11 files changed, 50 insertions, 27 deletions

diff --git a/net/core/utils.c b/net/core/utils.c
index 2030bb8c2d30..0bf17da40d52 100644
--- a/net/core/utils.c
+++ b/net/core/utils.c
@@ -25,6 +25,7 @@
 #include <linux/random.h>
 #include <linux/percpu.h>
 #include <linux/init.h>
+#include <net/sock.h>
 
 #include <asm/byteorder.h>
 #include <asm/system.h>
diff --git a/net/ipv4/netfilter/ipt_recent.c b/net/ipv4/netfilter/ipt_recent.c
index 321804315659..6d0c0f7364ad 100644
--- a/net/ipv4/netfilter/ipt_recent.c
+++ b/net/ipv4/netfilter/ipt_recent.c
@@ -387,12 +387,17 @@ static int recent_seq_open(struct inode *inode, struct file *file)
         st = kzalloc(sizeof(*st), GFP_KERNEL);
         if (st == NULL)
                 return -ENOMEM;
+
         ret = seq_open(file, &recent_seq_ops);
-        if (ret)
+        if (ret) {
                 kfree(st);
+                goto out;
+        }
+
         st->table    = pde->data;
         seq          = file->private_data;
         seq->private = st;
+out:
         return ret;
 }
 
diff --git a/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c b/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c
index 64552afd01cb..d9b5177989c6 100644
--- a/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c
+++ b/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c
@@ -509,3 +509,9 @@ static void __exit nf_conntrack_l3proto_ipv4_fini(void)
 
 module_init(nf_conntrack_l3proto_ipv4_init);
 module_exit(nf_conntrack_l3proto_ipv4_fini);
+
+void need_ipv4_conntrack(void)
+{
+        return;
+}
+EXPORT_SYMBOL_GPL(need_ipv4_conntrack);
diff --git a/net/ipv4/netfilter/nf_nat_standalone.c b/net/ipv4/netfilter/nf_nat_standalone.c
index 332814dac503..46cc99def165 100644
--- a/net/ipv4/netfilter/nf_nat_standalone.c
+++ b/net/ipv4/netfilter/nf_nat_standalone.c
@@ -328,7 +328,7 @@ static int __init nf_nat_standalone_init(void)
 {
         int ret = 0;
 
-        need_conntrack();
+        need_ipv4_conntrack();
 
 #ifdef CONFIG_XFRM
         BUG_ON(ip_nat_decode_session != NULL);
diff --git a/net/ipv4/tcp_htcp.c b/net/ipv4/tcp_htcp.c
index b66556c0a5bd..5215691f2760 100644
--- a/net/ipv4/tcp_htcp.c
+++ b/net/ipv4/tcp_htcp.c
@@ -79,7 +79,6 @@ static u32 htcp_cwnd_undo(struct sock *sk)
 static inline void measure_rtt(struct sock *sk, u32 srtt)
 {
         const struct inet_connection_sock *icsk = inet_csk(sk);
-        const struct tcp_sock *tp = tcp_sk(sk);
         struct htcp *ca = inet_csk_ca(sk);
 
         /* keep track of minimum RTT seen so far, minRTT is zero at first */
@@ -87,8 +86,7 @@ static inline void measure_rtt(struct sock *sk, u32 srtt)
                 ca->minRTT = srtt;
 
         /* max RTT */
-        if (icsk->icsk_ca_state == TCP_CA_Open
-            && tp->snd_ssthresh < 0xFFFF && htcp_ccount(ca) > 3) {
+        if (icsk->icsk_ca_state == TCP_CA_Open) {
                 if (ca->maxRTT < ca->minRTT)
                         ca->maxRTT = ca->minRTT;
                 if (ca->maxRTT < srtt
diff --git a/net/mac80211/debugfs_netdev.c b/net/mac80211/debugfs_netdev.c
index 799a9208c4b4..095be91829ca 100644
--- a/net/mac80211/debugfs_netdev.c
+++ b/net/mac80211/debugfs_netdev.c
@@ -271,9 +271,11 @@ static void add_files(struct ieee80211_sub_if_data *sdata)
         }
 }
 
-#define DEBUGFS_DEL(name, type)\
-        debugfs_remove(sdata->debugfs.type.name);\
-        sdata->debugfs.type.name = NULL;
+#define DEBUGFS_DEL(name, type)                                 \
+        do {                                                    \
+                debugfs_remove(sdata->debugfs.type.name);       \
+                sdata->debugfs.type.name = NULL;                \
+        } while (0)
 
 static void del_sta_files(struct ieee80211_sub_if_data *sdata)
 {
diff --git a/net/mac80211/debugfs_sta.c b/net/mac80211/debugfs_sta.c
index d41e696f3980..da34ea70276f 100644
--- a/net/mac80211/debugfs_sta.c
+++ b/net/mac80211/debugfs_sta.c
@@ -157,7 +157,7 @@ static ssize_t sta_last_seq_ctrl_read(struct file *file, char __user *userbuf,
         struct sta_info *sta = file->private_data;
         for (i = 0; i < NUM_RX_DATA_QUEUES; i++)
                 p += scnprintf(p, sizeof(buf)+buf-p, "%x ",
-                               sta->last_seq_ctrl[i]);
+                               le16_to_cpu(sta->last_seq_ctrl[i]));
         p += scnprintf(p, sizeof(buf)+buf-p, "\n");
         return simple_read_from_buffer(userbuf, count, ppos, buf, p - buf);
 }
diff --git a/net/mac80211/ieee80211.c b/net/mac80211/ieee80211.c
index c944b17d0fc0..8ec5ed192b5d 100644
--- a/net/mac80211/ieee80211.c
+++ b/net/mac80211/ieee80211.c
@@ -1650,6 +1650,7 @@ static int ieee80211_master_start_xmit(struct sk_buff *skb,
         if (skb_headroom(skb) < headroom) {
                 if (pskb_expand_head(skb, headroom, 0, GFP_ATOMIC)) {
                         dev_kfree_skb(skb);
+                        dev_put(odev);
                         return 0;
                 }
         }
diff --git a/net/mac80211/ieee80211_ioctl.c b/net/mac80211/ieee80211_ioctl.c
index d0e1ab5589db..e7904db55325 100644
--- a/net/mac80211/ieee80211_ioctl.c
+++ b/net/mac80211/ieee80211_ioctl.c
@@ -697,17 +697,24 @@ static int ieee80211_ioctl_siwscan(struct net_device *dev,
         if (!netif_running(dev))
                 return -ENETDOWN;
 
