24 files changed, 148 insertions, 69 deletions

diff --git a/net/atm/atm_sysfs.c b/net/atm/atm_sysfs.c
index 799c631f0fed..f7fa67c78766 100644
--- a/net/atm/atm_sysfs.c
+++ b/net/atm/atm_sysfs.c
@@ -143,12 +143,13 @@ static struct class atm_class = {
         .dev_uevent             = atm_uevent,
 };
 
-int atm_register_sysfs(struct atm_dev *adev)
+int atm_register_sysfs(struct atm_dev *adev, struct device *parent)
 {
         struct device *cdev = &adev->class_dev;
         int i, j, err;
 
         cdev->class = &atm_class;
+        cdev->parent = parent;
         dev_set_drvdata(cdev, adev);
 
         dev_set_name(cdev, "%s%d", adev->type, adev->number);
diff --git a/net/atm/resources.c b/net/atm/resources.c
index d29e58261511..23f45ce6f351 100644
--- a/net/atm/resources.c
+++ b/net/atm/resources.c
@@ -74,8 +74,9 @@ struct atm_dev *atm_dev_lookup(int number)
 }
 EXPORT_SYMBOL(atm_dev_lookup);
 
-struct atm_dev *atm_dev_register(const char *type, const struct atmdev_ops *ops,
-                                 int number, unsigned long *flags)
+struct atm_dev *atm_dev_register(const char *type, struct device *parent,
+                                 const struct atmdev_ops *ops, int number,
+                                 unsigned long *flags)
 {
         struct atm_dev *dev, *inuse;
 
@@ -115,7 +116,7 @@ struct atm_dev *atm_dev_register(const char *type, const struct atmdev_ops *ops,
                 goto out_fail;
         }
 
-        if (atm_register_sysfs(dev) < 0) {
+        if (atm_register_sysfs(dev, parent) < 0) {
                 pr_err("atm_register_sysfs failed for dev %s\n", type);
                 atm_proc_dev_deregister(dev);
                 goto out_fail;
diff --git a/net/atm/resources.h b/net/atm/resources.h
index 126fb1840dfb..521431e30507 100644
--- a/net/atm/resources.h
+++ b/net/atm/resources.h
@@ -42,6 +42,6 @@ static inline void atm_proc_dev_deregister(struct atm_dev *dev)
 
 #endif /* CONFIG_PROC_FS */
 
-int atm_register_sysfs(struct atm_dev *adev);
+int atm_register_sysfs(struct atm_dev *adev, struct device *parent);
 void atm_unregister_sysfs(struct atm_dev *adev);
 #endif
diff --git a/net/bluetooth/sco.c b/net/bluetooth/sco.c
index d0927d1fdada..66b9e5c0523a 100644
--- a/net/bluetooth/sco.c
+++ b/net/bluetooth/sco.c
@@ -882,7 +882,7 @@ static int sco_connect_ind(struct hci_dev *hdev, bdaddr_t *bdaddr, __u8 type)
         int lm = 0;
 
         if (type != SCO_LINK && type != ESCO_LINK)
-                return 0;
+                return -EINVAL;
 
         BT_DBG("hdev %s, bdaddr %s", hdev->name, batostr(bdaddr));
 
@@ -908,7 +908,7 @@ static int sco_connect_cfm(struct hci_conn *hcon, __u8 status)
         BT_DBG("hcon %p bdaddr %s status %d", hcon, batostr(&hcon->dst), status);
 
         if (hcon->type != SCO_LINK && hcon->type != ESCO_LINK)
-                return 0;
+                return -EINVAL;
 
         if (!status) {
                 struct sco_conn *conn;
@@ -927,7 +927,7 @@ static int sco_disconn_cfm(struct hci_conn *hcon, __u8 reason)
         BT_DBG("hcon %p reason %d", hcon, reason);
 
