35 files changed, 220 insertions, 118 deletions

diff --git a/net/bluetooth/hci_conn.c b/net/bluetooth/hci_conn.c
index 61309b26f271..fa47d5d84f5c 100644
--- a/net/bluetooth/hci_conn.c
+++ b/net/bluetooth/hci_conn.c
@@ -171,10 +171,8 @@ static void hci_conn_timeout(unsigned long arg)
         switch (conn->state) {
         case BT_CONNECT:
         case BT_CONNECT2:
-                if (conn->type == ACL_LINK)
+                if (conn->type == ACL_LINK && conn->out)
                         hci_acl_connect_cancel(conn);
-                else
-                        hci_acl_disconn(conn, 0x13);
                 break;
         case BT_CONFIG:
         case BT_CONNECTED:
@@ -292,6 +290,8 @@ int hci_conn_del(struct hci_conn *conn)
 
         hci_conn_del_sysfs(conn);
 
+        hci_dev_put(hdev);
+
         return 0;
 }
 
diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c
index 4e7cb88e5da9..184ba0a88ec0 100644
--- a/net/bluetooth/hci_event.c
+++ b/net/bluetooth/hci_event.c
@@ -1493,7 +1493,7 @@ static inline void hci_pin_code_request_evt(struct hci_dev *hdev, struct sk_buff
         hci_dev_lock(hdev);
 
         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
-        if (conn) {
+        if (conn && conn->state == BT_CONNECTED) {
                 hci_conn_hold(conn);
                 conn->disc_timeout = HCI_PAIRING_TIMEOUT;
                 hci_conn_put(conn);
diff --git a/net/bluetooth/hci_sysfs.c b/net/bluetooth/hci_sysfs.c
index a05d45eb3ba1..95f7a7a544b4 100644
--- a/net/bluetooth/hci_sysfs.c
+++ b/net/bluetooth/hci_sysfs.c
@@ -90,15 +90,14 @@ static void add_conn(struct work_struct *work)
         struct hci_conn *conn = container_of(work, struct hci_conn, work_add);
         struct hci_dev *hdev = conn->hdev;
 
-        /* ensure previous del is complete */
-        flush_work(&conn->work_del);
-
         dev_set_name(&conn->dev, "%s:%d", hdev->name, conn->handle);
 
         if (device_add(&conn->dev) < 0) {
                 BT_ERR("Failed to register connection device");
                 return;
         }
+
+        hci_dev_hold(hdev);
 }
 
 /*
@@ -116,9 +115,6 @@ static void del_conn(struct work_struct *work)
         struct hci_conn *conn = container_of(work, struct hci_conn, work_del);
         struct hci_dev *hdev = conn->hdev;
 
-        /* ensure previous add is complete */
-        flush_work(&conn->work_add);
-
         if (!device_is_registered(&conn->dev))
                 return;
 
@@ -134,6 +130,7 @@ static void del_conn(struct work_struct *work)
 
         device_del(&conn->dev);
         put_device(&conn->dev);
+
         hci_dev_put(hdev);
 }
 
diff --git a/net/bridge/br_input.c b/net/bridge/br_input.c
index 30b88777c3df..5ee1a3682bf2 100644
--- a/net/bridge/br_input.c
+++ b/net/bridge/br_input.c
@@ -134,6 +134,10 @@ struct sk_buff *br_handle_frame(struct net_bridge_port *p, struct sk_buff *skb)
                 if (skb->protocol == htons(ETH_P_PAUSE))
                         goto drop;
 
+                /* If STP is turned off, then forward */
+                if (p->br->stp_enabled == BR_NO_STP && dest[5] == 0)
+                        goto forward;
+
                 if (NF_HOOK(PF_BRIDGE, NF_BR_LOCAL_IN, skb, skb->dev,
                             NULL, br_handle_local_finish))
                         return NULL;    /* frame consumed by filter */
@@ -141,6 +145,7 @@ struct sk_buff *br_handle_frame(struct net_bridge_port *p, struct sk_buff *skb)
                         return skb;     /* continue processing */
         }
 
+forward:
         switch (p->state) {
         case BR_STATE_FORWARDING:
                 rhook = rcu_dereference(br_should_route_hook);
diff --git a/net/bridge/br_stp.c b/net/bridge/br_stp.c
index 6e63ec3f1fcf..0660515f3992 100644
--- a/net/bridge/br_stp.c
+++ b/net/bridge/br_stp.c
@@ -297,6 +297,9 @@ void br_topology_change_detection(struct net_bridge *br)
 {
         int isroot = br_is_root_bridge(br);
 
+        if (br->stp_enabled != BR_KERNEL_STP)
+                return;
+
         pr_info("%s: topology change detected, %s\n", br->dev->name,
                 isroot ? "propagating" : "sending tcn bpdu");
 
diff --git a/net/core/drop_monitor.c b/net/core/drop_monitor.c
index 9fd0dc3cca99..b75b6cea49da 100644
--- a/net/core/drop_monitor.c
+++ b/net/core/drop_monitor.c
@@ -23,7 +23,7 @@
 #include <linux/bitops.h>
 #include <net/genetlink.h>
 
-#include <trace/skb.h>
+#include <trace/events/skb.h>
 
 #include <asm/unaligned.h>
 
diff --git a/net/core/gen_estimator.c b/net/core/gen_estimator.c
index 9cc9f95b109e..6d62d4618cfc 100644
--- a/net/core/gen_estimator.c
+++ b/net/core/gen_estimator.c
@@ -66,9 +66,9 @@
 
    NOTES.
 
