44 files changed, 114 insertions, 372 deletions
diff --git a/net/9p/client.c b/net/9p/client.c
index 0ce959218607..ceab943dfc49 100644
--- a/net/9p/client.c
+++ b/net/9p/client.c
@@ -614,7 +614,7 @@ p9_client_rpc(struct p9_client *c, int8_t type, const char *fmt, ...)
        err = c->trans_mod->request(c, req);
        if (err < 0) {
-                if (err != -ERESTARTSYS)
+                if (err != -ERESTARTSYS && err != -EFAULT)
                        c->status = Disconnected;
                goto reterr;
        }
@@ -929,15 +929,15 @@ error:
 }
 EXPORT_SYMBOL(p9_client_attach);
-struct p9_fid *p9_client_walk(struct p9_fid *oldfid, int nwname, char **wnames,
+struct p9_fid *p9_client_walk(struct p9_fid *oldfid, uint16_t nwname,
-        int clone)
+                char **wnames, int clone)
 {
        int err;
        struct p9_client *clnt;
        struct p9_fid *fid;
        struct p9_qid *wqids;
        struct p9_req_t *req;
-        int16_t nwqids, count;
+        uint16_t nwqids, count;
        err = 0;
        wqids = NULL;
@@ -955,7 +955,7 @@ struct p9_fid *p9_client_walk(struct p9_fid *oldfid, int nwname, char **wnames,
                fid = oldfid;
-        P9_DPRINTK(P9_DEBUG_9P, ">>> TWALK fids %d,%d nwname %d wname[0] %s\n",
+        P9_DPRINTK(P9_DEBUG_9P, ">>> TWALK fids %d,%d nwname %ud wname[0] %s\n",
                oldfid->fid, fid->fid, nwname, wnames ? wnames[0] : NULL);
        req = p9_client_rpc(clnt, P9_TWALK, "ddT", oldfid->fid, fid->fid,
@@ -1220,27 +1220,6 @@ error:
 }
 EXPORT_SYMBOL(p9_client_fsync);
-int p9_client_sync_fs(struct p9_fid *fid)
-{
-        int err = 0;
-        struct p9_req_t *req;
-        struct p9_client *clnt;
-        P9_DPRINTK(P9_DEBUG_9P, ">>> TSYNC_FS fid %d\n", fid->fid);
-        clnt = fid->clnt;
-        req = p9_client_rpc(clnt, P9_TSYNCFS, "d", fid->fid);
-        if (IS_ERR(req)) {
-                err = PTR_ERR(req);
-                goto error;
-        }
-        P9_DPRINTK(P9_DEBUG_9P, "<<< RSYNCFS fid %d\n", fid->fid);
-        p9_free_req(clnt, req);
-error:
-        return err;
-}
-EXPORT_SYMBOL(p9_client_sync_fs);
 int p9_client_clunk(struct p9_fid *fid)
 {
        int err;
diff --git a/net/9p/protocol.c b/net/9p/protocol.c
index 8a4084fa8b5a..a873277cb996 100644
--- a/net/9p/protocol.c
+++ b/net/9p/protocol.c
@@ -265,7 +265,7 @@ p9pdu_vreadf(struct p9_fcall *pdu, int proto_version, const char *fmt,
                        }
                        break;
                case 'T':{
-                                int16_t *nwname = va_arg(ap, int16_t *);
+                                uint16_t *nwname = va_arg(ap, uint16_t *);
                                char ***wnames = va_arg(ap, char ***);
                                errcode = p9pdu_readf(pdu, proto_version,
@@ -468,7 +468,8 @@ p9pdu_vwritef(struct p9_fcall *pdu, int proto_version, const char *fmt,
                case 'E':{
                                 int32_t cnt = va_arg(ap, int32_t);
                                 const char *k = va_arg(ap, const void *);
-                                 const char *u = va_arg(ap, const void *);
+                                 const char __user *u = va_arg(ap,
+                                                        const void __user *);
                                 errcode = p9pdu_writef(pdu, proto_version, "d",
                                                 cnt);
                                 if (!errcode && pdu_write_urw(pdu, k, u, cnt))
@@ -495,7 +496,7 @@ p9pdu_vwritef(struct p9_fcall *pdu, int proto_version, const char *fmt,
                        }
                        break;
                case 'T':{
-                                int16_t nwname = va_arg(ap, int);
+                                uint16_t nwname = va_arg(ap, int);
                                const char **wnames = va_arg(ap, const char **);
                                errcode = p9pdu_writef(pdu, proto_version, "w",
@@ -673,6 +674,7 @@ int p9dirent_read(char *buf, int len, struct p9_dirent *dirent,
        }
        strcpy(dirent->d_name, nameptr);
+        kfree(nameptr);
 out:
        return fake_pdu.offset;
diff --git a/net/9p/trans_common.c b/net/9p/trans_common.c
index d47880e971dd..9a70ebdec56e 100644
--- a/net/9p/trans_common.c
+++ b/net/9p/trans_common.c
@@ -63,10 +63,10 @@ p9_payload_gup(struct p9_req_t *req, size_t *pdata_off, int *pdata_len,
                int nr_pages, u8 rw)
 {
        uint32_t first_page_bytes = 0;
-        uint32_t pdata_mapped_pages;
+        int32_t pdata_mapped_pages;
        struct trans_rpage_info  *rpinfo;
-        *pdata_off = (size_t)req->tc->pubuf & (PAGE_SIZE-1);
+        *pdata_off = (__force size_t)req->tc->pubuf & (PAGE_SIZE-1);
        if (*pdata_off)
                first_page_bytes = min(((size_t)PAGE_SIZE - *pdata_off),
@@ -75,14 +75,9 @@ p9_payload_gup(struct p9_req_t *req, size_t *pdata_off, int *pdata_len,
        rpinfo = req->tc->private;
        pdata_mapped_pages = get_user_pages_fast((unsigned long)req->tc->pubuf,
                        nr_pages, rw, &rpinfo->rp_data[0]);
+        if (pdata_mapped_pages <= 0)
+                return pdata_mapped_pages;
-        if (pdata_mapped_pages < 0) {
-                printk(KERN_ERR "get_user_pages_fast failed:%d udata:%p"
-                                "nr_pages:%d\n", pdata_mapped_pages,
-                                req->tc->pubuf, nr_pages);
-                pdata_mapped_pages = 0;
-                return -EIO;
-        }
        rpinfo->rp_nr_pages = pdata_mapped_pages;
        if (*pdata_off) {
                *pdata_len = first_page_bytes;
diff --git a/net/9p/trans_virtio.c b/net/9p/trans_virtio.c
index e8f046b07182..244e70742183 100644
--- a/net/9p/trans_virtio.c
+++ b/net/9p/trans_virtio.c
@@ -326,8 +326,11 @@ req_retry_pinned:
                        outp = pack_sg_list_p(chan->sg, out, VIRTQUEUE_NUM,
                                        pdata_off, rpinfo->rp_data, pdata_len);
                } else {
-                        char *pbuf = req->tc->pubuf ? req->tc->pubuf :
+                        char *pbuf;
-                                                                req->tc->pkbuf;
+                        if (req->tc->pubuf)
