85 files changed, 1015 insertions, 1023 deletions
diff --git a/net/802/tr.c b/net/802/tr.c
index a755e880f4ba..1bb7dc1b85cd 100644
--- a/net/802/tr.c
+++ b/net/802/tr.c
@@ -251,10 +251,11 @@ void tr_source_route(struct sk_buff *skb,struct trh_hdr *trh,struct net_device *
        unsigned int hash;
        struct rif_cache *entry;
        unsigned char *olddata;
+        unsigned long flags;
        static const unsigned char mcast_func_addr[] 
                = {0xC0,0x00,0x00,0x04,0x00,0x00};
        
-        spin_lock_bh(&rif_lock);
+        spin_lock_irqsave(&rif_lock, flags);
        /*
         *      Broadcasts are single route as stated in RFC 1042 
@@ -323,7 +324,7 @@ printk("source routing for %02X:%02X:%02X:%02X:%02X:%02X\n",trh->daddr[0],
        else 
                slack = 18 - ((ntohs(trh->rcf) & TR_RCF_LEN_MASK)>>8);
        olddata = skb->data;
-        spin_unlock_bh(&rif_lock);
+        spin_unlock_irqrestore(&rif_lock, flags);
        skb_pull(skb, slack);
        memmove(skb->data, olddata, sizeof(struct trh_hdr) - slack);
@@ -337,10 +338,11 @@ printk("source routing for %02X:%02X:%02X:%02X:%02X:%02X\n",trh->daddr[0],
 static void tr_add_rif_info(struct trh_hdr *trh, struct net_device *dev)
 {
        unsigned int hash, rii_p = 0;
+        unsigned long flags;
        struct rif_cache *entry;
-        spin_lock_bh(&rif_lock);
+        spin_lock_irqsave(&rif_lock, flags);
        
        /*
         *      Firstly see if the entry exists
@@ -378,7 +380,7 @@ printk("adding rif_entry: addr:%02X:%02X:%02X:%02X:%02X:%02X rcf:%04X\n",
                if(!entry) 
                {
                        printk(KERN_DEBUG "tr.c: Couldn't malloc rif cache entry !\n");
-                        spin_unlock_bh(&rif_lock);
+                        spin_unlock_irqrestore(&rif_lock, flags);
                        return;
                }
@@ -420,7 +422,7 @@ printk("updating rif_entry: addr:%02X:%02X:%02X:%02X:%02X:%02X rcf:%04X\n",
                    }                                         
                entry->last_used=jiffies;               
        }
-        spin_unlock_bh(&rif_lock);
+        spin_unlock_irqrestore(&rif_lock, flags);
 }
 /*
@@ -430,9 +432,9 @@ printk("updating rif_entry: addr:%02X:%02X:%02X:%02X:%02X:%02X rcf:%04X\n",
 static void rif_check_expire(unsigned long dummy) 
 {
        int i;
-        unsigned long next_interval = jiffies + sysctl_tr_rif_timeout/2;
+        unsigned long flags, next_interval = jiffies + sysctl_tr_rif_timeout/2;
-        spin_lock_bh(&rif_lock);
+        spin_lock_irqsave(&rif_lock, flags);
        
        for(i =0; i < RIF_TABLE_SIZE; i++) {
                struct rif_cache *entry, **pentry;
@@ -454,7 +456,7 @@ static void rif_check_expire(unsigned long dummy)
                }
        }
        
-        spin_unlock_bh(&rif_lock);
+        spin_unlock_irqrestore(&rif_lock, flags);
        mod_timer(&rif_timer, next_interval);
@@ -485,7 +487,7 @@ static struct rif_cache *rif_get_idx(loff_t pos)
 static void *rif_seq_start(struct seq_file *seq, loff_t *pos)
 {
-        spin_lock_bh(&rif_lock);
+        spin_lock_irq(&rif_lock);
        return *pos ? rif_get_idx(*pos - 1) : SEQ_START_TOKEN;
 }
@@ -516,7 +518,7 @@ static void *rif_seq_next(struct seq_file *seq, void *v, loff_t *pos)
 static void rif_seq_stop(struct seq_file *seq, void *v)
 {
-        spin_unlock_bh(&rif_lock);
+        spin_unlock_irq(&rif_lock);
 }
 static int rif_seq_show(struct seq_file *seq, void *v)
diff --git a/net/Kconfig b/net/Kconfig
index 2684e809a649..40a31ba86d2c 100644
--- a/net/Kconfig
+++ b/net/Kconfig
@@ -209,22 +209,6 @@ endmenu
 endmenu
-config NETPOLL
-        def_bool NETCONSOLE
-config NETPOLL_RX
-        bool "Netpoll support for trapping incoming packets"
-        default n
-        depends on NETPOLL
-config NETPOLL_TRAP
-        bool "Netpoll traffic trapping"
-        default n
-        depends on NETPOLL
-config NET_POLL_CONTROLLER
-        def_bool NETPOLL
 source "net/ax25/Kconfig"
 source "net/irda/Kconfig"
 source "net/bluetooth/Kconfig"
diff --git a/net/atm/Kconfig b/net/atm/Kconfig
index bea2426229b1..21ff276b2d80 100644
--- a/net/atm/Kconfig
+++ b/net/atm/Kconfig
@@ -60,7 +60,7 @@ config ATM_BR2684
        tristate "RFC1483/2684 Bridged protocols"
        depends on ATM && INET
        help
-          ATM PVCs can carry ethernet PDUs according to rfc2684 (formerly 1483)
+          ATM PVCs can carry ethernet PDUs according to RFC2684 (formerly 1483)
          This device will act like an ethernet from the kernels point of view,
          with the traffic being carried by ATM PVCs (currently 1 PVC/device).
          This is sometimes used over DSL lines.  If in doubt, say N.
@@ -69,6 +69,6 @@ config ATM_BR2684_IPFILTER
        bool "Per-VC IP filter kludge"
        depends on ATM_BR2684
        help
-          This is an experimental mechanism for users who need to terminating a
+          This is an experimental mechanism for users who need to terminate a
          large number of IP-only vcc's.  Do not enable this unless you are sure
          you know what you are doing.
diff --git a/net/atm/svc.c b/net/atm/svc.c
index 02f5374a51f2..08e46052a3e4 100644
--- a/net/atm/svc.c
+++ b/net/atm/svc.c
@@ -118,10 +118,6 @@ static int svc_bind(struct socket *sock,struct sockaddr *sockaddr,
                goto out;
        }
        vcc = ATM_SD(sock);
-        if (test_bit(ATM_VF_SESSION, &vcc->flags)) {
-                error = -EINVAL;
-                goto out;
-        }
        addr = (struct sockaddr_atmsvc *) sockaddr;
        if (addr->sas_family != AF_ATMSVC) {
                error = -EAFNOSUPPORT;
diff --git a/net/ax25/af_ax25.c b/net/ax25/af_ax25.c
index 707097deac3d..a5c94f11547c 100644
--- a/net/ax25/af_ax25.c
+++ b/net/ax25/af_ax25.c
@@ -875,12 +875,7 @@ struct sock *ax25_make_new(struct sock *osk, struct ax25_dev *ax25_dev)
        sk->sk_sndbuf   = osk->sk_sndbuf;
        sk->sk_state    = TCP_ESTABLISHED;
        sk->sk_sleep    = osk->sk_sleep;
+        sock_copy_flags(sk, osk);
-        if (sock_flag(osk, SOCK_DBG))
-                sock_set_flag(sk, SOCK_DBG);
-        if (sock_flag(osk, SOCK_ZAPPED))
-                sock_set_flag(sk, SOCK_ZAPPED);
        oax25 = ax25_sk(osk);
@@ -1007,7 +1002,8 @@ static int ax25_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
        struct sock *sk = sock->sk;
        struct full_sockaddr_ax25 *addr = (struct full_sockaddr_ax25 *)uaddr;
        ax25_dev *ax25_dev = NULL;
-        ax25_address *call;
+        ax25_uid_assoc *user;
+        ax25_address call;
        ax25_cb *ax25;
        int err = 0;
@@ -1026,9 +1022,15 @@ static int ax25_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
        if (addr->fsa_ax25.sax25_family != AF_AX25)
                return -EINVAL;
-        call = ax25_findbyuid(current->euid);
+        user = ax25_findbyuid(current->euid);
-        if (call == NULL && ax25_uid_policy && !capable(CAP_NET_ADMIN)) {
+        if (user) {
-                return -EACCES;
+                call = user->call;
+                ax25_uid_put(user);
+        } else {
+                if (ax25_uid_policy && !capable(CAP_NET_ADMIN))
+                        return -EACCES;
+                call = addr->fsa_ax25.sax25_call;
        }
        lock_sock(sk);
@@ -1039,10 +1041,7 @@ static int ax25_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
                goto out;
        }
-        if (call == NULL)
+        ax25->source_addr = call;
-                ax25->source_addr = addr->fsa_ax25.sax25_call;
-        else
-                ax25->source_addr = *call;
        /*
         * User already set interface with SO_BINDTODEVICE
diff --git a/net/ax25/ax25_route.c b/net/ax25/ax25_route.c
index 44b99b1ff9f8..c288526da4ce 100644
--- a/net/ax25/ax25_route.c
+++ b/net/ax25/ax25_route.c
@@ -422,8 +422,8 @@ static inline void ax25_adjust_path(ax25_address *addr, ax25_digi *digipeat)
 */
 int ax25_rt_autobind(ax25_cb *ax25, ax25_address *addr)
 {
+        ax25_uid_assoc *user;
        ax25_route *ax25_rt;
-        ax25_address *call;
        int err;
        if ((ax25_rt = ax25_get_route(addr, NULL)) == NULL)
@@ -434,16 +434,18 @@ int ax25_rt_autobind(ax25_cb *ax25, ax25_address *addr)
                goto put;
        }
-        if ((call = ax25_findbyuid(current->euid)) == NULL) {
+        user = ax25_findbyuid(current->euid);
+        if (user) {
+                ax25->source_addr = user->call;
+                ax25_uid_put(user);
+        } else {
                if (ax25_uid_policy && !capable(CAP_NET_BIND_SERVICE)) {
                        err = -EPERM;
                        goto put;
                }
-                call = (ax25_address *)ax25->ax25_dev->dev->dev_addr;
+                ax25->source_addr = *(ax25_address *)ax25->ax25_dev->dev->dev_addr;
        }
-        ax25->source_addr = *call;
        if (ax25_rt->digipeat != NULL) {
                if ((ax25->digipeat = kmalloc(sizeof(ax25_digi), GFP_ATOMIC)) == NULL) {
                        err = -ENOMEM;
diff --git a/net/ax25/ax25_uid.c b/net/ax25/ax25_uid.c
index cea6b7d19729..a8b3822f3ee4 100644
--- a/net/ax25/ax25_uid.c
+++ b/net/ax25/ax25_uid.c
@@ -28,6 +28,7 @@
 #include <linux/fcntl.h>
 #include <linux/mm.h>
 #include <linux/interrupt.h>
+#include <linux/list.h>
 #include <linux/notifier.h>
 #include <linux/proc_fs.h>
 #include <linux/seq_file.h>
@@ -41,38 +42,41 @@
 *      Callsign/UID mapper. This is in kernel space for security on multi-amateur machines.
 */
-static ax25_uid_assoc *ax25_uid_list;
+HLIST_HEAD(ax25_uid_list);
 static DEFINE_RWLOCK(ax25_uid_lock);
 int ax25_uid_policy = 0;
-ax25_address *ax25_findbyuid(uid_t uid)
+ax25_uid_assoc *ax25_findbyuid(uid_t uid)
 {
-        ax25_uid_assoc *ax25_uid;
+        ax25_uid_assoc *ax25_uid, *res = NULL;
-        ax25_address *res = NULL;
+        struct hlist_node *node;
        read_lock(&ax25_uid_lock);
-        for (ax25_uid = ax25_uid_list; ax25_uid != NULL; ax25_uid = ax25_uid->next) {
+        ax25_uid_for_each(ax25_uid, node, &ax25_uid_list) {
                if (ax25_uid->uid == uid) {
-                        res = &ax25_uid->call;
+                        ax25_uid_hold(ax25_uid);
+                        res = ax25_uid;
                        break;
                }
        }
        read_unlock(&ax25_uid_lock);
-        return NULL;
+        return res;
 }
 int ax25_uid_ioctl(int cmd, struct sockaddr_ax25 *sax)
 {
-        ax25_uid_assoc *s, *ax25_uid;
+        ax25_uid_assoc *ax25_uid;
+        struct hlist_node *node;
+        ax25_uid_assoc *user;
        unsigned long res;
        switch (cmd) {
        case SIOCAX25GETUID:
                res = -ENOENT;
                read_lock(&ax25_uid_lock);
-                for (ax25_uid = ax25_uid_list; ax25_uid != NULL; ax25_uid = ax25_uid->next) {
+                ax25_uid_for_each(ax25_uid, node, &ax25_uid_list) {
                        if (ax25cmp(&sax->sax25_call, &ax25_uid->call) == 0) {
                                res = ax25_uid->uid;
                                break;
@@ -85,19 +89,22 @@ int ax25_uid_ioctl(int cmd, struct sockaddr_ax25 *sax)
        case SIOCAX25ADDUID:
                if (!capable(CAP_NET_ADMIN))
                        return -EPERM;
-                if (ax25_findbyuid(sax->sax25_uid))
+                user = ax25_findbyuid(sax->sax25_uid);
+                if (user) {
+                        ax25_uid_put(user);
                        return -EEXIST;
+                }
                if (sax->sax25_uid == 0)
                        return -EINVAL;
                if ((ax25_uid = kmalloc(sizeof(*ax25_uid), GFP_KERNEL)) == NULL)
                        return -ENOMEM;
+                atomic_set(&ax25_uid->refcount, 1);
                ax25_uid->uid  = sax->sax25_uid;
                ax25_uid->call = sax->sax25_call;
                write_lock(&ax25_uid_lock);
-                ax25_uid->next = ax25_uid_list;
+                hlist_add_head(&ax25_uid->uid_node, &ax25_uid_list);
-                ax25_uid_list  = ax25_uid;
                write_unlock(&ax25_uid_lock);
                return 0;
@@ -106,34 +113,21 @@ int ax25_uid_ioctl(int cmd, struct sockaddr_ax25 *sax)
                if (!capable(CAP_NET_ADMIN))
                        return -EPERM;
+                ax25_uid = NULL;
                write_lock(&ax25_uid_lock);
-                for (ax25_uid = ax25_uid_list; ax25_uid != NULL; ax25_uid = ax25_uid->next) {
+                ax25_uid_for_each(ax25_uid, node, &ax25_uid_list) {
-                        if (ax25cmp(&sax->sax25_call, &ax25_uid->call) == 0) {
+                        if (ax25cmp(&sax->sax25_call, &ax25_uid->call) == 0)
                                break;
-                        }
                }
                if (ax25_uid == NULL) {
                        write_unlock(&ax25_uid_lock);
                        return -ENOENT;
                }
-                if ((s = ax25_uid_list) == ax25_uid) {
+                hlist_del_init(&ax25_uid->uid_node);
-                        ax25_uid_list = s->next;
+                ax25_uid_put(ax25_uid);
-                        write_unlock(&ax25_uid_lock);
-                        kfree(ax25_uid);
-                        return 0;
-                }
-                while (s != NULL && s->next != NULL) {
-                        if (s->next == ax25_uid) {
-                                s->next = ax25_uid->next;
-                                write_unlock(&ax25_uid_lock);
-                                kfree(ax25_uid);
-                                return 0;
-                        }
-                        s = s->next;
-                }
                write_unlock(&ax25_uid_lock);
-                return -ENOENT;
+                return 0;
        default:
                return -EINVAL;
@@ -147,13 +141,11 @@ int ax25_uid_ioctl(int cmd, struct sockaddr_ax25 *sax)
 static void *ax25_uid_seq_start(struct seq_file *seq, loff_t *pos)
 {
        struct ax25_uid_assoc *pt;
-        int i = 1;
+        struct hlist_node *node;
+        int i = 0;
        read_lock(&ax25_uid_lock);
-        if (*pos == 0)
+        ax25_uid_for_each(pt, node, &ax25_uid_list) {
-                return SEQ_START_TOKEN;
-        for (pt = ax25_uid_list; pt != NULL; pt = pt->next) {
                if (i == *pos)
                        return pt;
                ++i;
@@ -164,8 +156,9 @@ static void *ax25_uid_seq_start(struct seq_file *seq, loff_t *pos)
 static void *ax25_uid_seq_next(struct seq_file *seq, void *v, loff_t *pos)
 {
        ++*pos;
-        return (v == SEQ_START_TOKEN) ? ax25_uid_list : 
-                ((struct ax25_uid_assoc *) v)->next;
+        return hlist_entry(((ax25_uid_assoc *)v)->uid_node.next,
+                           ax25_uid_assoc, uid_node);
 }
 static void ax25_uid_seq_stop(struct seq_file *seq, void *v)
@@ -179,7 +172,6 @@ static int ax25_uid_seq_show(struct seq_file *seq, void *v)
                seq_printf(seq, "Policy: %d\n", ax25_uid_policy);
        else {
                struct ax25_uid_assoc *pt = v;
-                
                seq_printf(seq, "%6d %s\n", pt->uid, ax2asc(&pt->call));
        }
@@ -213,16 +205,13 @@ struct file_operations ax25_uid_fops = {
 */
 void __exit ax25_uid_free(void)
 {
-        ax25_uid_assoc *s, *ax25_uid;
+        ax25_uid_assoc *ax25_uid;
+        struct hlist_node *node;
        write_lock(&ax25_uid_lock);
-        ax25_uid = ax25_uid_list;
+        ax25_uid_for_each(ax25_uid, node, &ax25_uid_list) {
-        while (ax25_uid != NULL) {
+                hlist_del_init(&ax25_uid->uid_node);
-                s        = ax25_uid;
+                ax25_uid_put(ax25_uid);
-                ax25_uid = ax25_uid->next;
-                kfree(s);
        }
-        ax25_uid_list = NULL;
        write_unlock(&ax25_uid_lock);
 }
diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c
index fb5524365bc2..ffa26c10bfe8 100644
--- a/net/bluetooth/hci_core.c
+++ b/net/bluetooth/hci_core.c
@@ -299,7 +299,6 @@ struct hci_dev *hci_dev_get(int index)
        read_unlock(&hci_dev_list_lock);
        return hdev;
 }
-EXPORT_SYMBOL(hci_dev_get);
 /* ---- Inquiry support ---- */
 static void inquiry_cache_flush(struct hci_dev *hdev)
@@ -1042,7 +1041,6 @@ int hci_send_cmd(struct hci_dev *hdev, __u16 ogf, __u16 ocf, __u32 plen, void *p
        return 0;
 }
-EXPORT_SYMBOL(hci_send_cmd);
 /* Get data from the previously sent command */
 void *hci_sent_cmd_data(struct hci_dev *hdev, __u16 ogf, __u16 ocf)
diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c
index c4b592b4ef10..46367bd129c3 100644
--- a/net/bluetooth/hci_event.c
+++ b/net/bluetooth/hci_event.c
@@ -1035,9 +1035,11 @@ void hci_si_event(struct hci_dev *hdev, int type, int dlen, void *data)
        ev->type = type;
        memcpy(ev->data, data, dlen);
+        bt_cb(skb)->incoming = 1;
+        do_gettimeofday(&skb->stamp);
        skb->pkt_type = HCI_EVENT_PKT;
        skb->dev = (void *) hdev;
        hci_send_to_sock(hdev, skb);
        kfree_skb(skb);
 }
-EXPORT_SYMBOL(hci_si_event);
diff --git a/net/bluetooth/lib.c b/net/bluetooth/lib.c
index 9efb0a093612..ee6a66979913 100644
--- a/net/bluetooth/lib.c
+++ b/net/bluetooth/lib.c
@@ -34,31 +34,6 @@
 #include <net/bluetooth/bluetooth.h>
-void bt_dump(char *pref, __u8 *buf, int count)
-{
-        char *ptr;
-        char line[100];
-        unsigned int i;
-        printk(KERN_INFO "%s: dump, len %d\n", pref, count);
-        ptr = line;
-        *ptr = 0;
-        for (i = 0; i < count; i++) {
-                ptr += sprintf(ptr, " %2.2X", buf[i]);
-                if (i && !((i + 1) % 20)) {
-                        printk(KERN_INFO "%s:%s\n", pref, line);
-                        ptr = line;
-                        *ptr = 0;
-                }
-        }
-        if (line[0])
-                printk(KERN_INFO "%s:%s\n", pref, line);
-}
-EXPORT_SYMBOL(bt_dump);
 void baswap(bdaddr_t *dst, bdaddr_t *src)
 {
        unsigned char *d = (unsigned char *) dst;
diff --git a/net/bluetooth/rfcomm/core.c b/net/bluetooth/rfcomm/core.c
index e9e6fda66f1a..27bf5047cd33 100644
--- a/net/bluetooth/rfcomm/core.c
+++ b/net/bluetooth/rfcomm/core.c
@@ -389,8 +389,6 @@ static int __rfcomm_dlc_close(struct rfcomm_dlc *d, int err)
                rfcomm_dlc_unlock(d);
                skb_queue_purge(&d->tx_queue);
-                rfcomm_session_put(s);
                rfcomm_dlc_unlink(d);
        }
@@ -600,8 +598,6 @@ static struct rfcomm_session *rfcomm_session_create(bdaddr_t *src, bdaddr_t *dst
                goto failed;
        }
-        rfcomm_session_hold(s);
        s->initiator = 1;
        bacpy(&addr.l2_bdaddr, dst);
diff --git a/net/bridge/netfilter/Kconfig b/net/bridge/netfilter/Kconfig
index 68ccef507b49..c70b3be23026 100644
--- a/net/bridge/netfilter/Kconfig
+++ b/net/bridge/netfilter/Kconfig
@@ -138,7 +138,7 @@ config BRIDGE_EBT_VLAN
 #
 config BRIDGE_EBT_ARPREPLY
        tristate "ebt: arp reply target support"
-        depends on BRIDGE_NF_EBTABLES
+        depends on BRIDGE_NF_EBTABLES && INET
        help
          This option adds the arp reply target, which allows
          automatically sending arp replies to arp requests.