-   * The stored value for avbps is scaled by 2^5, so that maximal
-     rate is ~1Gbit, avpps is scaled by 2^10.
-
+   * avbps is scaled by 2^5, avpps is scaled by 2^10.
+   * both values are reported as 32 bit unsigned values. bps can
+     overflow for fast links : max speed being 34360Mbit/sec
    * Minimal interval is HZ/4=250msec (it is the greatest common divisor
      for HZ=100 and HZ=1024 8)), maximal interval
      is (HZ*2^EST_MAX_INTERVAL)/4 = 8sec. Shorter intervals
@@ -86,9 +86,9 @@ struct gen_estimator
         spinlock_t              *stats_lock;
         int                     ewma_log;
         u64                     last_bytes;
+        u64                     avbps;
         u32                     last_packets;
         u32                     avpps;
-        u32                     avbps;
         struct rcu_head         e_rcu;
         struct rb_node          node;
 };
@@ -115,6 +115,7 @@ static void est_timer(unsigned long arg)
         rcu_read_lock();
         list_for_each_entry_rcu(e, &elist[idx].list, list) {
                 u64 nbytes;
+                u64 brate;
                 u32 npackets;
                 u32 rate;
 
@@ -125,9 +126,9 @@ static void est_timer(unsigned long arg)
 
                 nbytes = e->bstats->bytes;
                 npackets = e->bstats->packets;
-                rate = (nbytes - e->last_bytes)<<(7 - idx);
+                brate = (nbytes - e->last_bytes)<<(7 - idx);
                 e->last_bytes = nbytes;
-                e->avbps += ((long)rate - (long)e->avbps) >> e->ewma_log;
+                e->avbps += ((s64)(brate - e->avbps)) >> e->ewma_log;
                 e->rate_est->bps = (e->avbps+0xF)>>5;
 
                 rate = (npackets - e->last_packets)<<(12 - idx);
diff --git a/net/core/net-traces.c b/net/core/net-traces.c
index c8fb45665e4f..499a67eaf3ae 100644
--- a/net/core/net-traces.c
+++ b/net/core/net-traces.c
@@ -19,11 +19,11 @@
 #include <linux/workqueue.h>
 #include <linux/netlink.h>
 #include <linux/net_dropmon.h>
-#include <trace/skb.h>
 
 #include <asm/unaligned.h>
 #include <asm/bitops.h>
 
+#define CREATE_TRACE_POINTS
+#include <trace/events/skb.h>
 
-DEFINE_TRACE(kfree_skb);
 EXPORT_TRACEPOINT_SYMBOL_GPL(kfree_skb);
diff --git a/net/core/netpoll.c b/net/core/netpoll.c
index b5873bdff612..64f51eec6576 100644
--- a/net/core/netpoll.c
+++ b/net/core/netpoll.c
@@ -175,9 +175,13 @@ static void service_arp_queue(struct netpoll_info *npi)
 void netpoll_poll(struct netpoll *np)
 {
         struct net_device *dev = np->dev;
-        const struct net_device_ops *ops = dev->netdev_ops;
+        const struct net_device_ops *ops;
+
+        if (!dev || !netif_running(dev))
+                return;
 
-        if (!dev || !netif_running(dev) || !ops->ndo_poll_controller)
+        ops = dev->netdev_ops;
+        if (!ops->ndo_poll_controller)
                 return;
 
         /* Process pending work on NIC */
diff --git a/net/core/pktgen.c b/net/core/pktgen.c
index 3779c1438c11..0666a827bc62 100644
--- a/net/core/pktgen.c
+++ b/net/core/pktgen.c
@@ -2447,7 +2447,7 @@ static inline void free_SAs(struct pktgen_dev *pkt_dev)
         if (pkt_dev->cflows) {
                 /* let go of the SAs if we have them */
                 int i = 0;
-                for (;  i < pkt_dev->nflows; i++){
+                for (;  i < pkt_dev->cflows; i++) {
                         struct xfrm_state *x = pkt_dev->flows[i].x;
                         if (x) {
                                 xfrm_state_put(x);
diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index d152394b2611..c2e4fb8f3546 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -65,7 +65,7 @@
 
 #include <asm/uaccess.h>
 #include <asm/system.h>
-#include <trace/skb.h>
+#include <trace/events/skb.h>
 
 #include "kmap_skb.h"
 
@@ -2288,7 +2288,7 @@ unsigned int skb_seq_read(unsigned int consumed, const u8 **data,
 next_skb:
         block_limit = skb_headlen(st->cur_skb) + st->stepped_offset;
 
-        if (abs_offset < block_limit) {
+        if (abs_offset < block_limit && !st->frag_data) {
                 *data = st->cur_skb->data + (abs_offset - st->stepped_offset);
                 return block_limit - abs_offset;
         }
diff --git a/net/ipv4/Kconfig b/net/ipv4/Kconfig
index 9d26a3da37e5..5b919f7b45db 100644
--- a/net/ipv4/Kconfig
+++ b/net/ipv4/Kconfig
@@ -408,7 +408,7 @@ config INET_XFRM_MODE_BEET
 
 config INET_LRO
         bool "Large Receive Offload (ipv4/tcp)"
-
+        default y
         ---help---
           Support for Large Receive Offload (ipv4/tcp).
 
diff --git a/net/ipv4/fib_trie.c b/net/ipv4/fib_trie.c
index ec0ae490f0b6..33c7c85dfe40 100644
--- a/net/ipv4/fib_trie.c
+++ b/net/ipv4/fib_trie.c
@@ -986,9 +986,12 @@ fib_find_node(struct trie *t, u32 key)
 static struct node *trie_rebalance(struct trie *t, struct tnode *tn)
 {
         int wasfull;
-        t_key cindex, key = tn->key;
+        t_key cindex, key;
         struct tnode *tp;
 
+        preempt_disable();
+        key = tn->key;
+
         while (tn != NULL && (tp = node_parent((struct node *)tn)) != NULL) {
                 cindex = tkey_extract_bits(key, tp->pos, tp->bits);
                 wasfull = tnode_full(tp, tnode_get_child(tp, cindex));
@@ -1007,6 +1010,7 @@ static struct node *trie_rebalance(struct trie *t, struct tnode *tn)
         if (IS_TNODE(tn))
                 tn = (struct tnode *)resize(t, (struct tnode *)tn);
 
+        preempt_enable();
         return (struct node *)tn;
 }
 
diff --git a/net/ipv4/ipconfig.c b/net/ipv4/ipconfig.c
index 90d22ae0a419..88bf051d0cbb 100644
--- a/net/ipv4/ipconfig.c
+++ b/net/ipv4/ipconfig.c
@@ -139,6 +139,8 @@ __be32 ic_servaddr = NONE;	/* Boot server IP address */
 __be32 root_server_addr = NONE; /* Address of NFS server */
 u8 root_server_path[256] = { 0, };      /* Path to mount as root */
 
+u32 ic_dev_xid;         /* Device under configuration */
+
 /* vendor class identifier */
 static char vendor_class_identifier[253] __initdata;
 