+                                pbuf = (__force char *) req->tc->pubuf;
+                        else
+                                pbuf = req->tc->pkbuf;
                        outp = pack_sg_list(chan->sg, out, VIRTQUEUE_NUM, pbuf,
                                        req->tc->pbuf_size);
                }
@@ -352,8 +355,12 @@ req_retry_pinned:
                        in = pack_sg_list_p(chan->sg, out+inp, VIRTQUEUE_NUM,
                                        pdata_off, rpinfo->rp_data, pdata_len);
                } else {
-                        char *pbuf = req->tc->pubuf ? req->tc->pubuf :
+                        char *pbuf;
-                                                                req->tc->pkbuf;
+                        if (req->tc->pubuf)
+                                pbuf = (__force char *) req->tc->pubuf;
+                        else
+                                pbuf = req->tc->pkbuf;
                        in = pack_sg_list(chan->sg, out+inp, VIRTQUEUE_NUM,
                                        pbuf, req->tc->pbuf_size);
                }
diff --git a/net/batman-adv/gateway_client.c b/net/batman-adv/gateway_client.c
index 65f39530799d..61605a0f3f39 100644
--- a/net/batman-adv/gateway_client.c
+++ b/net/batman-adv/gateway_client.c
@@ -29,18 +29,10 @@
 #include <linux/udp.h>
 #include <linux/if_vlan.h>
-static void gw_node_free_rcu(struct rcu_head *rcu)
-{
-        struct gw_node *gw_node;
-        gw_node = container_of(rcu, struct gw_node, rcu);
-        kfree(gw_node);
-}
 static void gw_node_free_ref(struct gw_node *gw_node)
 {
        if (atomic_dec_and_test(&gw_node->refcount))
-                call_rcu(&gw_node->rcu, gw_node_free_rcu);
+                kfree_rcu(gw_node, rcu);
 }
 static struct gw_node *gw_get_selected_gw_node(struct bat_priv *bat_priv)
diff --git a/net/batman-adv/originator.c b/net/batman-adv/originator.c
index 080ec88330a3..40a30bbcd147 100644
--- a/net/batman-adv/originator.c
+++ b/net/batman-adv/originator.c
@@ -54,18 +54,10 @@ err:
        return 0;
 }
-static void neigh_node_free_rcu(struct rcu_head *rcu)
-{
-        struct neigh_node *neigh_node;
-        neigh_node = container_of(rcu, struct neigh_node, rcu);
-        kfree(neigh_node);
-}
 void neigh_node_free_ref(struct neigh_node *neigh_node)
 {
        if (atomic_dec_and_test(&neigh_node->refcount))
-                call_rcu(&neigh_node->rcu, neigh_node_free_rcu);
+                kfree_rcu(neigh_node, rcu);
 }
 /* increases the refcounter of a found router */
diff --git a/net/batman-adv/soft-interface.c b/net/batman-adv/soft-interface.c
index c76a33eeb3f1..d5aa60999e83 100644
--- a/net/batman-adv/soft-interface.c
+++ b/net/batman-adv/soft-interface.c
@@ -72,18 +72,10 @@ int my_skb_head_push(struct sk_buff *skb, unsigned int len)
        return 0;
 }
-static void softif_neigh_free_rcu(struct rcu_head *rcu)
-{
-        struct softif_neigh *softif_neigh;
-        softif_neigh = container_of(rcu, struct softif_neigh, rcu);
-        kfree(softif_neigh);
-}
 static void softif_neigh_free_ref(struct softif_neigh *softif_neigh)
 {
        if (atomic_dec_and_test(&softif_neigh->refcount))
-                call_rcu(&softif_neigh->rcu, softif_neigh_free_rcu);
+                kfree_rcu(softif_neigh, rcu);
 }
 static void softif_neigh_vid_free_rcu(struct rcu_head *rcu)
diff --git a/net/bluetooth/sco.c b/net/bluetooth/sco.c
index 94954c74f6ae..42fdffd1d76c 100644
--- a/net/bluetooth/sco.c
+++ b/net/bluetooth/sco.c
@@ -369,15 +369,6 @@ static void __sco_sock_close(struct sock *sk)
        case BT_CONNECTED:
        case BT_CONFIG:
-                if (sco_pi(sk)->conn) {
-                        sk->sk_state = BT_DISCONN;
-                        sco_sock_set_timer(sk, SCO_DISCONN_TIMEOUT);
-                        hci_conn_put(sco_pi(sk)->conn->hcon);
-                        sco_pi(sk)->conn = NULL;
-                } else
-                        sco_chan_del(sk, ECONNRESET);
-                break;
        case BT_CONNECT:
        case BT_DISCONN:
                sco_chan_del(sk, ECONNRESET);
diff --git a/net/ceph/messenger.c b/net/ceph/messenger.c
index 05f357828a2f..e15a82ccc05f 100644
--- a/net/ceph/messenger.c
+++ b/net/ceph/messenger.c
@@ -2267,6 +2267,19 @@ struct ceph_msg *ceph_msg_new(int type, int front_len, gfp_t flags)
        m->more_to_follow = false;
        m->pool = NULL;
+        /* middle */
+        m->middle = NULL;
+        /* data */
+        m->nr_pages = 0;
+        m->page_alignment = 0;
+        m->pages = NULL;
+        m->pagelist = NULL;
+        m->bio = NULL;
+        m->bio_iter = NULL;
+        m->bio_seg = 0;
+        m->trail = NULL;
        /* front */
        if (front_len) {
                if (front_len > PAGE_CACHE_SIZE) {
@@ -2286,19 +2299,6 @@ struct ceph_msg *ceph_msg_new(int type, int front_len, gfp_t flags)
        }
        m->front.iov_len = front_len;
-        /* middle */
-        m->middle = NULL;
-        /* data */
-        m->nr_pages = 0;
-        m->page_alignment = 0;
-        m->pages = NULL;
-        m->pagelist = NULL;
-        m->bio = NULL;
-        m->bio_iter = NULL;
-        m->bio_seg = 0;
-        m->trail = NULL;
        dout("ceph_msg_new %p front %d\n", m, front_len);
        return m;
diff --git a/net/ceph/osd_client.c b/net/ceph/osd_client.c
index 50af02737a3d..6b5dda1cb5df 100644
--- a/net/ceph/osd_client.c
+++ b/net/ceph/osd_client.c
@@ -470,8 +470,8 @@ struct ceph_osd_request *ceph_osdc_new_request(struct ceph_osd_client *osdc,
                                         snapc, ops,
                                         use_mempool,
                                         GFP_NOFS, NULL, NULL);
-        if (IS_ERR(req))
+        if (!req)
-                return req;
+                return NULL;
        /* calculate max write size */
        calc_layout(osdc, vino, layout, off, plen, req, ops);
@@ -579,9 +579,15 @@ static void __kick_osd_requests(struct ceph_osd_client *osdc,
        list_for_each_entry_safe(req, nreq, &osd->o_linger_requests,
                                 r_linger_osd) {
-                __unregister_linger_request(osdc, req);
+                /*
+                 * reregister request prior to unregistering linger so
+                 * that r_osd is preserved.
