24 files changed, 245 insertions, 133 deletions

diff --git a/net/bluetooth/hci_sock.c b/net/bluetooth/hci_sock.c
index bfc9a35bad33..1dae3dfc66a9 100644
--- a/net/bluetooth/hci_sock.c
+++ b/net/bluetooth/hci_sock.c
@@ -665,7 +665,8 @@ static int hci_sock_dev_event(struct notifier_block *this, unsigned long event,
                 /* Detach sockets from device */
                 read_lock(&hci_sk_list.lock);
                 sk_for_each(sk, node, &hci_sk_list.head) {
-                        lock_sock(sk);
+                        local_bh_disable();
+                        bh_lock_sock_nested(sk);
                         if (hci_pi(sk)->hdev == hdev) {
                                 hci_pi(sk)->hdev = NULL;
                                 sk->sk_err = EPIPE;
@@ -674,7 +675,8 @@ static int hci_sock_dev_event(struct notifier_block *this, unsigned long event,
 
                                 hci_dev_put(hdev);
                         }
-                        release_sock(sk);
+                        bh_unlock_sock(sk);
+                        local_bh_enable();
                 }
                 read_unlock(&hci_sk_list.lock);
         }
diff --git a/net/core/dev.c b/net/core/dev.c
index 8301e2ac747f..5a7f20f78574 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -116,6 +116,7 @@
 #include <linux/dmaengine.h>
 #include <linux/err.h>
 #include <linux/ctype.h>
+#include <linux/if_arp.h>
 
 /*
  *      The list of packet types we will receive (as opposed to discard)
@@ -217,6 +218,73 @@ extern void netdev_unregister_sysfs(struct net_device *);
 #define netdev_unregister_sysfs(dev)    do { } while(0)
 #endif
 
+#ifdef CONFIG_DEBUG_LOCK_ALLOC
+/*
+ * register_netdevice() inits dev->_xmit_lock and sets lockdep class
+ * according to dev->type
+ */
+static const unsigned short netdev_lock_type[] =
+        {ARPHRD_NETROM, ARPHRD_ETHER, ARPHRD_EETHER, ARPHRD_AX25,
+         ARPHRD_PRONET, ARPHRD_CHAOS, ARPHRD_IEEE802, ARPHRD_ARCNET,
+         ARPHRD_APPLETLK, ARPHRD_DLCI, ARPHRD_ATM, ARPHRD_METRICOM,
+         ARPHRD_IEEE1394, ARPHRD_EUI64, ARPHRD_INFINIBAND, ARPHRD_SLIP,
+         ARPHRD_CSLIP, ARPHRD_SLIP6, ARPHRD_CSLIP6, ARPHRD_RSRVD,
+         ARPHRD_ADAPT, ARPHRD_ROSE, ARPHRD_X25, ARPHRD_HWX25,
+         ARPHRD_PPP, ARPHRD_CISCO, ARPHRD_LAPB, ARPHRD_DDCMP,
+         ARPHRD_RAWHDLC, ARPHRD_TUNNEL, ARPHRD_TUNNEL6, ARPHRD_FRAD,
+         ARPHRD_SKIP, ARPHRD_LOOPBACK, ARPHRD_LOCALTLK, ARPHRD_FDDI,
+         ARPHRD_BIF, ARPHRD_SIT, ARPHRD_IPDDP, ARPHRD_IPGRE,
+         ARPHRD_PIMREG, ARPHRD_HIPPI, ARPHRD_ASH, ARPHRD_ECONET,
+         ARPHRD_IRDA, ARPHRD_FCPP, ARPHRD_FCAL, ARPHRD_FCPL,
+         ARPHRD_FCFABRIC, ARPHRD_IEEE802_TR, ARPHRD_IEEE80211,
+         ARPHRD_IEEE80211_PRISM, ARPHRD_IEEE80211_RADIOTAP, ARPHRD_VOID,
+         ARPHRD_NONE};
+
+static const char *netdev_lock_name[] =
+        {"_xmit_NETROM", "_xmit_ETHER", "_xmit_EETHER", "_xmit_AX25",
+         "_xmit_PRONET", "_xmit_CHAOS", "_xmit_IEEE802", "_xmit_ARCNET",
+         "_xmit_APPLETLK", "_xmit_DLCI", "_xmit_ATM", "_xmit_METRICOM",
+         "_xmit_IEEE1394", "_xmit_EUI64", "_xmit_INFINIBAND", "_xmit_SLIP",
+         "_xmit_CSLIP", "_xmit_SLIP6", "_xmit_CSLIP6", "_xmit_RSRVD",
+         "_xmit_ADAPT", "_xmit_ROSE", "_xmit_X25", "_xmit_HWX25",
+         "_xmit_PPP", "_xmit_CISCO", "_xmit_LAPB", "_xmit_DDCMP",
+         "_xmit_RAWHDLC", "_xmit_TUNNEL", "_xmit_TUNNEL6", "_xmit_FRAD",
+         "_xmit_SKIP", "_xmit_LOOPBACK", "_xmit_LOCALTLK", "_xmit_FDDI",
+         "_xmit_BIF", "_xmit_SIT", "_xmit_IPDDP", "_xmit_IPGRE",
+         "_xmit_PIMREG", "_xmit_HIPPI", "_xmit_ASH", "_xmit_ECONET",
+         "_xmit_IRDA", "_xmit_FCPP", "_xmit_FCAL", "_xmit_FCPL",
+         "_xmit_FCFABRIC", "_xmit_IEEE802_TR", "_xmit_IEEE80211",
+         "_xmit_IEEE80211_PRISM", "_xmit_IEEE80211_RADIOTAP", "_xmit_VOID",
+         "_xmit_NONE"};
+
+static struct lock_class_key netdev_xmit_lock_key[ARRAY_SIZE(netdev_lock_type)];
+
+static inline unsigned short netdev_lock_pos(unsigned short dev_type)
+{
+        int i;
+
+        for (i = 0; i < ARRAY_SIZE(netdev_lock_type); i++)
+                if (netdev_lock_type[i] == dev_type)
+                        return i;
+        /* the last key is used by default */
+        return ARRAY_SIZE(netdev_lock_type) - 1;
+}
+
+static inline void netdev_set_lockdep_class(spinlock_t *lock,
+                                            unsigned short dev_type)
+{
+        int i;
+
+        i = netdev_lock_pos(dev_type);
+        lockdep_set_class_and_name(lock, &netdev_xmit_lock_key[i],
+                                   netdev_lock_name[i]);
+}
+#else
+static inline void netdev_set_lockdep_class(spinlock_t *lock,
+                                            unsigned short dev_type)
+{
+}
+#endif
 
