct sctp_endpoint *ep,
         const struct sctp_association *asoc,
         const sctp_subtype_t type,
@@ -5705,7 +5805,7 @@ sctp_disposition_t sctp_sf_autoclose_timer_expire(
 {
         int disposition;
 
-        SCTP_INC_STATS(SCTP_MIB_AUTOCLOSE_EXPIREDS);
+        SCTP_INC_STATS(net, SCTP_MIB_AUTOCLOSE_EXPIREDS);
 
         /* From 9.2 Shutdown of an Association
          * Upon receipt of the SHUTDOWN primitive from its upper
@@ -5720,7 +5820,7 @@ sctp_disposition_t sctp_sf_autoclose_timer_expire(
 
         disposition = SCTP_DISPOSITION_CONSUME;
         if (sctp_outq_is_empty(&asoc->outqueue)) {
-                disposition = sctp_sf_do_9_2_start_shutdown(ep, asoc, type,
+                disposition = sctp_sf_do_9_2_start_shutdown(net, ep, asoc, type,
                                                             arg, commands);
         }
         return disposition;
@@ -5738,7 +5838,8 @@ sctp_disposition_t sctp_sf_autoclose_timer_expire(
  *
  * The return value is the disposition of the chunk.
  */
-sctp_disposition_t sctp_sf_not_impl(const struct sctp_endpoint *ep,
+sctp_disposition_t sctp_sf_not_impl(struct net *net,
+                                    const struct sctp_endpoint *ep,
                                     const struct sctp_association *asoc,
                                     const sctp_subtype_t type,
                                     void *arg,
@@ -5755,7 +5856,8 @@ sctp_disposition_t sctp_sf_not_impl(const struct sctp_endpoint *ep,
  *
  * The return value is the disposition of the chunk.
  */
-sctp_disposition_t sctp_sf_bug(const struct sctp_endpoint *ep,
+sctp_disposition_t sctp_sf_bug(struct net *net,
+                               const struct sctp_endpoint *ep,
                                const struct sctp_association *asoc,
                                const sctp_subtype_t type,
                                void *arg,
@@ -5775,7 +5877,8 @@ sctp_disposition_t sctp_sf_bug(const struct sctp_endpoint *ep,
  *
  * The return value is the disposition of the chunk.
  */
-sctp_disposition_t sctp_sf_timer_ignore(const struct sctp_endpoint *ep,
+sctp_disposition_t sctp_sf_timer_ignore(struct net *net,
+                                        const struct sctp_endpoint *ep,
                                         const struct sctp_association *asoc,
                                         const sctp_subtype_t type,
                                         void *arg,
@@ -5817,7 +5920,8 @@ static struct sctp_sackhdr *sctp_sm_pull_sack(struct sctp_chunk *chunk)
 /* Create an ABORT packet to be sent as a response, with the specified
  * error causes.
  */
-static struct sctp_packet *sctp_abort_pkt_new(const struct sctp_endpoint *ep,
+static struct sctp_packet *sctp_abort_pkt_new(struct net *net,
+                                  const struct sctp_endpoint *ep,
                                   const struct sctp_association *asoc,
                                   struct sctp_chunk *chunk,
                                   const void *payload,
@@ -5826,7 +5930,7 @@ static struct sctp_packet *sctp_abort_pkt_new(const struct sctp_endpoint *ep,
         struct sctp_packet *packet;
         struct sctp_chunk *abort;
 
-        packet = sctp_ootb_pkt_new(asoc, chunk);
+        packet = sctp_ootb_pkt_new(net, asoc, chunk);
 
         if (packet) {
                 /* Make an ABORT.
@@ -5858,7 +5962,8 @@ static struct sctp_packet *sctp_abort_pkt_new(const struct sctp_endpoint *ep,
 }
 
 /* Allocate a packet for responding in the OOTB conditions.  */
-static struct sctp_packet *sctp_ootb_pkt_new(const struct sctp_association *asoc,
+static struct sctp_packet *sctp_ootb_pkt_new(struct net *net,
+                                             const struct sctp_association *asoc,
                                              const struct sctp_chunk *chunk)
 {
         struct sctp_packet *packet;
@@ -5911,7 +6016,7 @@ static struct sctp_packet *sctp_ootb_pkt_new(const struct sctp_association *asoc
         }
 
         /* Make a transport for the bucket, Eliza... */
-        transport = sctp_transport_new(sctp_source(chunk), GFP_ATOMIC);
+        transport = sctp_transport_new(net, sctp_source(chunk), GFP_ATOMIC);
         if (!transport)
                 goto nomem;
 
@@ -5919,7 +6024,7 @@ static struct sctp_packet *sctp_ootb_pkt_new(const struct sctp_association *asoc
          * the source address.
          */
         sctp_transport_route(transport, (union sctp_addr *)&chunk->dest,
-                             sctp_sk(sctp_get_ctl_sock()));
+                             sctp_sk(net->sctp.ctl_sock));
 
         packet = sctp_packet_init(&transport->packet, transport, sport, dport);
         packet = sctp_packet_config(packet, vtag, 0);
@@ -5937,7 +6042,8 @@ void sctp_ootb_pkt_free(struct sctp_packet *packet)
 }
 
 /* Send a stale cookie error when a invalid COOKIE ECHO chunk is found  */
-static void sctp_send_stale_cookie_err(const struct sctp_endpoint *ep,
+static void sctp_send_stale_cookie_err(struct net *net,
+                                       const struct sctp_endpoint *ep,
                                        const struct sctp_association *asoc,
                                        const struct sctp_chunk *chunk,
                                        sctp_cmd_seq_t *commands,
@@ -5946,7 +6052,7 @@ static void sctp_send_stale_cookie_err(const struct sctp_endpoint *ep,
         struct sctp_packet *packet;
 
         if (err_chunk) {
-                packet = sctp_ootb_pkt_new(asoc, chunk);
+                packet = sctp_ootb_pkt_new(net, asoc, chunk);
                 if (packet) {
                         struct sctp_signed_cookie *cookie;
 
@@ -5959,7 +6065,7 @@ static void sctp_send_stale_cookie_err(const struct sctp_endpoint *ep,
                         sctp_packet_append_chunk(packet, err_chunk);
                         sctp_add_cmd_sf(commands, SCTP_CMD_SEND_PKT,
                                         SCTP_PACKET(packet));
-                        SCTP_INC_STATS(SCTP_MIB_OUTCTRLCHUNKS);
+                        SCTP_INC_STATS(net, SCTP_MIB_OUTCTRLCHUNKS);
                 } else
                         sctp_chunk_free (err_chunk);
         }
@@ -5979,6 +6085,7 @@ static int sctp_eat_data(const struct sctp_association *asoc,
         __u32 tsn;
         struct sctp_tsnmap *map = (struct sctp_tsnmap *)&asoc->peer.tsn_map;
         struct sock *sk = asoc->base.sk;
+        struct net *net = sock_net(sk);
         u16 ssn;
         u16 sid;
         u8 ordered = 0;
@@ -6109,8 +6216,8 @@ static int sctp_eat_data(const struct sctp_association *asoc,
                                 SCTP_ERROR(ECONNABORTED));
                 sctp_add_cmd_sf(commands, SCTP_CMD_ASSOC_FAILED,
                                 SCTP_PERR(SCTP_ERROR_NO_DATA));
-                SCTP_INC_STATS(SCTP_MIB_ABORTEDS);
-                SCTP_DEC_STATS(SCTP_MIB_CURRESTAB);
+                SCTP_INC_STATS(net, SCTP_MIB_ABORTEDS);
+                SCTP_DEC_STATS(net, SCTP_MIB_CURRESTAB);
                 return SCTP_IERROR_NO_DATA;
         }
 
@@ -6120,9 +6227,9 @@ static int sctp_eat_data(const struct sctp_association *asoc,
          * if we renege and the chunk arrives again.
          */
         if (chunk->chunk_hdr->flags & SCTP_DATA_UNORDERED)
-                SCTP_INC_STATS(SCTP_MIB_INUNORDERCHUNKS);
+                SCTP_INC_STATS(net, SCTP_MIB_INUNORDERCHUNKS);
         else {
-                SCTP_INC_STATS(SCTP_MIB_INORDERCHUNKS);
+                SCTP_INC_STATS(net, SCTP_MIB_INORDERCHUNKS);
                 ordered = 1;
         }
 
diff --git a/net/sctp/sm_statetable.c b/net/sctp/sm_statetable.c
index 7c211a7f90f4..84d98d8a5a74 100644
--- a/net/sctp/sm_statetable.c
+++ b/net/sctp/sm_statetable.c
@@ -59,7 +59,8 @@ other_event_table[SCTP_NUM_OTHER_TYPES][SCTP_STATE_NUM_STATES];
 static const sctp_sm_table_entry_t
 timeout_event_table[SCTP_NUM_TIMEOUT_TYPES][SCTP_STATE_NUM_STATES];
 
-static const sctp_sm_table_entry_t *sctp_chunk_event_lookup(sctp_cid_t cid,
+static const sctp_sm_table_entry_t *sctp_chunk_event_lookup(struct net *net,
+                                                            sctp_cid_t cid,
                                                             sctp_state_t state);
 
 
@@ -82,13 +83,14 @@ static const sctp_sm_table_entry_t bug = {
         rtn;                                                            \
 })
 
-const sctp_sm_table_entry_t *sctp_sm_lookup_event(sctp_event_t event_type,
+const sctp_sm_table_entry_t *sctp_sm_lookup_event(struct net *net,
+                                                  sctp_event_t event_type,
                                                   sctp_state_t state,
                                                   sctp_subtype_t event_subtype)
 {
         switch (event_type) {
         case SCTP_EVENT_T_CHUNK:
-                return sctp_chunk_event_lookup(event_subtype.chunk, state);
+                return sctp_chunk_event_lookup(net, event_subtype.chunk, state);
         case SCTP_EVENT_T_TIMEOUT:
                 return DO_LOOKUP(SCTP_EVENT_TIMEOUT_MAX, timeout,
                                  timeout_event_table);
@@ -906,7 +908,8 @@ static const sctp_sm_table_entry_t timeout_event_table[SCTP_NUM_TIMEOUT_TYPES][S
         TYPE_SCTP_EVENT_TIMEOUT_AUTOCLOSE,
 };
 
-static const sctp_sm_table_entry_t *sctp_chunk_event_lookup(sctp_cid_t cid,
+static const sctp_sm_table_entry_t *sctp_chunk_event_lookup(struct net *net,
+                                                            sctp_cid_t cid,
                                                             sctp_state_t state)
 {
         if (state > SCTP_STATE_MAX)
@@ -915,12 +918,12 @@ static const sctp_sm_table_entry_t *sctp_chunk_event_lookup(sctp_cid_t cid,
         if (cid <= SCTP_CID_BASE_MAX)
                 return &chunk_event_table[cid][state];
 
-        if (sctp_prsctp_enable) {
+        if (net->sctp.prsctp_enable) {
                 if (cid == SCTP_CID_FWD_TSN)
                         return &prsctp_chunk_event_table[0][state];
         }
 
-        if (sctp_addip_enable) {
+        if (net->sctp.addip_enable) {
                 if (cid == SCTP_CID_ASCONF)
                         return &addip_chunk_event_table[0][state];
 
@@ -928,7 +931,7 @@ static const sctp_sm_table_entry_t *sctp_chunk_event_lookup(sctp_cid_t cid,
                         return &addip_chunk_event_table[1][state];
         }
 
-        if (sctp_auth_enable) {
+        if (net->sctp.auth_enable) {
                 if (cid == SCTP_CID_AUTH)
                         return &auth_chunk_event_table[0][state];
         }
diff --git a/net/sctp/socket.c b/net/sctp/socket.c
index 5e259817a7f3..d37d24ff197f 100644
--- a/net/sctp/socket.c
+++ b/net/sctp/socket.c
@@ -427,6 +427,7 @@ SCTP_STATIC int sctp_do_bind(struct sock *sk, union sctp_addr *addr, int len)
 static int sctp_send_asconf(struct sctp_association *asoc,
                             struct sctp_chunk *chunk)
 {
+        struct net      *net = sock_net(asoc->base.sk);
         int             retval = 0;
 
         /* If there is an outstanding ASCONF chunk, queue it for later
@@ -439,7 +440,7 @@ static int sctp_send_asconf(struct sctp_association *asoc,
 
         /* Hold the chunk until an ASCONF_ACK is received. */
         sctp_chunk_hold(chunk);
-        retval = sctp_primitive_ASCONF(asoc, chunk);
+        retval = sctp_primitive_ASCONF(net, asoc, chunk);
         if (retval)
                 sctp_chunk_free(chunk);
         else
@@ -515,6 +516,7 @@ static int sctp_send_asconf_add_ip(struct sock		*sk,
                                    struct sockaddr      *addrs,
                                    int                  addrcnt)
 {
+        struct net *net = sock_net(sk);
         struct sctp_sock                *sp;
         struct sctp_endpoint            *ep;
         struct sctp_association         *asoc;
@@ -529,7 +531,7 @@ static int sctp_send_asconf_add_ip(struct sock		*sk,
         int                             i;
         int                             retval = 0;
 
