25 files changed, 85 insertions, 31 deletions

diff --git a/net/appletalk/ddp.c b/net/appletalk/ddp.c
index bfbe13786bb4..875eda5dbad7 100644
--- a/net/appletalk/ddp.c
+++ b/net/appletalk/ddp.c
@@ -1238,6 +1238,7 @@ static int atalk_getname(struct socket *sock, struct sockaddr *uaddr,
                         return -ENOBUFS;
 
         *uaddr_len = sizeof(struct sockaddr_at);
+        memset(&sat.sat_zero, 0, sizeof(sat.sat_zero));
 
         if (peer) {
                 if (sk->sk_state != TCP_ESTABLISHED)
diff --git a/net/can/raw.c b/net/can/raw.c
index f4cc44548bda..db3152df7d2b 100644
--- a/net/can/raw.c
+++ b/net/can/raw.c
@@ -401,6 +401,7 @@ static int raw_getname(struct socket *sock, struct sockaddr *uaddr,
         if (peer)
                 return -EOPNOTSUPP;
 
+        memset(addr, 0, sizeof(*addr));
         addr->can_family  = AF_CAN;
         addr->can_ifindex = ro->ifindex;
 
diff --git a/net/core/gen_estimator.c b/net/core/gen_estimator.c
index 78e5bfc454ae..493775f4f2f1 100644
--- a/net/core/gen_estimator.c
+++ b/net/core/gen_estimator.c
@@ -81,7 +81,7 @@
 struct gen_estimator
 {
         struct list_head        list;
-        struct gnet_stats_basic *bstats;
+        struct gnet_stats_basic_packed  *bstats;
         struct gnet_stats_rate_est      *rate_est;
         spinlock_t              *stats_lock;
         int                     ewma_log;
@@ -165,7 +165,7 @@ static void gen_add_node(struct gen_estimator *est)
 }
 
 static
-struct gen_estimator *gen_find_node(const struct gnet_stats_basic *bstats,
+struct gen_estimator *gen_find_node(const struct gnet_stats_basic_packed *bstats,
                                     const struct gnet_stats_rate_est *rate_est)
 {
         struct rb_node *p = est_root.rb_node;
@@ -202,7 +202,7 @@ struct gen_estimator *gen_find_node(const struct gnet_stats_basic *bstats,
  *
  * NOTE: Called under rtnl_mutex
  */
-int gen_new_estimator(struct gnet_stats_basic *bstats,
+int gen_new_estimator(struct gnet_stats_basic_packed *bstats,
                       struct gnet_stats_rate_est *rate_est,
                       spinlock_t *stats_lock,
                       struct nlattr *opt)
@@ -262,7 +262,7 @@ static void __gen_kill_estimator(struct rcu_head *head)
  *
  * NOTE: Called under rtnl_mutex
  */
-void gen_kill_estimator(struct gnet_stats_basic *bstats,
+void gen_kill_estimator(struct gnet_stats_basic_packed *bstats,
                         struct gnet_stats_rate_est *rate_est)
 {
         struct gen_estimator *e;
@@ -292,7 +292,7 @@ EXPORT_SYMBOL(gen_kill_estimator);
  *
  * Returns 0 on success or a negative error code.
  */
-int gen_replace_estimator(struct gnet_stats_basic *bstats,
+int gen_replace_estimator(struct gnet_stats_basic_packed *bstats,
                           struct gnet_stats_rate_est *rate_est,
                           spinlock_t *stats_lock, struct nlattr *opt)
 {
@@ -308,7 +308,7 @@ EXPORT_SYMBOL(gen_replace_estimator);
  *
  * Returns true if estimator is active, and false if not.
  */
-bool gen_estimator_active(const struct gnet_stats_basic *bstats,
+bool gen_estimator_active(const struct gnet_stats_basic_packed *bstats,
                           const struct gnet_stats_rate_est *rate_est)
 {
         ASSERT_RTNL();
diff --git a/net/core/gen_stats.c b/net/core/gen_stats.c
index c3d0ffeac243..8569310268ab 100644
--- a/net/core/gen_stats.c
+++ b/net/core/gen_stats.c
@@ -106,16 +106,21 @@ gnet_stats_start_copy(struct sk_buff *skb, int type, spinlock_t *lock,
  * if the room in the socket buffer was not sufficient.
  */
 int
-gnet_stats_copy_basic(struct gnet_dump *d, struct gnet_stats_basic *b)
+gnet_stats_copy_basic(struct gnet_dump *d, struct gnet_stats_basic_packed *b)
 {
         if (d->compat_tc_stats) {
                 d->tc_stats.bytes = b->bytes;
                 d->tc_stats.packets = b->packets;
         }
 