+                 */
+                BUG_ON(!list_empty(&req->r_req_lru_item));
                __register_request(osdc, req);
-                list_move(&req->r_req_lru_item, &osdc->req_unsent);
+                list_add(&req->r_req_lru_item, &osdc->req_unsent);
+                list_add(&req->r_osd_item, &req->r_osd->o_requests);
+                __unregister_linger_request(osdc, req);
                dout("requeued lingering %p tid %llu osd%d\n", req, req->r_tid,
                     osd->o_osd);
        }
@@ -798,7 +804,7 @@ static void __register_request(struct ceph_osd_client *osdc,
        req->r_request->hdr.tid = cpu_to_le64(req->r_tid);
        INIT_LIST_HEAD(&req->r_req_lru_item);
-        dout("register_request %p tid %lld\n", req, req->r_tid);
+        dout("__register_request %p tid %lld\n", req, req->r_tid);
        __insert_request(osdc, req);
        ceph_osdc_get_request(req);
        osdc->num_requests++;
diff --git a/net/core/dev_addr_lists.c b/net/core/dev_addr_lists.c
index 7b39f3ed2fda..e2e66939ed00 100644
--- a/net/core/dev_addr_lists.c
+++ b/net/core/dev_addr_lists.c
@@ -68,14 +68,6 @@ static int __hw_addr_add(struct netdev_hw_addr_list *list, unsigned char *addr,
        return __hw_addr_add_ex(list, addr, addr_len, addr_type, false);
 }
-static void ha_rcu_free(struct rcu_head *head)
-{
-        struct netdev_hw_addr *ha;
-        ha = container_of(head, struct netdev_hw_addr, rcu_head);
-        kfree(ha);
-}
 static int __hw_addr_del_ex(struct netdev_hw_addr_list *list,
                            unsigned char *addr, int addr_len,
                            unsigned char addr_type, bool global)
@@ -94,7 +86,7 @@ static int __hw_addr_del_ex(struct netdev_hw_addr_list *list,
                        if (--ha->refcount)
                                return 0;
                        list_del_rcu(&ha->list);
-                        call_rcu(&ha->rcu_head, ha_rcu_free);
+                        kfree_rcu(ha, rcu_head);
                        list->count--;
                        return 0;
                }
@@ -197,7 +189,7 @@ void __hw_addr_flush(struct netdev_hw_addr_list *list)
        list_for_each_entry_safe(ha, tmp, &list->list, list) {
                list_del_rcu(&ha->list);
-                call_rcu(&ha->rcu_head, ha_rcu_free);
+                kfree_rcu(ha, rcu_head);
        }
        list->count = 0;
 }
diff --git a/net/core/drop_monitor.c b/net/core/drop_monitor.c
index 706502ff64aa..7f36b38e060f 100644
--- a/net/core/drop_monitor.c
+++ b/net/core/drop_monitor.c
@@ -207,14 +207,6 @@ static void trace_napi_poll_hit(void *ignore, struct napi_struct *napi)
        rcu_read_unlock();
 }
-static void free_dm_hw_stat(struct rcu_head *head)
-{
-        struct dm_hw_stat_delta *n;
-        n = container_of(head, struct dm_hw_stat_delta, rcu);
-        kfree(n);
-}
 static int set_all_monitor_traces(int state)
 {
        int rc = 0;
@@ -245,7 +237,7 @@ static int set_all_monitor_traces(int state)
                list_for_each_entry_safe(new_stat, temp, &hw_stats_list, list) {
                        if (new_stat->dev == NULL) {
                                list_del_rcu(&new_stat->list);
-                                call_rcu(&new_stat->rcu, free_dm_hw_stat);
+                                kfree_rcu(new_stat, rcu);
                        }
                }
                break;
@@ -314,7 +306,7 @@ static int dropmon_net_event(struct notifier_block *ev_block,
                                new_stat->dev = NULL;
                                if (trace_state == TRACE_OFF) {
                                        list_del_rcu(&new_stat->list);
-                                        call_rcu(&new_stat->rcu, free_dm_hw_stat);
+                                        kfree_rcu(new_stat, rcu);
                                        break;
                                }
                        }
diff --git a/net/core/dst.c b/net/core/dst.c
index da47a299618a..81a4fa1c95ed 100644
--- a/net/core/dst.c
+++ b/net/core/dst.c
@@ -19,6 +19,7 @@
 #include <linux/types.h>
 #include <net/net_namespace.h>
 #include <linux/sched.h>
+#include <linux/prefetch.h>
 #include <net/dst.h>
diff --git a/net/core/gen_estimator.c b/net/core/gen_estimator.c
index 7c2373321b74..43b03dd71e85 100644
--- a/net/core/gen_estimator.c
+++ b/net/core/gen_estimator.c
@@ -249,13 +249,6 @@ int gen_new_estimator(struct gnet_stats_basic_packed *bstats,
 }
 EXPORT_SYMBOL(gen_new_estimator);
-static void __gen_kill_estimator(struct rcu_head *head)
-{
-        struct gen_estimator *e = container_of(head,
-                                        struct gen_estimator, e_rcu);
-        kfree(e);
-}
 /**
 * gen_kill_estimator - remove a rate estimator
 * @bstats: basic statistics
@@ -279,7 +272,7 @@ void gen_kill_estimator(struct gnet_stats_basic_packed *bstats,
                write_unlock(&est_lock);
                list_del_rcu(&e->list);
-                call_rcu(&e->e_rcu, __gen_kill_estimator);
+                kfree_rcu(e, e_rcu);
        }
        spin_unlock_bh(&est_tree_lock);
 }
diff --git a/net/core/net-sysfs.c b/net/core/net-sysfs.c
index 1b122177c8fa..11b98bc2aa8f 100644
--- a/net/core/net-sysfs.c
+++ b/net/core/net-sysfs.c
@@ -561,13 +561,6 @@ static ssize_t show_rps_map(struct netdev_rx_queue *queue,
        return len;
 }
-static void rps_map_release(struct rcu_head *rcu)
-{
-        struct rps_map *map = container_of(rcu, struct rps_map, rcu);
-        kfree(map);
-}
 static ssize_t store_rps_map(struct netdev_rx_queue *queue,
                      struct rx_queue_attribute *attribute,
                      const char *buf, size_t len)
@@ -615,7 +608,7 @@ static ssize_t store_rps_map(struct netdev_rx_queue *queue,
        spin_unlock(&rps_map_lock);
        if (old_map)
-                call_rcu(&old_map->rcu, rps_map_release);
+                kfree_rcu(old_map, rcu);
        free_cpumask_var(mask);
        return len;
@@ -724,7 +717,7 @@ static void rx_queue_release(struct kobject *kobj)
        map = rcu_dereference_raw(queue->rps_map);
        if (map) {
                RCU_INIT_POINTER(queue->rps_map, NULL);
-                call_rcu(&map->rcu, rps_map_release);
+                kfree_rcu(map, rcu);
        }
        flow_table = rcu_dereference_raw(queue->rps_flow_table);
@@ -894,21 +887,6 @@ static ssize_t show_xps_map(struct netdev_queue *queue,
        return len;
 }
-static void xps_map_release(struct rcu_head *rcu)
-{
-        struct xps_map *map = container_of(rcu, struct xps_map, rcu);
-        kfree(map);
-}
-static void xps_dev_maps_release(struct rcu_head *rcu)
-{
-        struct xps_dev_maps *dev_maps =
-            container_of(rcu, struct xps_dev_maps, rcu);
-        kfree(dev_maps);
-}
 static DEFINE_MUTEX(xps_map_mutex);
 #define xmap_dereference(P)             \
        rcu_dereference_protected((P), lockdep_is_held(&xps_map_mutex))
@@ -1005,7 +983,7 @@ static ssize_t store_xps_map(struct netdev_queue *queue,
                map = dev_maps ?