diff --git a/net/compat.c b/net/compat.c
index be5d936dc423..d99ab9695893 100644
--- a/net/compat.c
+++ b/net/compat.c
@@ -91,20 +91,11 @@ int verify_compat_iovec(struct msghdr *kern_msg, struct iovec *kern_iov,
        } else
                kern_msg->msg_name = NULL;
-        if(kern_msg->msg_iovlen > UIO_FASTIOV) {
-                kern_iov = kmalloc(kern_msg->msg_iovlen * sizeof(struct iovec),
-                                   GFP_KERNEL);
-                if(!kern_iov)
-                        return -ENOMEM;
-        }
        tot_len = iov_from_user_compat_to_kern(kern_iov,
                                          (struct compat_iovec __user *)kern_msg->msg_iov,
                                          kern_msg->msg_iovlen);
        if(tot_len >= 0)
                kern_msg->msg_iov = kern_iov;
-        else if(kern_msg->msg_iovlen > UIO_FASTIOV)
-                kfree(kern_iov);
        return tot_len;
 }
diff --git a/net/core/Makefile b/net/core/Makefile
index 5e0c56b7f607..f5f5e58943e8 100644
--- a/net/core/Makefile
+++ b/net/core/Makefile
@@ -7,9 +7,10 @@ obj-y := sock.o request_sock.o skbuff.o iovec.o datagram.o stream.o scm.o \
 obj-$(CONFIG_SYSCTL) += sysctl_net_core.o
-obj-y                += flow.o dev.o ethtool.o dev_mcast.o dst.o \
+obj-y                += dev.o ethtool.o dev_mcast.o dst.o \
                        neighbour.o rtnetlink.o utils.o link_watch.o filter.o
+obj-$(CONFIG_XFRM) += flow.o
 obj-$(CONFIG_SYSFS) += net-sysfs.o
 obj-$(CONFIG_NETFILTER) += netfilter.o
 obj-$(CONFIG_NET_DIVERT) += dv.o
diff --git a/net/core/dev.c b/net/core/dev.c
index ff9dc029233a..faf59b02c4bf 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -901,8 +901,7 @@ int dev_close(struct net_device *dev)
        smp_mb__after_clear_bit(); /* Commit netif_running(). */
        while (test_bit(__LINK_STATE_RX_SCHED, &dev->state)) {
                /* No hurry. */
-                current->state = TASK_INTERRUPTIBLE;
+                msleep(1);
-                schedule_timeout(1);
        }
        /*
@@ -1697,7 +1696,8 @@ static void net_rx_action(struct softirq_action *h)
        struct softnet_data *queue = &__get_cpu_var(softnet_data);
        unsigned long start_time = jiffies;
        int budget = netdev_budget;
-        
+        void *have;
        local_irq_disable();
        while (!list_empty(&queue->poll_list)) {
@@ -1710,10 +1710,10 @@ static void net_rx_action(struct softirq_action *h)
                dev = list_entry(queue->poll_list.next,
                                 struct net_device, poll_list);
-                netpoll_poll_lock(dev);
+                have = netpoll_poll_lock(dev);
                if (dev->quota <= 0 || dev->poll(dev, &budget)) {
-                        netpoll_poll_unlock(dev);
+                        netpoll_poll_unlock(have);
                        local_irq_disable();
                        list_del(&dev->poll_list);
                        list_add_tail(&dev->poll_list, &queue->poll_list);
@@ -1722,7 +1722,7 @@ static void net_rx_action(struct softirq_action *h)
                        else
                                dev->quota = dev->weight;
                } else {
-                        netpoll_poll_unlock(dev);
+                        netpoll_poll_unlock(have);
                        dev_put(dev);
                        local_irq_disable();
                }
diff --git a/net/core/dst.c b/net/core/dst.c
index fc434ade5270..334790da9f16 100644
--- a/net/core/dst.c
+++ b/net/core/dst.c
@@ -45,6 +45,7 @@ static struct timer_list dst_gc_timer =
 static void dst_run_gc(unsigned long dummy)
 {
        int    delayed = 0;
+        int    work_performed;
        struct dst_entry * dst, **dstp;
        if (!spin_trylock(&dst_lock)) {
@@ -52,9 +53,9 @@ static void dst_run_gc(unsigned long dummy)
                return;
        }
        del_timer(&dst_gc_timer);
        dstp = &dst_garbage_list;
+        work_performed = 0;
        while ((dst = *dstp) != NULL) {
                if (atomic_read(&dst->__refcnt)) {
                        dstp = &dst->next;
@@ -62,6 +63,7 @@ static void dst_run_gc(unsigned long dummy)
                        continue;
                }
                *dstp = dst->next;
+                work_performed = 1;
                dst = dst_destroy(dst);
                if (dst) {
@@ -86,9 +88,14 @@ static void dst_run_gc(unsigned long dummy)
                dst_gc_timer_inc = DST_GC_MAX;
                goto out;
        }
-        if ((dst_gc_timer_expires += dst_gc_timer_inc) > DST_GC_MAX)
+        if (!work_performed) {
-                dst_gc_timer_expires = DST_GC_MAX;
+                if ((dst_gc_timer_expires += dst_gc_timer_inc) > DST_GC_MAX)
-        dst_gc_timer_inc += DST_GC_INC;
+                        dst_gc_timer_expires = DST_GC_MAX;
+                dst_gc_timer_inc += DST_GC_INC;
+        } else {
+                dst_gc_timer_inc = DST_GC_INC;
+                dst_gc_timer_expires = DST_GC_MIN;
+        }
        dst_gc_timer.expires = jiffies + dst_gc_timer_expires;
 #if RT_CACHE_DEBUG >= 2
        printk("dst_total: %d/%d %ld\n",
diff --git a/net/core/netpoll.c b/net/core/netpoll.c
index c327c9edadc5..a1a9a7abff50 100644
--- a/net/core/netpoll.c
+++ b/net/core/netpoll.c
@@ -33,6 +33,7 @@
 #define MAX_UDP_CHUNK 1460
 #define MAX_SKBS 32
 #define MAX_QUEUE_DEPTH (MAX_SKBS / 2)
+#define MAX_RETRIES 20000
 static DEFINE_SPINLOCK(skb_list_lock);
 static int nr_skbs;
@@ -248,14 +249,14 @@ static void netpoll_send_skb(struct netpoll *np, struct sk_buff *skb)
        int status;
        struct netpoll_info *npinfo;
-repeat:
+        if (!np || !np->dev || !netif_running(np->dev)) {
-        if(!np || !np->dev || !netif_running(np->dev)) {
                __kfree_skb(skb);
                return;
        }
-        /* avoid recursion */
        npinfo = np->dev->npinfo;
+        /* avoid recursion */
        if (npinfo->poll_owner == smp_processor_id() ||
            np->dev->xmit_lock_owner == smp_processor_id()) {
                if (np->drop)
@@ -265,30 +266,37 @@ repeat:
                return;
        }
-        spin_lock(&np->dev->xmit_lock);
+        do {
-        np->dev->xmit_lock_owner = smp_processor_id();
+                npinfo->tries--;
+                spin_lock(&np->dev->xmit_lock);
+                np->dev->xmit_lock_owner = smp_processor_id();
-        /*
+                /*
-         * network drivers do not expect to be called if the queue is
+                 * network drivers do not expect to be called if the queue is
-         * stopped.
+                 * stopped.
-         */
+                 */
-        if (netif_queue_stopped(np->dev)) {
+                if (netif_queue_stopped(np->dev)) {
+                        np->dev->xmit_lock_owner = -1;
+                        spin_unlock(&np->dev->xmit_lock);
+                        netpoll_poll(np);
+                        udelay(50);
+                        continue;
+                }
+                status = np->dev->hard_start_xmit(skb, np->dev);
                np->dev->xmit_lock_owner = -1;
                spin_unlock(&np->dev->xmit_lock);
-                netpoll_poll(np);
+                /* success */
-                goto repeat;
+                if(!status) {
-        }
+                        npinfo->tries = MAX_RETRIES; /* reset */
+                        return;
-        status = np->dev->hard_start_xmit(skb, np->dev);
+                }
-        np->dev->xmit_lock_owner = -1;
-        spin_unlock(&np->dev->xmit_lock);
-        /* transmit busy */
+                /* transmit busy */
-        if(status) {
                netpoll_poll(np);
-                goto repeat;
+                udelay(50);
-        }
+        } while (npinfo->tries > 0);
 }
 void netpoll_send_udp(struct netpoll *np, const char *msg, int len)
@@ -349,15 +357,11 @@ static void arp_reply(struct sk_buff *skb)
        unsigned char *arp_ptr;
        int size, type = ARPOP_REPLY, ptype = ETH_P_ARP;
        u32 sip, tip;
-        unsigned long flags;
        struct sk_buff *send_skb;
        struct netpoll *np = NULL;
-        spin_lock_irqsave(&npinfo->rx_lock, flags);
        if (npinfo->rx_np && npinfo->rx_np->dev == skb->dev)
                np = npinfo->rx_np;
-        spin_unlock_irqrestore(&npinfo->rx_lock, flags);
        if (!np)
                return;
@@ -639,9 +643,11 @@ int netpoll_setup(struct netpoll *np)
                if (!npinfo)
                        goto release;
+                npinfo->rx_flags = 0;
                npinfo->rx_np = NULL;
                npinfo->poll_lock = SPIN_LOCK_UNLOCKED;
                npinfo->poll_owner = -1;
+                npinfo->tries = MAX_RETRIES;
                npinfo->rx_lock = SPIN_LOCK_UNLOCKED;
        } else
                npinfo = ndev->npinfo;
@@ -718,9 +724,16 @@ int netpoll_setup(struct netpoll *np)
                npinfo->rx_np = np;
                spin_unlock_irqrestore(&npinfo->rx_lock, flags);
        }
+        /* fill up the skb queue */
+        refill_skbs();
        /* last thing to do is link it to the net device structure */
        ndev->npinfo = npinfo;
+        /* avoid racing with NAPI reading npinfo */
+        synchronize_rcu();
        return 0;
 release:
diff --git a/net/core/pktgen.c b/net/core/pktgen.c
index 975d651312dc..8eb083b6041a 100644
--- a/net/core/pktgen.c
+++ b/net/core/pktgen.c
@@ -363,7 +363,7 @@ struct pktgen_thread {
 * All Rights Reserved.
 *
 */
-inline static s64 divremdi3(s64 x, s64 y, int type) 
+static inline s64 divremdi3(s64 x, s64 y, int type)
 {
        u64 a = (x < 0) ? -x : x;
        u64 b = (y < 0) ? -y : y;
diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index d9f7b06fe886..7eab867ede59 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -377,8 +377,8 @@ struct sk_buff *skb_clone(struct sk_buff *skb, unsigned int __nocast gfp_mask)
        C(tc_index);
 #ifdef CONFIG_NET_CLS_ACT
        n->tc_verd = SET_TC_VERD(skb->tc_verd,0);
-        n->tc_verd = CLR_TC_OK2MUNGE(skb->tc_verd);
+        n->tc_verd = CLR_TC_OK2MUNGE(n->tc_verd);
-        n->tc_verd = CLR_TC_MUNGED(skb->tc_verd);
+        n->tc_verd = CLR_TC_MUNGED(n->tc_verd);
        C(input_dev);
        C(tc_classid);
 #endif
diff --git a/net/core/sock.c b/net/core/sock.c
index 8b35ccdc2b3b..12f6d9a2a522 100644
--- a/net/core/sock.c
+++ b/net/core/sock.c
@@ -206,13 +206,14 @@ int sock_setsockopt(struct socket *sock, int level, int optname,
         */
 #ifdef SO_DONTLINGER            /* Compatibility item... */
-        switch (optname) {
+        if (optname == SO_DONTLINGER) {
-                case SO_DONTLINGER:
+                lock_sock(sk);
-                        sock_reset_flag(sk, SOCK_LINGER);
+                sock_reset_flag(sk, SOCK_LINGER);
-                        return 0;
+                release_sock(sk);
+                return 0;
        }
-#endif  
+#endif
-                
+        
        if(optlen<sizeof(int))
                return(-EINVAL);
        
diff --git a/net/core/utils.c b/net/core/utils.c
index e11a8654f363..88eb8b68e26b 100644
--- a/net/core/utils.c
+++ b/net/core/utils.c
@@ -23,10 +23,10 @@
 #include <linux/percpu.h>
 #include <linux/init.h>
+#include <asm/byteorder.h>
 #include <asm/system.h>
 #include <asm/uaccess.h>
 /*
  This is a maximally equidistributed combined Tausworthe generator
  based on code from GNU Scientific Library 1.5 (30 Jun 2004)
@@ -153,3 +153,38 @@ int net_ratelimit(void)
 EXPORT_SYMBOL(net_random);
 EXPORT_SYMBOL(net_ratelimit);
 EXPORT_SYMBOL(net_srandom);
+/*
+ * Convert an ASCII string to binary IP.