         if (hcon->type != SCO_LINK && hcon->type != ESCO_LINK)
-                return 0;
+                return -EINVAL;
 
         sco_conn_del(hcon, bt_err(reason));
 
diff --git a/net/ceph/messenger.c b/net/ceph/messenger.c
index 1c7a2ec4f3cc..b6ff4a1519ab 100644
--- a/net/ceph/messenger.c
+++ b/net/ceph/messenger.c
@@ -97,11 +97,9 @@ struct workqueue_struct *ceph_msgr_wq;
 int ceph_msgr_init(void)
 {
         ceph_msgr_wq = create_workqueue("ceph-msgr");
-        if (IS_ERR(ceph_msgr_wq)) {
-                int ret = PTR_ERR(ceph_msgr_wq);
-                pr_err("msgr_init failed to create workqueue: %d\n", ret);
-                ceph_msgr_wq = NULL;
-                return ret;
+        if (!ceph_msgr_wq) {
+                pr_err("msgr_init failed to create workqueue\n");
+                return -ENOMEM;
         }
         return 0;
 }
diff --git a/net/ceph/pagevec.c b/net/ceph/pagevec.c
index ac34feeb2b3a..1a040e64c69f 100644
--- a/net/ceph/pagevec.c
+++ b/net/ceph/pagevec.c
@@ -13,7 +13,7 @@
  * build a vector of user pages
  */
 struct page **ceph_get_direct_page_vector(const char __user *data,
-                                          int num_pages)
+                                          int num_pages, bool write_page)
 {
         struct page **pages;
         int rc;
@@ -24,24 +24,27 @@ struct page **ceph_get_direct_page_vector(const char __user *data,
 
         down_read(&current->mm->mmap_sem);
         rc = get_user_pages(current, current->mm, (unsigned long)data,
-                            num_pages, 0, 0, pages, NULL);
+                            num_pages, write_page, 0, pages, NULL);
         up_read(&current->mm->mmap_sem);
-        if (rc < 0)
+        if (rc < num_pages)
                 goto fail;
         return pages;
 
 fail:
-        kfree(pages);
+        ceph_put_page_vector(pages, rc > 0 ? rc : 0, false);
         return ERR_PTR(rc);
 }
 EXPORT_SYMBOL(ceph_get_direct_page_vector);
 
-void ceph_put_page_vector(struct page **pages, int num_pages)
+void ceph_put_page_vector(struct page **pages, int num_pages, bool dirty)
 {
         int i;
 
-        for (i = 0; i < num_pages; i++)
+        for (i = 0; i < num_pages; i++) {
+                if (dirty)
+                        set_page_dirty_lock(pages[i]);
                 put_page(pages[i]);
+        }
         kfree(pages);
 }
 EXPORT_SYMBOL(ceph_put_page_vector);
diff --git a/net/core/filter.c b/net/core/filter.c
index c1ee800bc080..ae21a0d3c4a2 100644
--- a/net/core/filter.c
+++ b/net/core/filter.c
@@ -589,23 +589,16 @@ int sk_chk_filter(struct sock_filter *filter, int flen)
 EXPORT_SYMBOL(sk_chk_filter);
 
 /**
- *      sk_filter_rcu_release - Release a socket filter by rcu_head
+ *      sk_filter_release_rcu - Release a socket filter by rcu_head
  *      @rcu: rcu_head that contains the sk_filter to free
  */
-static void sk_filter_rcu_release(struct rcu_head *rcu)
+void sk_filter_release_rcu(struct rcu_head *rcu)
 {
         struct sk_filter *fp = container_of(rcu, struct sk_filter, rcu);
 
-        sk_filter_release(fp);
-}
-
-static void sk_filter_delayed_uncharge(struct sock *sk, struct sk_filter *fp)
-{
-        unsigned int size = sk_filter_len(fp);
-
-        atomic_sub(size, &sk->sk_omem_alloc);
-        call_rcu_bh(&fp->rcu, sk_filter_rcu_release);
+        kfree(fp);
 }
+EXPORT_SYMBOL(sk_filter_release_rcu);
 