 /*******************************************************************************
 
@@ -3001,6 +3069,7 @@ int register_netdevice(struct net_device *dev)
 
         spin_lock_init(&dev->queue_lock);
         spin_lock_init(&dev->_xmit_lock);
+        netdev_set_lockdep_class(&dev->_xmit_lock, dev->type);
         dev->xmit_lock_owner = -1;
         spin_lock_init(&dev->ingress_lock);
 
@@ -3245,7 +3314,6 @@ void netdev_run_todo(void)
                         continue;
                 }
 
-                netdev_unregister_sysfs(dev);
                 dev->reg_state = NETREG_UNREGISTERED;
 
                 netdev_wait_allrefs(dev);
@@ -3256,11 +3324,11 @@ void netdev_run_todo(void)
                 BUG_TRAP(!dev->ip6_ptr);
                 BUG_TRAP(!dev->dn_ptr);
 
-                /* It must be the very last action,
-                 * after this 'dev' may point to freed up memory.
-                 */
                 if (dev->destructor)
                         dev->destructor(dev);
+
+                /* Free network device */
+                kobject_put(&dev->dev.kobj);
         }
 
 out:
@@ -3411,6 +3479,9 @@ void unregister_netdevice(struct net_device *dev)
         /* Notifier chain MUST detach us from master device. */
         BUG_TRAP(!dev->master);
 
+        /* Remove entries from sysfs */
+        netdev_unregister_sysfs(dev);
+
         /* Finish processing unregister after unlock */
         net_set_todo(dev);
 
diff --git a/net/core/net-sysfs.c b/net/core/net-sysfs.c
index b21307b15b82..5c19b0646d7a 100644
--- a/net/core/net-sysfs.c
+++ b/net/core/net-sysfs.c
@@ -456,9 +456,15 @@ static struct class net_class = {
 #endif
 };
 
+/* Delete sysfs entries but hold kobject reference until after all
+ * netdev references are gone.
+ */
 void netdev_unregister_sysfs(struct net_device * net)
 {
-        device_del(&(net->dev));
+        struct device *dev = &(net->dev);
+
+        kobject_get(&dev->kobj);
+        device_del(dev);
 }
 
 /* Create sysfs entries for network device. */
diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index 142257307fa2..7c6a34e21eee 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -644,11 +644,10 @@ int pskb_expand_head(struct sk_buff *skb, int nhead, int ntail,
 