                        xmap_dereference(dev_maps->cpu_map[cpu]) : NULL;
                if (map && xmap_dereference(new_dev_maps->cpu_map[cpu]) != map)
-                        call_rcu(&map->rcu, xps_map_release);
+                        kfree_rcu(map, rcu);
                if (new_dev_maps->cpu_map[cpu])
                        nonempty = 1;
        }
@@ -1018,7 +996,7 @@ static ssize_t store_xps_map(struct netdev_queue *queue,
        }
        if (dev_maps)
-                call_rcu(&dev_maps->rcu, xps_dev_maps_release);
+                kfree_rcu(dev_maps, rcu);
        netdev_queue_numa_node_write(queue, (numa_node >= 0) ? numa_node :
                                            NUMA_NO_NODE);
@@ -1080,7 +1058,7 @@ static void netdev_queue_release(struct kobject *kobj)
                                else {
                                        RCU_INIT_POINTER(dev_maps->cpu_map[i],
                                            NULL);
-                                        call_rcu(&map->rcu, xps_map_release);
+                                        kfree_rcu(map, rcu);
                                        map = NULL;
                                }
                        }
@@ -1090,7 +1068,7 @@ static void netdev_queue_release(struct kobject *kobj)
                if (!nonempty) {
                        RCU_INIT_POINTER(dev->xps_maps, NULL);
-                        call_rcu(&dev_maps->rcu, xps_dev_maps_release);
+                        kfree_rcu(dev_maps, rcu);
                }
        }
diff --git a/net/core/net_namespace.c b/net/core/net_namespace.c
index 1abb50841046..2e2dce6583e1 100644
--- a/net/core/net_namespace.c
+++ b/net/core/net_namespace.c
@@ -27,14 +27,6 @@ EXPORT_SYMBOL(init_net);
 #define INITIAL_NET_GEN_PTRS    13 /* +1 for len +2 for rcu_head */
-static void net_generic_release(struct rcu_head *rcu)
-{
-        struct net_generic *ng;
-        ng = container_of(rcu, struct net_generic, rcu);
-        kfree(ng);
-}
 static int net_assign_generic(struct net *net, int id, void *data)
 {
        struct net_generic *ng, *old_ng;
@@ -68,7 +60,7 @@ static int net_assign_generic(struct net *net, int id, void *data)
        memcpy(&ng->ptr, &old_ng->ptr, old_ng->len * sizeof(void*));
        rcu_assign_pointer(net->gen, ng);
-        call_rcu(&old_ng->rcu, net_generic_release);
+        kfree_rcu(old_ng, rcu);
 assign:
        ng->ptr[id - 1] = data;
        return 0;
diff --git a/net/core/pktgen.c b/net/core/pktgen.c
index 379270f14771..67870e9fd097 100644
--- a/net/core/pktgen.c
+++ b/net/core/pktgen.c
@@ -156,6 +156,7 @@
 #include <linux/wait.h>
 #include <linux/etherdevice.h>
 #include <linux/kthread.h>
+#include <linux/prefetch.h>
 #include <net/net_namespace.h>
 #include <net/checksum.h>
 #include <net/ipv6.h>
diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index 3e934fe96f29..46cbd28f40f9 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -57,6 +57,7 @@
 #include <linux/init.h>
 #include <linux/scatterlist.h>
 #include <linux/errqueue.h>
+#include <linux/prefetch.h>
 #include <net/protocol.h>
 #include <net/dst.h>
diff --git a/net/decnet/dn_dev.c b/net/decnet/dn_dev.c
index 404fa1591027..cf26ac74a188 100644
--- a/net/decnet/dn_dev.c
+++ b/net/decnet/dn_dev.c
@@ -332,14 +332,9 @@ static struct dn_ifaddr *dn_dev_alloc_ifa(void)
        return ifa;
 }
-static void dn_dev_free_ifa_rcu(struct rcu_head *head)
-{
-        kfree(container_of(head, struct dn_ifaddr, rcu));
-}
 static void dn_dev_free_ifa(struct dn_ifaddr *ifa)
 {
-        call_rcu(&ifa->rcu, dn_dev_free_ifa_rcu);
+        kfree_rcu(ifa, rcu);
 }
 static void dn_dev_del_ifa(struct dn_dev *dn_db, struct dn_ifaddr __rcu **ifap, int destroy)
diff --git a/net/ipv4/fib_semantics.c b/net/ipv4/fib_semantics.c
index 641a5a2a9f9c..33e2c35b74b7 100644
--- a/net/ipv4/fib_semantics.c
+++ b/net/ipv4/fib_semantics.c
@@ -141,18 +141,8 @@ const struct fib_prop fib_props[RTN_MAX + 1] = {
        },
 };
 /* Release a nexthop info record */
-static void free_fib_info_rcu(struct rcu_head *head)
-{
-        struct fib_info *fi = container_of(head, struct fib_info, rcu);
-        if (fi->fib_metrics != (u32 *) dst_default_metrics)
-                kfree(fi->fib_metrics);
-        kfree(fi);
-}
 void free_fib_info(struct fib_info *fi)
 {
        if (fi->fib_dead == 0) {
@@ -166,7 +156,7 @@ void free_fib_info(struct fib_info *fi)
        } endfor_nexthops(fi);
        fib_info_cnt--;
        release_net(fi->fib_net);
-        call_rcu(&fi->rcu, free_fib_info_rcu);
+        kfree_rcu(fi, rcu);
 }
 void fib_release_info(struct fib_info *fi)
diff --git a/net/ipv4/fib_trie.c b/net/ipv4/fib_trie.c
index 6375c1c5f642..c779ce96e5b5 100644
--- a/net/ipv4/fib_trie.c
+++ b/net/ipv4/fib_trie.c
@@ -369,14 +369,9 @@ static inline void free_leaf(struct leaf *l)
        call_rcu_bh(&l->rcu, __leaf_free_rcu);
 }
-static void __leaf_info_free_rcu(struct rcu_head *head)
-{
-        kfree(container_of(head, struct leaf_info, rcu));
-}
 static inline void free_leaf_info(struct leaf_info *leaf)
 {
-        call_rcu(&leaf->rcu, __leaf_info_free_rcu);
+        kfree_rcu(leaf, rcu);
 }
 static struct tnode *tnode_alloc(size_t size)
diff --git a/net/ipv4/igmp.c b/net/ipv4/igmp.c
index ec03c2fda6ce..672e476c8c8a 100644
--- a/net/ipv4/igmp.c
+++ b/net/ipv4/igmp.c
@@ -149,17 +149,11 @@ static void ip_mc_clear_src(struct ip_mc_list *pmc);
 static int ip_mc_add_src(struct in_device *in_dev, __be32 *pmca, int sfmode,
                         int sfcount, __be32 *psfsrc, int delta);
-static void ip_mc_list_reclaim(struct rcu_head *head)
-{
-        kfree(container_of(head, struct ip_mc_list, rcu));
-}
 static void ip_ma_put(struct ip_mc_list *im)
 {
        if (atomic_dec_and_test(&im->refcnt)) {
                in_dev_put(im->interface);
-                call_rcu(&im->rcu, ip_mc_list_reclaim);
+                kfree_rcu(im, rcu);
        }
 }
@@ -1828,12 +1822,6 @@ done:
 }
 EXPORT_SYMBOL(ip_mc_join_group);
-static void ip_sf_socklist_reclaim(struct rcu_head *rp)
-{
-        kfree(container_of(rp, struct ip_sf_socklist, rcu));
-        /* sk_omem_alloc should have been decreased by the caller*/
-}
 static int ip_mc_leave_src(struct sock *sk, struct ip_mc_socklist *iml,
                           struct in_device *in_dev)
 {
@@ -1850,18 +1838,10 @@ static int ip_mc_leave_src(struct sock *sk, struct ip_mc_socklist *iml,
        rcu_assign_pointer(iml->sflist, NULL);
        /* decrease mem now to avoid the memleak warning */
        atomic_sub(IP_SFLSIZE(psf->sl_max), &sk->sk_omem_alloc);
-        call_rcu(&psf->rcu, ip_sf_socklist_reclaim);
+        kfree_rcu(psf, rcu);
        return err;
 }
-static void ip_mc_socklist_reclaim(struct rcu_head *rp)
-{
-        kfree(container_of(rp, struct ip_mc_socklist, rcu));
-        /* sk_omem_alloc should have been decreased by the caller*/
-}
 /*
 *      Ask a socket to leave a group.