 /**
  *      sk_attach_filter - attach a socket filter
@@ -649,7 +642,7 @@ int sk_attach_filter(struct sock_fprog *fprog, struct sock *sk)
         rcu_assign_pointer(sk->sk_filter, fp);
 
         if (old_fp)
-                sk_filter_delayed_uncharge(sk, old_fp);
+                sk_filter_uncharge(sk, old_fp);
         return 0;
 }
 EXPORT_SYMBOL_GPL(sk_attach_filter);
@@ -663,7 +656,7 @@ int sk_detach_filter(struct sock *sk)
                                            sock_owned_by_user(sk));
         if (filter) {
                 rcu_assign_pointer(sk->sk_filter, NULL);
-                sk_filter_delayed_uncharge(sk, filter);
+                sk_filter_uncharge(sk, filter);
                 ret = 0;
         }
         return ret;
diff --git a/net/core/timestamping.c b/net/core/timestamping.c
index 0ae6c22da85b..c19bb4ee405e 100644
--- a/net/core/timestamping.c
+++ b/net/core/timestamping.c
@@ -96,11 +96,13 @@ bool skb_defer_rx_timestamp(struct sk_buff *skb)
         struct phy_device *phydev;
         unsigned int type;
 
-        skb_push(skb, ETH_HLEN);
+        if (skb_headroom(skb) < ETH_HLEN)
+                return false;
+        __skb_push(skb, ETH_HLEN);
 
         type = classify(skb);
 
-        skb_pull(skb, ETH_HLEN);
+        __skb_pull(skb, ETH_HLEN);
 
         switch (type) {
         case PTP_CLASS_V1_IPV4:
diff --git a/net/econet/af_econet.c b/net/econet/af_econet.c
index 13992e1d2726..15dcc1a586b4 100644
--- a/net/econet/af_econet.c
+++ b/net/econet/af_econet.c
@@ -661,8 +661,10 @@ static int ec_dev_ioctl(struct socket *sock, unsigned int cmd, void __user *arg)
         err = 0;
         switch (cmd) {
         case SIOCSIFADDR:
-                if (!capable(CAP_NET_ADMIN))
-                        return -EPERM;
+                if (!capable(CAP_NET_ADMIN)) {
+                        err = -EPERM;
+                        break;
+                }
 
                 edev = dev->ec_ptr;
                 if (edev == NULL) {
@@ -849,9 +851,13 @@ static void aun_incoming(struct sk_buff *skb, struct aunhdr *ah, size_t len)
 {
         struct iphdr *ip = ip_hdr(skb);
         unsigned char stn = ntohl(ip->saddr) & 0xff;
+        struct dst_entry *dst = skb_dst(skb);
+        struct ec_device *edev = NULL;
         struct sock *sk = NULL;
         struct sk_buff *newskb;
-        struct ec_device *edev = skb->dev->ec_ptr;
+
+        if (dst)
+                edev = dst->dev->ec_ptr;
 
         if (! edev)
                 goto bad;
diff --git a/net/ipv4/proc.c b/net/ipv4/proc.c
index 1b48eb1ed453..b14ec7d03b6e 100644
--- a/net/ipv4/proc.c
+++ b/net/ipv4/proc.c
@@ -253,6 +253,7 @@ static const struct snmp_mib snmp4_net_list[] = {
         SNMP_MIB_ITEM("TCPMinTTLDrop", LINUX_MIB_TCPMINTTLDROP),
         SNMP_MIB_ITEM("TCPDeferAcceptDrop", LINUX_MIB_TCPDEFERACCEPTDROP),
         SNMP_MIB_ITEM("IPReversePathFilter", LINUX_MIB_IPRPFILTER),
+        SNMP_MIB_ITEM("TCPTimeWaitOverflow", LINUX_MIB_TCPTIMEWAITOVERFLOW),
         SNMP_MIB_SENTINEL
 };
 