+ * This is outside of net/ipv4/ because various code that uses IP addresses
+ * is otherwise not dependent on the TCP/IP stack.
+ */
+__u32 in_aton(const char *str)
+{
+        unsigned long l;
+        unsigned int val;
+        int i;
+        l = 0;
+        for (i = 0; i < 4; i++)
+        {
+                l <<= 8;
+                if (*str != '\0')
+                {
+                        val = 0;
+                        while (*str != '\0' && *str != '.')
+                        {
+                                val *= 10;
+                                val += *str - '0';
+                                str++;
+                        }
+                        l |= val;
+                        if (*str != '\0')
+                                str++;
+                }
+        }
+        return(htonl(l));
+}
+EXPORT_SYMBOL(in_aton);
diff --git a/net/decnet/af_decnet.c b/net/decnet/af_decnet.c
index 96a02800cd28..acdd18e6adb2 100644
--- a/net/decnet/af_decnet.c
+++ b/net/decnet/af_decnet.c
@@ -1876,15 +1876,6 @@ static inline unsigned int dn_current_mss(struct sock *sk, int flags)
        return mss_now;
 }
-static int dn_error(struct sock *sk, int flags, int err)
-{
-        if (err == -EPIPE)
-                err = sock_error(sk) ? : -EPIPE;
-        if (err == -EPIPE && !(flags & MSG_NOSIGNAL))
-                send_sig(SIGPIPE, current, 0);
-        return err;
-}
 static int dn_sendmsg(struct kiocb *iocb, struct socket *sock,
           struct msghdr *msg, size_t size)
 {
@@ -2045,7 +2036,7 @@ out:
        return sent ? sent : err;
 out_err:
-        err = dn_error(sk, flags, err);
+        err = sk_stream_error(sk, flags, err);
        release_sock(sk);
        return err;
 }
diff --git a/net/decnet/dn_neigh.c b/net/decnet/dn_neigh.c
index f32dba9e26fe..8d0cc3cf3e49 100644
--- a/net/decnet/dn_neigh.c
+++ b/net/decnet/dn_neigh.c
@@ -148,12 +148,12 @@ static int dn_neigh_construct(struct neighbour *neigh)
        __neigh_parms_put(neigh->parms);
        neigh->parms = neigh_parms_clone(parms);
-        rcu_read_unlock();
        if (dn_db->use_long)
                neigh->ops = &dn_long_ops;
        else
                neigh->ops = &dn_short_ops;
+        rcu_read_unlock();
        if (dn->flags & DN_NDFLAG_P3)
                neigh->ops = &dn_phase3_ops;
diff --git a/net/ipv4/Kconfig b/net/ipv4/Kconfig
index df5386885a90..0b3d9f1d8069 100644
--- a/net/ipv4/Kconfig
+++ b/net/ipv4/Kconfig
@@ -54,9 +54,9 @@ config IP_ADVANCED_ROUTER
 choice 
        prompt "Choose IP: FIB lookup algorithm (choose FIB_HASH if unsure)"
        depends on IP_ADVANCED_ROUTER
-        default IP_FIB_HASH
+        default ASK_IP_FIB_HASH
-config IP_FIB_HASH
+config ASK_IP_FIB_HASH
        bool "FIB_HASH"
        ---help---
        Current FIB is very proven and good enough for most users.
@@ -82,12 +82,8 @@ config IP_FIB_TRIE
       
 endchoice
-# If the user does not enable advanced routing, he gets the safe
-# default of the fib-hash algorithm.
 config IP_FIB_HASH
-        bool
+        def_bool ASK_IP_FIB_HASH || !IP_ADVANCED_ROUTER
-        depends on !IP_ADVANCED_ROUTER
-        default y
 config IP_MULTIPLE_TABLES
        bool "IP: policy routing"
@@ -128,7 +124,7 @@ config IP_ROUTE_MULTIPATH
 config IP_ROUTE_MULTIPATH_CACHED
        bool "IP: equal cost multipath with caching support (EXPERIMENTAL)"
-        depends on: IP_ROUTE_MULTIPATH
+        depends on IP_ROUTE_MULTIPATH
        help
          Normally, equal cost multipath routing is not supported by the
          routing cache. If you say Y here, alternative routes are cached
@@ -239,7 +235,6 @@ config IP_PNP_RARP
 #   bool '    IP: ARP support' CONFIG_IP_PNP_ARP                
 config NET_IPIP
        tristate "IP: tunneling"
-        select INET_TUNNEL
        ---help---
          Tunneling means encapsulating data of one protocol type within
          another protocol and sending it over a channel that understands the
@@ -256,7 +251,6 @@ config NET_IPIP
 config NET_IPGRE
        tristate "IP: GRE tunnels over IP"
-        select XFRM
        help
          Tunneling means encapsulating data of one protocol type within
          another protocol and sending it over a channel that understands the
diff --git a/net/ipv4/Makefile b/net/ipv4/Makefile
index 5718cdb3a61e..55dc6cca1e7b 100644
--- a/net/ipv4/Makefile
+++ b/net/ipv4/Makefile
@@ -2,7 +2,7 @@
 # Makefile for the Linux TCP/IP (INET) layer.
 #
-obj-y     := utils.o route.o inetpeer.o protocol.o \
+obj-y     := route.o inetpeer.o protocol.o \
             ip_input.o ip_fragment.o ip_forward.o ip_options.o \
             ip_output.o ip_sockglue.o \
             tcp.o tcp_input.o tcp_output.o tcp_timer.o tcp_ipv4.o \
diff --git a/net/ipv4/af_inet.c b/net/ipv4/af_inet.c
index ef7468376ae6..163ae4068b5f 100644
--- a/net/ipv4/af_inet.c
+++ b/net/ipv4/af_inet.c
@@ -1157,7 +1157,7 @@ static int __init ipv4_proc_init(void)
 #ifdef CONFIG_IP_FIB_TRIE
         if (fib_stat_proc_init())
                 goto out_fib_stat;
- #endif
+#endif
        if (ip_misc_proc_init())
                goto out_misc;
 out:
diff --git a/net/ipv4/fib_semantics.c b/net/ipv4/fib_semantics.c
index c886b28ba9f5..e278cb9d0075 100644
--- a/net/ipv4/fib_semantics.c
+++ b/net/ipv4/fib_semantics.c
@@ -593,10 +593,13 @@ static void fib_hash_move(struct hlist_head *new_info_hash,
                          struct hlist_head *new_laddrhash,
                          unsigned int new_size)
 {
+        struct hlist_head *old_info_hash, *old_laddrhash;
        unsigned int old_size = fib_hash_size;
-        unsigned int i;
+        unsigned int i, bytes;
        write_lock(&fib_info_lock);
+        old_info_hash = fib_info_hash;
+        old_laddrhash = fib_info_laddrhash;
        fib_hash_size = new_size;
        for (i = 0; i < old_size; i++) {
@@ -636,6 +639,10 @@ static void fib_hash_move(struct hlist_head *new_info_hash,
        fib_info_laddrhash = new_laddrhash;
        write_unlock(&fib_info_lock);
+        bytes = old_size * sizeof(struct hlist_head *);
+        fib_hash_free(old_info_hash, bytes);
+        fib_hash_free(old_laddrhash, bytes);
 }
 struct fib_info *
diff --git a/net/ipv4/fib_trie.c b/net/ipv4/fib_trie.c
index 4be234c7d8c3..45efd5f4741b 100644
--- a/net/ipv4/fib_trie.c
+++ b/net/ipv4/fib_trie.c
@@ -90,14 +90,14 @@ typedef unsigned int t_key;
 #define T_LEAF  1
 #define NODE_TYPE_MASK  0x1UL
 #define NODE_PARENT(_node) \
-((struct tnode *)((_node)->_parent & ~NODE_TYPE_MASK))
+        ((struct tnode *)((_node)->_parent & ~NODE_TYPE_MASK))
 #define NODE_SET_PARENT(_node, _ptr) \
-((_node)->_parent = (((unsigned long)(_ptr)) | \
+        ((_node)->_parent = (((unsigned long)(_ptr)) | \
                     ((_node)->_parent & NODE_TYPE_MASK)))
 #define NODE_INIT_PARENT(_node, _type) \
-((_node)->_parent = (_type))
+        ((_node)->_parent = (_type))
 #define NODE_TYPE(_node) \
-((_node)->_parent & NODE_TYPE_MASK)
+        ((_node)->_parent & NODE_TYPE_MASK)
 #define IS_TNODE(n) (!(n->_parent & T_LEAF))
 #define IS_LEAF(n) (n->_parent & T_LEAF)
@@ -147,7 +147,7 @@ struct trie_stat {
        unsigned int leaves;
        unsigned int nullpointers;
        unsigned int nodesizes[MAX_CHILDS];
-};    
+};
 struct trie {
        struct node *trie;
@@ -185,9 +185,9 @@ static void trie_bug(char *err)
        BUG();
 }
-static inline struct node *tnode_get_child(struct tnode *tn, int i) 
+static inline struct node *tnode_get_child(struct tnode *tn, int i)
 {
-        if (i >=  1<<tn->bits) 
+        if (i >= 1<<tn->bits)
                trie_bug("tnode_get_child");
        return tn->child[i];
@@ -202,7 +202,7 @@ static inline int tnode_child_length(struct tnode *tn)
  _________________________________________________________________
  | i | i | i | i | i | i | i | N | N | N | S | S | S | S | S | C |
  ----------------------------------------------------------------
-    0   1   2   3   4   5   6   7   8   9  10  11  12  13  14  15 
+    0   1   2   3   4   5   6   7   8   9  10  11  12  13  14  15
  _________________________________________________________________
  | C | C | C | u | u | u | u | u | u | u | u | u | u | u | u | u |
@@ -226,25 +226,25 @@ static inline t_key tkey_extract_bits(t_key a, int offset, int bits)
 static inline int tkey_equals(t_key a, t_key b)
 {
-  return a == b;
+        return a == b;
 }
 static inline int tkey_sub_equals(t_key a, int offset, int bits, t_key b)
 {
-     if (bits == 0 || offset >= KEYLENGTH)
+        if (bits == 0 || offset >= KEYLENGTH)
-            return 1;
+                return 1;
        bits = bits > KEYLENGTH ? KEYLENGTH : bits;
        return ((a ^ b) << offset) >> (KEYLENGTH - bits) == 0;
-}       
+}
 static inline int tkey_mismatch(t_key a, int offset, t_key b)
 {
        t_key diff = a ^ b;
        int i = offset;
-        if(!diff) 
+        if (!diff)
-          return 0;
+                return 0;
-        while((diff << i) >> (KEYLENGTH-1) == 0)
+        while ((diff << i) >> (KEYLENGTH-1) == 0)
                i++;
        return i;
 }
@@ -314,6 +314,7 @@ static void fn_free_alias(struct fib_alias *fa)
  The bits from (n->pos) to (n->pos + n->bits - 1) - "C" - are the index into 
  n's child array, and will of course be different for each child.
  
  The rest of the bits, from (n->pos + n->bits) onward, are completely unknown
  at this point.
@@ -321,7 +322,7 @@ static void fn_free_alias(struct fib_alias *fa)
 static void check_tnode(struct tnode *tn)
 {
-        if(tn && tn->pos+tn->bits > 32) {
+        if (tn && tn->pos+tn->bits > 32) {
                printk("TNODE ERROR tn=%p, pos=%d, bits=%d\n", tn, tn->pos, tn->bits);
        }
 }
@@ -332,7 +333,7 @@ static int inflate_threshold = 50;
 static struct leaf *leaf_new(void)
 {
        struct leaf *l = kmalloc(sizeof(struct leaf),  GFP_KERNEL);
-        if(l) {
+        if (l) {
                NODE_INIT_PARENT(l, T_LEAF);
                INIT_HLIST_HEAD(&l->list);
        }
@@ -342,7 +343,7 @@ static struct leaf *leaf_new(void)
 static struct leaf_info *leaf_info_new(int plen)
 {
        struct leaf_info *li = kmalloc(sizeof(struct leaf_info),  GFP_KERNEL);
-        if(li) {
+        if (li) {
                li->plen = plen;
                INIT_LIST_HEAD(&li->falh);
        }
@@ -365,7 +366,7 @@ static struct tnode *tnode_alloc(unsigned int size)
                return kmalloc(size, GFP_KERNEL);
        } else {
                return (struct tnode *)
-                       __get_free_pages(GFP_KERNEL, get_order(size));
+                        __get_free_pages(GFP_KERNEL, get_order(size));
        }
 }
@@ -386,7 +387,7 @@ static struct tnode* tnode_new(t_key key, int pos, int bits)
        int sz = sizeof(struct tnode) + nchildren * sizeof(struct node *);
        struct tnode *tn = tnode_alloc(sz);
-        if(tn)  {
+        if (tn)  {
                memset(tn, 0, sz);
                NODE_INIT_PARENT(tn, T_TNODE);
                tn->pos = pos;
@@ -395,7 +396,8 @@ static struct tnode* tnode_new(t_key key, int pos, int bits)
                tn->full_children = 0;
                tn->empty_children = 1<<bits;
        }
-        if(trie_debug > 0) 
+        if (trie_debug > 0)
                printk("AT %p s=%u %u\n", tn, (unsigned int) sizeof(struct tnode),
                       (unsigned int) (sizeof(struct node) * 1<<bits));
        return tn;
@@ -403,17 +405,17 @@ static struct tnode* tnode_new(t_key key, int pos, int bits)
 static void tnode_free(struct tnode *tn)
 {
-        if(!tn) {
+        if (!tn) {
                trie_bug("tnode_free\n");
        }
-        if(IS_LEAF(tn)) {
+        if (IS_LEAF(tn)) {
                free_leaf((struct leaf *)tn);
-                if(trie_debug > 0 ) 
+                if (trie_debug > 0 )
                        printk("FL %p \n", tn);
        }
-        else if(IS_TNODE(tn)) { 
+        else if (IS_TNODE(tn)) {
                __tnode_free(tn);
-                if(trie_debug > 0 ) 
+                if (trie_debug > 0 )
                        printk("FT %p \n", tn);
        }
        else {
@@ -428,58 +430,58 @@ static void tnode_free(struct tnode *tn)
 static inline int tnode_full(struct tnode *tn, struct node *n)
 {
-        if(n == NULL || IS_LEAF(n))
+        if (n == NULL || IS_LEAF(n))
                return 0;
        return ((struct tnode *) n)->pos == tn->pos + tn->bits;
 }
-static inline void put_child(struct trie *t, struct tnode *tn, int i, struct node *n) 
+static inline void put_child(struct trie *t, struct tnode *tn, int i, struct node *n)
 {
        tnode_put_child_reorg(tn, i, n, -1);
 }
- /* 
+ /*
  * Add a child at position i overwriting the old value.
  * Update the value of full_children and empty_children.
  */
-static void tnode_put_child_reorg(struct tnode *tn, int i, struct node *n, int wasfull) 
+static void tnode_put_child_reorg(struct tnode *tn, int i, struct node *n, int wasfull)
 {
        struct node *chi;
        int isfull;
-        if(i >=  1<<tn->bits) {
+        if (i >= 1<<tn->bits) {
                printk("bits=%d, i=%d\n", tn->bits, i);
                trie_bug("tnode_put_child_reorg bits");
        }
        write_lock_bh(&fib_lock);
-        chi = tn->child[i];     
+        chi = tn->child[i];
        /* update emptyChildren */
        if (n == NULL && chi != NULL)
                tn->empty_children++;
        else if (n != NULL && chi == NULL)
                tn->empty_children--;
-  
        /* update fullChildren */
        if (wasfull == -1)
                wasfull = tnode_full(tn, chi);
        isfull = tnode_full(tn, n);
-        if (wasfull && !isfull) 
+        if (wasfull && !isfull)
                tn->full_children--;
-        
-        else if (!wasfull && isfull) 
+        else if (!wasfull && isfull)
                tn->full_children++;
-        if(n) 
+        if (n)
-                NODE_SET_PARENT(n, tn); 
+                NODE_SET_PARENT(n, tn);
        tn->child[i] = n;
        write_unlock_bh(&fib_lock);
 }
-static struct node *resize(struct trie *t, struct tnode *tn) 
+static struct node *resize(struct trie *t, struct tnode *tn)
 {
        int i;
        int err = 0;
@@ -487,8 +489,8 @@ static struct node *resize(struct trie *t, struct tnode *tn)
        if (!tn)
                return NULL;
-        if(trie_debug) 
+        if (trie_debug)
-                printk("In tnode_resize %p inflate_threshold=%d threshold=%d\n", 
+                printk("In tnode_resize %p inflate_threshold=%d threshold=%d\n",
                      tn, inflate_threshold, halve_threshold);
        /* No children */
@@ -505,7 +507,7 @@ static struct node *resize(struct trie *t, struct tnode *tn)
                                /* compress one level */
                                struct node *n = tn->child[i];
-                                if(n)
+                                if (n)
                                        NODE_INIT_PARENT(n, NODE_TYPE(n));
                                write_unlock_bh(&fib_lock);
@@ -514,72 +516,72 @@ static struct node *resize(struct trie *t, struct tnode *tn)
                        }
                        write_unlock_bh(&fib_lock);
                }
-        /* 
+        /*
         * Double as long as the resulting node has a number of
         * nonempty nodes that are above the threshold.