-        if (local->scan_flags & IEEE80211_SCAN_MATCH_SSID) {
-                if (sdata->type == IEEE80211_IF_TYPE_STA ||
-                    sdata->type == IEEE80211_IF_TYPE_IBSS) {
+        switch (sdata->type) {
+        case IEEE80211_IF_TYPE_STA:
+        case IEEE80211_IF_TYPE_IBSS:
+                if (local->scan_flags & IEEE80211_SCAN_MATCH_SSID) {
                         ssid = sdata->u.sta.ssid;
                         ssid_len = sdata->u.sta.ssid_len;
-                } else if (sdata->type == IEEE80211_IF_TYPE_AP) {
+                }
+                break;
+        case IEEE80211_IF_TYPE_AP:
+                if (local->scan_flags & IEEE80211_SCAN_MATCH_SSID) {
                         ssid = sdata->u.ap.ssid;
                         ssid_len = sdata->u.ap.ssid_len;
-                } else
-                        return -EINVAL;
+                }
+                break;
+        default:
+                return -EOPNOTSUPP;
         }
+
         return ieee80211_sta_req_scan(dev, ssid, ssid_len);
 }
 
diff --git a/net/netfilter/nf_conntrack_netlink.c b/net/netfilter/nf_conntrack_netlink.c
index 6f89b105a205..2863e72b4091 100644
--- a/net/netfilter/nf_conntrack_netlink.c
+++ b/net/netfilter/nf_conntrack_netlink.c
@@ -1052,17 +1052,18 @@ ctnetlink_new_conntrack(struct sock *ctnl, struct sk_buff *skb,
         }
         /* implicit 'else' */
 
-        /* we only allow nat config for new conntracks */
-        if (cda[CTA_NAT_SRC-1] || cda[CTA_NAT_DST-1]) {
-                err = -EINVAL;
-                goto out_unlock;
-        }
-
         /* We manipulate the conntrack inside the global conntrack table lock,
          * so there's no need to increase the refcount */
         err = -EEXIST;
-        if (!(nlh->nlmsg_flags & NLM_F_EXCL))
-                err = ctnetlink_change_conntrack(nf_ct_tuplehash_to_ctrack(h), cda);
+        if (!(nlh->nlmsg_flags & NLM_F_EXCL)) {
+                /* we only allow nat config for new conntracks */
+                if (cda[CTA_NAT_SRC-1] || cda[CTA_NAT_DST-1]) {
+                        err = -EINVAL;
+                        goto out_unlock;
+                }
+                err = ctnetlink_change_conntrack(nf_ct_tuplehash_to_ctrack(h),
+                                                 cda);
+        }
 
 out_unlock:
         write_unlock_bh(&nf_conntrack_lock);
diff --git a/net/netlabel/netlabel_domainhash.c b/net/netlabel/netlabel_domainhash.c
index f46a0aeec44f..b6c844b7e1c1 100644
--- a/net/netlabel/netlabel_domainhash.c
+++ b/net/netlabel/netlabel_domainhash.c
@@ -126,7 +126,9 @@ static struct netlbl_dom_map *netlbl_domhsh_search(const char *domain, u32 def)
 
         if (domain != NULL) {
                 bkt = netlbl_domhsh_hash(domain);
-                list_for_each_entry_rcu(iter, &netlbl_domhsh->tbl[bkt], list)
+                list_for_each_entry_rcu(iter,
+                                     &rcu_dereference(netlbl_domhsh)->tbl[bkt],
+                                     list)
                         if (iter->valid && strcmp(iter->domain, domain) == 0)
                                 return iter;
         }
@@ -227,7 +229,7 @@ int netlbl_domhsh_add(struct netlbl_dom_map *entry,
                 spin_lock(&netlbl_domhsh_lock);
                 if (netlbl_domhsh_search(entry->domain, 0) == NULL)
                         list_add_tail_rcu(&entry->list,
-                                          &netlbl_domhsh->tbl[bkt]);
+                                    &rcu_dereference(netlbl_domhsh)->tbl[bkt]);
                 else
                         ret_val = -EEXIST;
                 spin_unlock(&netlbl_domhsh_lock);
@@ -423,8 +425,8 @@ int netlbl_domhsh_walk(u32 *skip_bkt,
              iter_bkt < rcu_dereference(netlbl_domhsh)->size;
              iter_bkt++, chain_cnt = 0) {
                 list_for_each_entry_rcu(iter_entry,
-                                        &netlbl_domhsh->tbl[iter_bkt],
-                                        list)
+                                &rcu_dereference(netlbl_domhsh)->tbl[iter_bkt],
+                                list)
                         if (iter_entry->valid) {
                                 if (chain_cnt++ < *skip_chain)
                                         continue;