-        if (!sctp_addip_enable)
+        if (!net->sctp.addip_enable)
                 return retval;
 
         sp = sctp_sk(sk);
@@ -717,6 +719,7 @@ static int sctp_send_asconf_del_ip(struct sock		*sk,
                                    struct sockaddr      *addrs,
                                    int                  addrcnt)
 {
+        struct net *net = sock_net(sk);
         struct sctp_sock        *sp;
         struct sctp_endpoint    *ep;
         struct sctp_association *asoc;
@@ -732,7 +735,7 @@ static int sctp_send_asconf_del_ip(struct sock		*sk,
         int                     stored = 0;
 
         chunk = NULL;
-        if (!sctp_addip_enable)
+        if (!net->sctp.addip_enable)
                 return retval;
 
         sp = sctp_sk(sk);
@@ -1050,6 +1053,7 @@ static int __sctp_connect(struct sock* sk,
                           int addrs_size,
                           sctp_assoc_t *assoc_id)
 {
+        struct net *net = sock_net(sk);
         struct sctp_sock *sp;
         struct sctp_endpoint *ep;
         struct sctp_association *asoc = NULL;
@@ -1200,7 +1204,7 @@ static int __sctp_connect(struct sock* sk,
                         goto out_free;
         }
 
-        err = sctp_primitive_ASSOCIATE(asoc, NULL);
+        err = sctp_primitive_ASSOCIATE(net, asoc, NULL);
         if (err < 0) {
                 goto out_free;
         }
@@ -1458,6 +1462,7 @@ SCTP_STATIC int sctp_getsockopt_connectx3(struct sock* sk, int len,
  */
 SCTP_STATIC void sctp_close(struct sock *sk, long timeout)
 {
+        struct net *net = sock_net(sk);
         struct sctp_endpoint *ep;
         struct sctp_association *asoc;
         struct list_head *pos, *temp;
@@ -1499,9 +1504,9 @@ SCTP_STATIC void sctp_close(struct sock *sk, long timeout)
 
                         chunk = sctp_make_abort_user(asoc, NULL, 0);
                         if (chunk)
-                                sctp_primitive_ABORT(asoc, chunk);
+                                sctp_primitive_ABORT(net, asoc, chunk);
                 } else
-                        sctp_primitive_SHUTDOWN(asoc, NULL);
+                        sctp_primitive_SHUTDOWN(net, asoc, NULL);
         }
 
         /* On a TCP-style socket, block for at most linger_time if set. */
@@ -1569,6 +1574,7 @@ SCTP_STATIC int sctp_msghdr_parse(const struct msghdr *, sctp_cmsgs_t *);
 SCTP_STATIC int sctp_sendmsg(struct kiocb *iocb, struct sock *sk,
                              struct msghdr *msg, size_t msg_len)
 {
+        struct net *net = sock_net(sk);
         struct sctp_sock *sp;
         struct sctp_endpoint *ep;
         struct sctp_association *new_asoc=NULL, *asoc=NULL;
@@ -1714,7 +1720,7 @@ SCTP_STATIC int sctp_sendmsg(struct kiocb *iocb, struct sock *sk,
                 if (sinfo_flags & SCTP_EOF) {
                         SCTP_DEBUG_PRINTK("Shutting down association: %p\n",
                                           asoc);
-                        sctp_primitive_SHUTDOWN(asoc, NULL);
+                        sctp_primitive_SHUTDOWN(net, asoc, NULL);
                         err = 0;
                         goto out_unlock;
                 }
@@ -1727,7 +1733,7 @@ SCTP_STATIC int sctp_sendmsg(struct kiocb *iocb, struct sock *sk,
                         }
 
                         SCTP_DEBUG_PRINTK("Aborting association: %p\n", asoc);
-                        sctp_primitive_ABORT(asoc, chunk);
+                        sctp_primitive_ABORT(net, asoc, chunk);
                         err = 0;
                         goto out_unlock;
                 }
@@ -1900,7 +1906,7 @@ SCTP_STATIC int sctp_sendmsg(struct kiocb *iocb, struct sock *sk,
 
         /* Auto-connect, if we aren't connected already. */
         if (sctp_state(asoc, CLOSED)) {
-                err = sctp_primitive_ASSOCIATE(asoc, NULL);
+                err = sctp_primitive_ASSOCIATE(net, asoc, NULL);
                 if (err < 0)
                         goto out_free;
                 SCTP_DEBUG_PRINTK("We associated primitively.\n");
@@ -1928,7 +1934,7 @@ SCTP_STATIC int sctp_sendmsg(struct kiocb *iocb, struct sock *sk,
          * works that way today.  Keep it that way or this
          * breaks.
          */
-        err = sctp_primitive_SEND(asoc, datamsg);
+        err = sctp_primitive_SEND(net, asoc, datamsg);
         /* Did the lower layer accept the chunk? */
         if (err)
                 sctp_datamsg_free(datamsg);
@@ -2320,7 +2326,9 @@ static int sctp_apply_peer_addr_params(struct sctp_paddrparams *params,
         int error;
 
         if (params->spp_flags & SPP_HB_DEMAND && trans) {
-                error = sctp_primitive_REQUESTHEARTBEAT (trans->asoc, trans);
+                struct net *net = sock_net(trans->asoc->base.sk);
+
+                error = sctp_primitive_REQUESTHEARTBEAT(net, trans->asoc, trans);
                 if (error)
                         return error;
         }
@@ -3033,6 +3041,7 @@ static int sctp_setsockopt_maxseg(struct sock *sk, char __user *optval, unsigned
 static int sctp_setsockopt_peer_primary_addr(struct sock *sk, char __user *optval,
                                              unsigned int optlen)
 {
+        struct net *net = sock_net(sk);
         struct sctp_sock        *sp;
         struct sctp_association *asoc = NULL;
         struct sctp_setpeerprim prim;
@@ -3042,7 +3051,7 @@ static int sctp_setsockopt_peer_primary_addr(struct sock *sk, char __user *optva
 
         sp = sctp_sk(sk);
 
-        if (!sctp_addip_enable)
+        if (!net->sctp.addip_enable)
                 return -EPERM;
 
         if (optlen != sizeof(struct sctp_setpeerprim))
@@ -3279,9 +3288,10 @@ static int sctp_setsockopt_auth_chunk(struct sock *sk,
                                       char __user *optval,
                                       unsigned int optlen)
 {
+        struct net *net = sock_net(sk);
         struct sctp_authchunk val;
 
-        if (!sctp_auth_enable)
+        if (!net->sctp.auth_enable)
                 return -EACCES;
 
         if (optlen != sizeof(struct sctp_authchunk))
@@ -3311,11 +3321,12 @@ static int sctp_setsockopt_hmac_ident(struct sock *sk,
                                       char __user *optval,
                                       unsigned int optlen)
 {
+        struct net *net = sock_net(sk);
         struct sctp_hmacalgo *hmacs;
         u32 idents;
         int err;
 
-        if (!sctp_auth_enable)
+        if (!net->sctp.auth_enable)
                 return -EACCES;
 
         if (optlen < sizeof(struct sctp_hmacalgo))
@@ -3348,11 +3359,12 @@ static int sctp_setsockopt_auth_key(struct sock *sk,
                                     char __user *optval,
                                     unsigned int optlen)
 {
+        struct net *net = sock_net(sk);
         struct sctp_authkey *authkey;
         struct sctp_association *asoc;
         int ret;
 
-        if (!sctp_auth_enable)
+        if (!net->sctp.auth_enable)
                 return -EACCES;
 
         if (optlen <= sizeof(struct sctp_authkey))
@@ -3389,10 +3401,11 @@ static int sctp_setsockopt_active_key(struct sock *sk,
                                       char __user *optval,
                                       unsigned int optlen)
 {
+        struct net *net = sock_net(sk);
         struct sctp_authkeyid val;
         struct sctp_association *asoc;
 
-        if (!sctp_auth_enable)
+        if (!net->sctp.auth_enable)
                 return -EACCES;
 
         if (optlen != sizeof(struct sctp_authkeyid))
@@ -3417,10 +3430,11 @@ static int sctp_setsockopt_del_key(struct sock *sk,
                                    char __user *optval,
                                    unsigned int optlen)
 {
+        struct net *net = sock_net(sk);
         struct sctp_authkeyid val;
         struct sctp_association *asoc;
 
-        if (!sctp_auth_enable)
+        if (!net->sctp.auth_enable)
                 return -EACCES;
 
         if (optlen != sizeof(struct sctp_authkeyid))
@@ -3471,7 +3485,7 @@ static int sctp_setsockopt_auto_asconf(struct sock *sk, char __user *optval,
                 sp->do_auto_asconf = 0;
         } else if (val && !sp->do_auto_asconf) {
                 list_add_tail(&sp->auto_asconf_list,
-                    &sctp_auto_asconf_splist);
+                    &sock_net(sk)->sctp.auto_asconf_splist);
                 sp->do_auto_asconf = 1;
         }
         return 0;
@@ -3843,6 +3857,7 @@ out:
  */
 SCTP_STATIC int sctp_init_sock(struct sock *sk)
 {
+        struct net *net = sock_net(sk);
         struct sctp_endpoint *ep;
         struct sctp_sock *sp;
 
@@ -3872,7 +3887,7 @@ SCTP_STATIC int sctp_init_sock(struct sock *sk)
         sp->default_timetolive = 0;
 
         sp->default_rcv_context = 0;
-        sp->max_burst = sctp_max_burst;
+        sp->max_burst = net->sctp.max_burst;
 
         /* Initialize default setup parameters. These parameters
          * can be modified with the SCTP_INITMSG socket option or
@@ -3880,24 +3895,24 @@ SCTP_STATIC int sctp_init_sock(struct sock *sk)
          */
         sp->initmsg.sinit_num_ostreams   = sctp_max_outstreams;
         sp->initmsg.sinit_max_instreams  = sctp_max_instreams;
-        sp->initmsg.sinit_max_attempts   = sctp_max_retrans_init;
-        sp->initmsg.sinit_max_init_timeo = sctp_rto_max;
+        sp->initmsg.sinit_max_attempts   = net->sctp.max_retrans_init;
+        sp->initmsg.sinit_max_init_timeo = net->sctp.rto_max;
 
         /* Initialize default RTO related parameters.  These parameters can
          * be modified for with the SCTP_RTOINFO socket option.
          */
-        sp->rtoinfo.srto_initial = sctp_rto_initial;
-        sp->rtoinfo.srto_max     = sctp_rto_max;
-        sp->rtoinfo.srto_min     = sctp_rto_min;
+        sp->rtoinfo.srto_initial = net->sctp.rto_initial;
+        sp->rtoinfo.srto_max     = net->sctp.rto_max;
+        sp->rtoinfo.srto_min     = net->sctp.rto_min;
 
         /* Initialize default association related parameters. These parameters
          * can be modified with the SCTP_ASSOCINFO socket option.
          */
-        sp->assocparams.sasoc_asocmaxrxt = sctp_max_retrans_association;
+        sp->assocparams.sasoc_asocmaxrxt = net->sctp.max_retrans_association;
         sp->assocparams.sasoc_number_peer_destinations = 0;
         sp->assocparams.sasoc_peer_rwnd = 0;
         sp->assocparams.sasoc_local_rwnd = 0;
-        sp->assocparams.sasoc_cookie_life = sctp_valid_cookie_life;
+        sp->assocparams.sasoc_cookie_life = net->sctp.valid_cookie_life;
 
         /* Initialize default event subscriptions. By default, all the
          * options are off.
@@ -3907,10 +3922,10 @@ SCTP_STATIC int sctp_init_sock(struct sock *sk)
         /* Default Peer Address Parameters.  These defaults can
          * be modified via SCTP_PEER_ADDR_PARAMS
          */
-        sp->hbinterval  = sctp_hb_interval;
-        sp->pathmaxrxt  = sctp_max_retrans_path;
+        sp->hbinterval  = net->sctp.hb_interval;
+        sp->pathmaxrxt  = net->sctp.max_retrans_path;
         sp->pathmtu     = 0; // allow default discovery
-        sp->sackdelay   = sctp_sack_timeout;
+        sp->sackdelay   = net->sctp.sack_timeout;
         sp->sackfreq    = 2;
         sp->param_flags = SPP_HB_ENABLE |
                           SPP_PMTUD_ENABLE |
@@ -3961,10 +3976,10 @@ SCTP_STATIC int sctp_init_sock(struct sock *sk)
 
         local_bh_disable();
         percpu_counter_inc(&sctp_sockets_allocated);
-        sock_prot_inuse_add(sock_net(sk), sk->sk_prot, 1);
-        if (sctp_default_auto_asconf) {
+        sock_prot_inuse_add(net, sk->sk_prot, 1);
+        if (net->sctp.default_auto_asconf) {
                 list_add_tail(&sp->auto_asconf_list,
-                    &sctp_auto_asconf_splist);
+                    &net->sctp.auto_asconf_splist);
                 sp->do_auto_asconf = 1;
         } else
                 sp->do_auto_asconf = 0;
@@ -4011,6 +4026,7 @@ SCTP_STATIC void sctp_destroy_sock(struct sock *sk)
  */
 SCTP_STATIC void sctp_shutdown(struct sock *sk, int how)
 {
+        struct net *net = sock_net(sk);
         struct sctp_endpoint *ep;
         struct sctp_association *asoc;
 
@@ -4022,7 +4038,7 @@ SCTP_STATIC void sctp_shutdown(struct sock *sk, int how)
                 if (!list_empty(&ep->asocs)) {
                         asoc = list_entry(ep->asocs.next,
                                           struct sctp_association, asocs);
-                        sctp_primitive_SHUTDOWN(asoc, NULL);
+                        sctp_primitive_SHUTDOWN(net, asoc, NULL);
                 }
         }
 }
@@ -4653,9 +4669,10 @@ static int sctp_copy_laddrs(struct sock *sk, __u16 port, void *to,
         union sctp_addr temp;
         int cnt = 0;
         int addrlen;
+        struct net *net = sock_net(sk);
 
         rcu_read_lock();
-        list_for_each_entry_rcu(addr, &sctp_local_addr_list, list) {
+        list_for_each_entry_rcu(addr, &net->sctp.local_addr_list, list) {
                 if (!addr->valid)
                         continue;
 