         */
        /*
-         * From "Implementing a dynamic compressed trie" by Stefan Nilsson of 
+         * From "Implementing a dynamic compressed trie" by Stefan Nilsson of
-         * the Helsinki University of Technology and Matti Tikkanen of Nokia 
+         * the Helsinki University of Technology and Matti Tikkanen of Nokia
         * Telecommunications, page 6:
-         * "A node is doubled if the ratio of non-empty children to all 
+         * "A node is doubled if the ratio of non-empty children to all
         * children in the *doubled* node is at least 'high'."
         *
-         * 'high' in this instance is the variable 'inflate_threshold'. It 
+         * 'high' in this instance is the variable 'inflate_threshold'. It
-         * is expressed as a percentage, so we multiply it with 
+         * is expressed as a percentage, so we multiply it with
-         * tnode_child_length() and instead of multiplying by 2 (since the 
+         * tnode_child_length() and instead of multiplying by 2 (since the
-         * child array will be doubled by inflate()) and multiplying 
+         * child array will be doubled by inflate()) and multiplying
-         * the left-hand side by 100 (to handle the percentage thing) we 
+         * the left-hand side by 100 (to handle the percentage thing) we
         * multiply the left-hand side by 50.
-         * 
+         *
-         * The left-hand side may look a bit weird: tnode_child_length(tn) 
+         * The left-hand side may look a bit weird: tnode_child_length(tn)
-         * - tn->empty_children is of course the number of non-null children 
+         * - tn->empty_children is of course the number of non-null children
-         * in the current node. tn->full_children is the number of "full" 
+         * in the current node. tn->full_children is the number of "full"
         * children, that is non-null tnodes with a skip value of 0.
-         * All of those will be doubled in the resulting inflated tnode, so 
+         * All of those will be doubled in the resulting inflated tnode, so
         * we just count them one extra time here.
-         * 
+         *
         * A clearer way to write this would be:
-         * 
+         *
         * to_be_doubled = tn->full_children;
-         * not_to_be_doubled = tnode_child_length(tn) - tn->empty_children - 
+         * not_to_be_doubled = tnode_child_length(tn) - tn->empty_children -
         *     tn->full_children;
         *
         * new_child_length = tnode_child_length(tn) * 2;
         *
-         * new_fill_factor = 100 * (not_to_be_doubled + 2*to_be_doubled) / 
+         * new_fill_factor = 100 * (not_to_be_doubled + 2*to_be_doubled) /
         *      new_child_length;
         * if (new_fill_factor >= inflate_threshold)
-         * 
+         *
-         * ...and so on, tho it would mess up the while() loop.
+         * ...and so on, tho it would mess up the while () loop.
-         * 
+         *
         * anyway,
         * 100 * (not_to_be_doubled + 2*to_be_doubled) / new_child_length >=
         *      inflate_threshold
-         * 
+         *
         * avoid a division:
         * 100 * (not_to_be_doubled + 2*to_be_doubled) >=
         *      inflate_threshold * new_child_length
-         * 
+         *
         * expand not_to_be_doubled and to_be_doubled, and shorten:
-         * 100 * (tnode_child_length(tn) - tn->empty_children + 
+         * 100 * (tnode_child_length(tn) - tn->empty_children +
         *    tn->full_children ) >= inflate_threshold * new_child_length
-         * 
+         *
         * expand new_child_length:
-         * 100 * (tnode_child_length(tn) - tn->empty_children + 
+         * 100 * (tnode_child_length(tn) - tn->empty_children +
         *    tn->full_children ) >=
         *      inflate_threshold * tnode_child_length(tn) * 2
-         * 
+         *
         * shorten again:
-         * 50 * (tn->full_children + tnode_child_length(tn) - 
+         * 50 * (tn->full_children + tnode_child_length(tn) -
-         *    tn->empty_children ) >= inflate_threshold * 
+         *    tn->empty_children ) >= inflate_threshold *
         *    tnode_child_length(tn)
-         * 
+         *
         */
        check_tnode(tn);
-        
        err = 0;
        while ((tn->full_children > 0 &&
               50 * (tn->full_children + tnode_child_length(tn) - tn->empty_children) >=
@@ -587,7 +589,7 @@ static struct node *resize(struct trie *t, struct tnode *tn)
                tn = inflate(t, tn, &err);
-                if(err) {
+                if (err) {
 #ifdef CONFIG_IP_FIB_TRIE_STATS
                        t->stats.resize_node_skipped++;
 #endif
@@ -609,7 +611,7 @@ static struct node *resize(struct trie *t, struct tnode *tn)
                tn = halve(t, tn, &err);
-                if(err) {
+                if (err) {
 #ifdef CONFIG_IP_FIB_TRIE_STATS
                        t->stats.resize_node_skipped++;
 #endif
@@ -617,18 +619,18 @@ static struct node *resize(struct trie *t, struct tnode *tn)
                }
        }
-  
        /* Only one child remains */
        if (tn->empty_children == tnode_child_length(tn) - 1)
                for (i = 0; i < tnode_child_length(tn); i++) {
-                        
+                
                        write_lock_bh(&fib_lock);
                        if (tn->child[i] != NULL) {
                                /* compress one level */
                                struct node *n = tn->child[i];
-                                if(n)
+                                if (n)
                                        NODE_INIT_PARENT(n, NODE_TYPE(n));
                                write_unlock_bh(&fib_lock);
@@ -648,7 +650,7 @@ static struct tnode *inflate(struct trie *t, struct tnode *tn, int *err)
        int olen = tnode_child_length(tn);
        int i;
-        if(trie_debug) 
+        if (trie_debug)
                printk("In inflate\n");
        tn = tnode_new(oldtnode->key, oldtnode->pos, oldtnode->bits + 1);
@@ -659,12 +661,12 @@ static struct tnode *inflate(struct trie *t, struct tnode *tn, int *err)
        }
        /*
-         * Preallocate and store tnodes before the actual work so we 
+         * Preallocate and store tnodes before the actual work so we
-         * don't get into an inconsistent state if memory allocation 
+         * don't get into an inconsistent state if memory allocation
-         * fails. In case of failure we return the oldnode and  inflate 
+         * fails. In case of failure we return the oldnode and  inflate
         * of tnode is ignored.
         */
-                        
+                
        for(i = 0; i < olen; i++) {
                struct tnode *inode = (struct tnode *) tnode_get_child(oldtnode, i);
@@ -675,20 +677,20 @@ static struct tnode *inflate(struct trie *t, struct tnode *tn, int *err)
                        struct tnode *left, *right;
                        t_key m = TKEY_GET_MASK(inode->pos, 1);
- 
                        left = tnode_new(inode->key&(~m), inode->pos + 1,
                                         inode->bits - 1);
-                        if(!left) {
+                        if (!left) {
-                                *err = -ENOMEM; 
+                                *err = -ENOMEM;
                                break;
                        }
-                        
+                
                        right = tnode_new(inode->key|m, inode->pos + 1,
                                          inode->bits - 1);
-                        if(!right) {
+                        if (!right) {
-                                *err = -ENOMEM; 
+                                *err = -ENOMEM;
                                break;
                        }
@@ -697,32 +699,32 @@ static struct tnode *inflate(struct trie *t, struct tnode *tn, int *err)
                }
        }
-        if(*err) {
+        if (*err) {
                int size = tnode_child_length(tn);
                int j;
-                for(j = 0; j < size; j++) 
+                for(j = 0; j < size; j++)
-                        if( tn->child[j])
+                        if (tn->child[j])
                                tnode_free((struct tnode *)tn->child[j]);
                tnode_free(tn);
-                
+        
                *err = -ENOMEM;
                return oldtnode;
        }
        for(i = 0; i < olen; i++) {
                struct node *node = tnode_get_child(oldtnode, i);
-      
                /* An empty child */
                if (node == NULL)
                        continue;
                /* A leaf or an internal node with skipped bits */
-                if(IS_LEAF(node) || ((struct tnode *) node)->pos >
+                if (IS_LEAF(node) || ((struct tnode *) node)->pos >
                   tn->pos + tn->bits - 1) {
-                        if(tkey_extract_bits(node->key, oldtnode->pos + oldtnode->bits,
+                        if (tkey_extract_bits(node->key, oldtnode->pos + oldtnode->bits,
                                             1) == 0)
                                put_child(t, tn, 2*i, node);
                        else
@@ -745,37 +747,37 @@ static struct tnode *inflate(struct trie *t, struct tnode *tn, int *err)
                        struct tnode *left, *right;
                        int size, j;
-                        /* We will replace this node 'inode' with two new 
+                        /* We will replace this node 'inode' with two new
-                         * ones, 'left' and 'right', each with half of the 
+                         * ones, 'left' and 'right', each with half of the
-                         * original children. The two new nodes will have 
+                         * original children. The two new nodes will have
-                         * a position one bit further down the key and this 
+                         * a position one bit further down the key and this
-                         * means that the "significant" part of their keys 
+                         * means that the "significant" part of their keys
-                         * (see the discussion near the top of this file) 
+                         * (see the discussion near the top of this file)
-                         * will differ by one bit, which will be "0" in 
+                         * will differ by one bit, which will be "0" in
-                         * left's key and "1" in right's key. Since we are 
+                         * left's key and "1" in right's key. Since we are
-                         * moving the key position by one step, the bit that 
+                         * moving the key position by one step, the bit that
-                         * we are moving away from - the bit at position 
+                         * we are moving away from - the bit at position
-                         * (inode->pos) - is the one that will differ between 
+                         * (inode->pos) - is the one that will differ between
                         * left and right. So... we synthesize that bit in the
                         * two  new keys.
-                         * The mask 'm' below will be a single "one" bit at 
+                         * The mask 'm' below will be a single "one" bit at
                         * the position (inode->pos)
                         */
-                        /* Use the old key, but set the new significant 
+                        /* Use the old key, but set the new significant
-                         *   bit to zero. 
+                         *   bit to zero.
                         */
                        left = (struct tnode *) tnode_get_child(tn, 2*i);
                        put_child(t, tn, 2*i, NULL);
-                        if(!left)
+                        if (!left)
                                BUG();
                        right = (struct tnode *) tnode_get_child(tn, 2*i+1);
                        put_child(t, tn, 2*i+1, NULL);
-                        if(!right)
+                        if (!right)
                                BUG();
                        size = tnode_child_length(left);
@@ -800,9 +802,9 @@ static struct tnode *halve(struct trie *t, struct tnode *tn, int *err)
        int i;
        int olen = tnode_child_length(tn);
-        if(trie_debug) printk("In halve\n");
+        if (trie_debug) printk("In halve\n");
-  
-        tn=tnode_new(oldtnode->key, oldtnode->pos, oldtnode->bits - 1);
+        tn = tnode_new(oldtnode->key, oldtnode->pos, oldtnode->bits - 1);
        if (!tn) {
                *err = -ENOMEM;
@@ -810,39 +812,39 @@ static struct tnode *halve(struct trie *t, struct tnode *tn, int *err)
        }
        /*
-         * Preallocate and store tnodes before the actual work so we 
+         * Preallocate and store tnodes before the actual work so we
-         * don't get into an inconsistent state if memory allocation 
+         * don't get into an inconsistent state if memory allocation
-         * fails. In case of failure we return the oldnode and halve 
+         * fails. In case of failure we return the oldnode and halve
         * of tnode is ignored.
         */
        for(i = 0; i < olen; i += 2) {
                left = tnode_get_child(oldtnode, i);
                right = tnode_get_child(oldtnode, i+1);
-    
                /* Two nonempty children */
-                if( left && right)  {
+                if (left && right)  {
                        struct tnode *newBinNode =
                                tnode_new(left->key, tn->pos + tn->bits, 1);
-                        if(!newBinNode) {
+                        if (!newBinNode) {
-                                *err = -ENOMEM; 
+                                *err = -ENOMEM;
                                break;
                        }
                        put_child(t, tn, i/2, (struct node *)newBinNode);
                }
        }
-        if(*err) {
+        if (*err) {
                int size = tnode_child_length(tn);
                int j;
-                for(j = 0; j < size; j++) 
+                for(j = 0; j < size; j++)
-                        if( tn->child[j])
+                        if (tn->child[j])
                                tnode_free((struct tnode *)tn->child[j]);
                tnode_free(tn);
-                
+        
                *err = -ENOMEM;
                return oldtnode;
        }
@@ -850,7 +852,7 @@ static struct tnode *halve(struct trie *t, struct tnode *tn, int *err)
        for(i = 0; i < olen; i += 2) {
                left = tnode_get_child(oldtnode, i);
                right = tnode_get_child(oldtnode, i+1);
-    
                /* At least one of the children is empty */
                if (left == NULL) {
                        if (right == NULL)    /* Both are empty */
@@ -858,14 +860,14 @@ static struct tnode *halve(struct trie *t, struct tnode *tn, int *err)
                        put_child(t, tn, i/2, right);
                } else if (right == NULL)
                        put_child(t, tn, i/2, left);
-     
                /* Two nonempty children */
                else {
                        struct tnode *newBinNode =
                                (struct tnode *) tnode_get_child(tn, i/2);
                        put_child(t, tn, i/2, NULL);
-                        if(!newBinNode) 
+                        if (!newBinNode)
                                BUG();
                        put_child(t, newBinNode, 0, left);
@@ -879,7 +881,7 @@ static struct tnode *halve(struct trie *t, struct tnode *tn, int *err)
 static void *trie_init(struct trie *t)
 {
-        if(t) {
+        if (t) {
                t->size = 0;
                t->trie = NULL;
                t->revision = 0;
@@ -896,8 +898,7 @@ static struct leaf_info *find_leaf_info(struct hlist_head *head, int plen)
        struct leaf_info *li;
        hlist_for_each_entry(li, node, head, hlist) {
-                  
+                if (li->plen == plen)
-                if ( li->plen == plen )
                        return li;
        }
        return NULL;
@@ -905,35 +906,35 @@ static struct leaf_info *find_leaf_info(struct hlist_head *head, int plen)
 static inline struct list_head * get_fa_head(struct leaf *l, int plen)
 {
-        struct list_head *fa_head=NULL;
+        struct list_head *fa_head = NULL;
        struct leaf_info *li = find_leaf_info(&l->list, plen);
-        
-        if(li) 
+        if (li)
                fa_head = &li->falh;
-        
        return fa_head;
 }
 static void insert_leaf_info(struct hlist_head *head, struct leaf_info *new)
 {
-        struct leaf_info *li=NULL, *last=NULL;
+        struct leaf_info *li = NULL, *last = NULL;
        struct hlist_node *node, *tmp;
        write_lock_bh(&fib_lock);
-        
-        if(hlist_empty(head))
+        if (hlist_empty(head))
                hlist_add_head(&new->hlist, head);
        else {
                hlist_for_each_entry_safe(li, node, tmp, head, hlist) {
-                        
+                
-                        if (new->plen > li->plen) 
+                        if (new->plen > li->plen)
                                break;
-                        
+                
                        last = li;
                }
-                if(last) 
+                if (last)
                        hlist_add_after(&last->hlist, &new->hlist);
-                else 
+                else
                        hlist_add_before(&new->hlist, &li->hlist);
        }
        write_unlock_bh(&fib_lock);
@@ -947,14 +948,14 @@ fib_find_node(struct trie *t, u32 key)
        struct node *n;
        pos = 0;
-        n=t->trie;
+        n = t->trie;
        while (n != NULL &&  NODE_TYPE(n) == T_TNODE) {
                tn = (struct tnode *) n;
-                        
+                
                check_tnode(tn);
-                        
+                
-                if(tkey_sub_equals(tn->key, pos, tn->pos-pos, key)) {
+                if (tkey_sub_equals(tn->key, pos, tn->pos-pos, key)) {
                        pos=tn->pos + tn->bits;
                        n = tnode_get_child(tn, tkey_extract_bits(key, tn->pos, tn->bits));
                }
@@ -977,23 +978,23 @@ static struct node *trie_rebalance(struct trie *t, struct tnode *tn)
        t_key cindex, key;
        struct tnode *tp = NULL;
-        if(!tn) 
+        if (!tn)
                BUG();
-        
        key = tn->key;
        i = 0;
        while (tn != NULL && NODE_PARENT(tn) != NULL) {
-                if( i > 10 ) {
+                if (i > 10) {
                        printk("Rebalance tn=%p \n", tn);
-                        if(tn)          printk("tn->parent=%p \n", NODE_PARENT(tn));
+                        if (tn)                 printk("tn->parent=%p \n", NODE_PARENT(tn));
-                        
+                
                        printk("Rebalance tp=%p \n", tp);
-                        if(tp)          printk("tp->parent=%p \n", NODE_PARENT(tp));
+                        if (tp)                 printk("tp->parent=%p \n", NODE_PARENT(tp));
                }
-                if( i > 12 ) BUG();
+                if (i > 12) BUG();
                i++;
                tp = NODE_PARENT(tn);
@@ -1001,14 +1002,14 @@ static struct node *trie_rebalance(struct trie *t, struct tnode *tn)
                wasfull = tnode_full(tp, tnode_get_child(tp, cindex));
                tn = (struct tnode *) resize (t, (struct tnode *)tn);
                tnode_put_child_reorg((struct tnode *)tp, cindex,(struct node*)tn, wasfull);
-                
+        
-                if(!NODE_PARENT(tn))
+                if (!NODE_PARENT(tn))
                        break;
                tn = NODE_PARENT(tn);
        }
        /* Handle last (top) tnode */
-        if (IS_TNODE(tn)) 
+        if (IS_TNODE(tn))
                tn = (struct tnode*) resize(t, (struct tnode *)tn);
        return (struct node*) tn;
@@ -1022,42 +1023,42 @@ fib_insert_node(struct trie *t, int *err, u32 key, int plen)
        struct node *n;
        struct leaf *l;
        int missbit;
-        struct list_head *fa_head=NULL;
+        struct list_head *fa_head = NULL;
        struct leaf_info *li;
        t_key cindex;
        pos = 0;
-        n=t->trie;
+        n = t->trie;
-        /* If we point to NULL, stop. Either the tree is empty and we should 
+        /* If we point to NULL, stop. Either the tree is empty and we should
-         * just put a new leaf in if, or we have reached an empty child slot, 
+         * just put a new leaf in if, or we have reached an empty child slot,
         * and we should just put our new leaf in that.