diff --git a/net/ipv4/tcp_minisocks.c b/net/ipv4/tcp_minisocks.c
index 43cf901d7659..a66735f75963 100644
--- a/net/ipv4/tcp_minisocks.c
+++ b/net/ipv4/tcp_minisocks.c
@@ -347,7 +347,7 @@ void tcp_time_wait(struct sock *sk, int state, int timeo)
                  * socket up.  We've got bigger problems than
                  * non-graceful socket closings.
                  */
-                LIMIT_NETDEBUG(KERN_INFO "TCP: time wait bucket table overflow\n");
+                NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_TCPTIMEWAITOVERFLOW);
         }
 
         tcp_update_metrics(sk);
diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
index 05b1ecf36763..61c2463e2753 100644
--- a/net/ipv4/tcp_output.c
+++ b/net/ipv4/tcp_output.c
@@ -231,11 +231,10 @@ void tcp_select_initial_window(int __space, __u32 mss,
                 /* when initializing use the value from init_rcv_wnd
                  * rather than the default from above
                  */
-                if (init_rcv_wnd &&
-                    (*rcv_wnd > init_rcv_wnd * mss))
-                        *rcv_wnd = init_rcv_wnd * mss;
-                else if (*rcv_wnd > init_cwnd * mss)
-                        *rcv_wnd = init_cwnd * mss;
+                if (init_rcv_wnd)
+                        *rcv_wnd = min(*rcv_wnd, init_rcv_wnd * mss);
+                else
+                        *rcv_wnd = min(*rcv_wnd, init_cwnd * mss);
         }
 
         /* Set the clamp no higher than max representable value */
@@ -386,27 +385,30 @@ struct tcp_out_options {
  */
 static u8 tcp_cookie_size_check(u8 desired)
 {
-        if (desired > 0) {
+        int cookie_size;
+
+        if (desired > 0)
                 /* previously specified */
                 return desired;
-        }
-        if (sysctl_tcp_cookie_size <= 0) {
+
+        cookie_size = ACCESS_ONCE(sysctl_tcp_cookie_size);
+        if (cookie_size <= 0)
                 /* no default specified */
                 return 0;
-        }
-        if (sysctl_tcp_cookie_size <= TCP_COOKIE_MIN) {
+
+        if (cookie_size <= TCP_COOKIE_MIN)
                 /* value too small, specify minimum */
                 return TCP_COOKIE_MIN;
-        }
-        if (sysctl_tcp_cookie_size >= TCP_COOKIE_MAX) {
+
+        if (cookie_size >= TCP_COOKIE_MAX)
                 /* value too large, specify maximum */
                 return TCP_COOKIE_MAX;
-        }
-        if (0x1 & sysctl_tcp_cookie_size) {
+
+        if (cookie_size & 1)
                 /* 8-bit multiple, illegal, fix it */
-                return (u8)(sysctl_tcp_cookie_size + 0x1);
-        }
-        return (u8)sysctl_tcp_cookie_size;
+                cookie_size++;
+
+        return (u8)cookie_size;
 }
 
 /* Write previously computed TCP options to the packet.
@@ -1513,6 +1515,7 @@ static int tcp_tso_should_defer(struct sock *sk, struct sk_buff *skb)
         struct tcp_sock *tp = tcp_sk(sk);
         const struct inet_connection_sock *icsk = inet_csk(sk);
         u32 send_win, cong_win, limit, in_flight;
+        int win_divisor;
 
         if (TCP_SKB_CB(skb)->flags & TCPHDR_FIN)
                 goto send_now;
@@ -1544,13 +1547,14 @@ static int tcp_tso_should_defer(struct sock *sk, struct sk_buff *skb)
         if ((skb != tcp_write_queue_tail(sk)) && (limit >= skb->len))
                 goto send_now;
 