-        if (d->tail)
-                return gnet_stats_copy(d, TCA_STATS_BASIC, b, sizeof(*b));
+        if (d->tail) {
+                struct gnet_stats_basic sb;
 
+                memset(&sb, 0, sizeof(sb));
+                sb.bytes = b->bytes;
+                sb.packets = b->packets;
+                return gnet_stats_copy(d, TCA_STATS_BASIC, &sb, sizeof(sb));
+        }
         return 0;
 }
 
diff --git a/net/dccp/proto.c b/net/dccp/proto.c
index 3281013ce038..1bca9205104e 100644
--- a/net/dccp/proto.c
+++ b/net/dccp/proto.c
@@ -1159,6 +1159,7 @@ static void __exit dccp_fini(void)
         kmem_cache_destroy(dccp_hashinfo.bind_bucket_cachep);
         dccp_ackvec_exit();
         dccp_sysctl_exit();
+        percpu_counter_destroy(&dccp_orphan_count);
 }
 
 module_init(dccp_init);
diff --git a/net/econet/af_econet.c b/net/econet/af_econet.c
index 2e1f836d4240..f0bbc57926cd 100644
--- a/net/econet/af_econet.c
+++ b/net/econet/af_econet.c
@@ -520,6 +520,7 @@ static int econet_getname(struct socket *sock, struct sockaddr *uaddr,
         if (peer)
                 return -EOPNOTSUPP;
 
+        memset(sec, 0, sizeof(*sec));
         mutex_lock(&econet_mutex);
 
         sk = sock->sk;
diff --git a/net/ieee802154/af_ieee802154.c b/net/ieee802154/af_ieee802154.c
index 3bb6bdb1dac1..af661805b9fa 100644
--- a/net/ieee802154/af_ieee802154.c
+++ b/net/ieee802154/af_ieee802154.c
@@ -136,7 +136,7 @@ static int ieee802154_dev_ioctl(struct sock *sk, struct ifreq __user *arg,
                 unsigned int cmd)
 {
         struct ifreq ifr;
-        int ret = -EINVAL;
+        int ret = -ENOIOCTLCMD;
         struct net_device *dev;
 
         if (copy_from_user(&ifr, arg, sizeof(struct ifreq)))
@@ -146,8 +146,10 @@ static int ieee802154_dev_ioctl(struct sock *sk, struct ifreq __user *arg,
 
         dev_load(sock_net(sk), ifr.ifr_name);
         dev = dev_get_by_name(sock_net(sk), ifr.ifr_name);
-        if (dev->type == ARPHRD_IEEE802154 ||
-            dev->type == ARPHRD_IEEE802154_PHY)
+
+        if ((dev->type == ARPHRD_IEEE802154 ||
+             dev->type == ARPHRD_IEEE802154_PHY) &&
+            dev->netdev_ops->ndo_do_ioctl)
                 ret = dev->netdev_ops->ndo_do_ioctl(dev, &ifr, cmd);
 
         if (!ret && copy_to_user(arg, &ifr, sizeof(struct ifreq)))
diff --git a/net/ieee802154/dgram.c b/net/ieee802154/dgram.c
index 14d39840dd62..ba8b214dda8f 100644
--- a/net/ieee802154/dgram.c
+++ b/net/ieee802154/dgram.c
@@ -377,6 +377,18 @@ int ieee802154_dgram_deliver(struct net_device *dev, struct sk_buff *skb)
         return ret;
 }
 
+static int dgram_getsockopt(struct sock *sk, int level, int optname,
+                    char __user *optval, int __user *optlen)
+{
+        return -EOPNOTSUPP;
+}
+
+static int dgram_setsockopt(struct sock *sk, int level, int optname,
+                    char __user *optval, int __user optlen)
+{
+        return -EOPNOTSUPP;
+}
+
 struct proto ieee802154_dgram_prot = {
         .name           = "IEEE-802.15.4-MAC",
         .owner          = THIS_MODULE,
@@ -391,5 +403,7 @@ struct proto ieee802154_dgram_prot = {
         .connect        = dgram_connect,
         .disconnect     = dgram_disconnect,
         .ioctl          = dgram_ioctl,
+        .getsockopt     = dgram_getsockopt,
+        .setsockopt     = dgram_setsockopt,
 };
 
diff --git a/net/ieee802154/raw.c b/net/ieee802154/raw.c
index fca44d59f97e..9315977c4c61 100644
--- a/net/ieee802154/raw.c
+++ b/net/ieee802154/raw.c
@@ -238,6 +238,18 @@ void ieee802154_raw_deliver(struct net_device *dev, struct sk_buff *skb)
         read_unlock(&raw_lock);
 }
 