         /* Copy only real data... and, alas, header. This should be
          * optimized for the cases when header is void. */
-        memcpy(data + nhead, skb->head,
 #ifdef NET_SKBUFF_DATA_USES_OFFSET
-                skb->tail);
+        memcpy(data + nhead, skb->head, skb->tail);
 #else
-                skb->tail - skb->head);
+        memcpy(data + nhead, skb->head, skb->tail - skb->head);
 #endif
         memcpy(data + size, skb_end_pointer(skb),
                sizeof(struct skb_shared_info));
diff --git a/net/ipv4/Kconfig b/net/ipv4/Kconfig
index c68196cc56ab..010fbb2d45e9 100644
--- a/net/ipv4/Kconfig
+++ b/net/ipv4/Kconfig
@@ -43,11 +43,11 @@ config IP_ADVANCED_ROUTER
           asymmetric routing (packets from you to a host take a different path
           than packets from that host to you) or if you operate a non-routing
           host which has several IP addresses on different interfaces. To turn
-          rp_filter off use:
+          rp_filter on use:
 
-          echo 0 > /proc/sys/net/ipv4/conf/<device>/rp_filter
+          echo 1 > /proc/sys/net/ipv4/conf/<device>/rp_filter
           or
-          echo 0 > /proc/sys/net/ipv4/conf/all/rp_filter
+          echo 1 > /proc/sys/net/ipv4/conf/all/rp_filter
 
           If unsure, say N here.
 
@@ -577,6 +577,7 @@ config TCP_CONG_VENO
 config TCP_CONG_YEAH
         tristate "YeAH TCP"
         depends on EXPERIMENTAL
+        select TCP_CONG_VEGAS
         default n
         ---help---
         YeAH-TCP is a sender-side high-speed enabled TCP congestion control
diff --git a/net/ipv4/icmp.c b/net/ipv4/icmp.c
index d38cbba92a4d..e238b17f554c 100644
--- a/net/ipv4/icmp.c
+++ b/net/ipv4/icmp.c
@@ -514,7 +514,10 @@ void icmp_send(struct sk_buff *skb_in, int type, int code, __be32 info)
 
         saddr = iph->daddr;
         if (!(rt->rt_flags & RTCF_LOCAL)) {
-                if (sysctl_icmp_errors_use_inbound_ifaddr)
+                /* This is broken, skb_in->dev points to the outgoing device
+                 * after the packet passes through ip_output().
+                 */
+                if (skb_in->dev && sysctl_icmp_errors_use_inbound_ifaddr)
                         saddr = inet_select_addr(skb_in->dev, 0, RT_SCOPE_LINK);
                 else
                         saddr = 0;
diff --git a/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c b/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c
index 0654eaae70c9..fd62a41d69cc 100644
--- a/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c
+++ b/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c
@@ -154,12 +154,10 @@ static unsigned int ipv4_conntrack_defrag(unsigned int hooknum,
                                           const struct net_device *out,
                                           int (*okfn)(struct sk_buff *))
 {
-#if !defined(CONFIG_IP_NF_NAT) && !defined(CONFIG_IP_NF_NAT_MODULE)
         /* Previously seen (loopback)?  Ignore.  Do this before
            fragment check. */
         if ((*pskb)->nfct)
                 return NF_ACCEPT;
-#endif
 
         /* Gather fragments. */
         if (ip_hdr(*pskb)->frag_off & htons(IP_MF | IP_OFFSET)) {
diff --git a/net/ipv4/proc.c b/net/ipv4/proc.c
index 37ab5802ca08..cdbc6c135849 100644
--- a/net/ipv4/proc.c
+++ b/net/ipv4/proc.c
@@ -109,6 +109,17 @@ static const struct snmp_mib snmp4_ipstats_list[] = {
         SNMP_MIB_SENTINEL
 };
 
+/* Following RFC4293 items are displayed in /proc/net/netstat */
+static const struct snmp_mib snmp4_ipextstats_list[] = {
+        SNMP_MIB_ITEM("InNoRoutes", IPSTATS_MIB_INNOROUTES),
+        SNMP_MIB_ITEM("InTruncatedPkts", IPSTATS_MIB_INTRUNCATEDPKTS),
+        SNMP_MIB_ITEM("InMcastPkts", IPSTATS_MIB_INMCASTPKTS),
+        SNMP_MIB_ITEM("OutMcastPkts", IPSTATS_MIB_OUTMCASTPKTS),
+        SNMP_MIB_ITEM("InBcastPkts", IPSTATS_MIB_INBCASTPKTS),
+        SNMP_MIB_ITEM("OutBcastPkts", IPSTATS_MIB_OUTBCASTPKTS),
+        SNMP_MIB_SENTINEL
+};
+
 static const struct snmp_mib snmp4_icmp_list[] = {
         SNMP_MIB_ITEM("InMsgs", ICMP_MIB_INMSGS),
         SNMP_MIB_ITEM("InErrors", ICMP_MIB_INERRORS),
@@ -338,6 +349,16 @@ static int netstat_seq_show(struct seq_file *seq, void *v)
                            snmp_fold_field((void **)net_statistics,
                                            snmp4_net_list[i].entry));
 