@@ -932,6 +934,13 @@ static int __init ic_bootp_recv(struct sk_buff *skb, struct net_device *dev, str
                 goto drop_unlock;
         }
 
+        /* Is it a reply for the device we are configuring? */
+        if (b->xid != ic_dev_xid) {
+                if (net_ratelimit())
+                        printk(KERN_ERR "DHCP/BOOTP: Ignoring delayed packet \n");
+                goto drop_unlock;
+        }
+
         /* Parse extensions */
         if (ext_len >= 4 &&
             !memcmp(b->exten, ic_bootp_cookie, 4)) { /* Check magic cookie */
@@ -1115,6 +1124,9 @@ static int __init ic_dynamic(void)
         get_random_bytes(&timeout, sizeof(timeout));
         timeout = CONF_BASE_TIMEOUT + (timeout % (unsigned) CONF_TIMEOUT_RANDOM);
         for (;;) {
+                /* Track the device we are configuring */
+                ic_dev_xid = d->xid;
+
 #ifdef IPCONFIG_BOOTP
                 if (do_bootp && (d->able & IC_BOOTP))
                         ic_bootp_send_if(d, jiffies - start_jiffies);
diff --git a/net/ipv4/route.c b/net/ipv4/route.c
index c4c60e9f068a..28205e5bfa9b 100644
--- a/net/ipv4/route.c
+++ b/net/ipv4/route.c
@@ -784,8 +784,8 @@ static void rt_check_expire(void)
 {
         static unsigned int rover;
         unsigned int i = rover, goal;
-        struct rtable *rth, **rthp;
-        unsigned long length = 0, samples = 0;
+        struct rtable *rth, *aux, **rthp;
+        unsigned long samples = 0;
         unsigned long sum = 0, sum2 = 0;
         u64 mult;
 
@@ -795,9 +795,9 @@ static void rt_check_expire(void)
         goal = (unsigned int)mult;
         if (goal > rt_hash_mask)
                 goal = rt_hash_mask + 1;
-        length = 0;
         for (; goal > 0; goal--) {
                 unsigned long tmo = ip_rt_gc_timeout;
+                unsigned long length;
 
                 i = (i + 1) & rt_hash_mask;
                 rthp = &rt_hash_table[i].chain;
@@ -809,8 +809,10 @@ static void rt_check_expire(void)
 
                 if (*rthp == NULL)
                         continue;
+                length = 0;
                 spin_lock_bh(rt_hash_lock_addr(i));
                 while ((rth = *rthp) != NULL) {
+                        prefetch(rth->u.dst.rt_next);
                         if (rt_is_expired(rth)) {
                                 *rthp = rth->u.dst.rt_next;
                                 rt_free(rth);
@@ -819,33 +821,30 @@ static void rt_check_expire(void)
                         if (rth->u.dst.expires) {
                                 /* Entry is expired even if it is in use */
                                 if (time_before_eq(jiffies, rth->u.dst.expires)) {
+nofree:
                                         tmo >>= 1;
                                         rthp = &rth->u.dst.rt_next;
                                         /*
-                                         * Only bump our length if the hash
-                                         * inputs on entries n and n+1 are not
-                                         * the same, we only count entries on
+                                         * We only count entries on
                                          * a chain with equal hash inputs once
                                          * so that entries for different QOS
                                          * levels, and other non-hash input
                                          * attributes don't unfairly skew
                                          * the length computation
                                          */
-                                        if ((*rthp == NULL) ||
-                                            !compare_hash_inputs(&(*rthp)->fl,
-                                                                 &rth->fl))
-                                                length += ONE;
+                                        for (aux = rt_hash_table[i].chain;;) {
+                                                if (aux == rth) {
+                                                        length += ONE;
+                                                        break;
+                                                }
+                                                if (compare_hash_inputs(&aux->fl, &rth->fl))
+                                                        break;
+                                                aux = aux->u.dst.rt_next;
+                                        }
                                         continue;
                                 }
-                        } else if (!rt_may_expire(rth, tmo, ip_rt_gc_timeout)) {
-                                tmo >>= 1;
-                                rthp = &rth->u.dst.rt_next;
-                                if ((*rthp == NULL) ||
-                                    !compare_hash_inputs(&(*rthp)->fl,
-                                                         &rth->fl))
-                                        length += ONE;
-                                continue;
-                        }
+                        } else if (!rt_may_expire(rth, tmo, ip_rt_gc_timeout))
+                                goto nofree;
 
                         /* Cleanup aged off entries. */
                         *rthp = rth->u.dst.rt_next;
@@ -1068,7 +1067,6 @@ out:	return 0;
 static int rt_intern_hash(unsigned hash, struct rtable *rt, struct rtable **rp)
 {
         struct rtable   *rth, **rthp;
-        struct rtable   *rthi;
         unsigned long   now;
         struct rtable *cand, **candp;
         u32             min_score;
@@ -1088,7 +1086,6 @@ restart:
         }
 
         rthp = &rt_hash_table[hash].chain;
-        rthi = NULL;
 
         spin_lock_bh(rt_hash_lock_addr(hash));
         while ((rth = *rthp) != NULL) {
@@ -1134,17 +1131,6 @@ restart:
                 chain_length++;
 
                 rthp = &rth->u.dst.rt_next;
-
-                /*
-                 * check to see if the next entry in the chain
-                 * contains the same hash input values as rt.  If it does
-                 * This is where we will insert into the list, instead of
-                 * at the head.  This groups entries that differ by aspects not
-                 * relvant to the hash function together, which we use to adjust
-                 * our chain length
-                 */
-                if (*rthp && compare_hash_inputs(&(*rthp)->fl, &rt->fl))
-                        rthi = rth;
         }
 
         if (cand) {
@@ -1205,10 +1191,7 @@ restart:
                 }
         }
 
-        if (rthi)
-                rt->u.dst.rt_next = rthi->u.dst.rt_next;
-        else
-                rt->u.dst.rt_next = rt_hash_table[hash].chain;
+        rt->u.dst.rt_next = rt_hash_table[hash].chain;
 