-        if (sysctl_tcp_tso_win_divisor) {
+        win_divisor = ACCESS_ONCE(sysctl_tcp_tso_win_divisor);
+        if (win_divisor) {
                 u32 chunk = min(tp->snd_wnd, tp->snd_cwnd * tp->mss_cache);
 
                 /* If at least some fraction of a window is available,
                  * just use it.
                  */
-                chunk /= sysctl_tcp_tso_win_divisor;
+                chunk /= win_divisor;
                 if (limit >= chunk)
                         goto send_now;
         } else {
diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index 23cc8e1ce8d4..93b7a933a775 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -4021,11 +4021,11 @@ void inet6_ifinfo_notify(int event, struct inet6_dev *idev)
                 kfree_skb(skb);
                 goto errout;
         }
-        rtnl_notify(skb, net, 0, RTNLGRP_IPV6_IFADDR, NULL, GFP_ATOMIC);
+        rtnl_notify(skb, net, 0, RTNLGRP_IPV6_IFINFO, NULL, GFP_ATOMIC);
         return;
 errout:
         if (err < 0)
-                rtnl_set_sk_err(net, RTNLGRP_IPV6_IFADDR, err);
+                rtnl_set_sk_err(net, RTNLGRP_IPV6_IFINFO, err);
 }
 
 static inline size_t inet6_prefix_nlmsg_size(void)
diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c
index 2a59610c2a58..70e891a20fb9 100644
--- a/net/ipv6/ip6_tunnel.c
+++ b/net/ipv6/ip6_tunnel.c
@@ -1175,6 +1175,8 @@ static void ip6_tnl_link_config(struct ip6_tnl *t)
                                 sizeof (struct ipv6hdr);
 
                         dev->mtu = rt->rt6i_dev->mtu - sizeof (struct ipv6hdr);
+                        if (!(t->parms.flags & IP6_TNL_F_IGN_ENCAP_LIMIT))
+                                dev->mtu-=8;
 
                         if (dev->mtu < IPV6_MIN_MTU)
                                 dev->mtu = IPV6_MIN_MTU;
@@ -1363,12 +1365,17 @@ static const struct net_device_ops ip6_tnl_netdev_ops = {
 
 static void ip6_tnl_dev_setup(struct net_device *dev)
 {
+        struct ip6_tnl *t;
+
         dev->netdev_ops = &ip6_tnl_netdev_ops;
         dev->destructor = ip6_dev_free;
 
         dev->type = ARPHRD_TUNNEL6;
         dev->hard_header_len = LL_MAX_HEADER + sizeof (struct ipv6hdr);
         dev->mtu = ETH_DATA_LEN - sizeof (struct ipv6hdr);
+        t = netdev_priv(dev);
+        if (!(t->parms.flags & IP6_TNL_F_IGN_ENCAP_LIMIT))
+                dev->mtu-=8;
         dev->flags |= IFF_NOARP;
         dev->addr_len = sizeof(struct in6_addr);
         dev->features |= NETIF_F_NETNS_LOCAL;
diff --git a/net/ipv6/sit.c b/net/ipv6/sit.c
index d6bfaec3bbbf..8c4d00c7cd2b 100644
--- a/net/ipv6/sit.c
+++ b/net/ipv6/sit.c
@@ -606,8 +606,9 @@ static int ipip6_rcv(struct sk_buff *skb)
                 return 0;
         }
 