@@ -5299,12 +5316,13 @@ static int sctp_getsockopt_maxburst(struct sock *sk, int len,
 static int sctp_getsockopt_hmac_ident(struct sock *sk, int len,
                                     char __user *optval, int __user *optlen)
 {
+        struct net *net = sock_net(sk);
         struct sctp_hmacalgo  __user *p = (void __user *)optval;
         struct sctp_hmac_algo_param *hmacs;
         __u16 data_len = 0;
         u32 num_idents;
 
-        if (!sctp_auth_enable)
+        if (!net->sctp.auth_enable)
                 return -EACCES;
 
         hmacs = sctp_sk(sk)->ep->auth_hmacs_list;
@@ -5328,10 +5346,11 @@ static int sctp_getsockopt_hmac_ident(struct sock *sk, int len,
 static int sctp_getsockopt_active_key(struct sock *sk, int len,
                                     char __user *optval, int __user *optlen)
 {
+        struct net *net = sock_net(sk);
         struct sctp_authkeyid val;
         struct sctp_association *asoc;
 
-        if (!sctp_auth_enable)
+        if (!net->sctp.auth_enable)
                 return -EACCES;
 
         if (len < sizeof(struct sctp_authkeyid))
@@ -5360,6 +5379,7 @@ static int sctp_getsockopt_active_key(struct sock *sk, int len,
 static int sctp_getsockopt_peer_auth_chunks(struct sock *sk, int len,
                                     char __user *optval, int __user *optlen)
 {
+        struct net *net = sock_net(sk);
         struct sctp_authchunks __user *p = (void __user *)optval;
         struct sctp_authchunks val;
         struct sctp_association *asoc;
@@ -5367,7 +5387,7 @@ static int sctp_getsockopt_peer_auth_chunks(struct sock *sk, int len,
         u32    num_chunks = 0;
         char __user *to;
 
-        if (!sctp_auth_enable)
+        if (!net->sctp.auth_enable)
                 return -EACCES;
 
         if (len < sizeof(struct sctp_authchunks))
@@ -5403,6 +5423,7 @@ num:
 static int sctp_getsockopt_local_auth_chunks(struct sock *sk, int len,
                                     char __user *optval, int __user *optlen)
 {
+        struct net *net = sock_net(sk);
         struct sctp_authchunks __user *p = (void __user *)optval;
         struct sctp_authchunks val;
         struct sctp_association *asoc;
@@ -5410,7 +5431,7 @@ static int sctp_getsockopt_local_auth_chunks(struct sock *sk, int len,
         u32    num_chunks = 0;
         char __user *to;
 
-        if (!sctp_auth_enable)
+        if (!net->sctp.auth_enable)
                 return -EACCES;
 
         if (len < sizeof(struct sctp_authchunks))
@@ -5769,7 +5790,7 @@ static void sctp_unhash(struct sock *sk)
  * a fastreuse flag (FIXME: NPI ipg).
  */
 static struct sctp_bind_bucket *sctp_bucket_create(
-        struct sctp_bind_hashbucket *head, unsigned short snum);
+        struct sctp_bind_hashbucket *head, struct net *, unsigned short snum);
 
 static long sctp_get_port_local(struct sock *sk, union sctp_addr *addr)
 {
@@ -5799,11 +5820,12 @@ static long sctp_get_port_local(struct sock *sk, union sctp_addr *addr)
                                 rover = low;
                         if (inet_is_reserved_local_port(rover))
                                 continue;
-                        index = sctp_phashfn(rover);
+                        index = sctp_phashfn(sock_net(sk), rover);
                         head = &sctp_port_hashtable[index];
                         sctp_spin_lock(&head->lock);
                         sctp_for_each_hentry(pp, node, &head->chain)
-                                if (pp->port == rover)
+                                if ((pp->port == rover) &&
+                                    net_eq(sock_net(sk), pp->net))
                                         goto next;
                         break;
                 next:
@@ -5827,10 +5849,10 @@ static long sctp_get_port_local(struct sock *sk, union sctp_addr *addr)
                  * to the port number (snum) - we detect that with the
                  * port iterator, pp being NULL.
                  */
-                head = &sctp_port_hashtable[sctp_phashfn(snum)];
+                head = &sctp_port_hashtable[sctp_phashfn(sock_net(sk), snum)];
                 sctp_spin_lock(&head->lock);
                 sctp_for_each_hentry(pp, node, &head->chain) {
-                        if (pp->port == snum)
+                        if ((pp->port == snum) && net_eq(pp->net, sock_net(sk)))
                                 goto pp_found;
                 }
         }
@@ -5881,7 +5903,7 @@ pp_found:
 pp_not_found:
         /* If there was a hash table miss, create a new port.  */
         ret = 1;
-        if (!pp && !(pp = sctp_bucket_create(head, snum)))
+        if (!pp && !(pp = sctp_bucket_create(head, sock_net(sk), snum)))
                 goto fail_unlock;
 
         /* In either case (hit or miss), make sure fastreuse is 1 only
@@ -6113,7 +6135,7 @@ unsigned int sctp_poll(struct file *file, struct socket *sock, poll_table *wait)
  ********************************************************************/
 
 static struct sctp_bind_bucket *sctp_bucket_create(
-        struct sctp_bind_hashbucket *head, unsigned short snum)
+        struct sctp_bind_hashbucket *head, struct net *net, unsigned short snum)
 {
         struct sctp_bind_bucket *pp;
 
@@ -6123,6 +6145,7 @@ static struct sctp_bind_bucket *sctp_bucket_create(
                 pp->port = snum;
                 pp->fastreuse = 0;
                 INIT_HLIST_HEAD(&pp->owner);
+                pp->net = net;
                 hlist_add_head(&pp->node, &head->chain);
         }
         return pp;
@@ -6142,7 +6165,8 @@ static void sctp_bucket_destroy(struct sctp_bind_bucket *pp)
 static inline void __sctp_put_port(struct sock *sk)
 {
         struct sctp_bind_hashbucket *head =
-                &sctp_port_hashtable[sctp_phashfn(inet_sk(sk)->inet_num)];
+                &sctp_port_hashtable[sctp_phashfn(sock_net(sk),
+                                                  inet_sk(sk)->inet_num)];
         struct sctp_bind_bucket *pp;
 
         sctp_spin_lock(&head->lock);
@@ -6809,7 +6833,8 @@ static void sctp_sock_migrate(struct sock *oldsk, struct sock *newsk,
         newsp->hmac = NULL;
 
         /* Hook this new socket in to the bind_hash list. */
-        head = &sctp_port_hashtable[sctp_phashfn(inet_sk(oldsk)->inet_num)];
+        head = &sctp_port_hashtable[sctp_phashfn(sock_net(oldsk),
+                                                 inet_sk(oldsk)->inet_num)];
         sctp_local_bh_disable();
         sctp_spin_lock(&head->lock);
         pp = sctp_sk(oldsk)->bind_hash;
diff --git a/net/sctp/sysctl.c b/net/sctp/sysctl.c
index 2b2bfe933ff1..70e3ba5cb50b 100644
--- a/net/sctp/sysctl.c
+++ b/net/sctp/sysctl.c
@@ -64,8 +64,34 @@ extern int sysctl_sctp_wmem[3];
 
 static ctl_table sctp_table[] = {
         {
+                .procname       = "sctp_mem",
+                .data           = &sysctl_sctp_mem,
+                .maxlen         = sizeof(sysctl_sctp_mem),
+                .mode           = 0644,
+                .proc_handler   = proc_doulongvec_minmax
+        },
+        {
+                .procname       = "sctp_rmem",
+                .data           = &sysctl_sctp_rmem,
+                .maxlen         = sizeof(sysctl_sctp_rmem),
+                .mode           = 0644,
+                .proc_handler   = proc_dointvec,
+        },
+        {
+                .procname       = "sctp_wmem",
+                .data           = &sysctl_sctp_wmem,
+                .maxlen         = sizeof(sysctl_sctp_wmem),
+                .mode           = 0644,
+                .proc_handler   = proc_dointvec,
+        },
+
+        { /* sentinel */ }
+};
+
+static ctl_table sctp_net_table[] = {
+        {
                 .procname       = "rto_initial",
-                .data           = &sctp_rto_initial,
+                .data           = &init_net.sctp.rto_initial,
                 .maxlen         = sizeof(unsigned int),
                 .mode           = 0644,
                 .proc_handler   = proc_dointvec_minmax,
@@ -74,7 +100,7 @@ static ctl_table sctp_table[] = {
         },
         {
                 .procname       = "rto_min",
-                .data           = &sctp_rto_min,
+                .data           = &init_net.sctp.rto_min,
                 .maxlen         = sizeof(unsigned int),
                 .mode           = 0644,
                 .proc_handler   = proc_dointvec_minmax,
@@ -83,7 +109,7 @@ static ctl_table sctp_table[] = {
         },
         {
                 .procname       = "rto_max",
-                .data           = &sctp_rto_max,
+                .data           = &init_net.sctp.rto_max,
                 .maxlen         = sizeof(unsigned int),
                 .mode           = 0644,
                 .proc_handler   = proc_dointvec_minmax,
@@ -91,17 +117,22 @@ static ctl_table sctp_table[] = {
                 .extra2         = &timer_max
         },
         {
-                .procname       = "valid_cookie_life",
-                .data           = &sctp_valid_cookie_life,
-                .maxlen         = sizeof(unsigned int),
-                .mode           = 0644,
-                .proc_handler   = proc_dointvec_minmax,
-                .extra1         = &one,
-                .extra2         = &timer_max
+                .procname       = "rto_alpha_exp_divisor",
+                .data           = &init_net.sctp.rto_alpha,
+                .maxlen         = sizeof(int),
+                .mode           = 0444,
+                .proc_handler   = proc_dointvec,
+        },
+        {
+                .procname       = "rto_beta_exp_divisor",
+                .data           = &init_net.sctp.rto_beta,
+                .maxlen         = sizeof(int),
+                .mode           = 0444,
+                .proc_handler   = proc_dointvec,
         },
         {
                 .procname       = "max_burst",
-                .data           = &sctp_max_burst,
+                .data           = &init_net.sctp.max_burst,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
                 .proc_handler   = proc_dointvec_minmax,
@@ -109,31 +140,42 @@ static ctl_table sctp_table[] = {
                 .extra2         = &int_max
         },
         {
-                .procname       = "association_max_retrans",
-                .data           = &sctp_max_retrans_association,
+                .procname       = "cookie_preserve_enable",
+                .data           = &init_net.sctp.cookie_preserve_enable,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
+                .proc_handler   = proc_dointvec,
+        },
+        {
+                .procname       = "valid_cookie_life",
+                .data           = &init_net.sctp.valid_cookie_life,
+                .maxlen         = sizeof(unsigned int),
+                .mode           = 0644,
                 .proc_handler   = proc_dointvec_minmax,
-                .extra1         = &one,
-                .extra2         = &int_max
+                .extra1         = &one,
+                .extra2         = &timer_max
         },
         {
-                .procname       = "sndbuf_policy",
-                .data           = &sctp_sndbuf_policy,
+                .procname       = "sack_timeout",
+                .data           = &init_net.sctp.sack_timeout,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
-                .proc_handler   = proc_dointvec,
+                .proc_handler   = proc_dointvec_minmax,
+                .extra1         = &sack_timer_min,
+                .extra2         = &sack_timer_max,
         },
         {
-                .procname       = "rcvbuf_policy",
-                .data           = &sctp_rcvbuf_policy,
-                .maxlen         = sizeof(int),
+                .procname       = "hb_interval",
+                .data           = &init_net.sctp.hb_interval,
+                .maxlen         = sizeof(unsigned int),
                 .mode           = 0644,
-                .proc_handler   = proc_dointvec,
+                .proc_handler   = proc_dointvec_minmax,
+                .extra1         = &one,
+                .extra2         = &timer_max
         },
         {
-                .procname       = "path_max_retrans",
-                .data           = &sctp_max_retrans_path,
+                .procname       = "association_max_retrans",
+                .data           = &init_net.sctp.max_retrans_association,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
                 .proc_handler   = proc_dointvec_minmax,
@@ -141,17 +183,17 @@ static ctl_table sctp_table[] = {
                 .extra2         = &int_max
         },
         {
-                .procname       = "pf_retrans",
-                .data           = &sctp_pf_retrans,
+                .procname       = "path_max_retrans",
+                .data           = &init_net.sctp.max_retrans_path,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
                 .proc_handler   = proc_dointvec_minmax,
-                .extra1         = &zero,
+                .extra1         = &one,
                 .extra2         = &int_max
         },
         {
                 .procname       = "max_init_retransmits",
-                .data           = &sctp_max_retrans_init,
+                .data           = &init_net.sctp.max_retrans_init,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
                 .proc_handler   = proc_dointvec_minmax,
@@ -159,103 +201,66 @@ static ctl_table sctp_table[] = {
                 .extra2         = &int_max
         },
         {
-                .procname       = "hb_interval",
-                .data           = &sctp_hb_interval,
-                .maxlen         = sizeof(unsigned int),
+                .procname       = "pf_retrans",
+                .data           = &init_net.sctp.pf_retrans,
+                .maxlen         = sizeof(int),
                 .mode           = 0644,
                 .proc_handler   = proc_dointvec_minmax,
-                .extra1         = &one,
-                .extra2         = &timer_max
+                .extra1         = &zero,
+                .extra2         = &int_max
         },
         {
-                .procname       = "cookie_preserve_enable",
-                .data           = &sctp_cookie_preserve_enable,
+                .procname       = "sndbuf_policy",
+                .data           = &init_net.sctp.sndbuf_policy,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
                 .proc_handler   = proc_dointvec,
         },
         {
-                .procname       = "rto_alpha_exp_divisor",
-                .data           = &sctp_rto_alpha,
-                .maxlen         = sizeof(int),
-                .mode           = 0444,
-                .proc_handler   = proc_dointvec,
-        },
-        {
-                .procname       = "rto_beta_exp_divisor",
-                .data           = &sctp_rto_beta,
-                .maxlen         = sizeof(int),
-                .mode           = 0444,
-                .proc_handler   = proc_dointvec,
-        },
-        {
-                .procname       = "addip_enable",
-                .data           = &sctp_addip_enable,
+                .procname       = "rcvbuf_policy",
+                .data           = &init_net.sctp.rcvbuf_policy,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
                 .proc_handler   = proc_dointvec,
         },
         {
                 .procname       = "default_auto_asconf",
-                .data           = &sctp_default_auto_asconf,
+                .data           = &init_net.sctp.default_auto_asconf,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
                 .proc_handler   = proc_dointvec,
         },
         {
-                .procname       = "prsctp_enable",
-                .data           = &sctp_prsctp_enable,
+                .procname       = "addip_enable",
+                .data           = &init_net.sctp.addip_enable,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
                 .proc_handler   = proc_dointvec,
         },
         {
-                .procname       = "sack_timeout",
-                .data           = &sctp_sack_timeout,
+                .procname       = "addip_noauth_enable",
+                .data           = &init_net.sctp.addip_noauth,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
-                .proc_handler   = proc_dointvec_minmax,
-                .extra1         = &sack_timer_min,
-                .extra2         = &sack_timer_max,
-        },
-        {
-                .procname       = "sctp_mem",
-                .data           = &sysctl_sctp_mem,
-                .maxlen         = sizeof(sysctl_sctp_mem),
-                .mode           = 0644,
-                .proc_handler   = proc_doulongvec_minmax
-        },
-        {
-                .procname       = "sctp_rmem",
-                .data           = &sysctl_sctp_rmem,
-                .maxlen         = sizeof(sysctl_sctp_rmem),
-                .mode           = 0644,
-                .proc_handler   = proc_dointvec,
-        },
-        {
-                .procname       = "sctp_wmem",
-                .data           = &sysctl_sctp_wmem,
-                .maxlen         = sizeof(sysctl_sctp_wmem),
-                .mode           = 0644,
                 .proc_handler   = proc_dointvec,
         },
         {
-                .procname       = "auth_enable",
-                .data           = &sctp_auth_enable,
+                .procname       = "prsctp_enable",
+                .data           = &init_net.sctp.prsctp_enable,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
                 .proc_handler   = proc_dointvec,
         },
         {
-                .procname       = "addip_noauth_enable",
-                .data           = &sctp_addip_noauth,
+                .procname       = "auth_enable",
+                .data           = &init_net.sctp.auth_enable,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
                 .proc_handler   = proc_dointvec,
         },
         {
                 .procname       = "addr_scope_policy",
-                .data           = &sctp_scope_policy,
+                .data           = &init_net.sctp.scope_policy,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
                 .proc_handler   = proc_dointvec_minmax,
@@ -264,7 +269,7 @@ static ctl_table sctp_table[] = {
         },
         {
                 .procname       = "rwnd_update_shift",
-                .data           = &sctp_rwnd_upd_shift,
+                .data           = &init_net.sctp.rwnd_upd_shift,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
                 .proc_handler   = &proc_dointvec_minmax,
@@ -273,7 +278,7 @@ static ctl_table sctp_table[] = {
         },
         {
                 .procname       = "max_autoclose",
-                .data           = &sctp_max_autoclose,
+                .data           = &init_net.sctp.max_autoclose,
                 .maxlen         = sizeof(unsigned long),
                 .mode           = 0644,
                 .proc_handler   = &proc_doulongvec_minmax,
@@ -284,6 +289,27 @@ static ctl_table sctp_table[] = {
         { /* sentinel */ }
 };
 