 #if RT_CACHE_DEBUG >= 2
         if (rt->u.dst.rt_next) {
@@ -1224,10 +1207,7 @@ restart:
          * previous writes to rt are comitted to memory
          * before making rt visible to other CPUS.
          */
-        if (rthi)
-                rcu_assign_pointer(rthi->u.dst.rt_next, rt);
-        else
-                rcu_assign_pointer(rt_hash_table[hash].chain, rt);
+        rcu_assign_pointer(rt_hash_table[hash].chain, rt);
 
         spin_unlock_bh(rt_hash_lock_addr(hash));
         *rp = rt;
diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
index 1d7f49c6f0ca..7a0f0b27bf1f 100644
--- a/net/ipv4/tcp.c
+++ b/net/ipv4/tcp.c
@@ -1321,6 +1321,7 @@ int tcp_recvmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
         struct task_struct *user_recv = NULL;
         int copied_early = 0;
         struct sk_buff *skb;
+        u32 urg_hole = 0;
 
         lock_sock(sk);
 
@@ -1532,7 +1533,8 @@ do_prequeue:
                                 }
                         }
                 }
-                if ((flags & MSG_PEEK) && peek_seq != tp->copied_seq) {
+                if ((flags & MSG_PEEK) &&
+                    (peek_seq - copied - urg_hole != tp->copied_seq)) {
                         if (net_ratelimit())
                                 printk(KERN_DEBUG "TCP(%s:%d): Application bug, race in MSG_PEEK.\n",
                                        current->comm, task_pid_nr(current));
@@ -1553,6 +1555,7 @@ do_prequeue:
                                 if (!urg_offset) {
                                         if (!sock_flag(sk, SOCK_URGINLINE)) {
                                                 ++*seq;
+                                                urg_hole++;
                                                 offset++;
                                                 used--;
                                                 if (!used)
diff --git a/net/ipv4/tcp_vegas.c b/net/ipv4/tcp_vegas.c
index a453aac91bd3..c6743eec9b7d 100644
--- a/net/ipv4/tcp_vegas.c
+++ b/net/ipv4/tcp_vegas.c
@@ -158,6 +158,11 @@ void tcp_vegas_cwnd_event(struct sock *sk, enum tcp_ca_event event)
 }
 EXPORT_SYMBOL_GPL(tcp_vegas_cwnd_event);
 
+static inline u32 tcp_vegas_ssthresh(struct tcp_sock *tp)
+{
+        return  min(tp->snd_ssthresh, tp->snd_cwnd-1);
+}
+
 static void tcp_vegas_cong_avoid(struct sock *sk, u32 ack, u32 in_flight)
 {
         struct tcp_sock *tp = tcp_sk(sk);
@@ -221,11 +226,10 @@ static void tcp_vegas_cong_avoid(struct sock *sk, u32 ack, u32 in_flight)
                          */
                         diff = tp->snd_cwnd * (rtt-vegas->baseRTT) / vegas->baseRTT;
 
-                        if (diff > gamma && tp->snd_ssthresh > 2 ) {
+                        if (diff > gamma && tp->snd_cwnd <= tp->snd_ssthresh) {
                                 /* Going too fast. Time to slow down
                                  * and switch to congestion avoidance.
                                  */
-                                tp->snd_ssthresh = 2;
 
                                 /* Set cwnd to match the actual rate
                                  * exactly:
@@ -235,6 +239,7 @@ static void tcp_vegas_cong_avoid(struct sock *sk, u32 ack, u32 in_flight)
                                  * utilization.
                                  */
                                 tp->snd_cwnd = min(tp->snd_cwnd, (u32)target_cwnd+1);
+                                tp->snd_ssthresh = tcp_vegas_ssthresh(tp);
 
                         } else if (tp->snd_cwnd <= tp->snd_ssthresh) {
                                 /* Slow start.  */
@@ -250,6 +255,8 @@ static void tcp_vegas_cong_avoid(struct sock *sk, u32 ack, u32 in_flight)
                                          * we slow down.
                                          */
                                         tp->snd_cwnd--;
+                                        tp->snd_ssthresh
+                                                = tcp_vegas_ssthresh(tp);
                                 } else if (diff < alpha) {
                                         /* We don't have enough extra packets
                                          * in the network, so speed up.
diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index 1394ddb6e35c..032a5ec391c5 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -137,6 +137,7 @@ static struct rt6_info ip6_null_entry_template = {
                 }
         },
         .rt6i_flags     = (RTF_REJECT | RTF_NONEXTHOP),
+        .rt6i_protocol  = RTPROT_KERNEL,
         .rt6i_metric    = ~(u32) 0,
         .rt6i_ref       = ATOMIC_INIT(1),
 };
@@ -159,6 +160,7 @@ static struct rt6_info ip6_prohibit_entry_template = {
                 }
         },
         .rt6i_flags     = (RTF_REJECT | RTF_NONEXTHOP),
+        .rt6i_protocol  = RTPROT_KERNEL,
         .rt6i_metric    = ~(u32) 0,
         .rt6i_ref       = ATOMIC_INIT(1),
 };
@@ -176,6 +178,7 @@ static struct rt6_info ip6_blk_hole_entry_template = {
                 }
         },
         .rt6i_flags     = (RTF_REJECT | RTF_NONEXTHOP),
+        .rt6i_protocol  = RTPROT_KERNEL,
         .rt6i_metric    = ~(u32) 0,
         .rt6i_ref       = ATOMIC_INIT(1),
 };
diff --git a/net/mac80211/rc80211_minstrel.c b/net/mac80211/rc80211_minstrel.c
index 70df3dcc3cf6..d9233ec50610 100644
--- a/net/mac80211/rc80211_minstrel.c
+++ b/net/mac80211/rc80211_minstrel.c
@@ -477,7 +477,7 @@ minstrel_alloc_sta(void *priv, struct ieee80211_sta *sta, gfp_t gfp)
 
         for (i = 0; i < IEEE80211_NUM_BANDS; i++) {
                 sband = hw->wiphy->bands[i];
-                if (sband->n_bitrates > max_rates)
+                if (sband && sband->n_bitrates > max_rates)
                         max_rates = sband->n_bitrates;
         }
 
diff --git a/net/mac80211/rc80211_pid_algo.c b/net/mac80211/rc80211_pid_algo.c
index 01d59a8e334c..8bef9a1262ff 100644
--- a/net/mac80211/rc80211_pid_algo.c
+++ b/net/mac80211/rc80211_pid_algo.c
@@ -378,7 +378,7 @@ static void *rate_control_pid_alloc(struct ieee80211_hw *hw,
 