-        icmp_send(skb, ICMP_DEST_UNREACH, ICMP_PORT_UNREACH, 0);
+        /* no tunnel matched,  let upstream know, ipsec may handle it */
         rcu_read_unlock();
+        return 1;
 out:
         kfree_skb(skb);
         return 0;
diff --git a/net/l2tp/l2tp_ip.c b/net/l2tp/l2tp_ip.c
index 0bf6a59545ab..522e219f3558 100644
--- a/net/l2tp/l2tp_ip.c
+++ b/net/l2tp/l2tp_ip.c
@@ -674,4 +674,8 @@ MODULE_LICENSE("GPL");
 MODULE_AUTHOR("James Chapman <jchapman@katalix.com>");
 MODULE_DESCRIPTION("L2TP over IP");
 MODULE_VERSION("1.0");
-MODULE_ALIAS_NET_PF_PROTO_TYPE(PF_INET, SOCK_DGRAM, IPPROTO_L2TP);
+
+/* Use the value of SOCK_DGRAM (2) directory, because __stringify does't like
+ * enums
+ */
+MODULE_ALIAS_NET_PF_PROTO_TYPE(PF_INET, 2, IPPROTO_L2TP);
diff --git a/net/llc/af_llc.c b/net/llc/af_llc.c
index 582612998211..e35dbe55f520 100644
--- a/net/llc/af_llc.c
+++ b/net/llc/af_llc.c
@@ -317,8 +317,9 @@ static int llc_ui_bind(struct socket *sock, struct sockaddr *uaddr, int addrlen)
                 goto out;
         rc = -ENODEV;
         rtnl_lock();
+        rcu_read_lock();
         if (sk->sk_bound_dev_if) {
-                llc->dev = dev_get_by_index(&init_net, sk->sk_bound_dev_if);
+                llc->dev = dev_get_by_index_rcu(&init_net, sk->sk_bound_dev_if);
                 if (llc->dev) {
                         if (!addr->sllc_arphrd)
                                 addr->sllc_arphrd = llc->dev->type;
@@ -329,13 +330,13 @@ static int llc_ui_bind(struct socket *sock, struct sockaddr *uaddr, int addrlen)
                             !llc_mac_match(addr->sllc_mac,
                                            llc->dev->dev_addr)) {
                                 rc = -EINVAL;
-                                dev_put(llc->dev);
                                 llc->dev = NULL;
                         }
                 }
         } else
                 llc->dev = dev_getbyhwaddr(&init_net, addr->sllc_arphrd,
                                            addr->sllc_mac);
+        rcu_read_unlock();
         rtnl_unlock();
         if (!llc->dev)
                 goto out;
diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
index 902b03ee8f60..54fb4a0e76f0 100644
--- a/net/mac80211/rx.c
+++ b/net/mac80211/rx.c
@@ -2247,6 +2247,10 @@ ieee80211_rx_h_mgmt(struct ieee80211_rx_data *rx)
                 break;
         case cpu_to_le16(IEEE80211_STYPE_DEAUTH):
         case cpu_to_le16(IEEE80211_STYPE_DISASSOC):
+                if (is_multicast_ether_addr(mgmt->da) &&
+                    !is_broadcast_ether_addr(mgmt->da))
+                        return RX_DROP_MONITOR;
+
                 /* process only for station */
                 if (sdata->vif.type != NL80211_IFTYPE_STATION)
                         return RX_DROP_MONITOR;
@@ -2741,6 +2745,7 @@ static void __ieee80211_rx_handle_packet(struct ieee80211_hw *hw,
 
                         if (ieee80211_prepare_and_rx_handle(&rx, skb, true))
                                 return;
+                        goto out;
                 }
         }
 
@@ -2780,6 +2785,7 @@ static void __ieee80211_rx_handle_packet(struct ieee80211_hw *hw,
                         return;
         }
 