+int sctp_sysctl_net_register(struct net *net)
+{
+        struct ctl_table *table;
+        int i;
+
+        table = kmemdup(sctp_net_table, sizeof(sctp_net_table), GFP_KERNEL);
+        if (!table)
+                return -ENOMEM;
+
+        for (i = 0; table[i].data; i++)
+                table[i].data += (char *)(&net->sctp) - (char *)&init_net.sctp;
+
+        net->sctp.sysctl_header = register_net_sysctl(net, "net/sctp", table);
+        return 0;
+}
+
+void sctp_sysctl_net_unregister(struct net *net)
+{
+        unregister_net_sysctl_table(net->sctp.sysctl_header);
+}
+
 static struct ctl_table_header * sctp_sysctl_header;
 
 /* Sysctl registration.  */
diff --git a/net/sctp/transport.c b/net/sctp/transport.c
index c97472b248a2..953c21e4af97 100644
--- a/net/sctp/transport.c
+++ b/net/sctp/transport.c
@@ -59,7 +59,8 @@
 /* 1st Level Abstractions.  */
 
 /* Initialize a new transport from provided memory.  */
-static struct sctp_transport *sctp_transport_init(struct sctp_transport *peer,
+static struct sctp_transport *sctp_transport_init(struct net *net,
+                                                  struct sctp_transport *peer,
                                                   const union sctp_addr *addr,
                                                   gfp_t gfp)
 {
@@ -76,7 +77,7 @@ static struct sctp_transport *sctp_transport_init(struct sctp_transport *peer,
          * given destination transport address, set RTO to the protocol
          * parameter 'RTO.Initial'.
          */
-        peer->rto = msecs_to_jiffies(sctp_rto_initial);
+        peer->rto = msecs_to_jiffies(net->sctp.rto_initial);
 
         peer->last_time_heard = jiffies;
         peer->last_time_ecne_reduced = jiffies;
@@ -86,8 +87,8 @@ static struct sctp_transport *sctp_transport_init(struct sctp_transport *peer,
                             SPP_SACKDELAY_ENABLE;
 
         /* Initialize the default path max_retrans.  */
-        peer->pathmaxrxt  = sctp_max_retrans_path;
-        peer->pf_retrans  = sctp_pf_retrans;
+        peer->pathmaxrxt  = net->sctp.max_retrans_path;
+        peer->pf_retrans  = net->sctp.pf_retrans;
 
         INIT_LIST_HEAD(&peer->transmitted);
         INIT_LIST_HEAD(&peer->send_ready);
@@ -109,7 +110,8 @@ static struct sctp_transport *sctp_transport_init(struct sctp_transport *peer,
 }
 
 /* Allocate and initialize a new transport.  */
-struct sctp_transport *sctp_transport_new(const union sctp_addr *addr,
+struct sctp_transport *sctp_transport_new(struct net *net,
+                                          const union sctp_addr *addr,
                                           gfp_t gfp)
 {
         struct sctp_transport *transport;
@@ -118,7 +120,7 @@ struct sctp_transport *sctp_transport_new(const union sctp_addr *addr,
         if (!transport)
                 goto fail;
 
-        if (!sctp_transport_init(transport, addr, gfp))
+        if (!sctp_transport_init(net, transport, addr, gfp))
                 goto fail_init;
 
         transport->malloced = 1;
@@ -316,6 +318,7 @@ void sctp_transport_update_rto(struct sctp_transport *tp, __u32 rtt)
         SCTP_ASSERT(tp->rto_pending, "rto_pending not set", return);
 
         if (tp->rttvar || tp->srtt) {
+                struct net *net = sock_net(tp->asoc->base.sk);
                 /* 6.3.1 C3) When a new RTT measurement R' is made, set
                  * RTTVAR <- (1 - RTO.Beta) * RTTVAR + RTO.Beta * |SRTT - R'|
                  * SRTT <- (1 - RTO.Alpha) * SRTT + RTO.Alpha * R'
@@ -327,10 +330,10 @@ void sctp_transport_update_rto(struct sctp_transport *tp, __u32 rtt)
                  * For example, assuming the default value of RTO.Alpha of
                  * 1/8, rto_alpha would be expressed as 3.
                  */
-                tp->rttvar = tp->rttvar - (tp->rttvar >> sctp_rto_beta)
-                        + ((abs(tp->srtt - rtt)) >> sctp_rto_beta);
-                tp->srtt = tp->srtt - (tp->srtt >> sctp_rto_alpha)
-                        + (rtt >> sctp_rto_alpha);
+                tp->rttvar = tp->rttvar - (tp->rttvar >> net->sctp.rto_beta)
+                        + ((abs(tp->srtt - rtt)) >> net->sctp.rto_beta);
+                tp->srtt = tp->srtt - (tp->srtt >> net->sctp.rto_alpha)
+                        + (rtt >> net->sctp.rto_alpha);
         } else {
                 /* 6.3.1 C2) When the first RTT measurement R is made, set
                  * SRTT <- R, RTTVAR <- R/2.
diff --git a/net/sctp/ulpqueue.c b/net/sctp/ulpqueue.c
index f5a6a4f4faf7..360d8697b95c 100644
--- a/net/sctp/ulpqueue.c
+++ b/net/sctp/ulpqueue.c
@@ -326,7 +326,9 @@ static void sctp_ulpq_store_reasm(struct sctp_ulpq *ulpq,
  * payload was fragmented on the way and ip had to reassemble them.
  * We add the rest of skb's to the first skb's fraglist.
  */
-static struct sctp_ulpevent *sctp_make_reassembled_event(struct sk_buff_head *queue, struct sk_buff *f_frag, struct sk_buff *l_frag)
+static struct sctp_ulpevent *sctp_make_reassembled_event(struct net *net,
+        struct sk_buff_head *queue, struct sk_buff *f_frag,
+        struct sk_buff *l_frag)
 {
         struct sk_buff *pos;
         struct sk_buff *new = NULL;
@@ -394,7 +396,7 @@ static struct sctp_ulpevent *sctp_make_reassembled_event(struct sk_buff_head *qu
         }
 
         event = sctp_skb2event(f_frag);
-        SCTP_INC_STATS(SCTP_MIB_REASMUSRMSGS);
+        SCTP_INC_STATS(net, SCTP_MIB_REASMUSRMSGS);
 
         return event;
 }
@@ -493,7 +495,8 @@ static struct sctp_ulpevent *sctp_ulpq_retrieve_reassembled(struct sctp_ulpq *ul
                 cevent = sctp_skb2event(pd_first);
                 pd_point = sctp_sk(asoc->base.sk)->pd_point;
                 if (pd_point && pd_point <= pd_len) {
-                        retval = sctp_make_reassembled_event(&ulpq->reasm,
+                        retval = sctp_make_reassembled_event(sock_net(asoc->base.sk),
+                                                             &ulpq->reasm,
                                                              pd_first,
                                                              pd_last);
                         if (retval)
@@ -503,7 +506,8 @@ static struct sctp_ulpevent *sctp_ulpq_retrieve_reassembled(struct sctp_ulpq *ul
 done:
         return retval;
 found:
-        retval = sctp_make_reassembled_event(&ulpq->reasm, first_frag, pos);
+        retval = sctp_make_reassembled_event(sock_net(ulpq->asoc->base.sk),
+                                             &ulpq->reasm, first_frag, pos);
         if (retval)
                 retval->msg_flags |= MSG_EOR;
         goto done;
@@ -563,7 +567,8 @@ static struct sctp_ulpevent *sctp_ulpq_retrieve_partial(struct sctp_ulpq *ulpq)
          * further.
          */
 done:
-        retval = sctp_make_reassembled_event(&ulpq->reasm, first_frag, last_frag);
+        retval = sctp_make_reassembled_event(sock_net(ulpq->asoc->base.sk),
+                                        &ulpq->reasm, first_frag, last_frag);
         if (retval && is_last)
                 retval->msg_flags |= MSG_EOR;
 
@@ -655,7 +660,8 @@ static struct sctp_ulpevent *sctp_ulpq_retrieve_first(struct sctp_ulpq *ulpq)
          * further.
          */
 done:
-        retval = sctp_make_reassembled_event(&ulpq->reasm, first_frag, last_frag);
+        retval = sctp_make_reassembled_event(sock_net(ulpq->asoc->base.sk),
+                                        &ulpq->reasm, first_frag, last_frag);
         return retval;
 }
 
diff --git a/net/socket.c b/net/socket.c
index dfe5b66c97e0..a5471f804d99 100644
--- a/net/socket.c
+++ b/net/socket.c
@@ -2657,6 +2657,7 @@ static int dev_ifconf(struct net *net, struct compat_ifconf __user *uifc32)
         if (copy_from_user(&ifc32, uifc32, sizeof(struct compat_ifconf)))
                 return -EFAULT;
 
+        memset(&ifc, 0, sizeof(ifc));
         if (ifc32.ifcbuf == 0) {
                 ifc32.ifc_len = 0;
                 ifc.ifc_len = 0;
diff --git a/net/tipc/bearer.c b/net/tipc/bearer.c
index 09e71241265d..4ec5c80e8a7c 100644
--- a/net/tipc/bearer.c
+++ b/net/tipc/bearer.c
@@ -49,21 +49,6 @@ struct tipc_bearer tipc_bearers[MAX_BEARERS];
 static void bearer_disable(struct tipc_bearer *b_ptr);
 