+static int raw_getsockopt(struct sock *sk, int level, int optname,
+                    char __user *optval, int __user *optlen)
+{
+        return -EOPNOTSUPP;
+}
+
+static int raw_setsockopt(struct sock *sk, int level, int optname,
+                    char __user *optval, int __user optlen)
+{
+        return -EOPNOTSUPP;
+}
+
 struct proto ieee802154_raw_prot = {
         .name           = "IEEE-802.15.4-RAW",
         .owner          = THIS_MODULE,
@@ -250,5 +262,7 @@ struct proto ieee802154_raw_prot = {
         .unhash         = raw_unhash,
         .connect        = raw_connect,
         .disconnect     = raw_disconnect,
+        .getsockopt     = raw_getsockopt,
+        .setsockopt     = raw_setsockopt,
 };
 
diff --git a/net/ipv4/ip_gre.c b/net/ipv4/ip_gre.c
index cb4a0f4bd5e5..82c11dd10a62 100644
--- a/net/ipv4/ip_gre.c
+++ b/net/ipv4/ip_gre.c
@@ -951,7 +951,7 @@ static int ipgre_tunnel_bind_dev(struct net_device *dev)
                         addend += 4;
         }
         dev->needed_headroom = addend + hlen;
-        mtu -= dev->hard_header_len - addend;
+        mtu -= dev->hard_header_len + addend;
 
         if (mtu < 68)
                 mtu = 68;
diff --git a/net/irda/af_irda.c b/net/irda/af_irda.c
index 80cf29aae096..50b43c57d5d8 100644
--- a/net/irda/af_irda.c
+++ b/net/irda/af_irda.c
@@ -715,6 +715,7 @@ static int irda_getname(struct socket *sock, struct sockaddr *uaddr,
         struct sock *sk = sock->sk;
         struct irda_sock *self = irda_sk(sk);
 
+        memset(&saddr, 0, sizeof(saddr));
         if (peer) {
                 if (sk->sk_state != TCP_ESTABLISHED)
                         return -ENOTCONN;
diff --git a/net/mac80211/agg-tx.c b/net/mac80211/agg-tx.c
index 9e5762ad307d..a24e59816b93 100644
--- a/net/mac80211/agg-tx.c
+++ b/net/mac80211/agg-tx.c
@@ -381,6 +381,14 @@ static void ieee80211_agg_splice_packets(struct ieee80211_local *local,
                 &local->hw, queue,
                 IEEE80211_QUEUE_STOP_REASON_AGGREGATION);
 
+        if (!(sta->ampdu_mlme.tid_state_tx[tid] & HT_ADDBA_REQUESTED_MSK))
+                return;
+
+        if (WARN(!sta->ampdu_mlme.tid_tx[tid],
+                 "TID %d gone but expected when splicing aggregates from"
+                 "the pending queue\n", tid))
+                return;
+
         if (!skb_queue_empty(&sta->ampdu_mlme.tid_tx[tid]->pending)) {
                 spin_lock_irqsave(&local->queue_stop_reason_lock, flags);
                 /* mark queue as pending, it is stopped already */
diff --git a/net/netfilter/xt_RATEEST.c b/net/netfilter/xt_RATEEST.c
index 43f5676b1af4..d80b8192e0d4 100644
--- a/net/netfilter/xt_RATEEST.c
+++ b/net/netfilter/xt_RATEEST.c
@@ -74,7 +74,7 @@ static unsigned int
 xt_rateest_tg(struct sk_buff *skb, const struct xt_target_param *par)
 {
         const struct xt_rateest_target_info *info = par->targinfo;
-        struct gnet_stats_basic *stats = &info->est->bstats;
+        struct gnet_stats_basic_packed *stats = &info->est->bstats;
 