 */
@@ -1901,7 +1881,7 @@ int ip_mc_leave_group(struct sock *sk, struct ip_mreqn *imr)
                rtnl_unlock();
                /* decrease mem now to avoid the memleak warning */
                atomic_sub(sizeof(*iml), &sk->sk_omem_alloc);
-                call_rcu(&iml->rcu, ip_mc_socklist_reclaim);
+                kfree_rcu(iml, rcu);
                return 0;
        }
        if (!in_dev)
@@ -2018,7 +1998,7 @@ int ip_mc_source(int add, int omode, struct sock *sk, struct
                                newpsl->sl_addr[i] = psl->sl_addr[i];
                        /* decrease mem now to avoid the memleak warning */
                        atomic_sub(IP_SFLSIZE(psl->sl_max), &sk->sk_omem_alloc);
-                        call_rcu(&psl->rcu, ip_sf_socklist_reclaim);
+                        kfree_rcu(psl, rcu);
                }
                rcu_assign_pointer(pmc->sflist, newpsl);
                psl = newpsl;
@@ -2119,7 +2099,7 @@ int ip_mc_msfilter(struct sock *sk, struct ip_msfilter *msf, int ifindex)
                        psl->sl_count, psl->sl_addr, 0);
                /* decrease mem now to avoid the memleak warning */
                atomic_sub(IP_SFLSIZE(psl->sl_max), &sk->sk_omem_alloc);
-                call_rcu(&psl->rcu, ip_sf_socklist_reclaim);
+                kfree_rcu(psl, rcu);
        } else
                (void) ip_mc_del_src(in_dev, &msf->imsf_multiaddr, pmc->sfmode,
                        0, NULL, 0);
@@ -2316,7 +2296,7 @@ void ip_mc_drop_socket(struct sock *sk)
                        ip_mc_dec_group(in_dev, iml->multi.imr_multiaddr.s_addr);
                /* decrease mem now to avoid the memleak warning */
                atomic_sub(sizeof(*iml), &sk->sk_omem_alloc);
-                call_rcu(&iml->rcu, ip_mc_socklist_reclaim);
+                kfree_rcu(iml, rcu);
        }
        rtnl_unlock();
 }
diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index 3cfbbf3387a0..498b927f68be 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -317,12 +317,6 @@ static void snmp6_free_dev(struct inet6_dev *idev)
 /* Nobody refers to this device, we may destroy it. */
-static void in6_dev_finish_destroy_rcu(struct rcu_head *head)
-{
-        struct inet6_dev *idev = container_of(head, struct inet6_dev, rcu);
-        kfree(idev);
-}
 void in6_dev_finish_destroy(struct inet6_dev *idev)
 {
        struct net_device *dev = idev->dev;
@@ -339,7 +333,7 @@ void in6_dev_finish_destroy(struct inet6_dev *idev)
                return;
        }
        snmp6_free_dev(idev);
-        call_rcu(&idev->rcu, in6_dev_finish_destroy_rcu);
+        kfree_rcu(idev, rcu);
 }
 EXPORT_SYMBOL(in6_dev_finish_destroy);
@@ -535,12 +529,6 @@ static int addrconf_fixup_forwarding(struct ctl_table *table, int *p, int old)
 }
 #endif
-static void inet6_ifa_finish_destroy_rcu(struct rcu_head *head)
-{
-        struct inet6_ifaddr *ifp = container_of(head, struct inet6_ifaddr, rcu);
-        kfree(ifp);
-}
 /* Nobody refers to this ifaddr, destroy it */
 void inet6_ifa_finish_destroy(struct inet6_ifaddr *ifp)
 {
@@ -561,7 +549,7 @@ void inet6_ifa_finish_destroy(struct inet6_ifaddr *ifp)
        }
        dst_release(&ifp->rt->dst);
-        call_rcu(&ifp->rcu, inet6_ifa_finish_destroy_rcu);
+        kfree_rcu(ifp, rcu);
 }
 static void
diff --git a/net/ipv6/mcast.c b/net/ipv6/mcast.c
index ff62e33ead07..3e6ebcdb4779 100644
--- a/net/ipv6/mcast.c
+++ b/net/ipv6/mcast.c
@@ -201,10 +201,6 @@ int ipv6_sock_mc_join(struct sock *sk, int ifindex, const struct in6_addr *addr)
        return 0;
 }
-static void ipv6_mc_socklist_reclaim(struct rcu_head *head)
-{
-        kfree(container_of(head, struct ipv6_mc_socklist, rcu));
-}
 /*
 *      socket leave on multicast group
 */
@@ -239,7 +235,7 @@ int ipv6_sock_mc_drop(struct sock *sk, int ifindex, const struct in6_addr *addr)
                                (void) ip6_mc_leave_src(sk, mc_lst, NULL);
                        rcu_read_unlock();
                        atomic_sub(sizeof(*mc_lst), &sk->sk_omem_alloc);
-                        call_rcu(&mc_lst->rcu, ipv6_mc_socklist_reclaim);
+                        kfree_rcu(mc_lst, rcu);
                        return 0;
                }
        }
@@ -307,7 +303,7 @@ void ipv6_sock_mc_close(struct sock *sk)
                rcu_read_unlock();
                atomic_sub(sizeof(*mc_lst), &sk->sk_omem_alloc);
-                call_rcu(&mc_lst->rcu, ipv6_mc_socklist_reclaim);
+                kfree_rcu(mc_lst, rcu);
                spin_lock(&ipv6_sk_mc_lock);
        }
diff --git a/net/ipv6/sit.c b/net/ipv6/sit.c
index a6a32b39b607..1cca5761aea9 100644
--- a/net/ipv6/sit.c
+++ b/net/ipv6/sit.c
@@ -396,11 +396,6 @@ out:
        return err;
 }
-static void prl_entry_destroy_rcu(struct rcu_head *head)
-{
-        kfree(container_of(head, struct ip_tunnel_prl_entry, rcu_head));
-}
 static void prl_list_destroy_rcu(struct rcu_head *head)
 {
        struct ip_tunnel_prl_entry *p, *n;
@@ -428,7 +423,7 @@ ipip6_tunnel_del_prl(struct ip_tunnel *t, struct ip_tunnel_prl *a)
                     p = &x->next) {