 /**
- * media_name_valid - validate media name
- *
- * Returns 1 if media name is valid, otherwise 0.
- */
-static int media_name_valid(const char *name)
-{
-        u32 len;
-
-        len = strlen(name);
-        if ((len + 1) > TIPC_MAX_MEDIA_NAME)
-                return 0;
-        return strspn(name, tipc_alphabet) == len;
-}
-
-/**
  * tipc_media_find - locates specified media object by name
  */
 struct tipc_media *tipc_media_find(const char *name)
@@ -102,7 +87,7 @@ int tipc_register_media(struct tipc_media *m_ptr)
 
         write_lock_bh(&tipc_net_lock);
 
-        if (!media_name_valid(m_ptr->name))
+        if ((strlen(m_ptr->name) + 1) > TIPC_MAX_MEDIA_NAME)
                 goto exit;
         if ((m_ptr->bcast_addr.media_id != m_ptr->type_id) ||
             !m_ptr->bcast_addr.broadcast)
@@ -206,9 +191,7 @@ static int bearer_name_validate(const char *name,
 
         /* validate component parts of bearer name */
         if ((media_len <= 1) || (media_len > TIPC_MAX_MEDIA_NAME) ||
-            (if_len <= 1) || (if_len > TIPC_MAX_IF_NAME) ||
-            (strspn(media_name, tipc_alphabet) != (media_len - 1)) ||
-            (strspn(if_name, tipc_alphabet) != (if_len - 1)))
+            (if_len <= 1) || (if_len > TIPC_MAX_IF_NAME))
                 return 0;
 
         /* return bearer name components, if necessary */
diff --git a/net/tipc/config.c b/net/tipc/config.c
index a056a3852f71..f67866c765dd 100644
--- a/net/tipc/config.c
+++ b/net/tipc/config.c
@@ -2,7 +2,7 @@
  * net/tipc/config.c: TIPC configuration management code
  *
  * Copyright (c) 2002-2006, Ericsson AB
- * Copyright (c) 2004-2007, 2010-2011, Wind River Systems
+ * Copyright (c) 2004-2007, 2010-2012, Wind River Systems
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -208,36 +208,6 @@ static struct sk_buff *cfg_set_remote_mng(void)
         return tipc_cfg_reply_none();
 }
 
-static struct sk_buff *cfg_set_max_publications(void)
-{
-        u32 value;
-
-        if (!TLV_CHECK(req_tlv_area, req_tlv_space, TIPC_TLV_UNSIGNED))
-                return tipc_cfg_reply_error_string(TIPC_CFG_TLV_ERROR);
-
-        value = ntohl(*(__be32 *)TLV_DATA(req_tlv_area));
-        if (value < 1 || value > 65535)
-                return tipc_cfg_reply_error_string(TIPC_CFG_INVALID_VALUE
-                                                   " (max publications must be 1-65535)");
-        tipc_max_publications = value;
-        return tipc_cfg_reply_none();
-}
-
-static struct sk_buff *cfg_set_max_subscriptions(void)
-{
-        u32 value;
-
-        if (!TLV_CHECK(req_tlv_area, req_tlv_space, TIPC_TLV_UNSIGNED))
-                return tipc_cfg_reply_error_string(TIPC_CFG_TLV_ERROR);
-
-        value = ntohl(*(__be32 *)TLV_DATA(req_tlv_area));
-        if (value < 1 || value > 65535)
-                return tipc_cfg_reply_error_string(TIPC_CFG_INVALID_VALUE
-                                                   " (max subscriptions must be 1-65535");
-        tipc_max_subscriptions = value;
-        return tipc_cfg_reply_none();
-}
-
 static struct sk_buff *cfg_set_max_ports(void)
 {
         u32 value;
@@ -357,12 +327,6 @@ struct sk_buff *tipc_cfg_do_cmd(u32 orig_node, u16 cmd, const void *request_area
         case TIPC_CMD_SET_MAX_PORTS:
                 rep_tlv_buf = cfg_set_max_ports();
                 break;
-        case TIPC_CMD_SET_MAX_PUBL:
-                rep_tlv_buf = cfg_set_max_publications();
-                break;
-        case TIPC_CMD_SET_MAX_SUBSCR:
-                rep_tlv_buf = cfg_set_max_subscriptions();
-                break;
         case TIPC_CMD_SET_NETID:
                 rep_tlv_buf = cfg_set_netid();
                 break;
@@ -372,12 +336,6 @@ struct sk_buff *tipc_cfg_do_cmd(u32 orig_node, u16 cmd, const void *request_area
         case TIPC_CMD_GET_MAX_PORTS:
                 rep_tlv_buf = tipc_cfg_reply_unsigned(tipc_max_ports);
                 break;
-        case TIPC_CMD_GET_MAX_PUBL:
-                rep_tlv_buf = tipc_cfg_reply_unsigned(tipc_max_publications);
-                break;
-        case TIPC_CMD_GET_MAX_SUBSCR:
-                rep_tlv_buf = tipc_cfg_reply_unsigned(tipc_max_subscriptions);
-                break;
         case TIPC_CMD_GET_NETID:
                 rep_tlv_buf = tipc_cfg_reply_unsigned(tipc_net_id);
                 break;
@@ -393,6 +351,10 @@ struct sk_buff *tipc_cfg_do_cmd(u32 orig_node, u16 cmd, const void *request_area
         case TIPC_CMD_GET_MAX_CLUSTERS:
         case TIPC_CMD_SET_MAX_NODES:
         case TIPC_CMD_GET_MAX_NODES:
+        case TIPC_CMD_SET_MAX_SUBSCR:
+        case TIPC_CMD_GET_MAX_SUBSCR:
+        case TIPC_CMD_SET_MAX_PUBL:
+        case TIPC_CMD_GET_MAX_PUBL:
         case TIPC_CMD_SET_LOG_SIZE:
         case TIPC_CMD_DUMP_LOG:
                 rep_tlv_buf = tipc_cfg_reply_error_string(TIPC_CFG_NOT_SUPPORTED
diff --git a/net/tipc/core.c b/net/tipc/core.c
index 6586eac6a50e..bfe8af88469a 100644
--- a/net/tipc/core.c
+++ b/net/tipc/core.c
@@ -48,18 +48,13 @@
 
 
 /* global variables used by multiple sub-systems within TIPC */
-int tipc_random;
-
-const char tipc_alphabet[] =
-        "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_.";
+int tipc_random __read_mostly;
 
 /* configurable TIPC parameters */
-u32 tipc_own_addr;
-int tipc_max_ports;
-int tipc_max_subscriptions;
-int tipc_max_publications;
-int tipc_net_id;
-int tipc_remote_management;
+u32 tipc_own_addr __read_mostly;
+int tipc_max_ports __read_mostly;
+int tipc_net_id __read_mostly;
+int tipc_remote_management __read_mostly;
 
 
 /**
@@ -101,9 +96,8 @@ int tipc_core_start_net(unsigned long addr)
 {
         int res;
 
-        res = tipc_net_start(addr);
-        if (!res)
-                res = tipc_eth_media_start();
+        tipc_net_start(addr);
+        res = tipc_eth_media_start();
         if (res)
                 tipc_core_stop_net();
         return res;
@@ -160,8 +154,6 @@ static int __init tipc_init(void)
 
         tipc_own_addr = 0;
         tipc_remote_management = 1;
-        tipc_max_publications = 10000;
-        tipc_max_subscriptions = 2000;
         tipc_max_ports = CONFIG_TIPC_PORTS;
         tipc_net_id = 4711;
 
diff --git a/net/tipc/core.h b/net/tipc/core.h
index fd42e106c185..0207db04179a 100644
--- a/net/tipc/core.h
+++ b/net/tipc/core.h
@@ -60,7 +60,9 @@
 
 #define TIPC_MOD_VER "2.0.0"
 
-#define ULTRA_STRING_MAX_LEN 32768
+#define ULTRA_STRING_MAX_LEN    32768
+#define TIPC_MAX_SUBSCRIPTIONS  65535
+#define TIPC_MAX_PUBLICATIONS   65535
 
 struct tipc_msg;        /* msg.h */
 
@@ -74,19 +76,15 @@ int tipc_snprintf(char *buf, int len, const char *fmt, ...);
 /*
  * Global configuration variables
  */
-extern u32 tipc_own_addr;
-extern int tipc_max_ports;
-extern int tipc_max_subscriptions;
-extern int tipc_max_publications;
-extern int tipc_net_id;
-extern int tipc_remote_management;
+extern u32 tipc_own_addr __read_mostly;
+extern int tipc_max_ports __read_mostly;
+extern int tipc_net_id __read_mostly;
+extern int tipc_remote_management __read_mostly;
 
 /*
  * Other global variables
  */
-extern int tipc_random;
-extern const char tipc_alphabet[];
-
+extern int tipc_random __read_mostly;
 
 /*
  * Routines available to privileged subsystems
diff --git a/net/tipc/eth_media.c b/net/tipc/eth_media.c
index 90ac9bfa7abb..2132c1ef2951 100644
--- a/net/tipc/eth_media.c
+++ b/net/tipc/eth_media.c
@@ -46,19 +46,30 @@
  * @bearer: ptr to associated "generic" bearer structure
  * @dev: ptr to associated Ethernet network device
  * @tipc_packet_type: used in binding TIPC to Ethernet driver
+ * @setup: work item used when enabling bearer
  * @cleanup: work item used when disabling bearer
  */
 struct eth_bearer {
         struct tipc_bearer *bearer;
         struct net_device *dev;
         struct packet_type tipc_packet_type;
+        struct work_struct setup;
         struct work_struct cleanup;
 };
 
 static struct tipc_media eth_media_info;
 static struct eth_bearer eth_bearers[MAX_ETH_BEARERS];
 static int eth_started;
-static struct notifier_block notifier;
+
+static int recv_notification(struct notifier_block *nb, unsigned long evt,
+                              void *dv);
+/*
+ * Network device notifier info
+ */
+static struct notifier_block notifier = {
+        .notifier_call  = recv_notification,
+        .priority       = 0
+};
 
 /**
  * eth_media_addr_set - initialize Ethernet media address structure
@@ -134,6 +145,17 @@ static int recv_msg(struct sk_buff *buf, struct net_device *dev,
 }
 
 /**
+ * setup_bearer - setup association between Ethernet bearer and interface
+ */
+static void setup_bearer(struct work_struct *work)
+{
+        struct eth_bearer *eb_ptr =
+                container_of(work, struct eth_bearer, setup);
+
+        dev_add_pack(&eb_ptr->tipc_packet_type);
+}
+
+/**
  * enable_bearer - attach TIPC bearer to an Ethernet interface
  */
 static int enable_bearer(struct tipc_bearer *tb_ptr)
@@ -173,7 +195,8 @@ static int enable_bearer(struct tipc_bearer *tb_ptr)
         eb_ptr->tipc_packet_type.func = recv_msg;
         eb_ptr->tipc_packet_type.af_packet_priv = eb_ptr;
         INIT_LIST_HEAD(&(eb_ptr->tipc_packet_type.list));
-        dev_add_pack(&eb_ptr->tipc_packet_type);
+        INIT_WORK(&eb_ptr->setup, setup_bearer);
+        schedule_work(&eb_ptr->setup);
 
         /* Associate TIPC bearer with Ethernet bearer */
         eb_ptr->bearer = tb_ptr;
@@ -357,8 +380,6 @@ int tipc_eth_media_start(void)
         if (res)
                 return res;
 
-        notifier.notifier_call = &recv_notification;
-        notifier.priority = 0;
         res = register_netdevice_notifier(&notifier);
         if (!res)
                 eth_started = 1;
diff --git a/net/tipc/handler.c b/net/tipc/handler.c
index 7a52d3922f3c..111ff8300ae5 100644
--- a/net/tipc/handler.c
+++ b/net/tipc/handler.c
@@ -45,7 +45,7 @@ struct queue_item {
 static struct kmem_cache *tipc_queue_item_cache;
 static struct list_head signal_queue_head;
 static DEFINE_SPINLOCK(qitem_lock);
-static int handler_enabled;
+static int handler_enabled __read_mostly;
 
 static void process_signal_queue(unsigned long dummy);
 
diff --git a/net/tipc/link.c b/net/tipc/link.c
index 1c1e6151875e..a79c755cb417 100644
--- a/net/tipc/link.c
+++ b/net/tipc/link.c
@@ -210,9 +210,7 @@ static int link_name_validate(const char *name,
             (z_local > 255) || (c_local > 4095) || (n_local > 4095) ||
             (z_peer  > 255) || (c_peer  > 4095) || (n_peer  > 4095) ||
             (if_local_len <= 1) || (if_local_len > TIPC_MAX_IF_NAME) ||
-            (if_peer_len  <= 1) || (if_peer_len  > TIPC_MAX_IF_NAME) ||
-            (strspn(if_local, tipc_alphabet) != (if_local_len - 1)) ||
-            (strspn(if_peer, tipc_alphabet) != (if_peer_len - 1)))
+            (if_peer_len  <= 1) || (if_peer_len  > TIPC_MAX_IF_NAME))
                 return 0;
 
         /* return link name components, if necessary */
diff --git a/net/tipc/name_table.c b/net/tipc/name_table.c
index 360c478b0b53..98975e80bb51 100644
--- a/net/tipc/name_table.c
+++ b/net/tipc/name_table.c
@@ -41,7 +41,7 @@
 #include "subscr.h"
 #include "port.h"
 