-         * If we point to a T_TNODE, check if it matches our key. Note that 
+         * If we point to a T_TNODE, check if it matches our key. Note that
-         * a T_TNODE might be skipping any number of bits - its 'pos' need 
+         * a T_TNODE might be skipping any number of bits - its 'pos' need
         * not be the parent's 'pos'+'bits'!
         *
-         * If it does match the current key, get pos/bits from it, extract 
+         * If it does match the current key, get pos/bits from it, extract
         * the index from our key, push the T_TNODE and walk the tree.
         *
         * If it doesn't, we have to replace it with a new T_TNODE.
         *
-         * If we point to a T_LEAF, it might or might not have the same key 
+         * If we point to a T_LEAF, it might or might not have the same key
-         * as we do. If it does, just change the value, update the T_LEAF's 
+         * as we do. If it does, just change the value, update the T_LEAF's
-         * value, and return it. 
+         * value, and return it.
         * If it doesn't, we need to replace it with a T_TNODE.
         */
        while (n != NULL &&  NODE_TYPE(n) == T_TNODE) {
                tn = (struct tnode *) n;
-                        
-                check_tnode(tn);
                
-                if(tkey_sub_equals(tn->key, pos, tn->pos-pos, key)) {
+                check_tnode(tn);
+        
+                if (tkey_sub_equals(tn->key, pos, tn->pos-pos, key)) {
                        tp = tn;
                        pos=tn->pos + tn->bits;
                        n = tnode_get_child(tn, tkey_extract_bits(key, tn->pos, tn->bits));
-                        if(n && NODE_PARENT(n) != tn) {
+                        if (n && NODE_PARENT(n) != tn) {
                                printk("BUG tn=%p, n->parent=%p\n", tn, NODE_PARENT(n));
                                BUG();
                        }
@@ -1069,21 +1070,21 @@ fib_insert_node(struct trie *t, int *err, u32 key, int plen)
        /*
         * n  ----> NULL, LEAF or TNODE
         *
-         * tp is n's (parent) ----> NULL or TNODE  
+         * tp is n's (parent) ----> NULL or TNODE
         */
-        if(tp && IS_LEAF(tp))
+        if (tp && IS_LEAF(tp))
                BUG();
        /* Case 1: n is a leaf. Compare prefixes */
-        if (n != NULL && IS_LEAF(n) && tkey_equals(key, n->key)) { 
+        if (n != NULL && IS_LEAF(n) && tkey_equals(key, n->key)) {
                struct leaf *l = ( struct leaf *)  n;
-                
+        
                li = leaf_info_new(plen);
-                
+        
-                if(! li) {
+                if (!li) {
                        *err = -ENOMEM;
                        goto err;
                }
@@ -1095,7 +1096,7 @@ fib_insert_node(struct trie *t, int *err, u32 key, int plen)
        t->size++;
        l = leaf_new();
-        if(! l) {
+        if (!l) {
                *err = -ENOMEM;
                goto err;
        }
@@ -1103,7 +1104,7 @@ fib_insert_node(struct trie *t, int *err, u32 key, int plen)
        l->key = key;
        li = leaf_info_new(plen);
-        if(! li) {
+        if (!li) {
                tnode_free((struct tnode *) l);
                *err = -ENOMEM;
                goto err;
@@ -1116,8 +1117,8 @@ fib_insert_node(struct trie *t, int *err, u32 key, int plen)
        if (t->trie && n == NULL) {
                NODE_SET_PARENT(l, tp);
-                
+        
-                if (!tp) 
+                if (!tp)
                        BUG();
                else {
@@ -1127,8 +1128,8 @@ fib_insert_node(struct trie *t, int *err, u32 key, int plen)
        }
        /* Case 3: n is a LEAF or a TNODE and the key doesn't match. */
        else {
-                /* 
+                /*
-                 *  Add a new tnode here 
+                 *  Add a new tnode here
                 *  first tnode need some special handling
                 */
@@ -1136,39 +1137,39 @@ fib_insert_node(struct trie *t, int *err, u32 key, int plen)
                        pos=tp->pos+tp->bits;
                else
                        pos=0;
-                if(n) {
+                if (n) {
                        newpos = tkey_mismatch(key, pos, n->key);
                        tn = tnode_new(n->key, newpos, 1);
                }
                else {
                        newpos = 0;
-                        tn = tnode_new(key, newpos, 1); /* First tnode */ 
+                        tn = tnode_new(key, newpos, 1); /* First tnode */
                }
-                if(!tn) {
+                if (!tn) {
                        free_leaf_info(li);
                        tnode_free((struct tnode *) l);
                        *err = -ENOMEM;
                        goto err;
-                }                       
+                }               
-                        
+                
                NODE_SET_PARENT(tn, tp);
                missbit=tkey_extract_bits(key, newpos, 1);
                put_child(t, tn, missbit, (struct node *)l);
                put_child(t, tn, 1-missbit, n);
-                if(tp) {
+                if (tp) {
                        cindex = tkey_extract_bits(key, tp->pos, tp->bits);
                        put_child(t, (struct tnode *)tp, cindex, (struct node *)tn);
                }
-                else { 
+                else {
                        t->trie = (struct node*) tn; /* First tnode */
                        tp = tn;
                }
        }
-        if(tp && tp->pos+tp->bits > 32) {
+        if (tp && tp->pos+tp->bits > 32) {
-                printk("ERROR tp=%p pos=%d, bits=%d, key=%0x plen=%d\n", 
+                printk("ERROR tp=%p pos=%d, bits=%d, key=%0x plen=%d\n",
                       tp, tp->pos, tp->bits, key, plen);
        }
        /* Rebalance the trie */
@@ -1185,7 +1186,7 @@ fn_trie_insert(struct fib_table *tb, struct rtmsg *r, struct kern_rta *rta,
 {
        struct trie *t = (struct trie *) tb->tb_data;
        struct fib_alias *fa, *new_fa;
-        struct list_head *fa_head=NULL;
+        struct list_head *fa_head = NULL;
        struct fib_info *fi;
        int plen = r->rtm_dst_len;
        int type = r->rtm_type;
@@ -1198,17 +1199,17 @@ fn_trie_insert(struct fib_table *tb, struct rtmsg *r, struct kern_rta *rta,
                return -EINVAL;
        key = 0;
-        if (rta->rta_dst) 
+        if (rta->rta_dst)
                memcpy(&key, rta->rta_dst, 4);
        key = ntohl(key);
-        if(trie_debug)
+        if (trie_debug)
                printk("Insert table=%d %08x/%d\n", tb->tb_id, key, plen);
-        mask =  ntohl( inet_make_mask(plen) );
+        mask = ntohl( inet_make_mask(plen) );
-        if(key & ~mask)
+        if (key & ~mask)
                return -EINVAL;
        key = key & mask;
@@ -1217,9 +1218,9 @@ fn_trie_insert(struct fib_table *tb, struct rtmsg *r, struct kern_rta *rta,
                goto err;
        l = fib_find_node(t, key);
-        fa = NULL;      
+        fa = NULL;
-        if(l) {
+        if (l) {
                fa_head = get_fa_head(l, plen);
                fa = fib_find_alias(fa_head, tos, fi->fib_priority);
        }
@@ -1298,16 +1299,16 @@ fn_trie_insert(struct fib_table *tb, struct rtmsg *r, struct kern_rta *rta,
        new_fa->fa_scope = r->rtm_scope;
        new_fa->fa_state = 0;
 #if 0
-        new_fa->dst  = NULL;
+        new_fa->dst = NULL;
 #endif
        /*
         * Insert new entry to the list.
         */
-        if(!fa_head) {
+        if (!fa_head) {
                fa_head = fib_insert_node(t, &err, key, plen);
                err = 0;
-                if(err) 
+                if (err)
                        goto out_free_new_fa;
        }
@@ -1327,38 +1328,38 @@ out_free_new_fa:
        kmem_cache_free(fn_alias_kmem, new_fa);
 out:
        fib_release_info(fi);
-err:;   
+err:;
        return err;
 }
-static inline int check_leaf(struct trie *t, struct leaf *l,  t_key key, int *plen, const struct flowi *flp, 
+static inline int check_leaf(struct trie *t, struct leaf *l,  t_key key, int *plen, const struct flowi *flp,
-                             struct fib_result *res, int *err)
+                             struct fib_result *res)
 {
-        int i;
+        int err, i;
        t_key mask;
        struct leaf_info *li;
        struct hlist_head *hhead = &l->list;
        struct hlist_node *node;
-        
        hlist_for_each_entry(li, node, hhead, hlist) {
                i = li->plen;
                mask = ntohl(inet_make_mask(i));
-                if (l->key != (key & mask)) 
+                if (l->key != (key & mask))
                        continue;
-                if (((*err) = fib_semantic_match(&li->falh, flp, res, l->key, mask, i)) == 0) {
+                if ((err = fib_semantic_match(&li->falh, flp, res, l->key, mask, i)) <= 0) {
                        *plen = i;
 #ifdef CONFIG_IP_FIB_TRIE_STATS
                        t->stats.semantic_match_passed++;
 #endif
-                        return 1;
+                        return err;
                }
 #ifdef CONFIG_IP_FIB_TRIE_STATS
                t->stats.semantic_match_miss++;
 #endif
        }
-        return 0;
+        return 1;
 }
 static int
@@ -1376,7 +1377,7 @@ fn_trie_lookup(struct fib_table *tb, const struct flowi *flp, struct fib_result
        n = t->trie;
        read_lock(&fib_lock);
-        if(!n)
+        if (!n)
                goto failed;
 #ifdef CONFIG_IP_FIB_TRIE_STATS
@@ -1385,19 +1386,19 @@ fn_trie_lookup(struct fib_table *tb, const struct flowi *flp, struct fib_result
        /* Just a leaf? */
        if (IS_LEAF(n)) {
-                if( check_leaf(t, (struct leaf *)n, key, &plen, flp, res, &ret) )
+                if ((ret = check_leaf(t, (struct leaf *)n, key, &plen, flp, res)) <= 0)
                        goto found;
                goto failed;
        }
        pn = (struct tnode *) n;
        chopped_off = 0;
-        
        while (pn) {
                pos = pn->pos;
                bits = pn->bits;
-                if(!chopped_off) 
+                if (!chopped_off)
                        cindex = tkey_extract_bits(MASK_PFX(key, current_prefix_length), pos, bits);
                n = tnode_get_child(pn, cindex);
@@ -1417,33 +1418,33 @@ fn_trie_lookup(struct fib_table *tb, const struct flowi *flp, struct fib_result
                        int mp;
                        /*
-                         * It's a tnode, and we can do some extra checks here if we 
+                         * It's a tnode, and we can do some extra checks here if we
                         * like, to avoid descending into a dead-end branch.
-                         * This tnode is in the parent's child array at index 
+                         * This tnode is in the parent's child array at index
-                         * key[p_pos..p_pos+p_bits] but potentially with some bits 
+                         * key[p_pos..p_pos+p_bits] but potentially with some bits
-                         * chopped off, so in reality the index may be just a 
+                         * chopped off, so in reality the index may be just a
                         * subprefix, padded with zero at the end.
-                         * We can also take a look at any skipped bits in this 
+                         * We can also take a look at any skipped bits in this
-                         * tnode - everything up to p_pos is supposed to be ok, 
+                         * tnode - everything up to p_pos is supposed to be ok,
                         * and the non-chopped bits of the index (se previous
-                         * paragraph) are also guaranteed ok, but the rest is 
+                         * paragraph) are also guaranteed ok, but the rest is
                         * considered unknown.
                         *
                         * The skipped bits are key[pos+bits..cn->pos].
                         */
-                        
+                
-                        /* If current_prefix_length < pos+bits, we are already doing 
+                        /* If current_prefix_length < pos+bits, we are already doing
-                         * actual prefix  matching, which means everything from 
+                         * actual prefix  matching, which means everything from
-                         * pos+(bits-chopped_off) onward must be zero along some 
+                         * pos+(bits-chopped_off) onward must be zero along some
-                         * branch of this subtree - otherwise there is *no* valid 
+                         * branch of this subtree - otherwise there is *no* valid
                         * prefix present. Here we can only check the skipped
-                         * bits. Remember, since we have already indexed into the 
+                         * bits. Remember, since we have already indexed into the
-                         * parent's child array, we know that the bits we chopped of 
+                         * parent's child array, we know that the bits we chopped of
                         * *are* zero.
                         */
                        /* NOTA BENE: CHECKING ONLY SKIPPED BITS FOR THE NEW NODE HERE */
-                        
+                
                        if (current_prefix_length < pos+bits) {
                                if (tkey_extract_bits(cn->key, current_prefix_length,
                                                      cn->pos - current_prefix_length) != 0 ||
@@ -1452,13 +1453,13 @@ fn_trie_lookup(struct fib_table *tb, const struct flowi *flp, struct fib_result
                        }
                        /*
-                         * If chopped_off=0, the index is fully validated and we 
+                         * If chopped_off=0, the index is fully validated and we
-                         * only need to look at the skipped bits for this, the new, 
+                         * only need to look at the skipped bits for this, the new,
                         * tnode. What we actually want to do is to find out if
                         * these skipped bits match our key perfectly, or if we will
-                         * have to count on finding a matching prefix further down, 
+                         * have to count on finding a matching prefix further down,
-                         * because if we do, we would like to have some way of 
+                         * because if we do, we would like to have some way of
-                         * verifying the existence of such a prefix at this point. 
+                         * verifying the existence of such a prefix at this point.
                         */
                        /* The only thing we can do at this point is to verify that
@@ -1470,22 +1471,22 @@ fn_trie_lookup(struct fib_table *tb, const struct flowi *flp, struct fib_result
                         * new tnode's key.
                         */
-                        /* Note: We aren't very concerned about the piece of the key 
+                        /* Note: We aren't very concerned about the piece of the key
-                         * that precede pn->pos+pn->bits, since these have already been 
+                         * that precede pn->pos+pn->bits, since these have already been
-                         * checked. The bits after cn->pos aren't checked since these are 
+                         * checked. The bits after cn->pos aren't checked since these are
-                         * by definition "unknown" at this point. Thus, what we want to 
+                         * by definition "unknown" at this point. Thus, what we want to
-                         * see is if we are about to enter the "prefix matching" state, 
+                         * see is if we are about to enter the "prefix matching" state,
-                         * and in that case verify that the skipped bits that will prevail 
+                         * and in that case verify that the skipped bits that will prevail
-                         * throughout this subtree are zero, as they have to be if we are 
+                         * throughout this subtree are zero, as they have to be if we are
                         * to find a matching prefix.
                         */
                        node_prefix = MASK_PFX(cn->key, cn->pos);
-                        key_prefix =  MASK_PFX(key, cn->pos);
+                        key_prefix = MASK_PFX(key, cn->pos);
                        pref_mismatch = key_prefix^node_prefix;
                        mp = 0;
-                        /* In short: If skipped bits in this node do not match the search 
+                        /* In short: If skipped bits in this node do not match the search
                         * key, enter the "prefix matching" state.directly.
                         */
                        if (pref_mismatch) {
@@ -1494,7 +1495,7 @@ fn_trie_lookup(struct fib_table *tb, const struct flowi *flp, struct fib_result
                                        pref_mismatch = pref_mismatch <<1;
                                }
                                key_prefix = tkey_extract_bits(cn->key, mp, cn->pos-mp);
-                                
+                        
                                if (key_prefix != 0)
                                        goto backtrace;
@@ -1505,9 +1506,9 @@ fn_trie_lookup(struct fib_table *tb, const struct flowi *flp, struct fib_result
                       pn = (struct tnode *)n; /* Descend */
                       chopped_off = 0;
                       continue;
-                } 
+                }
-                if (IS_LEAF(n)) {       
+                if (IS_LEAF(n)) {
-                        if( check_leaf(t, (struct leaf *)n, key, &plen, flp, res, &ret))
+                        if ((ret = check_leaf(t, (struct leaf *)n, key, &plen, flp, res)) <= 0)
                                goto found;
               }
 backtrace:
@@ -1521,18 +1522,18 @@ backtrace:
                /* Decrease current_... with bits chopped off */
                if (current_prefix_length > pn->pos + pn->bits - chopped_off)
                        current_prefix_length = pn->pos + pn->bits - chopped_off;
-                
+        
                /*
-                 * Either we do the actual chop off according or if we have 
+                 * Either we do the actual chop off according or if we have
                 * chopped off all bits in this tnode walk up to our parent.