+ out:
         dev_kfree_skb(skb);
 }
 
diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c
index 96c594309506..7a637b80a62e 100644
--- a/net/mac80211/tx.c
+++ b/net/mac80211/tx.c
@@ -1587,7 +1587,12 @@ static void ieee80211_xmit(struct ieee80211_sub_if_data *sdata,
                                                 list) {
                                 if (!ieee80211_sdata_running(tmp_sdata))
                                         continue;
-                                if (tmp_sdata->vif.type != NL80211_IFTYPE_AP)
+                                if (tmp_sdata->vif.type ==
+                                    NL80211_IFTYPE_MONITOR ||
+                                    tmp_sdata->vif.type ==
+                                    NL80211_IFTYPE_AP_VLAN ||
+                                        tmp_sdata->vif.type ==
+                                    NL80211_IFTYPE_WDS)
                                         continue;
                                 if (compare_ether_addr(tmp_sdata->vif.addr,
                                                        hdr->addr2) == 0) {
@@ -1732,15 +1737,13 @@ netdev_tx_t ieee80211_subif_start_xmit(struct sk_buff *skb,
         int nh_pos, h_pos;
         struct sta_info *sta = NULL;
         u32 sta_flags = 0;
+        struct sk_buff *tmp_skb;
 
         if (unlikely(skb->len < ETH_HLEN)) {
                 ret = NETDEV_TX_OK;
                 goto fail;
         }
 
-        nh_pos = skb_network_header(skb) - skb->data;
-        h_pos = skb_transport_header(skb) - skb->data;
-
         /* convert Ethernet header to proper 802.11 header (based on
          * operation mode) */
         ethertype = (skb->data[12] << 8) | skb->data[13];
@@ -1913,6 +1916,20 @@ netdev_tx_t ieee80211_subif_start_xmit(struct sk_buff *skb,
                 goto fail;
         }
 
+        /*
+         * If the skb is shared we need to obtain our own copy.
+         */
+        if (skb_shared(skb)) {
+                tmp_skb = skb;
+                skb = skb_copy(skb, GFP_ATOMIC);
+                kfree_skb(tmp_skb);
+
+                if (!skb) {
+                        ret = NETDEV_TX_OK;
+                        goto fail;
+                }
+        }
+
         hdr.frame_control = fc;
         hdr.duration_id = 0;
         hdr.seq_ctrl = 0;
@@ -1931,6 +1948,9 @@ netdev_tx_t ieee80211_subif_start_xmit(struct sk_buff *skb,
                 encaps_len = 0;
         }
 
+        nh_pos = skb_network_header(skb) - skb->data;
+        h_pos = skb_transport_header(skb) - skb->data;
+
         skb_pull(skb, skip_header_bytes);
         nh_pos -= skip_header_bytes;
         h_pos -= skip_header_bytes;
diff --git a/net/sctp/socket.c b/net/sctp/socket.c
index 6bd554323a34..0b9ee34ad35c 100644
--- a/net/sctp/socket.c
+++ b/net/sctp/socket.c
@@ -2932,6 +2932,7 @@ static int sctp_setsockopt_peer_primary_addr(struct sock *sk, char __user *optva
         struct sctp_association *asoc = NULL;
         struct sctp_setpeerprim prim;
         struct sctp_chunk       *chunk;
+        struct sctp_af          *af;
         int                     err;
 
         sp = sctp_sk(sk);
@@ -2959,6 +2960,13 @@ static int sctp_setsockopt_peer_primary_addr(struct sock *sk, char __user *optva
         if (!sctp_state(asoc, ESTABLISHED))
                 return -ENOTCONN;
 
+        af = sctp_get_af_specific(prim.sspp_addr.ss_family);
+        if (!af)
+                return -EINVAL;
+
+        if (!af->addr_valid((union sctp_addr *)&prim.sspp_addr, sp, NULL))
+                return -EADDRNOTAVAIL;
+
         if (!sctp_assoc_lookup_laddr(asoc, (union sctp_addr *)&prim.sspp_addr))
                 return -EADDRNOTAVAIL;
 
diff --git a/net/socket.c b/net/socket.c
index 3ca2fd9e3720..088fb3fd45e0 100644
--- a/net/socket.c
+++ b/net/socket.c
@@ -732,6 +732,21 @@ static int sock_recvmsg_nosec(struct socket *sock, struct msghdr *msg,
         return ret;
 }
 