         spin_lock_bh(&info->est->lock);
         stats->bytes += skb->len;
diff --git a/net/netrom/af_netrom.c b/net/netrom/af_netrom.c
index ce51ce012cda..ce1a34b99c23 100644
--- a/net/netrom/af_netrom.c
+++ b/net/netrom/af_netrom.c
@@ -847,6 +847,7 @@ static int nr_getname(struct socket *sock, struct sockaddr *uaddr,
                 sax->fsa_ax25.sax25_family = AF_NETROM;
                 sax->fsa_ax25.sax25_ndigis = 1;
                 sax->fsa_ax25.sax25_call   = nr->user_addr;
+                memset(sax->fsa_digipeater, 0, sizeof(sax->fsa_digipeater));
                 sax->fsa_digipeater[0]     = nr->dest_addr;
                 *uaddr_len = sizeof(struct full_sockaddr_ax25);
         } else {
diff --git a/net/netrom/nr_route.c b/net/netrom/nr_route.c
index e943c16552a2..4eb1ac9a7679 100644
--- a/net/netrom/nr_route.c
+++ b/net/netrom/nr_route.c
@@ -630,23 +630,23 @@ out:
         return dev;
 }
 
-static ax25_digi *nr_call_to_digi(int ndigis, ax25_address *digipeaters)
+static ax25_digi *nr_call_to_digi(ax25_digi *digi, int ndigis,
+        ax25_address *digipeaters)
 {
-        static ax25_digi ax25_digi;
         int i;
 
         if (ndigis == 0)
                 return NULL;
 
         for (i = 0; i < ndigis; i++) {
-                ax25_digi.calls[i]    = digipeaters[i];
-                ax25_digi.repeated[i] = 0;
+                digi->calls[i]    = digipeaters[i];
+                digi->repeated[i] = 0;
         }
 
-        ax25_digi.ndigi      = ndigis;
-        ax25_digi.lastrepeat = -1;
+        digi->ndigi      = ndigis;
+        digi->lastrepeat = -1;
 
-        return &ax25_digi;
+        return digi;
 }
 
 /*
@@ -656,6 +656,7 @@ int nr_rt_ioctl(unsigned int cmd, void __user *arg)
 {
         struct nr_route_struct nr_route;
         struct net_device *dev;
+        ax25_digi digi;
         int ret;
 
         switch (cmd) {
@@ -673,13 +674,15 @@ int nr_rt_ioctl(unsigned int cmd, void __user *arg)
                         ret = nr_add_node(&nr_route.callsign,
                                 nr_route.mnemonic,
                                 &nr_route.neighbour,
-                                nr_call_to_digi(nr_route.ndigis, nr_route.digipeaters),
+                                nr_call_to_digi(&digi, nr_route.ndigis,
+                                                nr_route.digipeaters),
                                 dev, nr_route.quality,
                                 nr_route.obs_count);
                         break;
                 case NETROM_NEIGH:
                         ret = nr_add_neigh(&nr_route.callsign,
-                                nr_call_to_digi(nr_route.ndigis, nr_route.digipeaters),
+                                nr_call_to_digi(&digi, nr_route.ndigis,
+                                                nr_route.digipeaters),
                                 dev, nr_route.quality);
                         break;
                 default:
diff --git a/net/phonet/pn_dev.c b/net/phonet/pn_dev.c
index b0d6ddd82a9d..c2b77a698695 100644
--- a/net/phonet/pn_dev.c
+++ b/net/phonet/pn_dev.c
@@ -96,7 +96,7 @@ struct net_device *phonet_device_get(struct net *net)
 {
         struct phonet_device_list *pndevs = phonet_device_list(net);
         struct phonet_device *pnd;
-        struct net_device *dev;
+        struct net_device *dev = NULL;
 
         spin_lock_bh(&pndevs->lock);
         list_for_each_entry(pnd, &pndevs->list, list) {
diff --git a/net/rose/af_rose.c b/net/rose/af_rose.c
index f0a76f6bca71..e5f478ca3d61 100644
--- a/net/rose/af_rose.c
+++ b/net/rose/af_rose.c
@@ -954,6 +954,7 @@ static int rose_getname(struct socket *sock, struct sockaddr *uaddr,
         struct rose_sock *rose = rose_sk(sk);
         int n;
 