                 */
-                if(chopped_off <= pn->bits)
+                if (chopped_off <= pn->bits)
                        cindex &= ~(1 << (chopped_off-1));
                else {
-                        if( NODE_PARENT(pn) == NULL)
+                        if (NODE_PARENT(pn) == NULL)
                                goto failed;
-                        
+                
                        /* Get Child's index */
                        cindex = tkey_extract_bits(pn->key, NODE_PARENT(pn)->pos, NODE_PARENT(pn)->bits);
                        pn = NODE_PARENT(pn);
@@ -1542,10 +1543,10 @@ backtrace:
                        t->stats.backtrack++;
 #endif
                        goto backtrace;
-                } 
+                }
        }
 failed:
-        ret =  1;
+        ret = 1;
 found:
        read_unlock(&fib_lock);
        return ret;
@@ -1558,11 +1559,11 @@ static int trie_leaf_remove(struct trie *t, t_key key)
        struct node *n = t->trie;
        struct leaf *l;
-        if(trie_debug) 
+        if (trie_debug)
                printk("entering trie_leaf_remove(%p)\n", n);
        /* Note that in the case skipped bits, those bits are *not* checked!
-         * When we finish this, we will have NULL or a T_LEAF, and the 
+         * When we finish this, we will have NULL or a T_LEAF, and the
         * T_LEAF may or may not match our key.
         */
@@ -1571,19 +1572,19 @@ static int trie_leaf_remove(struct trie *t, t_key key)
                check_tnode(tn);
                n = tnode_get_child(tn ,tkey_extract_bits(key, tn->pos, tn->bits));
-                        if(n && NODE_PARENT(n) != tn) {
+                        if (n && NODE_PARENT(n) != tn) {
                                printk("BUG tn=%p, n->parent=%p\n", tn, NODE_PARENT(n));
                                BUG();
                        }
        }
        l = (struct leaf *) n;
-        if(!n || !tkey_equals(l->key, key)) 
+        if (!n || !tkey_equals(l->key, key))
                return 0;
-    
-        /* 
+        /*
-         * Key found. 
+         * Key found.
-         * Remove the leaf and rebalance the tree 
+         * Remove the leaf and rebalance the tree
         */
        t->revision++;
@@ -1592,7 +1593,7 @@ static int trie_leaf_remove(struct trie *t, t_key key)
        tp = NODE_PARENT(n);
        tnode_free((struct tnode *) n);
-        if(tp) {
+        if (tp) {
                cindex = tkey_extract_bits(key, tp->pos, tp->bits);
                put_child(t, (struct tnode *)tp, cindex, NULL);
                t->trie = trie_rebalance(t, tp);
@@ -1615,23 +1616,23 @@ fn_trie_delete(struct fib_table *tb, struct rtmsg *r, struct kern_rta *rta,
        struct list_head *fa_head;
        struct leaf *l;
-        if (plen > 32) 
+        if (plen > 32)
                return -EINVAL;
        key = 0;
-        if (rta->rta_dst) 
+        if (rta->rta_dst)
                memcpy(&key, rta->rta_dst, 4);
        key = ntohl(key);
-        mask =  ntohl( inet_make_mask(plen) );
+        mask = ntohl( inet_make_mask(plen) );
-        if(key & ~mask)
+        if (key & ~mask)
                return -EINVAL;
        key = key & mask;
        l = fib_find_node(t, key);
-        if(!l)
+        if (!l)
                return -ESRCH;
        fa_head = get_fa_head(l, plen);
@@ -1677,16 +1678,16 @@ fn_trie_delete(struct fib_table *tb, struct rtmsg *r, struct kern_rta *rta,
                list_del(&fa->fa_list);
-                if(list_empty(fa_head)) {
+                if (list_empty(fa_head)) {
                        hlist_del(&li->hlist);
                        kill_li = 1;
                }
                write_unlock_bh(&fib_lock);
-                
+        
-                if(kill_li)
+                if (kill_li)
                        free_leaf_info(li);
-                if(hlist_empty(&l->list))
+                if (hlist_empty(&l->list))
                        trie_leaf_remove(t, key);
                if (fa->fa_state & FA_S_ACCESSED)
@@ -1705,12 +1706,12 @@ static int trie_flush_list(struct trie *t, struct list_head *head)
        list_for_each_entry_safe(fa, fa_node, head, fa_list) {
                struct fib_info *fi = fa->fa_info;
-                
+        
                if (fi && (fi->fib_flags&RTNH_F_DEAD)) {
-                        write_lock_bh(&fib_lock);       
+                        write_lock_bh(&fib_lock);
                        list_del(&fa->fa_list);
-                        write_unlock_bh(&fib_lock); 
+                        write_unlock_bh(&fib_lock);
                        fn_free_alias(fa);
                        found++;
@@ -1727,14 +1728,14 @@ static int trie_flush_leaf(struct trie *t, struct leaf *l)
        struct leaf_info *li = NULL;
        hlist_for_each_entry_safe(li, node, tmp, lih, hlist) {
-                        
+                
                found += trie_flush_list(t, &li->falh);
                if (list_empty(&li->falh)) {
-                        write_lock_bh(&fib_lock); 
+                        write_lock_bh(&fib_lock);
                        hlist_del(&li->hlist);
-                        write_unlock_bh(&fib_lock); 
+                        write_unlock_bh(&fib_lock);
                        free_leaf_info(li);
                }
@@ -1748,8 +1749,8 @@ static struct leaf *nextleaf(struct trie *t, struct leaf *thisleaf)
        struct tnode *p;
        int idx;
-        if(c == NULL) {
+        if (c == NULL) {
-                if(t->trie == NULL)
+                if (t->trie == NULL)
                        return NULL;
                if (IS_LEAF(t->trie))          /* trie w. just a leaf */
@@ -1757,33 +1758,34 @@ static struct leaf *nextleaf(struct trie *t, struct leaf *thisleaf)
                p = (struct tnode*) t->trie;  /* Start */
        }
-        else 
+        else
                p = (struct tnode *) NODE_PARENT(c);
        while (p) {
                int pos, last;
                /*  Find the next child of the parent */
-                if(c)
+                if (c)
-                        pos  = 1 + tkey_extract_bits(c->key, p->pos, p->bits);
+                        pos = 1 + tkey_extract_bits(c->key, p->pos, p->bits);
-                else 
+                else
                        pos = 0;
                last = 1 << p->bits;
                for(idx = pos; idx < last ; idx++) {
-                        if( p->child[idx]) {
+                        if (p->child[idx]) {
                                /* Decend if tnode */
                                while (IS_TNODE(p->child[idx])) {
                                        p = (struct tnode*) p->child[idx];
                                        idx = 0;
-                                        
+                                
                                        /* Rightmost non-NULL branch */
-                                        if( p && IS_TNODE(p) )
+                                        if (p && IS_TNODE(p))
-                                                while ( p->child[idx] == NULL && idx < (1 << p->bits) ) idx++;
+                                                while (p->child[idx] == NULL && idx < (1 << p->bits)) idx++;
                                        /* Done with this tnode? */
-                                        if( idx >= (1 << p->bits) || p->child[idx] == NULL ) 
+                                        if (idx >= (1 << p->bits) || p->child[idx] == NULL )
                                                goto up;
                                }
                                return (struct leaf*) p->child[idx];
@@ -1816,7 +1818,7 @@ static int fn_trie_flush(struct fib_table *tb)
        if (ll && hlist_empty(&ll->list))
                trie_leaf_remove(t, ll->key);
-        if(trie_debug) 
+        if (trie_debug)
                printk("trie_flush found=%d\n", found);
        return found;
 }
@@ -1839,32 +1841,32 @@ fn_trie_select_default(struct fib_table *tb, const struct flowi *flp, struct fib
        order = -1;
        read_lock(&fib_lock);
-        
        l = fib_find_node(t, 0);
-        if(!l) 
+        if (!l)
                goto out;
        fa_head = get_fa_head(l, 0);
-        if(!fa_head)
+        if (!fa_head)
                goto out;
-        if (list_empty(fa_head)) 
+        if (list_empty(fa_head))
                goto out;
        list_for_each_entry(fa, fa_head, fa_list) {
                struct fib_info *next_fi = fa->fa_info;
-                
+        
                if (fa->fa_scope != res->scope ||
                    fa->fa_type != RTN_UNICAST)
                        continue;
-                
+        
                if (next_fi->fib_priority > res->fi->fib_priority)
                        break;
                if (!next_fi->fib_nh[0].nh_gw ||
                    next_fi->fib_nh[0].nh_scope != RT_SCOPE_LINK)
                        continue;
                fa->fa_state |= FA_S_ACCESSED;
-                
+        
                if (fi == NULL) {
                        if (next_fi != res->fi)
                                break;
@@ -1902,10 +1904,10 @@ fn_trie_select_default(struct fib_table *tb, const struct flowi *flp, struct fib
        }
        trie_last_dflt = last_idx;
 out:;
-        read_unlock(&fib_lock); 
+        read_unlock(&fib_lock);
 }
-static int fn_trie_dump_fa(t_key key, int plen, struct list_head *fah, struct fib_table *tb, 
+static int fn_trie_dump_fa(t_key key, int plen, struct list_head *fah, struct fib_table *tb,
                           struct sk_buff *skb, struct netlink_callback *cb)
 {
        int i, s_i;
@@ -1951,7 +1953,7 @@ static int fn_trie_dump_fa(t_key key, int plen, struct list_head *fah, struct fi
        return skb->len;
 }
-static int fn_trie_dump_plen(struct trie *t, int plen, struct fib_table *tb, struct sk_buff *skb, 
+static int fn_trie_dump_plen(struct trie *t, int plen, struct fib_table *tb, struct sk_buff *skb,
                             struct netlink_callback *cb)
 {
        int h, s_h;
@@ -1968,11 +1970,11 @@ static int fn_trie_dump_plen(struct trie *t, int plen, struct fib_table *tb, str
                               sizeof(cb->args) - 3*sizeof(cb->args[0]));
                fa_head = get_fa_head(l, plen);
-                
+        
-                if(!fa_head)
+                if (!fa_head)
                        continue;
-                if(list_empty(fa_head))
+                if (list_empty(fa_head))
                        continue;
                if (fn_trie_dump_fa(l->key, plen, fa_head, tb, skb, cb)<0) {
@@ -2048,10 +2050,10 @@ struct fib_table * __init fib_hash_init(int id)
        trie_init(t);
-        if (id == RT_TABLE_LOCAL) 
+        if (id == RT_TABLE_LOCAL)
-                trie_local=t;
+                trie_local = t;
-          else if (id == RT_TABLE_MAIN) 
+        else if (id == RT_TABLE_MAIN)
-                trie_main=t;
+                trie_main = t;
        if (id == RT_TABLE_LOCAL)
                printk("IPv4 FIB: Using LC-trie version %s\n", VERSION);
@@ -2072,7 +2074,7 @@ static void printbin_seq(struct seq_file *seq, unsigned int v, int bits)
                seq_printf(seq, "%s", (v & (1<<bits))?"1":"0");
 }
-static void printnode_seq(struct seq_file *seq, int indent, struct node *n, 
+static void printnode_seq(struct seq_file *seq, int indent, struct node *n,
                   int pend, int cindex, int bits)
 {
        putspace_seq(seq, indent);
@@ -2090,12 +2092,12 @@ static void printnode_seq(struct seq_file *seq, int indent, struct node *n,
        seq_printf(seq, "%s:%p ", IS_LEAF(n)?"Leaf":"Internal node", n);
        if (IS_LEAF(n))
-                seq_printf(seq, "key=%d.%d.%d.%d\n", 
+                seq_printf(seq, "key=%d.%d.%d.%d\n",
                           n->key >> 24, (n->key >> 16) % 256, (n->key >> 8) % 256, n->key % 256);
        else {
-                int plen=((struct tnode *)n)->pos;
+                int plen = ((struct tnode *)n)->pos;
                t_key prf=MASK_PFX(n->key, plen);
-                seq_printf(seq, "key=%d.%d.%d.%d/%d\n", 
+                seq_printf(seq, "key=%d.%d.%d.%d/%d\n",
                           prf >> 24, (prf >> 16) % 256, (prf >> 8) % 256, prf % 256, plen);
        }
        if (IS_LEAF(n)) {
@@ -2103,14 +2105,14 @@ static void printnode_seq(struct seq_file *seq, int indent, struct node *n,
                struct fib_alias *fa;
                int i;
                for (i=32; i>=0; i--)
-                  if(find_leaf_info(&l->list, i)) {
+                  if (find_leaf_info(&l->list, i)) {
-                        
+                
                                struct list_head *fa_head = get_fa_head(l, i);
-                                
+                        
-                                if(!fa_head)
+                                if (!fa_head)
                                        continue;
-                                if(list_empty(fa_head))
+                                if (list_empty(fa_head))
                                        continue;
                                putspace_seq(seq, indent+2);
@@ -2136,7 +2138,7 @@ static void printnode_seq(struct seq_file *seq, int indent, struct node *n,
                        }
        }
        else if (IS_TNODE(n)) {
-                struct tnode *tn=(struct tnode *)n;
+                struct tnode *tn = (struct tnode *)n;
                putspace_seq(seq, indent); seq_printf(seq, "|    ");
                seq_printf(seq, "{key prefix=%08x/", tn->key&TKEY_GET_MASK(0, tn->pos));
                printbin_seq(seq, tkey_extract_bits(tn->key, 0, tn->pos), tn->pos);
@@ -2152,7 +2154,7 @@ static void printnode_seq(struct seq_file *seq, int indent, struct node *n,
 static void trie_dump_seq(struct seq_file *seq, struct trie *t)
 {
-        struct node *n=t->trie;
+        struct node *n = t->trie;
        int cindex=0;
        int indent=1;
        int pend=0;
@@ -2164,7 +2166,7 @@ static void trie_dump_seq(struct seq_file *seq, struct trie *t)
        if (n) {
                printnode_seq(seq, indent, n, pend, cindex, 0);
                if (IS_TNODE(n)) {
-                        struct tnode *tn=(struct tnode *)n;
+                        struct tnode *tn = (struct tnode *)n;
                        pend = tn->pos+tn->bits;
                        putspace_seq(seq, indent); seq_printf(seq, "\\--\n");
                        indent += 3;
@@ -2172,42 +2174,42 @@ static void trie_dump_seq(struct seq_file *seq, struct trie *t)
                        while (tn && cindex < (1 << tn->bits)) {
                                if (tn->child[cindex]) {
-                                        
+                                
                                        /* Got a child */
-                                        
+                                
                                        printnode_seq(seq, indent, tn->child[cindex], pend, cindex, tn->bits);
-                                        if (IS_LEAF(tn->child[cindex])) { 
+                                        if (IS_LEAF(tn->child[cindex])) {
                                                cindex++;
-                                                
+                                        
                                        }
                                        else {
-                                                /* 
+                                                /*
-                                                 * New tnode. Decend one level 
+                                                 * New tnode. Decend one level
                                                 */
-                                                
+                                        
                                                depth++;
-                                                n=tn->child[cindex];
+                                                n = tn->child[cindex];
-                                                tn=(struct tnode *)n;
+                                                tn = (struct tnode *)n;
-                                                pend=tn->pos+tn->bits;
+                                                pend = tn->pos+tn->bits;
                                                putspace_seq(seq, indent); seq_printf(seq, "\\--\n");
                                                indent+=3;
                                                cindex=0;
                                        }
                                }
-                                else 
+                                else
                                        cindex++;
                                /*
-                                 * Test if we are done 
+                                 * Test if we are done
                                 */
-                                
+                        
                                while (cindex >= (1 << tn->bits)) {
                                        /*
                                         * Move upwards and test for root
                                         * pop off all traversed  nodes
                                         */
-                                        
+                                
                                        if (NODE_PARENT(tn) == NULL) {
                                                tn = NULL;
                                                n = NULL;
@@ -2217,8 +2219,8 @@ static void trie_dump_seq(struct seq_file *seq, struct trie *t)
                                                cindex = tkey_extract_bits(tn->key, NODE_PARENT(tn)->pos, NODE_PARENT(tn)->bits);
                                                tn = NODE_PARENT(tn);
                                                cindex++;
-                                                n=(struct node *)tn;
+                                                n = (struct node *)tn;
-                                                pend=tn->pos+tn->bits;
+                                                pend = tn->pos+tn->bits;
                                                indent-=3;
                                                depth--;
                                        }
@@ -2236,36 +2238,36 @@ static struct trie_stat *trie_stat_new(void)
 {
        struct trie_stat *s = kmalloc(sizeof(struct trie_stat), GFP_KERNEL);
        int i;
-        
-        if(s) {
+        if (s) {
                s->totdepth = 0;
                s->maxdepth = 0;
                s->tnodes = 0;
                s->leaves = 0;
                s->nullpointers = 0;
-                
+        
                for(i=0; i< MAX_CHILDS; i++)
                        s->nodesizes[i] = 0;
        }
        return s;
-}    
+}
 static struct trie_stat *trie_collect_stats(struct trie *t)
 {
-        struct node *n=t->trie;
+        struct node *n = t->trie;
        struct trie_stat *s = trie_stat_new();
        int cindex = 0;
        int indent = 1;
        int pend = 0;
        int depth = 0;
-        read_lock(&fib_lock);           
+        read_lock(&fib_lock);   
        if (s) {
                if (n) {
                        if (IS_TNODE(n)) {
                                struct tnode *tn = (struct tnode *)n;
-                                pend=tn->pos+tn->bits;
+                                pend = tn->pos+tn->bits;
                                indent += 3;
                                s->nodesizes[tn->bits]++;
                                depth++;
@@ -2273,26 +2275,26 @@ static struct trie_stat *trie_collect_stats(struct trie *t)
                                while (tn && cindex < (1 << tn->bits)) {
                                        if (tn->child[cindex]) {
                                                /* Got a child */
-                                        
+                                
-                                                if (IS_LEAF(tn->child[cindex])) { 
+                                                if (IS_LEAF(tn->child[cindex])) {
                                                        cindex++;
-                                                
+                                        
                                                        /* stats */
                                                        if (depth > s->maxdepth)
                                                                s->maxdepth = depth;
                                                        s->totdepth += depth;
                                                        s->leaves++;
                                                }
-                                        
+                                
                                                else {
-                                                        /* 
+                                                        /*
-                                                         * New tnode. Decend one level 
+                                                         * New tnode. Decend one level
                                                         */
-                                                
+                                        
                                                        s->tnodes++;
                                                        s->nodesizes[tn->bits]++;
                                                        depth++;
-                                                
+                                        
                                                        n = tn->child[cindex];
                                                        tn = (struct tnode *)n;
                                                        pend = tn->pos+tn->bits;
@@ -2303,13 +2305,13 @@ static struct trie_stat *trie_collect_stats(struct trie *t)
                                        }
                                        else {
                                                cindex++;
-                                                s->nullpointers++; 
+                                                s->nullpointers++;
                                        }
                                        /*
-                                         * Test if we are done 
+                                         * Test if we are done
                                         */
-                                
+                        
                                        while (cindex >= (1 << tn->bits)) {
                                                /*
@@ -2317,7 +2319,7 @@ static struct trie_stat *trie_collect_stats(struct trie *t)
                                                 * pop off all traversed  nodes
                                                 */
-                                                
+                                        
                                                if (NODE_PARENT(tn) == NULL) {
                                                        tn = NULL;
                                                        n = NULL;
@@ -2326,9 +2328,9 @@ static struct trie_stat *trie_collect_stats(struct trie *t)
                                                else {
                                                        cindex = tkey_extract_bits(tn->key, NODE_PARENT(tn)->pos, NODE_PARENT(tn)->bits);
                                                        tn = NODE_PARENT(tn);
-                                                        cindex++; 
+                                                        cindex++;
                                                        n = (struct node *)tn;
-                                                        pend=tn->pos+tn->bits;
+                                                        pend = tn->pos+tn->bits;
                                                        indent -= 3;
                                                        depth--;
                                                }
@@ -2339,7 +2341,7 @@ static struct trie_stat *trie_collect_stats(struct trie *t)
                }
        }
-        read_unlock(&fib_lock);         
+        read_unlock(&fib_lock); 
        return s;
 }
@@ -2375,7 +2377,7 @@ static void fib_triestat_seq_stop(struct seq_file *seq, void *v)
 }
-/* 
+/*
 *      This outputs /proc/net/fib_triestats
 *
 *      It always works in backward compatibility mode.