-static int tipc_nametbl_size = 1024;            /* must be a power of 2 */
+#define TIPC_NAMETBL_SIZE 1024          /* must be a power of 2 */
 
 /**
  * struct name_info - name sequence publication info
@@ -114,7 +114,7 @@ DEFINE_RWLOCK(tipc_nametbl_lock);
 
 static int hash(int x)
 {
-        return x & (tipc_nametbl_size - 1);
+        return x & (TIPC_NAMETBL_SIZE - 1);
 }
 
 /**
@@ -667,9 +667,9 @@ struct publication *tipc_nametbl_publish(u32 type, u32 lower, u32 upper,
 {
         struct publication *publ;
 
-        if (table.local_publ_count >= tipc_max_publications) {
+        if (table.local_publ_count >= TIPC_MAX_PUBLICATIONS) {
                 pr_warn("Publication failed, local publication limit reached (%u)\n",
-                        tipc_max_publications);
+                        TIPC_MAX_PUBLICATIONS);
                 return NULL;
         }
 
@@ -871,7 +871,7 @@ static int nametbl_list(char *buf, int len, u32 depth_info,
                 ret += nametbl_header(buf, len, depth);
                 lowbound = 0;
                 upbound = ~0;
-                for (i = 0; i < tipc_nametbl_size; i++) {
+                for (i = 0; i < TIPC_NAMETBL_SIZE; i++) {
                         seq_head = &table.types[i];
                         hlist_for_each_entry(seq, seq_node, seq_head, ns_list) {
                                 ret += nameseq_list(seq, buf + ret, len - ret,
@@ -935,7 +935,7 @@ struct sk_buff *tipc_nametbl_get(const void *req_tlv_area, int req_tlv_space)
 
 int tipc_nametbl_init(void)
 {
-        table.types = kcalloc(tipc_nametbl_size, sizeof(struct hlist_head),
+        table.types = kcalloc(TIPC_NAMETBL_SIZE, sizeof(struct hlist_head),
                               GFP_ATOMIC);
         if (!table.types)
                 return -ENOMEM;
@@ -953,7 +953,7 @@ void tipc_nametbl_stop(void)
 
         /* Verify name table is empty, then release it */
         write_lock_bh(&tipc_nametbl_lock);
-        for (i = 0; i < tipc_nametbl_size; i++) {
+        for (i = 0; i < TIPC_NAMETBL_SIZE; i++) {
                 if (hlist_empty(&table.types[i]))
                         continue;
                 pr_err("nametbl_stop(): orphaned hash chain detected\n");
diff --git a/net/tipc/net.c b/net/tipc/net.c
index 5b5cea259caf..7d305ecc09c2 100644
--- a/net/tipc/net.c
+++ b/net/tipc/net.c
@@ -171,7 +171,7 @@ void tipc_net_route_msg(struct sk_buff *buf)
         tipc_link_send(buf, dnode, msg_link_selector(msg));
 }
 
-int tipc_net_start(u32 addr)
+void tipc_net_start(u32 addr)
 {
         char addr_string[16];
 
@@ -187,7 +187,6 @@ int tipc_net_start(u32 addr)
         pr_info("Started in network mode\n");
         pr_info("Own node address %s, network identity %u\n",
                 tipc_addr_string_fill(addr_string, tipc_own_addr), tipc_net_id);
-        return 0;
 }
 
 void tipc_net_stop(void)
diff --git a/net/tipc/net.h b/net/tipc/net.h
index 9eb4b9e220eb..079daadb3f72 100644
--- a/net/tipc/net.h
+++ b/net/tipc/net.h
@@ -41,7 +41,7 @@ extern rwlock_t tipc_net_lock;
 
 void tipc_net_route_msg(struct sk_buff *buf);
 
-int tipc_net_start(u32 addr);
+void tipc_net_start(u32 addr);
 void tipc_net_stop(void);
 
 #endif
diff --git a/net/tipc/subscr.c b/net/tipc/subscr.c
index 5ed5965eb0be..0f7d0d007e22 100644
--- a/net/tipc/subscr.c
+++ b/net/tipc/subscr.c
@@ -304,9 +304,9 @@ static struct tipc_subscription *subscr_subscribe(struct tipc_subscr *s,
         }
 
         /* Refuse subscription if global limit exceeded */
-        if (atomic_read(&topsrv.subscription_count) >= tipc_max_subscriptions) {
+        if (atomic_read(&topsrv.subscription_count) >= TIPC_MAX_SUBSCRIPTIONS) {
                 pr_warn("Subscription rejected, limit reached (%u)\n",
-                        tipc_max_subscriptions);
+                        TIPC_MAX_SUBSCRIPTIONS);
                 subscr_terminate(subscriber);
                 return NULL;
         }
diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c
index e4768c180da2..8a84ab64cafd 100644
--- a/net/unix/af_unix.c
+++ b/net/unix/af_unix.c
@@ -1450,7 +1450,7 @@ static int unix_dgram_sendmsg(struct kiocb *kiocb, struct socket *sock,
         if (NULL == siocb->scm)
                 siocb->scm = &tmp_scm;
         wait_for_unix_gc();
-        err = scm_send(sock, msg, siocb->scm);
+        err = scm_send(sock, msg, siocb->scm, false);
         if (err < 0)
                 return err;
 
@@ -1619,7 +1619,7 @@ static int unix_stream_sendmsg(struct kiocb *kiocb, struct socket *sock,
         if (NULL == siocb->scm)
                 siocb->scm = &tmp_scm;
         wait_for_unix_gc();
-        err = scm_send(sock, msg, siocb->scm);
+        err = scm_send(sock, msg, siocb->scm, false);
         if (err < 0)
                 return err;
 
@@ -2060,10 +2060,14 @@ static int unix_shutdown(struct socket *sock, int mode)
         struct sock *sk = sock->sk;
         struct sock *other;
 
-        mode = (mode+1)&(RCV_SHUTDOWN|SEND_SHUTDOWN);
-
-        if (!mode)
-                return 0;
+        if (mode < SHUT_RD || mode > SHUT_RDWR)
+                return -EINVAL;
+        /* This maps:
+         * SHUT_RD   (0) -> RCV_SHUTDOWN  (1)
+         * SHUT_WR   (1) -> SEND_SHUTDOWN (2)
+         * SHUT_RDWR (2) -> SHUTDOWN_MASK (3)
+         */
+        ++mode;
 
         unix_state_lock(sk);
         sk->sk_shutdown |= mode;
diff --git a/net/wireless/chan.c b/net/wireless/chan.c
index d355f67d0cdd..2f876b9ee344 100644
--- a/net/wireless/chan.c
+++ b/net/wireless/chan.c
@@ -105,7 +105,7 @@ cfg80211_get_chan_state(struct wireless_dev *wdev,
 
         ASSERT_WDEV_LOCK(wdev);
 
-        if (!netif_running(wdev->netdev))
+        if (wdev->netdev && !netif_running(wdev->netdev))
                 return;
 
         switch (wdev->iftype) {
@@ -143,6 +143,11 @@ cfg80211_get_chan_state(struct wireless_dev *wdev,
         case NL80211_IFTYPE_WDS:
                 /* these interface types don't really have a channel */
                 return;
+        case NL80211_IFTYPE_P2P_DEVICE:
+                if (wdev->wiphy->features &
+                                NL80211_FEATURE_P2P_DEVICE_NEEDS_CHANNEL)
+                        *chanmode = CHAN_MODE_EXCLUSIVE;
+                return;
         case NL80211_IFTYPE_UNSPECIFIED:
         case NUM_NL80211_IFTYPES:
                 WARN_ON(1);
diff --git a/net/wireless/core.c b/net/wireless/core.c
index 31b40cc4a9c3..443d4d7deea2 100644
--- a/net/wireless/core.c
+++ b/net/wireless/core.c
@@ -230,9 +230,24 @@ static int cfg80211_rfkill_set_block(void *data, bool blocked)
         rtnl_lock();
         mutex_lock(&rdev->devlist_mtx);
 
-        list_for_each_entry(wdev, &rdev->wdev_list, list)
-                if (wdev->netdev)
+        list_for_each_entry(wdev, &rdev->wdev_list, list) {
+                if (wdev->netdev) {
                         dev_close(wdev->netdev);
+                        continue;
+                }
+                /* otherwise, check iftype */
+                switch (wdev->iftype) {
+                case NL80211_IFTYPE_P2P_DEVICE:
+                        if (!wdev->p2p_started)
+                                break;
+                        rdev->ops->stop_p2p_device(&rdev->wiphy, wdev);
+                        wdev->p2p_started = false;
+                        rdev->opencount--;
+                        break;
+                default:
+                        break;
+                }
+        }
 
         mutex_unlock(&rdev->devlist_mtx);
         rtnl_unlock();
@@ -407,6 +422,11 @@ static int wiphy_verify_combinations(struct wiphy *wiphy)
                         if (WARN_ON(wiphy->software_iftypes & types))
                                 return -EINVAL;
 
+                        /* Only a single P2P_DEVICE can be allowed */
+                        if (WARN_ON(types & BIT(NL80211_IFTYPE_P2P_DEVICE) &&
+                                    c->limits[j].max > 1))
+                                return -EINVAL;
+
                         cnt += c->limits[j].max;
                         /*
                          * Don't advertise an unsupported type
@@ -734,6 +754,35 @@ static void wdev_cleanup_work(struct work_struct *work)
         dev_put(wdev->netdev);
 }
 
+void cfg80211_unregister_wdev(struct wireless_dev *wdev)
+{
+        struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
+
+        ASSERT_RTNL();
+
+        if (WARN_ON(wdev->netdev))
+                return;
+
+        mutex_lock(&rdev->devlist_mtx);
+        list_del_rcu(&wdev->list);
+        rdev->devlist_generation++;
+
+        switch (wdev->iftype) {
+        case NL80211_IFTYPE_P2P_DEVICE:
+                if (!wdev->p2p_started)
+                        break;
+                rdev->ops->stop_p2p_device(&rdev->wiphy, wdev);
+                wdev->p2p_started = false;
+                rdev->opencount--;
+                break;
+        default:
+                WARN_ON_ONCE(1);
+                break;
+        }
+        mutex_unlock(&rdev->devlist_mtx);
+}
+EXPORT_SYMBOL(cfg80211_unregister_wdev);
+
 static struct device_type wiphy_type = {
         .name   = "wlan",
 };
@@ -952,6 +1001,11 @@ static int cfg80211_netdev_notifier_call(struct notifier_block *nb,
                  */
                 synchronize_rcu();
                 INIT_LIST_HEAD(&wdev->list);
+                /*
+                 * Ensure that all events have been processed and
+                 * freed.
+                 */
+                cfg80211_process_wdev_events(wdev);
                 break;
         case NETDEV_PRE_UP:
                 if (!(wdev->wiphy->interface_modes & BIT(wdev->iftype)))
diff --git a/net/wireless/core.h b/net/wireless/core.h
index 5206c6844fd7..bc7430b54771 100644
--- a/net/wireless/core.h
+++ b/net/wireless/core.h
@@ -426,6 +426,7 @@ int cfg80211_change_iface(struct cfg80211_registered_device *rdev,
                           struct net_device *dev, enum nl80211_iftype ntype,
                           u32 *flags, struct vif_params *params);
 void cfg80211_process_rdev_events(struct cfg80211_registered_device *rdev);
+void cfg80211_process_wdev_events(struct wireless_dev *wdev);
 
 int cfg80211_can_use_iftype_chan(struct cfg80211_registered_device *rdev,
                                  struct wireless_dev *wdev,
diff --git a/net/wireless/mlme.c b/net/wireless/mlme.c
index 1cdb1d5e6b0f..8fd0242ee169 100644
--- a/net/wireless/mlme.c
+++ b/net/wireless/mlme.c
@@ -736,7 +736,6 @@ int cfg80211_mlme_mgmt_tx(struct cfg80211_registered_device *rdev,
                           const u8 *buf, size_t len, bool no_cck,
                           bool dont_wait_for_ack, u64 *cookie)
 {
-        struct net_device *dev = wdev->netdev;
         const struct ieee80211_mgmt *mgmt;
         u16 stype;
 
@@ -796,7 +795,7 @@ int cfg80211_mlme_mgmt_tx(struct cfg80211_registered_device *rdev,
                 case NL80211_IFTYPE_AP:
                 case NL80211_IFTYPE_P2P_GO:
                 case NL80211_IFTYPE_AP_VLAN:
-                        if (!ether_addr_equal(mgmt->bssid, dev->dev_addr))
+                        if (!ether_addr_equal(mgmt->bssid, wdev_address(wdev)))
                                 err = -EINVAL;
                         break;
                 case NL80211_IFTYPE_MESH_POINT:
@@ -809,6 +808,11 @@ int cfg80211_mlme_mgmt_tx(struct cfg80211_registered_device *rdev,
                          * cfg80211 doesn't track the stations
                          */
                         break;
+                case NL80211_IFTYPE_P2P_DEVICE:
+                        /*
+                         * fall through, P2P device only supports
+                         * public action frames
+                         */
                 default:
                         err = -EOPNOTSUPP;
                         break;
@@ -819,7 +823,7 @@ int cfg80211_mlme_mgmt_tx(struct cfg80211_registered_device *rdev,
                         return err;
         }
 
-        if (!ether_addr_equal(mgmt->sa, dev->dev_addr))
+        if (!ether_addr_equal(mgmt->sa, wdev_address(wdev)))
                 return -EINVAL;
 