                        if (x->addr == a->addr) {
                                *p = x->next;
-                                call_rcu(&x->rcu_head, prl_entry_destroy_rcu);
+                                kfree_rcu(x, rcu_head);
                                t->prl_count--;
                                goto out;
                        }
diff --git a/net/l2tp/l2tp_ip.c b/net/l2tp/l2tp_ip.c
index f7fb09ecaf89..b6466e71f5e1 100644
--- a/net/l2tp/l2tp_ip.c
+++ b/net/l2tp/l2tp_ip.c
@@ -687,7 +687,7 @@ MODULE_AUTHOR("James Chapman <jchapman@katalix.com>");
 MODULE_DESCRIPTION("L2TP over IP");
 MODULE_VERSION("1.0");
-/* Use the value of SOCK_DGRAM (2) directory, because __stringify does't like
+/* Use the value of SOCK_DGRAM (2) directory, because __stringify doesn't like
 * enums
 */
 MODULE_ALIAS_NET_PF_PROTO_TYPE(PF_INET, 2, IPPROTO_L2TP);
diff --git a/net/mac80211/agg-tx.c b/net/mac80211/agg-tx.c
index cd5125f77cc5..c8be8eff70da 100644
--- a/net/mac80211/agg-tx.c
+++ b/net/mac80211/agg-tx.c
@@ -144,14 +144,6 @@ void ieee80211_assign_tid_tx(struct sta_info *sta, int tid,
        rcu_assign_pointer(sta->ampdu_mlme.tid_tx[tid], tid_tx);
 }
-static void kfree_tid_tx(struct rcu_head *rcu_head)
-{
-        struct tid_ampdu_tx *tid_tx =
-            container_of(rcu_head, struct tid_ampdu_tx, rcu_head);
-        kfree(tid_tx);
-}
 int ___ieee80211_stop_tx_ba_session(struct sta_info *sta, u16 tid,
                                    enum ieee80211_back_parties initiator,
                                    bool tx)
@@ -174,7 +166,7 @@ int ___ieee80211_stop_tx_ba_session(struct sta_info *sta, u16 tid,
                /* not even started yet! */
                ieee80211_assign_tid_tx(sta, tid, NULL);
                spin_unlock_bh(&sta->lock);
-                call_rcu(&tid_tx->rcu_head, kfree_tid_tx);
+                kfree_rcu(tid_tx, rcu_head);
                return 0;
        }
@@ -333,7 +325,7 @@ void ieee80211_tx_ba_session_handle_start(struct sta_info *sta, int tid)
                spin_unlock_bh(&sta->lock);
                ieee80211_wake_queue_agg(local, tid);
-                call_rcu(&tid_tx->rcu_head, kfree_tid_tx);
+                kfree_rcu(tid_tx, rcu_head);
                return;
        }
@@ -718,7 +710,7 @@ void ieee80211_stop_tx_ba_cb(struct ieee80211_vif *vif, u8 *ra, u8 tid)
        ieee80211_agg_splice_finish(local, tid);
-        call_rcu(&tid_tx->rcu_head, kfree_tid_tx);
+        kfree_rcu(tid_tx, rcu_head);
 unlock_sta:
        spin_unlock_bh(&sta->lock);
diff --git a/net/mac80211/work.c b/net/mac80211/work.c
index a94b312dbfac..d2e7f0e86677 100644
--- a/net/mac80211/work.c
+++ b/net/mac80211/work.c
@@ -65,17 +65,9 @@ static void run_again(struct ieee80211_local *local,
                mod_timer(&local->work_timer, timeout);
 }
-static void work_free_rcu(struct rcu_head *head)
-{
-        struct ieee80211_work *wk =
-                container_of(head, struct ieee80211_work, rcu_head);
-        kfree(wk);
-}
 void free_work(struct ieee80211_work *wk)
 {
-        call_rcu(&wk->rcu_head, work_free_rcu);
+        kfree_rcu(wk, rcu_head);
 }
 static int ieee80211_compatible_rates(const u8 *supp_rates, int supp_rates_len,
diff --git a/net/netfilter/nf_conntrack_extend.c b/net/netfilter/nf_conntrack_extend.c
index 80a23ed62bb0..05ecdc281a53 100644
--- a/net/netfilter/nf_conntrack_extend.c
+++ b/net/netfilter/nf_conntrack_extend.c
@@ -68,12 +68,6 @@ nf_ct_ext_create(struct nf_ct_ext **ext, enum nf_ct_ext_id id, gfp_t gfp)
        return (void *)(*ext) + off;
 }
-static void __nf_ct_ext_free_rcu(struct rcu_head *head)
-{
-        struct nf_ct_ext *ext = container_of(head, struct nf_ct_ext, rcu);
-        kfree(ext);
-}
 void *__nf_ct_ext_add(struct nf_conn *ct, enum nf_ct_ext_id id, gfp_t gfp)
 {
        struct nf_ct_ext *old, *new;
@@ -114,7 +108,7 @@ void *__nf_ct_ext_add(struct nf_conn *ct, enum nf_ct_ext_id id, gfp_t gfp)
                                        (void *)old + old->offset[i]);
                        rcu_read_unlock();
                }
-                call_rcu(&old->rcu, __nf_ct_ext_free_rcu);
+                kfree_rcu(old, rcu);
                ct->ext = new;
        }
diff --git a/net/netfilter/xt_osf.c b/net/netfilter/xt_osf.c
index 4327e101c047..846f895cb656 100644
--- a/net/netfilter/xt_osf.c
+++ b/net/netfilter/xt_osf.c
@@ -62,13 +62,6 @@ static const struct nla_policy xt_osf_policy[OSF_ATTR_MAX + 1] = {
        [OSF_ATTR_FINGER]       = { .len = sizeof(struct xt_osf_user_finger) },
 };
-static void xt_osf_finger_free_rcu(struct rcu_head *rcu_head)
-{
-        struct xt_osf_finger *f = container_of(rcu_head, struct xt_osf_finger, rcu_head);
-        kfree(f);
-}
 static int xt_osf_add_callback(struct sock *ctnl, struct sk_buff *skb,
                               const struct nlmsghdr *nlh,
                               const struct nlattr * const osf_attrs[])
@@ -133,7 +126,7 @@ static int xt_osf_remove_callback(struct sock *ctnl, struct sk_buff *skb,
                 * We are protected by nfnl mutex.