+        seq_puts(seq, "\nIpExt:");
+        for (i = 0; snmp4_ipextstats_list[i].name != NULL; i++)
+                seq_printf(seq, " %s", snmp4_ipextstats_list[i].name);
+
+        seq_puts(seq, "\nIpExt:");
+        for (i = 0; snmp4_ipextstats_list[i].name != NULL; i++)
+                seq_printf(seq, " %lu",
+                           snmp_fold_field((void **)ip_statistics,
+                                           snmp4_ipextstats_list[i].entry));
+
         seq_putc(seq, '\n');
         return 0;
 }
diff --git a/net/ipv4/route.c b/net/ipv4/route.c
index cb76e3c725a0..df9fe4f2e8cc 100644
--- a/net/ipv4/route.c
+++ b/net/ipv4/route.c
@@ -2396,7 +2396,7 @@ static int ip_route_output_slow(struct rtable **rp, const struct flowi *oldflp)
 
                 /* It is equivalent to inet_addr_type(saddr) == RTN_LOCAL */
                 dev_out = ip_dev_find(oldflp->fl4_src);
-                if ((dev_out == NULL) && !(sysctl_ip_nonlocal_bind))
+                if (dev_out == NULL)
                         goto out;
 
                 /* I removed check for oif == dev_out->oif here.
@@ -2407,7 +2407,7 @@ static int ip_route_output_slow(struct rtable **rp, const struct flowi *oldflp)
                       of another iface. --ANK
                  */
 
-                if (dev_out && oldflp->oif == 0
+                if (oldflp->oif == 0
                     && (MULTICAST(oldflp->fl4_dst) || oldflp->fl4_dst == htonl(0xFFFFFFFF))) {
                         /* Special hack: user can direct multicasts
                            and limited broadcast via necessary interface
diff --git a/net/ipv4/tcp_cong.c b/net/ipv4/tcp_cong.c
index 86b26539e54b..1260e52ad772 100644
--- a/net/ipv4/tcp_cong.c
+++ b/net/ipv4/tcp_cong.c
@@ -276,30 +276,34 @@ int tcp_set_congestion_control(struct sock *sk, const char *name)
 
 
 /*
- * Slow start (exponential increase) with
- * RFC3742 Limited Slow Start (fast linear increase) support.
+ * Slow start is used when congestion window is less than slow start
+ * threshold. This version implements the basic RFC2581 version
+ * and optionally supports:
+ *      RFC3742 Limited Slow Start        - growth limited to max_ssthresh
+ *      RFC3465 Appropriate Byte Counting - growth limited by bytes acknowledged
  */
 void tcp_slow_start(struct tcp_sock *tp)
 {
-        int cnt = 0;
-
-        if (sysctl_tcp_abc) {
-                /* RFC3465: Slow Start
-                 * TCP sender SHOULD increase cwnd by the number of
-                 * previously unacknowledged bytes ACKed by each incoming
-                 * acknowledgment, provided the increase is not more than L
-                 */
-                if (tp->bytes_acked < tp->mss_cache)
-                        return;
-        }
+        int cnt; /* increase in packets */
+
+        /* RFC3465: ABC Slow start
+         * Increase only after a full MSS of bytes is acked
+         *
+         * TCP sender SHOULD increase cwnd by the number of
+         * previously unacknowledged bytes ACKed by each incoming
+         * acknowledgment, provided the increase is not more than L
+         */
+        if (sysctl_tcp_abc && tp->bytes_acked < tp->mss_cache)
+                return;
 
-        if (sysctl_tcp_max_ssthresh > 0 &&
-            tp->snd_cwnd > sysctl_tcp_max_ssthresh)
-                cnt += sysctl_tcp_max_ssthresh>>1;
+        if (sysctl_tcp_max_ssthresh > 0 && tp->snd_cwnd > sysctl_tcp_max_ssthresh)
+                cnt = sysctl_tcp_max_ssthresh >> 1;     /* limited slow start */
         else
-                cnt += tp->snd_cwnd;
+                cnt = tp->snd_cwnd;                     /* exponential increase */
 