+/**
+ * kernel_recvmsg - Receive a message from a socket (kernel space)
+ * @sock:       The socket to receive the message from
+ * @msg:        Received message
+ * @vec:        Input s/g array for message data
+ * @num:        Size of input s/g array
+ * @size:       Number of bytes to read
+ * @flags:      Message flags (MSG_DONTWAIT, etc...)
+ *
+ * On return the msg structure contains the scatter/gather array passed in the
+ * vec argument. The array is modified so that it consists of the unfilled
+ * portion of the original array.
+ *
+ * The returned value is the total number of bytes received, or an error.
+ */
 int kernel_recvmsg(struct socket *sock, struct msghdr *msg,
                    struct kvec *vec, size_t num, size_t size, int flags)
 {
diff --git a/net/sunrpc/svc_xprt.c b/net/sunrpc/svc_xprt.c
index ea2ff78dcf7b..3f2c5559ca1a 100644
--- a/net/sunrpc/svc_xprt.c
+++ b/net/sunrpc/svc_xprt.c
@@ -212,6 +212,7 @@ int svc_create_xprt(struct svc_serv *serv, const char *xprt_name,
         spin_lock(&svc_xprt_class_lock);
         list_for_each_entry(xcl, &svc_xprt_class_list, xcl_list) {
                 struct svc_xprt *newxprt;
+                unsigned short newport;
 
                 if (strcmp(xprt_name, xcl->xcl_name))
                         continue;
@@ -230,8 +231,9 @@ int svc_create_xprt(struct svc_serv *serv, const char *xprt_name,
                 spin_lock_bh(&serv->sv_lock);
                 list_add(&newxprt->xpt_list, &serv->sv_permsocks);
                 spin_unlock_bh(&serv->sv_lock);
+                newport = svc_xprt_local_port(newxprt);
                 clear_bit(XPT_BUSY, &newxprt->xpt_flags);
-                return svc_xprt_local_port(newxprt);
+                return newport;
         }
  err:
         spin_unlock(&svc_xprt_class_lock);
@@ -425,8 +427,13 @@ void svc_xprt_received(struct svc_xprt *xprt)
 {
         BUG_ON(!test_bit(XPT_BUSY, &xprt->xpt_flags));
         xprt->xpt_pool = NULL;
+        /* As soon as we clear busy, the xprt could be closed and
+         * 'put', so we need a reference to call svc_xprt_enqueue with:
+         */
+        svc_xprt_get(xprt);
         clear_bit(XPT_BUSY, &xprt->xpt_flags);
         svc_xprt_enqueue(xprt);
+        svc_xprt_put(xprt);
 }
 EXPORT_SYMBOL_GPL(svc_xprt_received);
 
diff --git a/net/x25/x25_link.c b/net/x25/x25_link.c
index 73e7b954ad28..b25c6463c3e9 100644
--- a/net/x25/x25_link.c
+++ b/net/x25/x25_link.c
@@ -394,6 +394,7 @@ void __exit x25_link_free(void)
         list_for_each_safe(entry, tmp, &x25_neigh_list) {
                 nb = list_entry(entry, struct x25_neigh, node);
                 __x25_remove_neigh(nb);
+                dev_put(nb->dev);
         }
         write_unlock_bh(&x25_neigh_list_lock);
 }
diff --git a/net/xfrm/xfrm_state.c b/net/xfrm/xfrm_state.c
index eb96ce52f178..220ebc05c7af 100644
--- a/net/xfrm/xfrm_state.c
+++ b/net/xfrm/xfrm_state.c
@@ -1268,7 +1268,7 @@ struct xfrm_state * xfrm_state_migrate(struct xfrm_state *x,
 
         return xc;
 error:
-        kfree(xc);
+        xfrm_state_put(xc);
         return NULL;
 }
 EXPORT_SYMBOL(xfrm_state_migrate);