         for (i = 0; i < IEEE80211_NUM_BANDS; i++) {
                 sband = hw->wiphy->bands[i];
-                if (sband->n_bitrates > max_rates)
+                if (sband && sband->n_bitrates > max_rates)
                         max_rates = sband->n_bitrates;
         }
 
diff --git a/net/netfilter/nf_conntrack_proto_dccp.c b/net/netfilter/nf_conntrack_proto_dccp.c
index 8e757dd53396..aee0d6bea309 100644
--- a/net/netfilter/nf_conntrack_proto_dccp.c
+++ b/net/netfilter/nf_conntrack_proto_dccp.c
@@ -22,6 +22,7 @@
 #include <linux/netfilter/nfnetlink_conntrack.h>
 #include <net/netfilter/nf_conntrack.h>
 #include <net/netfilter/nf_conntrack_l4proto.h>
+#include <net/netfilter/nf_conntrack_ecache.h>
 #include <net/netfilter/nf_log.h>
 
 static DEFINE_RWLOCK(dccp_lock);
@@ -553,6 +554,9 @@ static int dccp_packet(struct nf_conn *ct, const struct sk_buff *skb,
         ct->proto.dccp.state = new_state;
         write_unlock_bh(&dccp_lock);
 
+        if (new_state != old_state)
+                nf_conntrack_event_cache(IPCT_PROTOINFO, ct);
+
         dn = dccp_pernet(net);
         nf_ct_refresh_acct(ct, ctinfo, skb, dn->dccp_timeout[new_state]);
 
diff --git a/net/netfilter/nf_conntrack_proto_tcp.c b/net/netfilter/nf_conntrack_proto_tcp.c
index b5ccf2b4b2e7..97a6e93d742e 100644
--- a/net/netfilter/nf_conntrack_proto_tcp.c
+++ b/net/netfilter/nf_conntrack_proto_tcp.c
@@ -634,6 +634,14 @@ static bool tcp_in_window(const struct nf_conn *ct,
                         sender->td_end = end;
                         sender->flags |= IP_CT_TCP_FLAG_DATA_UNACKNOWLEDGED;
                 }
+                if (tcph->ack) {
+                        if (!(sender->flags & IP_CT_TCP_FLAG_MAXACK_SET)) {
+                                sender->td_maxack = ack;
+                                sender->flags |= IP_CT_TCP_FLAG_MAXACK_SET;
+                        } else if (after(ack, sender->td_maxack))
+                                sender->td_maxack = ack;
+                }
+
                 /*
                  * Update receiver data.
                  */
@@ -919,6 +927,16 @@ static int tcp_packet(struct nf_conn *ct,
                 return -NF_ACCEPT;
         case TCP_CONNTRACK_CLOSE:
                 if (index == TCP_RST_SET
+                    && (ct->proto.tcp.seen[!dir].flags & IP_CT_TCP_FLAG_MAXACK_SET)
+                    && before(ntohl(th->seq), ct->proto.tcp.seen[!dir].td_maxack)) {
+                        /* Invalid RST  */
+                        write_unlock_bh(&tcp_lock);
+                        if (LOG_INVALID(net, IPPROTO_TCP))
+                                nf_log_packet(pf, 0, skb, NULL, NULL, NULL,
+                                          "nf_ct_tcp: invalid RST ");
+                        return -NF_ACCEPT;
+                }
+                if (index == TCP_RST_SET
                     && ((test_bit(IPS_SEEN_REPLY_BIT, &ct->status)
                          && ct->proto.tcp.last_index == TCP_SYN_SET)
                         || (!test_bit(IPS_ASSURED_BIT, &ct->status)
diff --git a/net/netfilter/nfnetlink_log.c b/net/netfilter/nfnetlink_log.c
index fd326ac27ec8..66a6dd5c519a 100644
--- a/net/netfilter/nfnetlink_log.c
+++ b/net/netfilter/nfnetlink_log.c
@@ -581,6 +581,12 @@ nfulnl_log_packet(u_int8_t pf,
                 + nla_total_size(sizeof(struct nfulnl_msg_packet_hw))
                 + nla_total_size(sizeof(struct nfulnl_msg_packet_timestamp));
 
+        if (in && skb_mac_header_was_set(skb)) {
+                size +=   nla_total_size(skb->dev->hard_header_len)
+                        + nla_total_size(sizeof(u_int16_t))     /* hwtype */
+                        + nla_total_size(sizeof(u_int16_t));    /* hwlen */
+        }
+
         spin_lock_bh(&inst->lock);
 
         if (inst->flags & NFULNL_CFG_F_SEQ)
diff --git a/net/netfilter/xt_hashlimit.c b/net/netfilter/xt_hashlimit.c
index a5b5369c30f9..219dcdbe388c 100644
--- a/net/netfilter/xt_hashlimit.c
+++ b/net/netfilter/xt_hashlimit.c
@@ -926,7 +926,7 @@ static int dl_seq_show(struct seq_file *s, void *v)
         if (!hlist_empty(&htable->hash[*bucket])) {
                 hlist_for_each_entry(ent, pos, &htable->hash[*bucket], node)
                         if (dl_seq_real_show(ent, htable->family, s))
-                                return 1;
+                                return -1;
         }
         return 0;
 }
diff --git a/net/rxrpc/ar-connection.c b/net/rxrpc/ar-connection.c
index 0f1218b8d289..67e38a056240 100644
--- a/net/rxrpc/ar-connection.c
+++ b/net/rxrpc/ar-connection.c
@@ -343,9 +343,9 @@ static int rxrpc_connect_exclusive(struct rxrpc_sock *rx,
                 /* not yet present - create a candidate for a new connection
                  * and then redo the check */
                 conn = rxrpc_alloc_connection(gfp);
-                if (IS_ERR(conn)) {
-                        _leave(" = %ld", PTR_ERR(conn));
-                        return PTR_ERR(conn);
+                if (!conn) {
+                        _leave(" = -ENOMEM");
+                        return -ENOMEM;
                 }
 