-        /* RFC3465: We MAY increase by 2 if discovered delayed ack */
+        /* RFC3465: ABC
+         * We MAY increase by 2 if discovered delayed ack
+         */
         if (sysctl_tcp_abc > 1 && tp->bytes_acked >= 2*tp->mss_cache)
                 cnt <<= 1;
         tp->bytes_acked = 0;
diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
index 7641b2761a14..38cb25b48bf3 100644
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -1501,6 +1501,8 @@ void tcp_enter_loss(struct sock *sk, int how)
         tcp_set_ca_state(sk, TCP_CA_Loss);
         tp->high_seq = tp->snd_nxt;
         TCP_ECN_queue_cwr(tp);
+        /* Abort FRTO algorithm if one is in progress */
+        tp->frto_counter = 0;
 
         clear_all_retrans_hints(tp);
 }
@@ -2608,6 +2610,7 @@ static void tcp_conservative_spur_to_response(struct tcp_sock *tp)
 {
         tp->snd_cwnd = min(tp->snd_cwnd, tp->snd_ssthresh);
         tp->snd_cwnd_cnt = 0;
+        TCP_ECN_queue_cwr(tp);
         tcp_moderate_cwnd(tp);
 }
 
diff --git a/net/ipv6/ip6_input.c b/net/ipv6/ip6_input.c
index be0ee8a34f9b..30a5cb1b203e 100644
--- a/net/ipv6/ip6_input.c
+++ b/net/ipv6/ip6_input.c
@@ -235,7 +235,7 @@ int ip6_mc_input(struct sk_buff *skb)
         IP6_INC_STATS_BH(ip6_dst_idev(skb->dst), IPSTATS_MIB_INMCASTPKTS);
 
         hdr = ipv6_hdr(skb);
-        deliver = likely(!(skb->dev->flags & (IFF_PROMISC|IFF_ALLMULTI))) ||
+        deliver = unlikely(skb->dev->flags & (IFF_PROMISC|IFF_ALLMULTI)) ||
             ipv6_chk_mcast_addr(skb->dev, &hdr->daddr, NULL);
 
         /*
diff --git a/net/ipx/af_ipx.c b/net/ipx/af_ipx.c
index 15419dd682fd..8400525177ab 100644
--- a/net/ipx/af_ipx.c
+++ b/net/ipx/af_ipx.c
@@ -87,7 +87,7 @@ extern int ipxrtr_add_route(__be32 network, struct ipx_interface *intrfc,
                             unsigned char *node);
 extern void ipxrtr_del_routes(struct ipx_interface *intrfc);
 extern int ipxrtr_route_packet(struct sock *sk, struct sockaddr_ipx *usipx,
-                               struct iovec *iov, int len, int noblock);
+                               struct iovec *iov, size_t len, int noblock);
 extern int ipxrtr_route_skb(struct sk_buff *skb);
 extern struct ipx_route *ipxrtr_lookup(__be32 net);
 extern int ipxrtr_ioctl(unsigned int cmd, void __user *arg);
diff --git a/net/key/af_key.c b/net/key/af_key.c
index a99444142dc7..d302ddae580c 100644
--- a/net/key/af_key.c
+++ b/net/key/af_key.c
@@ -1448,8 +1448,6 @@ static int pfkey_add(struct sock *sk, struct sk_buff *skb, struct sadb_msg *hdr,
         int err;
         struct km_event c;
 
-        xfrm_probe_algs();
-
         x = pfkey_msg2xfrm_state(hdr, ext_hdrs);
         if (IS_ERR(x))
                 return PTR_ERR(x);
diff --git a/net/netfilter/nf_conntrack_core.c b/net/netfilter/nf_conntrack_core.c
index e8b5c2d7db62..483e927a9ca4 100644
--- a/net/netfilter/nf_conntrack_core.c
+++ b/net/netfilter/nf_conntrack_core.c
@@ -298,7 +298,6 @@ static void
 destroy_conntrack(struct nf_conntrack *nfct)
 {
         struct nf_conn *ct = (struct nf_conn *)nfct;
-        struct nf_conn_help *help = nfct_help(ct);
         struct nf_conntrack_l4proto *l4proto;
         typeof(nf_conntrack_destroyed) destroyed;
 
@@ -309,9 +308,6 @@ destroy_conntrack(struct nf_conntrack *nfct)
         nf_conntrack_event(IPCT_DESTROY, ct);
         set_bit(IPS_DYING_BIT, &ct->status);
 