         /* Transmit the Action frame as requested by user space */
diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
index 97026f3b215a..787aeaa902fe 100644
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -1100,6 +1100,7 @@ static int nl80211_send_wiphy(struct sk_buff *msg, u32 pid, u32 seq, int flags,
                 if (nla_put_u32(msg, i, NL80211_CMD_REGISTER_BEACONS))
                         goto nla_put_failure;
         }
+        CMD(start_p2p_device, START_P2P_DEVICE);
 
 #ifdef CONFIG_NL80211_TESTMODE
         CMD(testmode_cmd, TESTMODE);
@@ -1748,13 +1749,13 @@ static int nl80211_send_iface(struct sk_buff *msg, u32 pid, u32 seq, int flags,
 
         if (dev &&
             (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
-             nla_put_string(msg, NL80211_ATTR_IFNAME, dev->name) ||
-             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, dev->dev_addr)))
+             nla_put_string(msg, NL80211_ATTR_IFNAME, dev->name)))
                 goto nla_put_failure;
 
         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
             nla_put_u32(msg, NL80211_ATTR_IFTYPE, wdev->iftype) ||
             nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)) ||
+            nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, wdev_address(wdev)) ||
             nla_put_u32(msg, NL80211_ATTR_GENERATION,
                         rdev->devlist_generation ^
                         (cfg80211_rdev_list_generation << 2)))
@@ -2021,8 +2022,10 @@ static int nl80211_new_interface(struct sk_buff *skb, struct genl_info *info)
                 return PTR_ERR(wdev);
         }
 
-        if (type == NL80211_IFTYPE_MESH_POINT &&
-            info->attrs[NL80211_ATTR_MESH_ID]) {
+        switch (type) {
+        case NL80211_IFTYPE_MESH_POINT:
+                if (!info->attrs[NL80211_ATTR_MESH_ID])
+                        break;
                 wdev_lock(wdev);
                 BUILD_BUG_ON(IEEE80211_MAX_SSID_LEN !=
                              IEEE80211_MAX_MESH_ID_LEN);
@@ -2031,6 +2034,26 @@ static int nl80211_new_interface(struct sk_buff *skb, struct genl_info *info)
                 memcpy(wdev->ssid, nla_data(info->attrs[NL80211_ATTR_MESH_ID]),
                        wdev->mesh_id_up_len);
                 wdev_unlock(wdev);
+                break;
+        case NL80211_IFTYPE_P2P_DEVICE:
+                /*
+                 * P2P Device doesn't have a netdev, so doesn't go
+                 * through the netdev notifier and must be added here
+                 */
+                mutex_init(&wdev->mtx);
+                INIT_LIST_HEAD(&wdev->event_list);
+                spin_lock_init(&wdev->event_lock);
+                INIT_LIST_HEAD(&wdev->mgmt_registrations);
+                spin_lock_init(&wdev->mgmt_registrations_lock);
+
+                mutex_lock(&rdev->devlist_mtx);
+                wdev->identifier = ++rdev->wdev_id;
+                list_add_rcu(&wdev->list, &rdev->wdev_list);
+                rdev->devlist_generation++;
+                mutex_unlock(&rdev->devlist_mtx);
+                break;
+        default:
+                break;
         }
 
         if (nl80211_send_iface(msg, info->snd_pid, info->snd_seq, 0,
@@ -6053,6 +6076,7 @@ static int nl80211_register_mgmt(struct sk_buff *skb, struct genl_info *info)
         case NL80211_IFTYPE_AP_VLAN:
         case NL80211_IFTYPE_MESH_POINT:
         case NL80211_IFTYPE_P2P_GO:
+        case NL80211_IFTYPE_P2P_DEVICE:
                 break;
         default:
                 return -EOPNOTSUPP;
@@ -6099,6 +6123,7 @@ static int nl80211_tx_mgmt(struct sk_buff *skb, struct genl_info *info)
         case NL80211_IFTYPE_AP_VLAN:
         case NL80211_IFTYPE_MESH_POINT:
         case NL80211_IFTYPE_P2P_GO:
+        case NL80211_IFTYPE_P2P_DEVICE:
                 break;
         default:
                 return -EOPNOTSUPP;
@@ -6195,6 +6220,7 @@ static int nl80211_tx_mgmt_cancel_wait(struct sk_buff *skb, struct genl_info *in
         case NL80211_IFTYPE_AP:
         case NL80211_IFTYPE_AP_VLAN:
         case NL80211_IFTYPE_P2P_GO:
+        case NL80211_IFTYPE_P2P_DEVICE:
                 break;
         default:
                 return -EOPNOTSUPP;
@@ -6810,6 +6836,68 @@ static int nl80211_register_beacons(struct sk_buff *skb, struct genl_info *info)
         return 0;
 }
 
+static int nl80211_start_p2p_device(struct sk_buff *skb, struct genl_info *info)
+{
+        struct cfg80211_registered_device *rdev = info->user_ptr[0];
+        struct wireless_dev *wdev = info->user_ptr[1];
+        int err;
+
+        if (!rdev->ops->start_p2p_device)
+                return -EOPNOTSUPP;
+
+        if (wdev->iftype != NL80211_IFTYPE_P2P_DEVICE)
+                return -EOPNOTSUPP;
+
+        if (wdev->p2p_started)
+                return 0;
+
+        mutex_lock(&rdev->devlist_mtx);
+        err = cfg80211_can_add_interface(rdev, wdev->iftype);
+        mutex_unlock(&rdev->devlist_mtx);
+        if (err)
+                return err;
+
+        err = rdev->ops->start_p2p_device(&rdev->wiphy, wdev);
+        if (err)
+                return err;
+
+        wdev->p2p_started = true;
+        mutex_lock(&rdev->devlist_mtx);
+        rdev->opencount++;
+        mutex_unlock(&rdev->devlist_mtx);
+
+        return 0;
+}
+
+static int nl80211_stop_p2p_device(struct sk_buff *skb, struct genl_info *info)
+{
+        struct cfg80211_registered_device *rdev = info->user_ptr[0];
+        struct wireless_dev *wdev = info->user_ptr[1];
+
+        if (wdev->iftype != NL80211_IFTYPE_P2P_DEVICE)
+                return -EOPNOTSUPP;
+
+        if (!rdev->ops->stop_p2p_device)
+                return -EOPNOTSUPP;
+
+        if (!wdev->p2p_started)
+                return 0;
+
+        rdev->ops->stop_p2p_device(&rdev->wiphy, wdev);
+        wdev->p2p_started = false;
+
+        mutex_lock(&rdev->devlist_mtx);
+        rdev->opencount--;
+        mutex_unlock(&rdev->devlist_mtx);
+
+        if (WARN_ON(rdev->scan_req && rdev->scan_req->wdev == wdev)) {
+                rdev->scan_req->aborted = true;
+                ___cfg80211_scan_done(rdev, true);
+        }
+
+        return 0;
+}
+
 #define NL80211_FLAG_NEED_WIPHY         0x01
 #define NL80211_FLAG_NEED_NETDEV        0x02
 #define NL80211_FLAG_NEED_RTNL          0x04
@@ -6817,7 +6905,7 @@ static int nl80211_register_beacons(struct sk_buff *skb, struct genl_info *info)
 #define NL80211_FLAG_NEED_NETDEV_UP     (NL80211_FLAG_NEED_NETDEV |\
                                          NL80211_FLAG_CHECK_NETDEV_UP)
 #define NL80211_FLAG_NEED_WDEV          0x10
-/* If a netdev is associated, it must be UP */
+/* If a netdev is associated, it must be UP, P2P must be started */
 #define NL80211_FLAG_NEED_WDEV_UP       (NL80211_FLAG_NEED_WDEV |\
                                          NL80211_FLAG_CHECK_NETDEV_UP)
 
@@ -6878,6 +6966,13 @@ static int nl80211_pre_doit(struct genl_ops *ops, struct sk_buff *skb,
                         }
 
                         dev_hold(dev);
+                } else if (ops->internal_flags & NL80211_FLAG_CHECK_NETDEV_UP) {
+                        if (!wdev->p2p_started) {
+                                mutex_unlock(&cfg80211_mutex);
+                                if (rtnl)
+                                        rtnl_unlock();
+                                return -ENETDOWN;
+                        }
                 }
 
                 cfg80211_lock_rdev(rdev);
@@ -7439,7 +7534,22 @@ static struct genl_ops nl80211_ops[] = {
                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
                                   NL80211_FLAG_NEED_RTNL,
         },
-
+        {
+                .cmd = NL80211_CMD_START_P2P_DEVICE,
+                .doit = nl80211_start_p2p_device,
+                .policy = nl80211_policy,
+                .flags = GENL_ADMIN_PERM,
+                .internal_flags = NL80211_FLAG_NEED_WDEV |
+                                  NL80211_FLAG_NEED_RTNL,
+        },
+        {
+                .cmd = NL80211_CMD_STOP_P2P_DEVICE,
+                .doit = nl80211_stop_p2p_device,
+                .policy = nl80211_policy,
+                .flags = GENL_ADMIN_PERM,
+                .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
+                                  NL80211_FLAG_NEED_RTNL,
+        },
 };
 
 static struct genl_multicast_group nl80211_mlme_mcgrp = {
diff --git a/net/wireless/radiotap.c b/net/wireless/radiotap.c
index c4ad7958af52..7d604c06c3dc 100644
--- a/net/wireless/radiotap.c
+++ b/net/wireless/radiotap.c
@@ -41,6 +41,8 @@ static const struct radiotap_align_size rtap_namespace_sizes[] = {
         [IEEE80211_RADIOTAP_TX_FLAGS] = { .align = 2, .size = 2, },
         [IEEE80211_RADIOTAP_RTS_RETRIES] = { .align = 1, .size = 1, },
         [IEEE80211_RADIOTAP_DATA_RETRIES] = { .align = 1, .size = 1, },
+        [IEEE80211_RADIOTAP_MCS] = { .align = 1, .size = 3, },
+        [IEEE80211_RADIOTAP_AMPDU_STATUS] = { .align = 4, .size = 8, },
         /*
          * add more here as they are defined in radiotap.h
          */
diff --git a/net/wireless/reg.c b/net/wireless/reg.c
index 2303ee73b50a..2ded3c7fad06 100644
--- a/net/wireless/reg.c
+++ b/net/wireless/reg.c
@@ -680,6 +680,8 @@ static u32 map_regdom_flags(u32 rd_flags)
                 channel_flags |= IEEE80211_CHAN_NO_IBSS;
         if (rd_flags & NL80211_RRF_DFS)
                 channel_flags |= IEEE80211_CHAN_RADAR;
+        if (rd_flags & NL80211_RRF_NO_OFDM)
+                channel_flags |= IEEE80211_CHAN_NO_OFDM;
         return channel_flags;
 }
 
@@ -901,7 +903,21 @@ static void handle_channel(struct wiphy *wiphy,
         chan->max_antenna_gain = min(chan->orig_mag,
                 (int) MBI_TO_DBI(power_rule->max_antenna_gain));
         chan->max_reg_power = (int) MBM_TO_DBM(power_rule->max_eirp);
-        chan->max_power = min(chan->max_power, chan->max_reg_power);
+        if (chan->orig_mpwr) {
+                /*
+                 * Devices that have their own custom regulatory domain
+                 * but also use WIPHY_FLAG_STRICT_REGULATORY will follow the
+                 * passed country IE power settings.
+                 */
+                if (initiator == NL80211_REGDOM_SET_BY_COUNTRY_IE &&
+                    wiphy->flags & WIPHY_FLAG_CUSTOM_REGULATORY &&
+                    wiphy->flags & WIPHY_FLAG_STRICT_REGULATORY)
+                        chan->max_power = chan->max_reg_power;
+                else
+                        chan->max_power = min(chan->orig_mpwr,
+                                              chan->max_reg_power);
+        } else
+                chan->max_power = chan->max_reg_power;
 }
 
 static void handle_band(struct wiphy *wiphy,
@@ -1885,6 +1901,7 @@ static void restore_custom_reg_settings(struct wiphy *wiphy)
                         chan->flags = chan->orig_flags;
                         chan->max_antenna_gain = chan->orig_mag;
                         chan->max_power = chan->orig_mpwr;
+                        chan->beacon_found = false;
                 }
         }
 }
diff --git a/net/wireless/util.c b/net/wireless/util.c
index 26f8cd30f712..ef35f4ef2aa6 100644
--- a/net/wireless/util.c
+++ b/net/wireless/util.c
@@ -684,22 +684,10 @@ EXPORT_SYMBOL(cfg80211_classify8021d);
 
 const u8 *ieee80211_bss_get_ie(struct cfg80211_bss *bss, u8 ie)
 {
-        u8 *end, *pos;
-
-        pos = bss->information_elements;
-        if (pos == NULL)
+        if (bss->information_elements == NULL)
                 return NULL;
-        end = pos + bss->len_information_elements;
-
-        while (pos + 1 < end) {
-                if (pos + 2 + pos[1] > end)
-                        break;
-                if (pos[0] == ie)
-                        return pos;
-                pos += 2 + pos[1];
-        }
-
-        return NULL;
+        return cfg80211_find_ie(ie, bss->information_elements,
+                                 bss->len_information_elements);
 }
 EXPORT_SYMBOL(ieee80211_bss_get_ie);
 
@@ -735,7 +723,7 @@ void cfg80211_upload_connect_keys(struct wireless_dev *wdev)
         wdev->connect_keys = NULL;
 }
 