                 conn->trans = trans;
@@ -508,9 +508,9 @@ int rxrpc_connect_call(struct rxrpc_sock *rx,
                 /* not yet present - create a candidate for a new connection and then
                  * redo the check */
                 candidate = rxrpc_alloc_connection(gfp);
-                if (IS_ERR(candidate)) {
-                        _leave(" = %ld", PTR_ERR(candidate));
-                        return PTR_ERR(candidate);
+                if (!candidate) {
+                        _leave(" = -ENOMEM");
+                        return -ENOMEM;
                 }
 
                 candidate->trans = trans;
diff --git a/net/sched/cls_api.c b/net/sched/cls_api.c
index 0759f32e9dca..09cdcdfe7e91 100644
--- a/net/sched/cls_api.c
+++ b/net/sched/cls_api.c
@@ -135,6 +135,7 @@ static int tc_ctl_tfilter(struct sk_buff *skb, struct nlmsghdr *n, void *arg)
         unsigned long cl;
         unsigned long fh;
         int err;
+        int tp_created = 0;
 
         if (net != &init_net)
                 return -EINVAL;
@@ -266,10 +267,7 @@ replay:
                         goto errout;
                 }
 
-                spin_lock_bh(root_lock);
-                tp->next = *back;
-                *back = tp;
-                spin_unlock_bh(root_lock);
+                tp_created = 1;
 
         } else if (tca[TCA_KIND] && nla_strcmp(tca[TCA_KIND], tp->ops->kind))
                 goto errout;
@@ -296,8 +294,11 @@ replay:
                 switch (n->nlmsg_type) {
                 case RTM_NEWTFILTER:
                         err = -EEXIST;
-                        if (n->nlmsg_flags & NLM_F_EXCL)
+                        if (n->nlmsg_flags & NLM_F_EXCL) {
+                                if (tp_created)
+                                        tcf_destroy(tp);
                                 goto errout;
+                        }
                         break;
                 case RTM_DELTFILTER:
                         err = tp->ops->delete(tp, fh);
@@ -314,8 +315,18 @@ replay:
         }
 
         err = tp->ops->change(tp, cl, t->tcm_handle, tca, &fh);
-        if (err == 0)
+        if (err == 0) {
+                if (tp_created) {
+                        spin_lock_bh(root_lock);
+                        tp->next = *back;
+                        *back = tp;
+                        spin_unlock_bh(root_lock);
+                }
                 tfilter_notify(skb, n, tp, fh, RTM_NEWTFILTER);
+        } else {
+                if (tp_created)
+                        tcf_destroy(tp);
+        }
 
 errout:
         if (cl)
diff --git a/net/sched/cls_cgroup.c b/net/sched/cls_cgroup.c
index 91a3db4a76f8..e5becb92b3e7 100644
--- a/net/sched/cls_cgroup.c
+++ b/net/sched/cls_cgroup.c
@@ -104,8 +104,7 @@ static int cls_cgroup_classify(struct sk_buff *skb, struct tcf_proto *tp,
                                struct tcf_result *res)
 {
         struct cls_cgroup_head *head = tp->root;
-        struct cgroup_cls_state *cs;
-        int ret = 0;
+        u32 classid;
 
         /*
          * Due to the nature of the classifier it is required to ignore all
@@ -121,17 +120,18 @@ static int cls_cgroup_classify(struct sk_buff *skb, struct tcf_proto *tp,
                 return -1;
 
         rcu_read_lock();
-        cs = task_cls_state(current);
-        if (cs->classid && tcf_em_tree_match(skb, &head->ematches, NULL)) {
-                res->classid = cs->classid;
-                res->class = 0;
-                ret = tcf_exts_exec(skb, &head->exts, res);
-        } else
-                ret = -1;
-
+        classid = task_cls_state(current)->classid;
         rcu_read_unlock();
 
-        return ret;
+        if (!classid)
+                return -1;
+
+        if (!tcf_em_tree_match(skb, &head->ematches, NULL))
+                return -1;
+
+        res->classid = classid;
+        res->class = 0;
+        return tcf_exts_exec(skb, &head->exts, res);
 }
 
 static unsigned long cls_cgroup_get(struct tcf_proto *tp, u32 handle)
@@ -167,6 +167,9 @@ static int cls_cgroup_change(struct tcf_proto *tp, unsigned long base,
         struct tcf_exts e;
         int err;
 
+        if (!tca[TCA_OPTIONS])
+                return -EINVAL;
+
         if (head == NULL) {
                 if (!handle)
                         return -EINVAL;
diff --git a/net/sched/sch_teql.c b/net/sched/sch_teql.c
index ec697cebb63b..3b6418297231 100644
--- a/net/sched/sch_teql.c
+++ b/net/sched/sch_teql.c
@@ -303,6 +303,8 @@ restart:
                 switch (teql_resolve(skb, skb_res, slave)) {
                 case 0:
                         if (__netif_tx_trylock(slave_txq)) {
+                                unsigned int length = qdisc_pkt_len(skb);
+
                                 if (!netif_tx_queue_stopped(slave_txq) &&
                                     !netif_tx_queue_frozen(slave_txq) &&
                                     slave_ops->ndo_start_xmit(skb, slave) == 0) {
@@ -310,8 +312,7 @@ restart:
                                         master->slaves = NEXT_SLAVE(q);
                                         netif_wake_queue(dev);
                                         master->stats.tx_packets++;
-                                        master->stats.tx_bytes +=
-                                                qdisc_pkt_len(skb);
+                                        master->stats.tx_bytes += length;
                                         return 0;
                                 }
                                 __netif_tx_unlock(slave_txq);
diff --git a/net/sunrpc/svcsock.c b/net/sunrpc/svcsock.c
index af3198814c15..9d504234af4a 100644
--- a/net/sunrpc/svcsock.c
+++ b/net/sunrpc/svcsock.c
@@ -345,6 +345,7 @@ static void svc_sock_setbufsize(struct socket *sock, unsigned int snd,
         lock_sock(sock->sk);
         sock->sk->sk_sndbuf = snd * 2;
         sock->sk->sk_rcvbuf = rcv * 2;
+        sock->sk->sk_userlocks |= SOCK_SNDBUF_LOCK|SOCK_RCVBUF_LOCK;
         release_sock(sock->sk);
 #endif
 }
@@ -796,6 +797,23 @@ static int svc_tcp_recvfrom(struct svc_rqst *rqstp)
                 test_bit(XPT_CONN, &svsk->sk_xprt.xpt_flags),
                 test_bit(XPT_CLOSE, &svsk->sk_xprt.xpt_flags));
 