-        if (help && help->helper && help->helper->destroy)
-                help->helper->destroy(ct);
-
         /* To make sure we don't get any weird locking issues here:
          * destroy_conntrack() MUST NOT be called with a write lock
          * to nf_conntrack_lock!!! -HW */
@@ -353,6 +349,10 @@ destroy_conntrack(struct nf_conntrack *nfct)
 static void death_by_timeout(unsigned long ul_conntrack)
 {
         struct nf_conn *ct = (void *)ul_conntrack;
+        struct nf_conn_help *help = nfct_help(ct);
+
+        if (help && help->helper && help->helper->destroy)
+                help->helper->destroy(ct);
 
         write_lock_bh(&nf_conntrack_lock);
         /* Inside lock so preempt is disabled on module removal path.
diff --git a/net/rfkill/rfkill.c b/net/rfkill/rfkill.c
index a973603e3880..f3986d498b40 100644
--- a/net/rfkill/rfkill.c
+++ b/net/rfkill/rfkill.c
@@ -296,7 +296,7 @@ struct rfkill *rfkill_allocate(struct device *parent, enum rfkill_type type)
         struct device *dev;
 
         rfkill = kzalloc(sizeof(struct rfkill), GFP_KERNEL);
-        if (rfkill)
+        if (!rfkill)
                 return NULL;
 
         mutex_init(&rfkill->mutex);
diff --git a/net/sched/sch_prio.c b/net/sched/sch_prio.c
index 269a6e17c6c4..6d7542c26e47 100644
--- a/net/sched/sch_prio.c
+++ b/net/sched/sch_prio.c
@@ -75,7 +75,7 @@ prio_classify(struct sk_buff *skb, struct Qdisc *sch, int *qerr)
                 band = res.classid;
         }
         band = TC_H_MIN(band) - 1;
-        if (band > q->bands)
+        if (band >= q->bands)
                 return q->queues[q->prio2band[0]];
 
         return q->queues[band];
diff --git a/net/socket.c b/net/socket.c
index 98a8f67abbfc..f4530196a70a 100644
--- a/net/socket.c
+++ b/net/socket.c
@@ -261,8 +261,7 @@ static void init_once(void *foo, struct kmem_cache *cachep, unsigned long flags)
 {
         struct socket_alloc *ei = (struct socket_alloc *)foo;
 
-        if (flags & SLAB_CTOR_CONSTRUCTOR)
-                inode_init_once(&ei->vfs_inode);
+        inode_init_once(&ei->vfs_inode);
 }
 
 static int init_inodecache(void)
diff --git a/net/sunrpc/rpc_pipe.c b/net/sunrpc/rpc_pipe.c
index a2f1893bde53..5887457dc936 100644
--- a/net/sunrpc/rpc_pipe.c
+++ b/net/sunrpc/rpc_pipe.c
@@ -828,19 +828,17 @@ init_once(void * foo, struct kmem_cache * cachep, unsigned long flags)
 {
         struct rpc_inode *rpci = (struct rpc_inode *) foo;
 
-        if (flags & SLAB_CTOR_CONSTRUCTOR) {
-                inode_init_once(&rpci->vfs_inode);
-                rpci->private = NULL;
-                rpci->nreaders = 0;
-                rpci->nwriters = 0;
-                INIT_LIST_HEAD(&rpci->in_upcall);
-                INIT_LIST_HEAD(&rpci->pipe);
-                rpci->pipelen = 0;
-                init_waitqueue_head(&rpci->waitq);
-                INIT_DELAYED_WORK(&rpci->queue_timeout,
-                                    rpc_timeout_upcall_queue);
-                rpci->ops = NULL;
-        }
+        inode_init_once(&rpci->vfs_inode);
+        rpci->private = NULL;
+        rpci->nreaders = 0;
+        rpci->nwriters = 0;
+        INIT_LIST_HEAD(&rpci->in_upcall);
+        INIT_LIST_HEAD(&rpci->pipe);
+        rpci->pipelen = 0;
+        init_waitqueue_head(&rpci->waitq);
+        INIT_DELAYED_WORK(&rpci->queue_timeout,
+                            rpc_timeout_upcall_queue);
+        rpci->ops = NULL;
 }
 
 int register_rpc_pipefs(void)
diff --git a/net/sunrpc/sched.c b/net/sunrpc/sched.c
index b011eb625e49..944d75396fb3 100644
--- a/net/sunrpc/sched.c
+++ b/net/sunrpc/sched.c
@@ -989,8 +989,6 @@ void rpc_killall_tasks(struct rpc_clnt *clnt)
         spin_unlock(&rpc_sched_lock);
 }
 
-static DECLARE_MUTEX_LOCKED(rpciod_running);
-
 static void rpciod_killall(void)
 {
         unsigned long flags;
diff --git a/net/sunrpc/sunrpc_syms.c b/net/sunrpc/sunrpc_syms.c
index 0d35bc796d00..73075dec83c0 100644
--- a/net/sunrpc/sunrpc_syms.c
+++ b/net/sunrpc/sunrpc_syms.c
@@ -134,11 +134,7 @@ EXPORT_SYMBOL(nfsd_debug);
 EXPORT_SYMBOL(nlm_debug);
 #endif
 