+        memset(srose, 0, sizeof(*srose));
         if (peer != 0) {
                 if (sk->sk_state != TCP_ESTABLISHED)
                         return -ENOTCONN;
diff --git a/net/sched/sch_atm.c b/net/sched/sch_atm.c
index 2a8b83af7c47..ab82f145f689 100644
--- a/net/sched/sch_atm.c
+++ b/net/sched/sch_atm.c
@@ -49,7 +49,7 @@ struct atm_flow_data {
         struct socket           *sock;          /* for closing */
         u32                     classid;        /* x:y type ID */
         int                     ref;            /* reference count */
-        struct gnet_stats_basic bstats;
+        struct gnet_stats_basic_packed  bstats;
         struct gnet_stats_queue qstats;
         struct atm_flow_data    *next;
         struct atm_flow_data    *excess;        /* flow for excess traffic;
diff --git a/net/sched/sch_cbq.c b/net/sched/sch_cbq.c
index 23a167670fd5..d5798e17a832 100644
--- a/net/sched/sch_cbq.c
+++ b/net/sched/sch_cbq.c
@@ -128,7 +128,7 @@ struct cbq_class
         long                    avgidle;
         long                    deficit;        /* Saved deficit for WRR */
         psched_time_t           penalized;
-        struct gnet_stats_basic bstats;
+        struct gnet_stats_basic_packed bstats;
         struct gnet_stats_queue qstats;
         struct gnet_stats_rate_est rate_est;
         struct tc_cbq_xstats    xstats;
diff --git a/net/sched/sch_drr.c b/net/sched/sch_drr.c
index 7597fe146866..12b2fb04b29b 100644
--- a/net/sched/sch_drr.c
+++ b/net/sched/sch_drr.c
@@ -22,7 +22,7 @@ struct drr_class {
         unsigned int                    refcnt;
         unsigned int                    filter_cnt;
 
-        struct gnet_stats_basic         bstats;
+        struct gnet_stats_basic_packed          bstats;
         struct gnet_stats_queue         qstats;
         struct gnet_stats_rate_est      rate_est;
         struct list_head                alist;
diff --git a/net/sched/sch_hfsc.c b/net/sched/sch_hfsc.c
index 362c2811b2df..dad0144423da 100644
--- a/net/sched/sch_hfsc.c
+++ b/net/sched/sch_hfsc.c
@@ -116,7 +116,7 @@ struct hfsc_class
         struct Qdisc_class_common cl_common;
         unsigned int    refcnt;         /* usage count */
 
-        struct gnet_stats_basic bstats;
+        struct gnet_stats_basic_packed bstats;
         struct gnet_stats_queue qstats;
         struct gnet_stats_rate_est rate_est;
         unsigned int    level;          /* class level in hierarchy */
diff --git a/net/sched/sch_htb.c b/net/sched/sch_htb.c
index 88cd02626621..ec4d46399d59 100644
--- a/net/sched/sch_htb.c
+++ b/net/sched/sch_htb.c
@@ -74,7 +74,7 @@ enum htb_cmode {
 struct htb_class {
         struct Qdisc_class_common common;
         /* general class parameters */
-        struct gnet_stats_basic bstats;
+        struct gnet_stats_basic_packed bstats;
         struct gnet_stats_queue qstats;
         struct gnet_stats_rate_est rate_est;
         struct tc_htb_xstats xstats;    /* our special stats */
diff --git a/net/sctp/protocol.c b/net/sctp/protocol.c
index 79cbd47f4df7..a76da657244a 100644
--- a/net/sctp/protocol.c
+++ b/net/sctp/protocol.c
@@ -160,6 +160,7 @@ static void sctp_proc_exit(void)
                 remove_proc_entry("sctp", init_net.proc_net);
         }
 #endif
+        percpu_counter_destroy(&sctp_sockets_allocated);
 }
 
 /* Private helper to extract ipv4 address and stash them in
diff --git a/net/socket.c b/net/socket.c
index 791d71a36a93..6d4716559047 100644
--- a/net/socket.c
+++ b/net/socket.c
@@ -736,7 +736,7 @@ static ssize_t sock_sendpage(struct file *file, struct page *page,
         if (more)
                 flags |= MSG_MORE;
 
-        return sock->ops->sendpage(sock, page, offset, size, flags);
+        return kernel_sendpage(sock, page, offset, size, flags);
 }
 
 static ssize_t sock_splice_read(struct file *file, loff_t *ppos,
diff --git a/net/xfrm/xfrm_hash.h b/net/xfrm/xfrm_hash.h
index d401dc8f05ed..e5195c99f71e 100644
--- a/net/xfrm/xfrm_hash.h
+++ b/net/xfrm/xfrm_hash.h
@@ -16,7 +16,7 @@ static inline unsigned int __xfrm6_addr_hash(xfrm_address_t *addr)
 
 static inline unsigned int __xfrm4_daddr_saddr_hash(xfrm_address_t *daddr, xfrm_address_t *saddr)
 {
-        return ntohl(daddr->a4 ^ saddr->a4);
+        return ntohl(daddr->a4 + saddr->a4);
 }
 
 static inline unsigned int __xfrm6_daddr_saddr_hash(xfrm_address_t *daddr, xfrm_address_t *saddr)