+        if (test_and_clear_bit(XPT_CHNGBUF, &svsk->sk_xprt.xpt_flags))
+                /* sndbuf needs to have room for one request
+                 * per thread, otherwise we can stall even when the
+                 * network isn't a bottleneck.
+                 *
+                 * We count all threads rather than threads in a
+                 * particular pool, which provides an upper bound
+                 * on the number of threads which will access the socket.
+                 *
+                 * rcvbuf just needs to be able to hold a few requests.
+                 * Normally they will be removed from the queue
+                 * as soon a a complete request arrives.
+                 */
+                svc_sock_setbufsize(svsk->sk_sock,
+                                    (serv->sv_nrthreads+3) * serv->sv_max_mesg,
+                                    3 * serv->sv_max_mesg);
+
         clear_bit(XPT_DATA, &svsk->sk_xprt.xpt_flags);
 
         /* Receive data. If we haven't got the record length yet, get
@@ -1043,6 +1061,15 @@ static void svc_tcp_init(struct svc_sock *svsk, struct svc_serv *serv)
 
                 tcp_sk(sk)->nonagle |= TCP_NAGLE_OFF;
 
+                /* initialise setting must have enough space to
+                 * receive and respond to one request.
+                 * svc_tcp_recvfrom will re-adjust if necessary
+                 */
+                svc_sock_setbufsize(svsk->sk_sock,
+                                    3 * svsk->sk_xprt.xpt_server->sv_max_mesg,
+                                    3 * svsk->sk_xprt.xpt_server->sv_max_mesg);
+
+                set_bit(XPT_CHNGBUF, &svsk->sk_xprt.xpt_flags);
                 set_bit(XPT_DATA, &svsk->sk_xprt.xpt_flags);
                 if (sk->sk_state != TCP_ESTABLISHED)
                         set_bit(XPT_CLOSE, &svsk->sk_xprt.xpt_flags);
@@ -1112,14 +1139,8 @@ static struct svc_sock *svc_setup_socket(struct svc_serv *serv,
         /* Initialize the socket */
         if (sock->type == SOCK_DGRAM)
                 svc_udp_init(svsk, serv);
-        else {
-                /* initialise setting must have enough space to
-                 * receive and respond to one request.
-                 */
-                svc_sock_setbufsize(svsk->sk_sock, 4 * serv->sv_max_mesg,
-                                        4 * serv->sv_max_mesg);
+        else
                 svc_tcp_init(svsk, serv);
-        }
 
         dprintk("svc: svc_setup_socket created %p (inet %p)\n",
                                 svsk, svsk->sk_sk);
diff --git a/net/sunrpc/xprtrdma/svc_rdma_recvfrom.c b/net/sunrpc/xprtrdma/svc_rdma_recvfrom.c
index 629a28764da9..42a6f9f20285 100644
--- a/net/sunrpc/xprtrdma/svc_rdma_recvfrom.c
+++ b/net/sunrpc/xprtrdma/svc_rdma_recvfrom.c
@@ -265,7 +265,7 @@ static int fast_reg_read_chunks(struct svcxprt_rdma *xprt,
                 frmr->page_list->page_list[page_no] =
                         ib_dma_map_single(xprt->sc_cm_id->device,
                                           page_address(rqstp->rq_arg.pages[page_no]),
-                                          PAGE_SIZE, DMA_TO_DEVICE);
+                                          PAGE_SIZE, DMA_FROM_DEVICE);
                 if (ib_dma_mapping_error(xprt->sc_cm_id->device,
                                          frmr->page_list->page_list[page_no]))
                         goto fatal_err;
diff --git a/net/sunrpc/xprtrdma/svc_rdma_sendto.c b/net/sunrpc/xprtrdma/svc_rdma_sendto.c
index 6c26a675435a..f11be72a1a80 100644
--- a/net/sunrpc/xprtrdma/svc_rdma_sendto.c
+++ b/net/sunrpc/xprtrdma/svc_rdma_sendto.c
@@ -128,7 +128,8 @@ static int fast_reg_xdr(struct svcxprt_rdma *xprt,
                 page_bytes -= sge_bytes;
 
                 frmr->page_list->page_list[page_no] =
-                        ib_dma_map_page(xprt->sc_cm_id->device, page, 0,
+                        ib_dma_map_single(xprt->sc_cm_id->device,
+                                          page_address(page),
                                           PAGE_SIZE, DMA_TO_DEVICE);
                 if (ib_dma_mapping_error(xprt->sc_cm_id->device,
                                          frmr->page_list->page_list[page_no]))
@@ -183,6 +184,7 @@ static int fast_reg_xdr(struct svcxprt_rdma *xprt,
 
  fatal_err:
         printk("svcrdma: Error fast registering memory for xprt %p\n", xprt);
+        vec->frmr = NULL;
         svc_rdma_put_frmr(xprt, frmr);
         return -EIO;
 }
@@ -516,6 +518,7 @@ static int send_reply(struct svcxprt_rdma *rdma,
                        "svcrdma: could not post a receive buffer, err=%d."
                        "Closing transport %p.\n", ret, rdma);
                 set_bit(XPT_CLOSE, &rdma->sc_xprt.xpt_flags);
+                svc_rdma_put_frmr(rdma, vec->frmr);
                 svc_rdma_put_context(ctxt, 0);
                 return -ENOTCONN;
         }
@@ -530,18 +533,17 @@ static int send_reply(struct svcxprt_rdma *rdma,
                 clear_bit(RDMACTXT_F_FAST_UNREG, &ctxt->flags);
 
         /* Prepare the SGE for the RPCRDMA Header */
+        ctxt->sge[0].lkey = rdma->sc_dma_lkey;
+        ctxt->sge[0].length = svc_rdma_xdr_get_reply_hdr_len(rdma_resp);
         ctxt->sge[0].addr =
-                ib_dma_map_page(rdma->sc_cm_id->device,
-                                page, 0, PAGE_SIZE, DMA_TO_DEVICE);
+                ib_dma_map_single(rdma->sc_cm_id->device, page_address(page),
+                                  ctxt->sge[0].length, DMA_TO_DEVICE);
         if (ib_dma_mapping_error(rdma->sc_cm_id->device, ctxt->sge[0].addr))
                 goto err;
         atomic_inc(&rdma->sc_dma_used);
 
         ctxt->direction = DMA_TO_DEVICE;
 