-extern int register_rpc_pipefs(void);
-extern void unregister_rpc_pipefs(void);
 extern struct cache_detail ip_map_cache, unix_gid_cache;
-extern int init_socket_xprt(void);
-extern void cleanup_socket_xprt(void);
 
 static int __init
 init_sunrpc(void)
diff --git a/net/xfrm/xfrm_algo.c b/net/xfrm/xfrm_algo.c
index 6249a9405bb8..8a72def25a34 100644
--- a/net/xfrm/xfrm_algo.c
+++ b/net/xfrm/xfrm_algo.c
@@ -347,67 +347,44 @@ static inline int calg_entries(void)
         return ARRAY_SIZE(calg_list);
 }
 
-/* Todo: generic iterators */
-struct xfrm_algo_desc *xfrm_aalg_get_byid(int alg_id)
-{
-        int i;
-
-        for (i = 0; i < aalg_entries(); i++) {
-                if (aalg_list[i].desc.sadb_alg_id == alg_id) {
-                        if (aalg_list[i].available)
-                                return &aalg_list[i];
-                        else
-                                break;
-                }
-        }
-        return NULL;
-}
-EXPORT_SYMBOL_GPL(xfrm_aalg_get_byid);
-
-struct xfrm_algo_desc *xfrm_ealg_get_byid(int alg_id)
-{
-        int i;
+struct xfrm_algo_list {
+        struct xfrm_algo_desc *algs;
+        int entries;
+        u32 type;
+        u32 mask;
+};
 
-        for (i = 0; i < ealg_entries(); i++) {
-                if (ealg_list[i].desc.sadb_alg_id == alg_id) {
-                        if (ealg_list[i].available)
-                                return &ealg_list[i];
-                        else
-                                break;
-                }
-        }
-        return NULL;
-}
-EXPORT_SYMBOL_GPL(xfrm_ealg_get_byid);
+static const struct xfrm_algo_list xfrm_aalg_list = {
+        .algs = aalg_list,
+        .entries = ARRAY_SIZE(aalg_list),
+        .type = CRYPTO_ALG_TYPE_HASH,
+        .mask = CRYPTO_ALG_TYPE_HASH_MASK | CRYPTO_ALG_ASYNC,
+};
 
-struct xfrm_algo_desc *xfrm_calg_get_byid(int alg_id)
-{
-        int i;
+static const struct xfrm_algo_list xfrm_ealg_list = {
+        .algs = ealg_list,
+        .entries = ARRAY_SIZE(ealg_list),
+        .type = CRYPTO_ALG_TYPE_BLKCIPHER,
+        .mask = CRYPTO_ALG_TYPE_MASK | CRYPTO_ALG_ASYNC,
+};
 
-        for (i = 0; i < calg_entries(); i++) {
-                if (calg_list[i].desc.sadb_alg_id == alg_id) {
-                        if (calg_list[i].available)
-                                return &calg_list[i];
-                        else
-                                break;
-                }
-        }
-        return NULL;
-}
-EXPORT_SYMBOL_GPL(xfrm_calg_get_byid);
+static const struct xfrm_algo_list xfrm_calg_list = {
+        .algs = calg_list,
+        .entries = ARRAY_SIZE(calg_list),
+        .type = CRYPTO_ALG_TYPE_COMPRESS,
+        .mask = CRYPTO_ALG_TYPE_MASK | CRYPTO_ALG_ASYNC,
+};
 
-static struct xfrm_algo_desc *xfrm_get_byname(struct xfrm_algo_desc *list,
-                                              int entries, u32 type, u32 mask,
-                                              char *name, int probe)
+static struct xfrm_algo_desc *xfrm_find_algo(
+        const struct xfrm_algo_list *algo_list,
+        int match(const struct xfrm_algo_desc *entry, const void *data),
+        const void *data, int probe)
 {
+        struct xfrm_algo_desc *list = algo_list->algs;
         int i, status;
 
-        if (!name)
-                return NULL;
-
-        for (i = 0; i < entries; i++) {
-                if (strcmp(name, list[i].name) &&
-                    (!list[i].compat || strcmp(name, list[i].compat)))
+        for (i = 0; i < algo_list->entries; i++) {
+                if (!match(list + i, data))
                         continue;
 
                 if (list[i].available)
@@ -416,8 +393,8 @@ static struct xfrm_algo_desc *xfrm_get_byname(struct xfrm_algo_desc *list,
                 if (!probe)
                         break;
 
-                status = crypto_has_alg(list[i].name, type,
-                                        mask | CRYPTO_ALG_ASYNC);
+                status = crypto_has_alg(list[i].name, algo_list->type,
+                                        algo_list->mask);
                 if (!status)
                         break;
 