                 */
                list_del_rcu(&sf->finger_entry);
-                call_rcu(&sf->rcu_head, xt_osf_finger_free_rcu);
+                kfree_rcu(sf, rcu_head);
                err = 0;
                break;
@@ -414,7 +407,7 @@ static void __exit xt_osf_fini(void)
                list_for_each_entry_rcu(f, &xt_osf_fingers[i], finger_entry) {
                        list_del_rcu(&f->finger_entry);
-                        call_rcu(&f->rcu_head, xt_osf_finger_free_rcu);
+                        kfree_rcu(f, rcu_head);
                }
        }
        rcu_read_unlock();
diff --git a/net/netlabel/netlabel_unlabeled.c b/net/netlabel/netlabel_unlabeled.c
index e2b0a680dd56..9c38658fba8b 100644
--- a/net/netlabel/netlabel_unlabeled.c
+++ b/net/netlabel/netlabel_unlabeled.c
@@ -154,44 +154,6 @@ static const struct nla_policy netlbl_unlabel_genl_policy[NLBL_UNLABEL_A_MAX + 1
 */
 /**
- * netlbl_unlhsh_free_addr4 - Frees an IPv4 address entry from the hash table
- * @entry: the entry's RCU field
- *
- * Description:
- * This function is designed to be used as a callback to the call_rcu()
- * function so that memory allocated to a hash table address entry can be
- * released safely.
- *
- */
-static void netlbl_unlhsh_free_addr4(struct rcu_head *entry)
-{
-        struct netlbl_unlhsh_addr4 *ptr;
-        ptr = container_of(entry, struct netlbl_unlhsh_addr4, rcu);
-        kfree(ptr);
-}
-#if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
-/**
- * netlbl_unlhsh_free_addr6 - Frees an IPv6 address entry from the hash table
- * @entry: the entry's RCU field
- *
- * Description:
- * This function is designed to be used as a callback to the call_rcu()
- * function so that memory allocated to a hash table address entry can be
- * released safely.
- *
- */
-static void netlbl_unlhsh_free_addr6(struct rcu_head *entry)
-{
-        struct netlbl_unlhsh_addr6 *ptr;
-        ptr = container_of(entry, struct netlbl_unlhsh_addr6, rcu);
-        kfree(ptr);
-}
-#endif /* IPv6 */
-/**
 * netlbl_unlhsh_free_iface - Frees an interface entry from the hash table
 * @entry: the entry's RCU field
 *
@@ -568,7 +530,7 @@ static int netlbl_unlhsh_remove_addr4(struct net *net,
        if (entry == NULL)
                return -ENOENT;
-        call_rcu(&entry->rcu, netlbl_unlhsh_free_addr4);
+        kfree_rcu(entry, rcu);
        return 0;
 }
@@ -629,7 +591,7 @@ static int netlbl_unlhsh_remove_addr6(struct net *net,
        if (entry == NULL)
                return -ENOENT;
-        call_rcu(&entry->rcu, netlbl_unlhsh_free_addr6);
+        kfree_rcu(entry, rcu);
        return 0;
 }
 #endif /* IPv6 */
diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c
index c8f35b5d2ee9..5fe4f3b04ed3 100644
--- a/net/netlink/af_netlink.c
+++ b/net/netlink/af_netlink.c
@@ -1566,12 +1566,6 @@ netlink_kernel_release(struct sock *sk)
 }
 EXPORT_SYMBOL(netlink_kernel_release);
-static void listeners_free_rcu(struct rcu_head *head)
-{
-        kfree(container_of(head, struct listeners, rcu));
-}
 int __netlink_change_ngroups(struct sock *sk, unsigned int groups)
 {
        struct listeners *new, *old;
@@ -1588,7 +1582,7 @@ int __netlink_change_ngroups(struct sock *sk, unsigned int groups)
                memcpy(new->masks, old->masks, NLGRPSZ(tbl->groups));
                rcu_assign_pointer(tbl->listeners, new);
-                call_rcu(&old->rcu, listeners_free_rcu);
+                kfree_rcu(old, rcu);
        }
        tbl->groups = groups;
diff --git a/net/phonet/pn_dev.c b/net/phonet/pn_dev.c
index 47b3452675b6..d2df8f33160b 100644
--- a/net/phonet/pn_dev.c
+++ b/net/phonet/pn_dev.c
@@ -162,14 +162,6 @@ int phonet_address_add(struct net_device *dev, u8 addr)
        return err;
 }
-static void phonet_device_rcu_free(struct rcu_head *head)
-{
-        struct phonet_device *pnd;
-        pnd = container_of(head, struct phonet_device, rcu);
-        kfree(pnd);
-}
 int phonet_address_del(struct net_device *dev, u8 addr)
 {
        struct phonet_device_list *pndevs = phonet_device_list(dev_net(dev));
@@ -188,7 +180,7 @@ int phonet_address_del(struct net_device *dev, u8 addr)
        mutex_unlock(&pndevs->lock);
        if (pnd)
-                call_rcu(&pnd->rcu, phonet_device_rcu_free);
+                kfree_rcu(pnd, rcu);
        return err;
 }
diff --git a/net/sched/act_api.c b/net/sched/act_api.c
index 14b42f4ad791..a606025814a1 100644
--- a/net/sched/act_api.c
+++ b/net/sched/act_api.c
@@ -26,11 +26,6 @@
 #include <net/act_api.h>
 #include <net/netlink.h>
-static void tcf_common_free_rcu(struct rcu_head *head)
-{
-        kfree(container_of(head, struct tcf_common, tcfc_rcu));
-}
 void tcf_hash_destroy(struct tcf_common *p, struct tcf_hashinfo *hinfo)
 {
        unsigned int h = tcf_hash(p->tcfc_index, hinfo->hmask);
@@ -47,7 +42,7 @@ void tcf_hash_destroy(struct tcf_common *p, struct tcf_hashinfo *hinfo)
                         * gen_estimator est_timer() might access p->tcfc_lock
                         * or bstats, wait a RCU grace period before freeing p
                         */
-                        call_rcu(&p->tcfc_rcu, tcf_common_free_rcu);
+                        kfree_rcu(p, tcfc_rcu);
                        return;
                }
        }
diff --git a/net/sched/act_police.c b/net/sched/act_police.c
index 8a1630774fd6..b3b9b32f4e00 100644
--- a/net/sched/act_police.c
+++ b/net/sched/act_police.c
@@ -96,11 +96,6 @@ nla_put_failure:
        goto done;
 }
-static void tcf_police_free_rcu(struct rcu_head *head)
-{
-        kfree(container_of(head, struct tcf_police, tcf_rcu));
-}
 static void tcf_police_destroy(struct tcf_police *p)
 {
        unsigned int h = tcf_hash(p->tcf_index, POL_TAB_MASK);
@@ -121,7 +116,7 @@ static void tcf_police_destroy(struct tcf_police *p)
                         * gen_estimator est_timer() might access p->tcf_lock
                         * or bstats, wait a RCU grace period before freeing p
                         */
-                        call_rcu(&p->tcf_rcu, tcf_police_free_rcu);
+                        kfree_rcu(p, tcf_rcu);
                        return;
                }
        }
@@ -401,7 +396,6 @@ static void __exit
 police_cleanup_module(void)
 {
        tcf_unregister_action(&act_police_ops);
-        rcu_barrier(); /* Wait for completion of call_rcu()'s (tcf_police_free_rcu) */