@@ -2401,7 +2403,7 @@ static void collect_and_show(struct trie *t, struct seq_file *seq)
                        avdepth=0;
                seq_printf(seq, "Aver depth: %d.%02d\n", avdepth / 100, avdepth % 100 );
                seq_printf(seq, "Max depth: %4d\n", stat->maxdepth);
-                                
+                        
                seq_printf(seq, "Leaves: %d\n", stat->leaves);
                bytes += sizeof(struct leaf) * stat->leaves;
                seq_printf(seq, "Internal nodes: %d\n", stat->tnodes);
@@ -2413,7 +2415,7 @@ static void collect_and_show(struct trie *t, struct seq_file *seq)
                        max--;
                pointers = 0;
-                for (i = 1; i <= max; i++) 
+                for (i = 1; i <= max; i++)
                        if (stat->nodesizes[i] != 0) {
                                seq_printf(seq, "  %d: %d",  i, stat->nodesizes[i]);
                                pointers += (1<<i) * stat->nodesizes[i];
@@ -2444,30 +2446,30 @@ static void collect_and_show(struct trie *t, struct seq_file *seq)
 static int fib_triestat_seq_show(struct seq_file *seq, void *v)
 {
        char bf[128];
-    
        if (v == SEQ_START_TOKEN) {
-                seq_printf(seq, "Basic info: size of leaf: %Zd bytes, size of tnode: %Zd bytes.\n", 
+                seq_printf(seq, "Basic info: size of leaf: %Zd bytes, size of tnode: %Zd bytes.\n",
                           sizeof(struct leaf), sizeof(struct tnode));
-                if (trie_local) 
+                if (trie_local)
                        collect_and_show(trie_local, seq);
-                if (trie_main) 
+                if (trie_main)
                        collect_and_show(trie_main, seq);
        }
        else {
                snprintf(bf, sizeof(bf),
                         "*\t%08X\t%08X", 200, 400);
-                
+        
                seq_printf(seq, "%-127s\n", bf);
        }
        return 0;
 }
 static struct seq_operations fib_triestat_seq_ops = {
-        .start  = fib_triestat_seq_start,
+        .start = fib_triestat_seq_start,
-        .next   = fib_triestat_seq_next,
+        .next  = fib_triestat_seq_next,
-        .stop   = fib_triestat_seq_stop,
+        .stop  = fib_triestat_seq_stop,
-        .show   = fib_triestat_seq_show,
+        .show  = fib_triestat_seq_show,
 };
 static int fib_triestat_seq_open(struct inode *inode, struct file *file)
@@ -2479,7 +2481,7 @@ static int fib_triestat_seq_open(struct inode *inode, struct file *file)
        if (rc)
                goto out_kfree;
-        seq          = file->private_data;
+        seq = file->private_data;
 out:
        return rc;
 out_kfree:
@@ -2487,11 +2489,11 @@ out_kfree:
 }
 static struct file_operations fib_triestat_seq_fops = {
-        .owner          = THIS_MODULE,
+        .owner  = THIS_MODULE,
-        .open           = fib_triestat_seq_open,
+        .open   = fib_triestat_seq_open,
-        .read           = seq_read,
+        .read   = seq_read,
-        .llseek         = seq_lseek,
+        .llseek = seq_lseek,
-        .release        = seq_release_private,
+        .release = seq_release_private,
 };
 int __init fib_stat_proc_init(void)
@@ -2536,7 +2538,7 @@ static void fib_trie_seq_stop(struct seq_file *seq, void *v)
 }
-/* 
+/*
 *      This outputs /proc/net/fib_trie.
 *
 *      It always works in backward compatibility mode.
@@ -2548,10 +2550,10 @@ static int fib_trie_seq_show(struct seq_file *seq, void *v)
        char bf[128];
        if (v == SEQ_START_TOKEN) {
-                if (trie_local) 
+                if (trie_local)
                        trie_dump_seq(seq, trie_local);
-                if (trie_main) 
+                if (trie_main)
                        trie_dump_seq(seq, trie_main);
        }
@@ -2565,10 +2567,10 @@ static int fib_trie_seq_show(struct seq_file *seq, void *v)
 }
 static struct seq_operations fib_trie_seq_ops = {
-        .start  = fib_trie_seq_start,
+        .start = fib_trie_seq_start,
-        .next   = fib_trie_seq_next,
+        .next  = fib_trie_seq_next,
-        .stop   = fib_trie_seq_stop,
+        .stop  = fib_trie_seq_stop,
-        .show   = fib_trie_seq_show,
+        .show  = fib_trie_seq_show,
 };
 static int fib_trie_seq_open(struct inode *inode, struct file *file)
@@ -2580,7 +2582,7 @@ static int fib_trie_seq_open(struct inode *inode, struct file *file)
        if (rc)
                goto out_kfree;
-        seq          = file->private_data;
+        seq = file->private_data;
 out:
        return rc;
 out_kfree:
@@ -2588,11 +2590,11 @@ out_kfree:
 }
 static struct file_operations fib_trie_seq_fops = {
-        .owner          = THIS_MODULE,
+        .owner  = THIS_MODULE,
-        .open           = fib_trie_seq_open,
+        .open   = fib_trie_seq_open,
-        .read           = seq_read,
+        .read   = seq_read,
-        .llseek         = seq_lseek,
+        .llseek = seq_lseek,
-        .release        = seq_release_private,
+        .release= seq_release_private,
 };
 int __init fib_proc_init(void)
diff --git a/net/ipv4/icmp.c b/net/ipv4/icmp.c
index 279f57abfecb..badfc5849973 100644
--- a/net/ipv4/icmp.c
+++ b/net/ipv4/icmp.c
@@ -349,12 +349,12 @@ static void icmp_push_reply(struct icmp_bxm *icmp_param,
 {
        struct sk_buff *skb;
-        ip_append_data(icmp_socket->sk, icmp_glue_bits, icmp_param,
+        if (ip_append_data(icmp_socket->sk, icmp_glue_bits, icmp_param,
-                       icmp_param->data_len+icmp_param->head_len,
+                           icmp_param->data_len+icmp_param->head_len,
-                       icmp_param->head_len,
+                           icmp_param->head_len,
-                       ipc, rt, MSG_DONTWAIT);
+                           ipc, rt, MSG_DONTWAIT) < 0)
+                ip_flush_pending_frames(icmp_socket->sk);
-        if ((skb = skb_peek(&icmp_socket->sk->sk_write_queue)) != NULL) {
+        else if ((skb = skb_peek(&icmp_socket->sk->sk_write_queue)) != NULL) {
                struct icmphdr *icmph = skb->h.icmph;
                unsigned int csum = 0;
                struct sk_buff *skb1;
@@ -936,8 +936,7 @@ int icmp_rcv(struct sk_buff *skb)
        case CHECKSUM_HW:
                if (!(u16)csum_fold(skb->csum))
                        break;
-                NETDEBUG(if (net_ratelimit())
+                LIMIT_NETDEBUG(printk(KERN_DEBUG "icmp v4 hw csum failure\n"));
-                                printk(KERN_DEBUG "icmp v4 hw csum failure\n"));
        case CHECKSUM_NONE:
                if ((u16)csum_fold(skb_checksum(skb, 0, skb->len, 0)))
                        goto error;
diff --git a/net/ipv4/inetpeer.c b/net/ipv4/inetpeer.c
index 95473953c406..ab18a853d7ce 100644
--- a/net/ipv4/inetpeer.c
+++ b/net/ipv4/inetpeer.c
@@ -450,10 +450,13 @@ static void peer_check_expire(unsigned long dummy)
        /* Trigger the timer after inet_peer_gc_mintime .. inet_peer_gc_maxtime
         * interval depending on the total number of entries (more entries,
         * less interval). */
-        peer_periodic_timer.expires = jiffies
+        if (peer_total >= inet_peer_threshold)
-                + inet_peer_gc_maxtime
+                peer_periodic_timer.expires = jiffies + inet_peer_gc_mintime;
-                - (inet_peer_gc_maxtime - inet_peer_gc_mintime) / HZ *
+        else
-                        peer_total / inet_peer_threshold * HZ;
+                peer_periodic_timer.expires = jiffies
+                        + inet_peer_gc_maxtime
+                        - (inet_peer_gc_maxtime - inet_peer_gc_mintime) / HZ *
+                                peer_total / inet_peer_threshold * HZ;
        add_timer(&peer_periodic_timer);
 }
diff --git a/net/ipv4/ip_fragment.c b/net/ipv4/ip_fragment.c
index 7f68e27eb4ea..eb377ae15305 100644
--- a/net/ipv4/ip_fragment.c
+++ b/net/ipv4/ip_fragment.c
@@ -377,7 +377,7 @@ static struct ipq *ip_frag_create(unsigned hash, struct iphdr *iph, u32 user)
        return ip_frag_intern(hash, qp);
 out_nomem:
-        NETDEBUG(if (net_ratelimit()) printk(KERN_ERR "ip_frag_create: no memory left !\n"));
+        LIMIT_NETDEBUG(printk(KERN_ERR "ip_frag_create: no memory left !\n"));
        return NULL;
 }
@@ -625,10 +625,8 @@ static struct sk_buff *ip_frag_reasm(struct ipq *qp, struct net_device *dev)
        return head;
 out_nomem:
-        NETDEBUG(if (net_ratelimit())
+        LIMIT_NETDEBUG(printk(KERN_ERR "IP: queue_glue: no memory for gluing "
-                 printk(KERN_ERR 
+                              "queue %p\n", qp));
-                        "IP: queue_glue: no memory for gluing queue %p\n",
-                        qp));
        goto out_fail;
 out_oversize:
        if (net_ratelimit())
diff --git a/net/ipv4/ip_gre.c b/net/ipv4/ip_gre.c
index 884835522224..f0d5740d7e22 100644
--- a/net/ipv4/ip_gre.c
+++ b/net/ipv4/ip_gre.c
@@ -290,7 +290,6 @@ static struct ip_tunnel * ipgre_tunnel_locate(struct ip_tunnel_parm *parms, int
        dev_hold(dev);
        ipgre_tunnel_link(nt);
-        /* Do not decrement MOD_USE_COUNT here. */
        return nt;
 failed:
@@ -1277,12 +1276,28 @@ err1:
        goto out;
 }
-static void ipgre_fini(void)
+static void __exit ipgre_destroy_tunnels(void)
+{
+        int prio;
+        for (prio = 0; prio < 4; prio++) {
+                int h;
+                for (h = 0; h < HASH_SIZE; h++) {
+                        struct ip_tunnel *t;
+                        while ((t = tunnels[prio][h]) != NULL)
+                                unregister_netdevice(t->dev);
+                }
+        }
+}
+static void __exit ipgre_fini(void)
 {
        if (inet_del_protocol(&ipgre_protocol, IPPROTO_GRE) < 0)
                printk(KERN_INFO "ipgre close: can't remove protocol\n");
-        unregister_netdev(ipgre_fb_tunnel_dev);
+        rtnl_lock();
+        ipgre_destroy_tunnels();
+        rtnl_unlock();
 }
 module_init(ipgre_init);
diff --git a/net/ipv4/ip_sockglue.c b/net/ipv4/ip_sockglue.c
index fc7c481d0d79..ff4bd067b397 100644
--- a/net/ipv4/ip_sockglue.c
+++ b/net/ipv4/ip_sockglue.c
@@ -848,6 +848,9 @@ mc_msf_out:
 
                case IP_IPSEC_POLICY:
                case IP_XFRM_POLICY:
+                        err = -EPERM;
+                        if (!capable(CAP_NET_ADMIN))
+                                break;
                        err = xfrm_user_policy(sk, optname, optval, optlen);
                        break;
diff --git a/net/ipv4/ipcomp.c b/net/ipv4/ipcomp.c
index 2065944fd9e5..7ded6e60f43a 100644
--- a/net/ipv4/ipcomp.c
+++ b/net/ipv4/ipcomp.c
@@ -358,7 +358,7 @@ static struct crypto_tfm **ipcomp_alloc_tfms(const char *alg_name)
        int cpu;
        /* This can be any valid CPU ID so we don't need locking. */
-        cpu = smp_processor_id();
+        cpu = raw_smp_processor_id();
        list_for_each_entry(pos, &ipcomp_tfms_list, list) {
                struct crypto_tfm *tfm;
diff --git a/net/ipv4/ipip.c b/net/ipv4/ipip.c
index 68a78731f722..c05c1df0bb04 100644
--- a/net/ipv4/ipip.c
+++ b/net/ipv4/ipip.c
@@ -255,7 +255,6 @@ static struct ip_tunnel * ipip_tunnel_locate(struct ip_tunnel_parm *parms, int c
        dev_hold(dev);
        ipip_tunnel_link(nt);
-        /* Do not decrement MOD_USE_COUNT here. */
        return nt;
 failed:
@@ -273,7 +272,7 @@ static void ipip_tunnel_uninit(struct net_device *dev)
        dev_put(dev);
 }
-static void ipip_err(struct sk_buff *skb, void *__unused)
+static void ipip_err(struct sk_buff *skb, u32 info)
 {
 #ifndef I_WISH_WORLD_WERE_PERFECT
@@ -852,11 +851,39 @@ static int __init ipip_fb_tunnel_init(struct net_device *dev)
        return 0;
 }
+#ifdef CONFIG_INET_TUNNEL
 static struct xfrm_tunnel ipip_handler = {
        .handler        =       ipip_rcv,
        .err_handler    =       ipip_err,
 };
+static inline int ipip_register(void)
+{
+        return xfrm4_tunnel_register(&ipip_handler);
+}
+static inline int ipip_unregister(void)
+{
+        return xfrm4_tunnel_deregister(&ipip_handler);
+}
+#else
+static struct net_protocol ipip_protocol = {
+        .handler        =       ipip_rcv,
+        .err_handler    =       ipip_err,
+        .no_policy      =       1,
+};
+static inline int ipip_register(void)
+{
+        return inet_add_protocol(&ipip_protocol, IPPROTO_IPIP);
+}
+static inline int ipip_unregister(void)
+{
+        return inet_del_protocol(&ipip_protocol, IPPROTO_IPIP);
+}
+#endif
 static char banner[] __initdata =
        KERN_INFO "IPv4 over IPv4 tunneling driver\n";
@@ -866,7 +893,7 @@ static int __init ipip_init(void)
        printk(banner);
-        if (xfrm4_tunnel_register(&ipip_handler) < 0) {
+        if (ipip_register() < 0) {
                printk(KERN_INFO "ipip init: can't register tunnel\n");
                return -EAGAIN;
        }
@@ -888,16 +915,33 @@ static int __init ipip_init(void)
 err2:
        free_netdev(ipip_fb_tunnel_dev);
 err1:
-        xfrm4_tunnel_deregister(&ipip_handler);
+        ipip_unregister();
        goto out;
 }
+static void __exit ipip_destroy_tunnels(void)
+{
+        int prio;
+        for (prio = 1; prio < 4; prio++) {
+                int h;
+                for (h = 0; h < HASH_SIZE; h++) {
+                        struct ip_tunnel *t;
+                        while ((t = tunnels[prio][h]) != NULL)
+                                unregister_netdevice(t->dev);
+                }
+        }
+}
 static void __exit ipip_fini(void)
 {
-        if (xfrm4_tunnel_deregister(&ipip_handler) < 0)
+        if (ipip_unregister() < 0)
                printk(KERN_INFO "ipip close: can't deregister tunnel\n");
-        unregister_netdev(ipip_fb_tunnel_dev);
+        rtnl_lock();
+        ipip_destroy_tunnels();
+        unregister_netdevice(ipip_fb_tunnel_dev);
+        rtnl_unlock();
 }
 module_init(ipip_init);
diff --git a/net/ipv4/ipmr.c b/net/ipv4/ipmr.c
index 7833d920bdba..dc806b578427 100644
--- a/net/ipv4/ipmr.c
+++ b/net/ipv4/ipmr.c
@@ -362,7 +362,7 @@ out:
 /* Fill oifs list. It is called under write locked mrt_lock. */
-static void ipmr_update_threshoulds(struct mfc_cache *cache, unsigned char *ttls)
+static void ipmr_update_thresholds(struct mfc_cache *cache, unsigned char *ttls)
 {
        int vifi;
@@ -727,7 +727,7 @@ static int ipmr_mfc_add(struct mfcctl *mfc, int mrtsock)
        if (c != NULL) {
                write_lock_bh(&mrt_lock);
                c->mfc_parent = mfc->mfcc_parent;
-                ipmr_update_threshoulds(c, mfc->mfcc_ttls);