@@ -427,27 +404,60 @@ static struct xfrm_algo_desc *xfrm_get_byname(struct xfrm_algo_desc *list,
         return NULL;
 }
 
+static int xfrm_alg_id_match(const struct xfrm_algo_desc *entry,
+                             const void *data)
+{
+        return entry->desc.sadb_alg_id == (int)data;
+}
+
+struct xfrm_algo_desc *xfrm_aalg_get_byid(int alg_id)
+{
+        return xfrm_find_algo(&xfrm_aalg_list, xfrm_alg_id_match,
+                              (void *)alg_id, 1);
+}
+EXPORT_SYMBOL_GPL(xfrm_aalg_get_byid);
+
+struct xfrm_algo_desc *xfrm_ealg_get_byid(int alg_id)
+{
+        return xfrm_find_algo(&xfrm_ealg_list, xfrm_alg_id_match,
+                              (void *)alg_id, 1);
+}
+EXPORT_SYMBOL_GPL(xfrm_ealg_get_byid);
+
+struct xfrm_algo_desc *xfrm_calg_get_byid(int alg_id)
+{
+        return xfrm_find_algo(&xfrm_calg_list, xfrm_alg_id_match,
+                              (void *)alg_id, 1);
+}
+EXPORT_SYMBOL_GPL(xfrm_calg_get_byid);
+
+static int xfrm_alg_name_match(const struct xfrm_algo_desc *entry,
+                               const void *data)
+{
+        const char *name = data;
+
+        return name && (!strcmp(name, entry->name) ||
+                        (entry->compat && !strcmp(name, entry->compat)));
+}
+
 struct xfrm_algo_desc *xfrm_aalg_get_byname(char *name, int probe)
 {
-        return xfrm_get_byname(aalg_list, aalg_entries(),
-                               CRYPTO_ALG_TYPE_HASH, CRYPTO_ALG_TYPE_HASH_MASK,
-                               name, probe);
+        return xfrm_find_algo(&xfrm_aalg_list, xfrm_alg_name_match, name,
+                              probe);
 }
 EXPORT_SYMBOL_GPL(xfrm_aalg_get_byname);
 
 struct xfrm_algo_desc *xfrm_ealg_get_byname(char *name, int probe)
 {
-        return xfrm_get_byname(ealg_list, ealg_entries(),
-                               CRYPTO_ALG_TYPE_BLKCIPHER, CRYPTO_ALG_TYPE_MASK,
-                               name, probe);
+        return xfrm_find_algo(&xfrm_ealg_list, xfrm_alg_name_match, name,
+                              probe);
 }
 EXPORT_SYMBOL_GPL(xfrm_ealg_get_byname);
 
 struct xfrm_algo_desc *xfrm_calg_get_byname(char *name, int probe)
 {
-        return xfrm_get_byname(calg_list, calg_entries(),
-                               CRYPTO_ALG_TYPE_COMPRESS, CRYPTO_ALG_TYPE_MASK,
-                               name, probe);
+        return xfrm_find_algo(&xfrm_calg_list, xfrm_alg_name_match, name,
+                              probe);
 }
 EXPORT_SYMBOL_GPL(xfrm_calg_get_byname);
 
diff --git a/net/xfrm/xfrm_hash.c b/net/xfrm/xfrm_hash.c
index 37643bb8768a..55ab5792af56 100644
--- a/net/xfrm/xfrm_hash.c
+++ b/net/xfrm/xfrm_hash.c
@@ -22,7 +22,8 @@ struct hlist_head *xfrm_hash_alloc(unsigned int sz)
                 n = __vmalloc(sz, GFP_KERNEL, PAGE_KERNEL);
         else
                 n = (struct hlist_head *)
-                        __get_free_pages(GFP_KERNEL, get_order(sz));
+                        __get_free_pages(GFP_KERNEL | __GFP_NOWARN,
+                                         get_order(sz));
 
         if (n)
                 memset(n, 0, sz);
diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c
index 95271e8426a1..d0882e53b6fc 100644
--- a/net/xfrm/xfrm_policy.c
+++ b/net/xfrm/xfrm_policy.c
@@ -796,6 +796,10 @@ struct xfrm_policy *xfrm_policy_byid(u8 type, int dir, u32 id, int delete,
         struct hlist_head *chain;
         struct hlist_node *entry;
 
+        *err = -ENOENT;
+        if (xfrm_policy_id2dir(id) != dir)
+                return NULL;
+
         *err = 0;
         write_lock_bh(&xfrm_policy_lock);
         chain = xfrm_policy_byidx + idx_hash(id);