 }
 module_init(police_init_module);
diff --git a/net/sctp/bind_addr.c b/net/sctp/bind_addr.c
index 6150ac5cf5dd..6338413376c8 100644
--- a/net/sctp/bind_addr.c
+++ b/net/sctp/bind_addr.c
@@ -217,7 +217,7 @@ int sctp_del_bind_addr(struct sctp_bind_addr *bp, union sctp_addr *del_addr)
        }
        if (found) {
-                call_rcu(&addr->rcu, sctp_local_addr_free);
+                kfree_rcu(addr, rcu);
                SCTP_DBG_OBJCNT_DEC(addr);
                return 0;
        }
diff --git a/net/sctp/ipv6.c b/net/sctp/ipv6.c
index 500875f4dc41..0bb0d7cb9f10 100644
--- a/net/sctp/ipv6.c
+++ b/net/sctp/ipv6.c
@@ -130,7 +130,7 @@ static int sctp_inet6addr_event(struct notifier_block *this, unsigned long ev,
                }
                spin_unlock_bh(&sctp_local_addr_lock);
                if (found)
-                        call_rcu(&addr->rcu, sctp_local_addr_free);
+                        kfree_rcu(addr, rcu);
                break;
        }
diff --git a/net/sctp/protocol.c b/net/sctp/protocol.c
index 4de77cb80d88..67380a29e2e9 100644
--- a/net/sctp/protocol.c
+++ b/net/sctp/protocol.c
@@ -230,13 +230,6 @@ static void sctp_free_local_addr_list(void)
        }
 }
-void sctp_local_addr_free(struct rcu_head *head)
-{
-        struct sctp_sockaddr_entry *e = container_of(head,
-                                struct sctp_sockaddr_entry, rcu);
-        kfree(e);
-}
 /* Copy the local addresses which are valid for 'scope' into 'bp'.  */
 int sctp_copy_local_addr_list(struct sctp_bind_addr *bp, sctp_scope_t scope,
                              gfp_t gfp, int copy_flags)
@@ -675,7 +668,7 @@ static int sctp_inetaddr_event(struct notifier_block *this, unsigned long ev,
                }
                spin_unlock_bh(&sctp_local_addr_lock);
                if (found)
-                        call_rcu(&addr->rcu, sctp_local_addr_free);
+                        kfree_rcu(addr, rcu);
                break;
        }
diff --git a/net/sctp/ulpevent.c b/net/sctp/ulpevent.c
index c962c6062aab..e70e5fc87890 100644
--- a/net/sctp/ulpevent.c
+++ b/net/sctp/ulpevent.c
@@ -554,7 +554,7 @@ struct sctp_ulpevent *sctp_ulpevent_make_send_failed(
        memcpy(&ssf->ssf_info, &chunk->sinfo, sizeof(struct sctp_sndrcvinfo));
        /* Per TSVWG discussion with Randy. Allow the application to
-         * resemble a fragmented message.
+         * reassemble a fragmented message.
         */
        ssf->ssf_info.sinfo_flags = chunk->chunk_hdr->flags;
diff --git a/net/socket.c b/net/socket.c
index 2d5382d0de54..02dc82db3d23 100644
--- a/net/socket.c
+++ b/net/socket.c
@@ -263,15 +263,6 @@ static struct inode *sock_alloc_inode(struct super_block *sb)
        return &ei->vfs_inode;
 }
-static void wq_free_rcu(struct rcu_head *head)
-{
-        struct socket_wq *wq = container_of(head, struct socket_wq, rcu);
-        kfree(wq);
-}
 static void sock_destroy_inode(struct inode *inode)
 {
        struct socket_alloc *ei;
@@ -279,7 +270,7 @@ static void sock_destroy_inode(struct inode *inode)
        ei = container_of(inode, struct socket_alloc, vfs_inode);
        wq = rcu_dereference_protected(ei->socket.wq, 1);
-        call_rcu(&wq->rcu, wq_free_rcu);
+        kfree_rcu(wq, rcu);
        kmem_cache_free(sock_inode_cachep, ei);
 }
diff --git a/net/sunrpc/Kconfig b/net/sunrpc/Kconfig
index 8873fd8ddacd..b2198e65d8bb 100644
--- a/net/sunrpc/Kconfig
+++ b/net/sunrpc/Kconfig
@@ -18,14 +18,13 @@ config SUNRPC_XPRT_RDMA
          If unsure, say N.
 config RPCSEC_GSS_KRB5
-        tristate
+        tristate "Secure RPC: Kerberos V mechanism"
        depends on SUNRPC && CRYPTO
-        prompt "Secure RPC: Kerberos V mechanism" if !(NFS_V4 || NFSD_V4)
+        depends on CRYPTO_MD5 && CRYPTO_DES && CRYPTO_CBC && CRYPTO_CTS
+        depends on CRYPTO_ECB && CRYPTO_HMAC && CRYPTO_SHA1 && CRYPTO_AES
+        depends on CRYPTO_ARC4
        default y
        select SUNRPC_GSS
-        select CRYPTO_MD5
-        select CRYPTO_DES
-        select CRYPTO_CBC
        help
          Choose Y here to enable Secure RPC using the Kerberos version 5
          GSS-API mechanism (RFC 1964).
diff --git a/net/sunrpc/auth_gss/auth_gss.c b/net/sunrpc/auth_gss/auth_gss.c
index f3914d0c5079..339ba64cce1e 100644
--- a/net/sunrpc/auth_gss/auth_gss.c
+++ b/net/sunrpc/auth_gss/auth_gss.c
@@ -520,7 +520,7 @@ gss_refresh_upcall(struct rpc_task *task)
                warn_gssd();
                task->tk_timeout = 15*HZ;
                rpc_sleep_on(&pipe_version_rpc_waitqueue, task, NULL);
-                return 0;
+                return -EAGAIN;
        }
        if (IS_ERR(gss_msg)) {
                err = PTR_ERR(gss_msg);
@@ -563,10 +563,12 @@ retry:
        if (PTR_ERR(gss_msg) == -EAGAIN) {
                err = wait_event_interruptible_timeout(pipe_version_waitqueue,
                                pipe_version >= 0, 15*HZ);
+                if (pipe_version < 0) {
+                        warn_gssd();
+                        err = -EACCES;
+                }
                if (err)
                        goto out;
-                if (pipe_version < 0)
-                        warn_gssd();
                goto retry;
        }
        if (IS_ERR(gss_msg)) {
diff --git a/net/sunrpc/clnt.c b/net/sunrpc/clnt.c
index e7a96e478f63..8d83f9d48713 100644
--- a/net/sunrpc/clnt.c
+++ b/net/sunrpc/clnt.c
@@ -1508,7 +1508,10 @@ call_timeout(struct rpc_task *task)
                if (clnt->cl_chatty)
                        printk(KERN_NOTICE "%s: server %s not responding, timed out\n",
                                clnt->cl_protname, clnt->cl_server);
-                rpc_exit(task, -EIO);
+                if (task->tk_flags & RPC_TASK_TIMEOUT)
+                        rpc_exit(task, -ETIMEDOUT);
+                else
+                        rpc_exit(task, -EIO);
                return;
        }
diff --git a/net/sunrpc/xprt.c b/net/sunrpc/xprt.c
index 9494c3767356..ce5eb68a9664 100644
--- a/net/sunrpc/xprt.c
+++ b/net/sunrpc/xprt.c
@@ -906,6 +906,7 @@ void xprt_transmit(struct rpc_task *task)
        }
        dprintk("RPC: %5u xmit complete\n", task->tk_pid);
+        task->tk_flags |= RPC_TASK_SENT;
        spin_lock_bh(&xprt->transport_lock);
        xprt->ops->set_retrans_timeout(task);