-        ctxt->sge[0].length = svc_rdma_xdr_get_reply_hdr_len(rdma_resp);
-        ctxt->sge[0].lkey = rdma->sc_dma_lkey;
-
         /* Determine how many of our SGE are to be transmitted */
         for (sge_no = 1; byte_count && sge_no < vec->count; sge_no++) {
                 sge_bytes = min_t(size_t, vec->sge[sge_no].iov_len, byte_count);
@@ -606,6 +608,7 @@ static int send_reply(struct svcxprt_rdma *rdma,
         return 0;
 
  err:
+        svc_rdma_unmap_dma(ctxt);
         svc_rdma_put_frmr(rdma, vec->frmr);
         svc_rdma_put_context(ctxt, 1);
         return -EIO;
diff --git a/net/sunrpc/xprtrdma/svc_rdma_transport.c b/net/sunrpc/xprtrdma/svc_rdma_transport.c
index 3d810e7df3fb..5151f9f6c573 100644
--- a/net/sunrpc/xprtrdma/svc_rdma_transport.c
+++ b/net/sunrpc/xprtrdma/svc_rdma_transport.c
@@ -500,8 +500,8 @@ int svc_rdma_post_recv(struct svcxprt_rdma *xprt)
                 BUG_ON(sge_no >= xprt->sc_max_sge);
                 page = svc_rdma_get_page();
                 ctxt->pages[sge_no] = page;
-                pa = ib_dma_map_page(xprt->sc_cm_id->device,
-                                     page, 0, PAGE_SIZE,
+                pa = ib_dma_map_single(xprt->sc_cm_id->device,
+                                     page_address(page), PAGE_SIZE,
                                      DMA_FROM_DEVICE);
                 if (ib_dma_mapping_error(xprt->sc_cm_id->device, pa))
                         goto err_put_ctxt;
@@ -520,8 +520,9 @@ int svc_rdma_post_recv(struct svcxprt_rdma *xprt)
         svc_xprt_get(&xprt->sc_xprt);
         ret = ib_post_recv(xprt->sc_qp, &recv_wr, &bad_recv_wr);
         if (ret) {
-                svc_xprt_put(&xprt->sc_xprt);
+                svc_rdma_unmap_dma(ctxt);
                 svc_rdma_put_context(ctxt, 1);
+                svc_xprt_put(&xprt->sc_xprt);
         }
         return ret;
 
@@ -1314,8 +1315,8 @@ void svc_rdma_send_error(struct svcxprt_rdma *xprt, struct rpcrdma_msg *rmsgp,
         length = svc_rdma_xdr_encode_error(xprt, rmsgp, err, va);
 
         /* Prepare SGE for local address */
-        sge.addr = ib_dma_map_page(xprt->sc_cm_id->device,
-                                   p, 0, PAGE_SIZE, DMA_FROM_DEVICE);
+        sge.addr = ib_dma_map_single(xprt->sc_cm_id->device,
+                                   page_address(p), PAGE_SIZE, DMA_FROM_DEVICE);
         if (ib_dma_mapping_error(xprt->sc_cm_id->device, sge.addr)) {
                 put_page(p);
                 return;
@@ -1342,7 +1343,7 @@ void svc_rdma_send_error(struct svcxprt_rdma *xprt, struct rpcrdma_msg *rmsgp,
         if (ret) {
                 dprintk("svcrdma: Error %d posting send for protocol error\n",
                         ret);
-                ib_dma_unmap_page(xprt->sc_cm_id->device,
+                ib_dma_unmap_single(xprt->sc_cm_id->device,
                                   sge.addr, PAGE_SIZE,
                                   DMA_FROM_DEVICE);
                 svc_rdma_put_context(ctxt, 1);
diff --git a/net/sunrpc/xprtrdma/verbs.c b/net/sunrpc/xprtrdma/verbs.c
index 3b21e0cc5e69..465aafc2007f 100644
--- a/net/sunrpc/xprtrdma/verbs.c
+++ b/net/sunrpc/xprtrdma/verbs.c
@@ -1495,7 +1495,8 @@ rpcrdma_register_frmr_external(struct rpcrdma_mr_seg *seg,
         frmr_wr.wr.fast_reg.page_shift = PAGE_SHIFT;
         frmr_wr.wr.fast_reg.length = i << PAGE_SHIFT;
         frmr_wr.wr.fast_reg.access_flags = (writing ?
-                                IB_ACCESS_REMOTE_WRITE : IB_ACCESS_REMOTE_READ);
+                                IB_ACCESS_REMOTE_WRITE | IB_ACCESS_LOCAL_WRITE :
+                                IB_ACCESS_REMOTE_READ);
         frmr_wr.wr.fast_reg.rkey = seg1->mr_chunk.rl_mw->r.frmr.fr_mr->rkey;
         DECR_CQCOUNT(&r_xprt->rx_ep);
 
diff --git a/net/wireless/reg.c b/net/wireless/reg.c
index 08265ca15785..487cb627ddba 100644
--- a/net/wireless/reg.c
+++ b/net/wireless/reg.c
@@ -1551,6 +1551,13 @@ static int regulatory_hint_core(const char *alpha2)
 
         queue_regulatory_request(request);
 
+        /*
+         * This ensures last_request is populated once modules
+         * come swinging in and calling regulatory hints and
+         * wiphy_apply_custom_regulatory().
+         */
+        flush_scheduled_work();
+
         return 0;
 }
 
diff --git a/net/wireless/wext.c b/net/wireless/wext.c
index cb6a5bb85d80..0e59f9ae9b81 100644
--- a/net/wireless/wext.c
+++ b/net/wireless/wext.c
@@ -786,6 +786,13 @@ static int ioctl_standard_iw_point(struct iw_point *iwp, unsigned int cmd,
                         err = -EFAULT;
                         goto out;
                 }
+
+                if (cmd == SIOCSIWENCODEEXT) {
+                        struct iw_encode_ext *ee = (void *) extra;
+
+                        if (iwp->length < sizeof(*ee) + ee->key_len)
+                                return -EFAULT;
+                }
         }
 
         err = handler(dev, info, (union iwreq_data *) iwp, extra);