-static void cfg80211_process_wdev_events(struct wireless_dev *wdev)
+void cfg80211_process_wdev_events(struct wireless_dev *wdev)
 {
         struct cfg80211_event *ev;
         unsigned long flags;
@@ -812,6 +800,10 @@ int cfg80211_change_iface(struct cfg80211_registered_device *rdev,
         if (otype == NL80211_IFTYPE_AP_VLAN)
                 return -EOPNOTSUPP;
 
+        /* cannot change into P2P device type */
+        if (ntype == NL80211_IFTYPE_P2P_DEVICE)
+                return -EOPNOTSUPP;
+
         if (!rdev->ops->change_virtual_intf ||
             !(rdev->wiphy.interface_modes & (1 << ntype)))
                 return -EOPNOTSUPP;
@@ -889,6 +881,9 @@ int cfg80211_change_iface(struct cfg80211_registered_device *rdev,
                 case NUM_NL80211_IFTYPES:
                         /* not happening */
                         break;
+                case NL80211_IFTYPE_P2P_DEVICE:
+                        WARN_ON(1);
+                        break;
                 }
         }
 
@@ -1053,8 +1048,15 @@ int cfg80211_can_use_iftype_chan(struct cfg80211_registered_device *rdev,
         list_for_each_entry(wdev_iter, &rdev->wdev_list, list) {
                 if (wdev_iter == wdev)
                         continue;
-                if (!netif_running(wdev_iter->netdev))
-                        continue;
+                if (wdev_iter->netdev) {
+                        if (!netif_running(wdev_iter->netdev))
+                                continue;
+                } else if (wdev_iter->iftype == NL80211_IFTYPE_P2P_DEVICE) {
+                        if (!wdev_iter->p2p_started)
+                                continue;
+                } else {
+                        WARN_ON(1);
+                }
 
                 if (rdev->wiphy.software_iftypes & BIT(wdev_iter->iftype))
                         continue;
diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c
index c5a5165a5927..741a32aa512e 100644
--- a/net/xfrm/xfrm_policy.c
+++ b/net/xfrm/xfrm_policy.c
@@ -42,13 +42,12 @@ static DEFINE_SPINLOCK(xfrm_policy_sk_bundle_lock);
 static struct dst_entry *xfrm_policy_sk_bundles;
 static DEFINE_RWLOCK(xfrm_policy_lock);
 
-static DEFINE_RWLOCK(xfrm_policy_afinfo_lock);
-static struct xfrm_policy_afinfo *xfrm_policy_afinfo[NPROTO];
+static DEFINE_SPINLOCK(xfrm_policy_afinfo_lock);
+static struct xfrm_policy_afinfo __rcu *xfrm_policy_afinfo[NPROTO]
+                                                __read_mostly;
 
 static struct kmem_cache *xfrm_dst_cache __read_mostly;
 
-static struct xfrm_policy_afinfo *xfrm_policy_get_afinfo(unsigned short family);
-static void xfrm_policy_put_afinfo(struct xfrm_policy_afinfo *afinfo);
 static void xfrm_init_pmtu(struct dst_entry *dst);
 static int stale_bundle(struct dst_entry *dst);
 static int xfrm_bundle_ok(struct xfrm_dst *xdst);
@@ -95,6 +94,24 @@ bool xfrm_selector_match(const struct xfrm_selector *sel, const struct flowi *fl
         return false;
 }
 
+static struct xfrm_policy_afinfo *xfrm_policy_get_afinfo(unsigned short family)
+{
+        struct xfrm_policy_afinfo *afinfo;
+
+        if (unlikely(family >= NPROTO))
+                return NULL;
+        rcu_read_lock();
+        afinfo = rcu_dereference(xfrm_policy_afinfo[family]);
+        if (unlikely(!afinfo))
+                rcu_read_unlock();
+        return afinfo;
+}
+
+static void xfrm_policy_put_afinfo(struct xfrm_policy_afinfo *afinfo)
+{
+        rcu_read_unlock();
+}
+
 static inline struct dst_entry *__xfrm_dst_lookup(struct net *net, int tos,
                                                   const xfrm_address_t *saddr,
                                                   const xfrm_address_t *daddr,
@@ -1357,6 +1374,8 @@ static inline struct xfrm_dst *xfrm_alloc_dst(struct net *net, int family)
 
                 memset(dst + 1, 0, sizeof(*xdst) - sizeof(*dst));
                 xdst->flo.ops = &xfrm_bundle_fc_ops;
+                if (afinfo->init_dst)
+                        afinfo->init_dst(net, xdst);
         } else
                 xdst = ERR_PTR(-ENOBUFS);
 
@@ -2418,7 +2437,7 @@ int xfrm_policy_register_afinfo(struct xfrm_policy_afinfo *afinfo)
                 return -EINVAL;
         if (unlikely(afinfo->family >= NPROTO))
                 return -EAFNOSUPPORT;
-        write_lock_bh(&xfrm_policy_afinfo_lock);
+        spin_lock(&xfrm_policy_afinfo_lock);
         if (unlikely(xfrm_policy_afinfo[afinfo->family] != NULL))
                 err = -ENOBUFS;
         else {
@@ -2439,9 +2458,9 @@ int xfrm_policy_register_afinfo(struct xfrm_policy_afinfo *afinfo)
                         dst_ops->neigh_lookup = xfrm_neigh_lookup;
                 if (likely(afinfo->garbage_collect == NULL))
                         afinfo->garbage_collect = xfrm_garbage_collect_deferred;
-                xfrm_policy_afinfo[afinfo->family] = afinfo;
+                rcu_assign_pointer(xfrm_policy_afinfo[afinfo->family], afinfo);
         }
-        write_unlock_bh(&xfrm_policy_afinfo_lock);
+        spin_unlock(&xfrm_policy_afinfo_lock);
 
         rtnl_lock();
         for_each_net(net) {
@@ -2474,21 +2493,26 @@ int xfrm_policy_unregister_afinfo(struct xfrm_policy_afinfo *afinfo)
                 return -EINVAL;
         if (unlikely(afinfo->family >= NPROTO))
                 return -EAFNOSUPPORT;
-        write_lock_bh(&xfrm_policy_afinfo_lock);
+        spin_lock(&xfrm_policy_afinfo_lock);
         if (likely(xfrm_policy_afinfo[afinfo->family] != NULL)) {
                 if (unlikely(xfrm_policy_afinfo[afinfo->family] != afinfo))
                         err = -EINVAL;
-                else {
-                        struct dst_ops *dst_ops = afinfo->dst_ops;
-                        xfrm_policy_afinfo[afinfo->family] = NULL;
-                        dst_ops->kmem_cachep = NULL;
-                        dst_ops->check = NULL;
-                        dst_ops->negative_advice = NULL;
-                        dst_ops->link_failure = NULL;
-                        afinfo->garbage_collect = NULL;
-                }
+                else
+                        RCU_INIT_POINTER(xfrm_policy_afinfo[afinfo->family],
+                                         NULL);
+        }
+        spin_unlock(&xfrm_policy_afinfo_lock);
+        if (!err) {
+                struct dst_ops *dst_ops = afinfo->dst_ops;
+
+                synchronize_rcu();
+
+                dst_ops->kmem_cachep = NULL;
+                dst_ops->check = NULL;
+                dst_ops->negative_advice = NULL;
+                dst_ops->link_failure = NULL;
+                afinfo->garbage_collect = NULL;
         }
-        write_unlock_bh(&xfrm_policy_afinfo_lock);
         return err;
 }
 EXPORT_SYMBOL(xfrm_policy_unregister_afinfo);
@@ -2497,33 +2521,16 @@ static void __net_init xfrm_dst_ops_init(struct net *net)
 {
         struct xfrm_policy_afinfo *afinfo;
 
-        read_lock_bh(&xfrm_policy_afinfo_lock);
-        afinfo = xfrm_policy_afinfo[AF_INET];
+        rcu_read_lock();
+        afinfo = rcu_dereference(xfrm_policy_afinfo[AF_INET]);
         if (afinfo)
                 net->xfrm.xfrm4_dst_ops = *afinfo->dst_ops;
 #if IS_ENABLED(CONFIG_IPV6)
-        afinfo = xfrm_policy_afinfo[AF_INET6];
+        afinfo = rcu_dereference(xfrm_policy_afinfo[AF_INET6]);
         if (afinfo)
                 net->xfrm.xfrm6_dst_ops = *afinfo->dst_ops;
 #endif
-        read_unlock_bh(&xfrm_policy_afinfo_lock);
-}
-
-static struct xfrm_policy_afinfo *xfrm_policy_get_afinfo(unsigned short family)
-{
-        struct xfrm_policy_afinfo *afinfo;
-        if (unlikely(family >= NPROTO))
-                return NULL;
-        read_lock(&xfrm_policy_afinfo_lock);
-        afinfo = xfrm_policy_afinfo[family];
-        if (unlikely(!afinfo))
-                read_unlock(&xfrm_policy_afinfo_lock);
-        return afinfo;
-}
-
-static void xfrm_policy_put_afinfo(struct xfrm_policy_afinfo *afinfo)
-{
-        read_unlock(&xfrm_policy_afinfo_lock);
+        rcu_read_unlock();
 }
 
 static int xfrm_dev_event(struct notifier_block *this, unsigned long event, void *ptr)
diff --git a/net/xfrm/xfrm_state.c b/net/xfrm/xfrm_state.c
index 5b228f97d4b3..7856c33898fa 100644
--- a/net/xfrm/xfrm_state.c
+++ b/net/xfrm/xfrm_state.c
@@ -415,8 +415,17 @@ static enum hrtimer_restart xfrm_timer_handler(struct hrtimer * me)
         if (x->lft.hard_add_expires_seconds) {
                 long tmo = x->lft.hard_add_expires_seconds +
                         x->curlft.add_time - now;
-                if (tmo <= 0)
-                        goto expired;
+                if (tmo <= 0) {
+                        if (x->xflags & XFRM_SOFT_EXPIRE) {
+                                /* enter hard expire without soft expire first?!
+                                 * setting a new date could trigger this.
+                                 * workarbound: fix x->curflt.add_time by below:
+                                 */
+                                x->curlft.add_time = now - x->saved_tmo - 1;
+                                tmo = x->lft.hard_add_expires_seconds - x->saved_tmo;
+                        } else
+                                goto expired;
+                }
                 if (tmo < next)
                         next = tmo;
         }
@@ -433,10 +442,14 @@ static enum hrtimer_restart xfrm_timer_handler(struct hrtimer * me)
         if (x->lft.soft_add_expires_seconds) {
                 long tmo = x->lft.soft_add_expires_seconds +
                         x->curlft.add_time - now;
-                if (tmo <= 0)
+                if (tmo <= 0) {
                         warn = 1;
-                else if (tmo < next)
+                        x->xflags &= ~XFRM_SOFT_EXPIRE;
+                } else if (tmo < next) {
                         next = tmo;
+                        x->xflags |= XFRM_SOFT_EXPIRE;
+                        x->saved_tmo = tmo;
+                }
         }
         if (x->lft.soft_use_expires_seconds) {
                 long tmo = x->lft.soft_use_expires_seconds +
@@ -1687,7 +1700,7 @@ int km_query(struct xfrm_state *x, struct xfrm_tmpl *t, struct xfrm_policy *pol)
 
         read_lock(&xfrm_km_lock);
         list_for_each_entry(km, &xfrm_km_list, list) {
-                acqret = km->acquire(x, t, pol, XFRM_POLICY_OUT);
+                acqret = km->acquire(x, t, pol);
                 if (!acqret)
                         err = acqret;
         }
diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c
index e75d8e47f35c..ab58034c42d6 100644
--- a/net/xfrm/xfrm_user.c
+++ b/net/xfrm/xfrm_user.c
@@ -2567,8 +2567,7 @@ static inline size_t xfrm_acquire_msgsize(struct xfrm_state *x,
 }
 
 static int build_acquire(struct sk_buff *skb, struct xfrm_state *x,
-                         struct xfrm_tmpl *xt, struct xfrm_policy *xp,
-                         int dir)
+                         struct xfrm_tmpl *xt, struct xfrm_policy *xp)
 {
         __u32 seq = xfrm_get_acqseq();
         struct xfrm_user_acquire *ua;
@@ -2583,7 +2582,7 @@ static int build_acquire(struct sk_buff *skb, struct xfrm_state *x,
         memcpy(&ua->id, &x->id, sizeof(ua->id));
         memcpy(&ua->saddr, &x->props.saddr, sizeof(ua->saddr));
         memcpy(&ua->sel, &x->sel, sizeof(ua->sel));
-        copy_to_user_policy(xp, &ua->policy, dir);
+        copy_to_user_policy(xp, &ua->policy, XFRM_POLICY_OUT);
         ua->aalgos = xt->aalgos;
         ua->ealgos = xt->ealgos;
         ua->calgos = xt->calgos;
@@ -2605,7 +2604,7 @@ static int build_acquire(struct sk_buff *skb, struct xfrm_state *x,
 }
 
 static int xfrm_send_acquire(struct xfrm_state *x, struct xfrm_tmpl *xt,
-                             struct xfrm_policy *xp, int dir)
+                             struct xfrm_policy *xp)
 {
         struct net *net = xs_net(x);
         struct sk_buff *skb;
@@ -2614,7 +2613,7 @@ static int xfrm_send_acquire(struct xfrm_state *x, struct xfrm_tmpl *xt,
         if (skb == NULL)
                 return -ENOMEM;
 
-        if (build_acquire(skb, x, xt, xp, dir) < 0)
+        if (build_acquire(skb, x, xt, xp) < 0)
                 BUG();
 
         return nlmsg_multicast(net->xfrm.nlsk, skb, 0, XFRMNLGRP_ACQUIRE, GFP_ATOMIC);