+                ipmr_update_thresholds(c, mfc->mfcc_ttls);
                if (!mrtsock)
                        c->mfc_flags |= MFC_STATIC;
                write_unlock_bh(&mrt_lock);
@@ -744,7 +744,7 @@ static int ipmr_mfc_add(struct mfcctl *mfc, int mrtsock)
        c->mfc_origin=mfc->mfcc_origin.s_addr;
        c->mfc_mcastgrp=mfc->mfcc_mcastgrp.s_addr;
        c->mfc_parent=mfc->mfcc_parent;
-        ipmr_update_threshoulds(c, mfc->mfcc_ttls);
+        ipmr_update_thresholds(c, mfc->mfcc_ttls);
        if (!mrtsock)
                c->mfc_flags |= MFC_STATIC;
diff --git a/net/ipv4/netfilter/ip_conntrack_amanda.c b/net/ipv4/netfilter/ip_conntrack_amanda.c
index a78a320eee08..01e1b58322a9 100644
--- a/net/ipv4/netfilter/ip_conntrack_amanda.c
+++ b/net/ipv4/netfilter/ip_conntrack_amanda.c
@@ -101,14 +101,13 @@ static int help(struct sk_buff **pskb,
                if (port == 0 || len > 5)
                        break;
-                exp = ip_conntrack_expect_alloc();
+                exp = ip_conntrack_expect_alloc(ct);
                if (exp == NULL) {
                        ret = NF_DROP;
                        goto out;
                }
                exp->expectfn = NULL;
-                exp->master = ct;
                exp->tuple.src.ip = ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.src.ip;
                exp->tuple.src.u.tcp.port = 0;
@@ -126,10 +125,9 @@ static int help(struct sk_buff **pskb,
                        ret = ip_nat_amanda_hook(pskb, ctinfo,
                                                 tmp - amanda_buffer,
                                                 len, exp);
-                else if (ip_conntrack_expect_related(exp) != 0) {
+                else if (ip_conntrack_expect_related(exp) != 0)
-                        ip_conntrack_expect_free(exp);
                        ret = NF_DROP;
-                }
+                ip_conntrack_expect_put(exp);
        }
 out:
diff --git a/net/ipv4/netfilter/ip_conntrack_core.c b/net/ipv4/netfilter/ip_conntrack_core.c
index 4b78ebeb6635..a7f0c821a9b2 100644
--- a/net/ipv4/netfilter/ip_conntrack_core.c
+++ b/net/ipv4/netfilter/ip_conntrack_core.c
@@ -137,19 +137,12 @@ ip_ct_invert_tuple(struct ip_conntrack_tuple *inverse,
 /* ip_conntrack_expect helper functions */
-static void destroy_expect(struct ip_conntrack_expect *exp)
-{
-        ip_conntrack_put(exp->master);
-        IP_NF_ASSERT(!timer_pending(&exp->timeout));
-        kmem_cache_free(ip_conntrack_expect_cachep, exp);
-        CONNTRACK_STAT_INC(expect_delete);
-}
 static void unlink_expect(struct ip_conntrack_expect *exp)
 {
        ASSERT_WRITE_LOCK(&ip_conntrack_lock);
+        IP_NF_ASSERT(!timer_pending(&exp->timeout));
        list_del(&exp->list);
-        /* Logically in destroy_expect, but we hold the lock here. */
+        CONNTRACK_STAT_INC(expect_delete);
        exp->master->expecting--;
 }
@@ -160,7 +153,7 @@ static void expectation_timed_out(unsigned long ul_expect)
        write_lock_bh(&ip_conntrack_lock);
        unlink_expect(exp);
        write_unlock_bh(&ip_conntrack_lock);
-        destroy_expect(exp);
+        ip_conntrack_expect_put(exp);
 }
 /* If an expectation for this connection is found, it gets delete from
@@ -198,7 +191,7 @@ static void remove_expectations(struct ip_conntrack *ct)
        list_for_each_entry_safe(i, tmp, &ip_conntrack_expect_list, list) {
                if (i->master == ct && del_timer(&i->timeout)) {
                        unlink_expect(i);
-                        destroy_expect(i);
+                        ip_conntrack_expect_put(i);
                }
        }
 }
@@ -517,9 +510,14 @@ init_conntrack(const struct ip_conntrack_tuple *tuple,
                /* Welcome, Mr. Bond.  We've been expecting you... */
                __set_bit(IPS_EXPECTED_BIT, &conntrack->status);
                conntrack->master = exp->master;
-#if CONFIG_IP_NF_CONNTRACK_MARK
+#ifdef CONFIG_IP_NF_CONNTRACK_MARK
                conntrack->mark = exp->master->mark;
 #endif
+#if defined(CONFIG_IP_NF_TARGET_MASQUERADE) || \
+    defined(CONFIG_IP_NF_TARGET_MASQUERADE_MODULE)
+                /* this is ugly, but there is no other place where to put it */
+                conntrack->nat.masq_index = exp->master->nat.masq_index;
+#endif
                nf_conntrack_get(&conntrack->master->ct_general);
                CONNTRACK_STAT_INC(expect_new);
        } else {
@@ -537,7 +535,7 @@ init_conntrack(const struct ip_conntrack_tuple *tuple,
        if (exp) {
                if (exp->expectfn)
                        exp->expectfn(conntrack, exp);
-                destroy_expect(exp);
+                ip_conntrack_expect_put(exp);
        }
        return &conntrack->tuplehash[IP_CT_DIR_ORIGINAL];
@@ -729,14 +727,14 @@ void ip_conntrack_unexpect_related(struct ip_conntrack_expect *exp)
                if (expect_matches(i, exp) && del_timer(&i->timeout)) {
                        unlink_expect(i);
                        write_unlock_bh(&ip_conntrack_lock);
-                        destroy_expect(i);
+                        ip_conntrack_expect_put(i);
                        return;
                }
        }
        write_unlock_bh(&ip_conntrack_lock);
 }
-struct ip_conntrack_expect *ip_conntrack_expect_alloc(void)
+struct ip_conntrack_expect *ip_conntrack_expect_alloc(struct ip_conntrack *me)
 {
        struct ip_conntrack_expect *new;
@@ -745,18 +743,23 @@ struct ip_conntrack_expect *ip_conntrack_expect_alloc(void)
                DEBUGP("expect_related: OOM allocating expect\n");
                return NULL;
        }
-        new->master = NULL;
+        new->master = me;
+        atomic_inc(&new->master->ct_general.use);
+        atomic_set(&new->use, 1);
        return new;
 }
-void ip_conntrack_expect_free(struct ip_conntrack_expect *expect)
+void ip_conntrack_expect_put(struct ip_conntrack_expect *exp)
 {
-        kmem_cache_free(ip_conntrack_expect_cachep, expect);
+        if (atomic_dec_and_test(&exp->use)) {
+                ip_conntrack_put(exp->master);
+                kmem_cache_free(ip_conntrack_expect_cachep, exp);
+        }
 }
 static void ip_conntrack_expect_insert(struct ip_conntrack_expect *exp)
 {
-        atomic_inc(&exp->master->ct_general.use);
+        atomic_inc(&exp->use);
        exp->master->expecting++;
        list_add(&exp->list, &ip_conntrack_expect_list);
@@ -778,7 +781,7 @@ static void evict_oldest_expect(struct ip_conntrack *master)
                if (i->master == master) {
                        if (del_timer(&i->timeout)) {
                                unlink_expect(i);
-                                destroy_expect(i);
+                                ip_conntrack_expect_put(i);
                        }
                        break;
                }
@@ -810,8 +813,6 @@ int ip_conntrack_expect_related(struct ip_conntrack_expect *expect)
                        /* Refresh timer: if it's dying, ignore.. */
                        if (refresh_timer(i)) {
                                ret = 0;
-                                /* We don't need the one they've given us. */
-                                ip_conntrack_expect_free(expect);
                                goto out;
                        }
                } else if (expect_clash(i, expect)) {
@@ -881,7 +882,7 @@ void ip_conntrack_helper_unregister(struct ip_conntrack_helper *me)
        list_for_each_entry_safe(exp, tmp, &ip_conntrack_expect_list, list) {
                if (exp->master->helper == me && del_timer(&exp->timeout)) {
                        unlink_expect(exp);
-                        destroy_expect(exp);
+                        ip_conntrack_expect_put(exp);
                }
        }
        /* Get rid of expecteds, set helpers to NULL. */
@@ -1111,6 +1112,9 @@ void ip_conntrack_cleanup(void)
                schedule();
                goto i_see_dead_people;
        }
+        /* wait until all references to ip_conntrack_untracked are dropped */
+        while (atomic_read(&ip_conntrack_untracked.ct_general.use) > 1)
+                schedule();
        kmem_cache_destroy(ip_conntrack_cachep);
        kmem_cache_destroy(ip_conntrack_expect_cachep);
diff --git a/net/ipv4/netfilter/ip_conntrack_ftp.c b/net/ipv4/netfilter/ip_conntrack_ftp.c
index fea6dd2a00b6..7a3b773be3f9 100644
--- a/net/ipv4/netfilter/ip_conntrack_ftp.c
+++ b/net/ipv4/netfilter/ip_conntrack_ftp.c
@@ -376,7 +376,7 @@ static int help(struct sk_buff **pskb,
               fb_ptr + matchoff, matchlen, ntohl(th->seq) + matchoff);
                         
        /* Allocate expectation which will be inserted */
-        exp = ip_conntrack_expect_alloc();
+        exp = ip_conntrack_expect_alloc(ct);
        if (exp == NULL) {
                ret = NF_DROP;
                goto out;
@@ -403,8 +403,7 @@ static int help(struct sk_buff **pskb,
                   networks, or the packet filter itself). */
                if (!loose) {
                        ret = NF_ACCEPT;
-                        ip_conntrack_expect_free(exp);
+                        goto out_put_expect;
-                        goto out_update_nl;
                }
                exp->tuple.dst.ip = htonl((array[0] << 24) | (array[1] << 16)
                                         | (array[2] << 8) | array[3]);
@@ -419,7 +418,6 @@ static int help(struct sk_buff **pskb,
                  { 0xFFFFFFFF, { .tcp = { 0xFFFF } }, 0xFF }});
        exp->expectfn = NULL;
-        exp->master = ct;
        /* Now, NAT might want to mangle the packet, and register the
         * (possibly changed) expectation itself. */
@@ -428,13 +426,15 @@ static int help(struct sk_buff **pskb,
                                      matchoff, matchlen, exp, &seq);
        else {
                /* Can't expect this?  Best to drop packet now. */
-                if (ip_conntrack_expect_related(exp) != 0) {
+                if (ip_conntrack_expect_related(exp) != 0)
-                        ip_conntrack_expect_free(exp);
                        ret = NF_DROP;
-                } else
+                else
                        ret = NF_ACCEPT;
        }
+out_put_expect:
+        ip_conntrack_expect_put(exp);
 out_update_nl:
        /* Now if this ends in \n, update ftp info.  Seq may have been
         * adjusted by NAT code. */
diff --git a/net/ipv4/netfilter/ip_conntrack_irc.c b/net/ipv4/netfilter/ip_conntrack_irc.c
index cd98772cc332..4a28f297d502 100644
--- a/net/ipv4/netfilter/ip_conntrack_irc.c
+++ b/net/ipv4/netfilter/ip_conntrack_irc.c
@@ -197,7 +197,7 @@ static int help(struct sk_buff **pskb,
                                continue;
                        }
-                        exp = ip_conntrack_expect_alloc();
+                        exp = ip_conntrack_expect_alloc(ct);
                        if (exp == NULL) {
                                ret = NF_DROP;
                                goto out;
@@ -221,16 +221,14 @@ static int help(struct sk_buff **pskb,
                                { { 0, { 0 } },
                                  { 0xFFFFFFFF, { .tcp = { 0xFFFF } }, 0xFF }});
                        exp->expectfn = NULL;
-                        exp->master = ct;
                        if (ip_nat_irc_hook)
                                ret = ip_nat_irc_hook(pskb, ctinfo, 
                                                      addr_beg_p - ib_ptr,
                                                      addr_end_p - addr_beg_p,
                                                      exp);
-                        else if (ip_conntrack_expect_related(exp) != 0) {
+                        else if (ip_conntrack_expect_related(exp) != 0)
-                                ip_conntrack_expect_free(exp);
                                ret = NF_DROP;
-                        }
+                        ip_conntrack_expect_put(exp);
                        goto out;
                } /* for .. NUM_DCCPROTO */
        } /* while data < ... */
diff --git a/net/ipv4/netfilter/ip_conntrack_standalone.c b/net/ipv4/netfilter/ip_conntrack_standalone.c
index 1dd824f3cf0a..61798c46e91d 100644
--- a/net/ipv4/netfilter/ip_conntrack_standalone.c
+++ b/net/ipv4/netfilter/ip_conntrack_standalone.c
@@ -985,7 +985,7 @@ EXPORT_SYMBOL(ip_ct_refresh_acct);
 EXPORT_SYMBOL(ip_ct_protos);
 EXPORT_SYMBOL(ip_ct_find_proto);
 EXPORT_SYMBOL(ip_conntrack_expect_alloc);
-EXPORT_SYMBOL(ip_conntrack_expect_free);
+EXPORT_SYMBOL(ip_conntrack_expect_put);
 EXPORT_SYMBOL(ip_conntrack_expect_related);
 EXPORT_SYMBOL(ip_conntrack_unexpect_related);
 EXPORT_SYMBOL(ip_conntrack_tuple_taken);
diff --git a/net/ipv4/netfilter/ip_conntrack_tftp.c b/net/ipv4/netfilter/ip_conntrack_tftp.c
index 992fac3e36ee..f8ff170f390a 100644
--- a/net/ipv4/netfilter/ip_conntrack_tftp.c
+++ b/net/ipv4/netfilter/ip_conntrack_tftp.c
@@ -65,7 +65,7 @@ static int tftp_help(struct sk_buff **pskb,
                DUMP_TUPLE(&ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple);
                DUMP_TUPLE(&ct->tuplehash[IP_CT_DIR_REPLY].tuple);
-                exp = ip_conntrack_expect_alloc();
+                exp = ip_conntrack_expect_alloc(ct);
                if (exp == NULL)
                        return NF_DROP;
@@ -75,17 +75,15 @@ static int tftp_help(struct sk_buff **pskb,
                exp->mask.dst.u.udp.port = 0xffff;
                exp->mask.dst.protonum = 0xff;
                exp->expectfn = NULL;
-                exp->master = ct;
                DEBUGP("expect: ");
                DUMP_TUPLE(&exp->tuple);
                DUMP_TUPLE(&exp->mask);
                if (ip_nat_tftp_hook)
                        ret = ip_nat_tftp_hook(pskb, ctinfo, exp);
-                else if (ip_conntrack_expect_related(exp) != 0) {
+                else if (ip_conntrack_expect_related(exp) != 0)
-                        ip_conntrack_expect_free(exp);
                        ret = NF_DROP;
-                }
+                ip_conntrack_expect_put(exp);
                break;
        case TFTP_OPCODE_DATA:
        case TFTP_OPCODE_ACK:
diff --git a/net/ipv4/netfilter/ip_nat_amanda.c b/net/ipv4/netfilter/ip_nat_amanda.c
index da1f412583ed..706c8074f422 100644
--- a/net/ipv4/netfilter/ip_nat_amanda.c
+++ b/net/ipv4/netfilter/ip_nat_amanda.c
@@ -56,10 +56,8 @@ static unsigned int help(struct sk_buff **pskb,
                        break;
        }
-        if (port == 0) {
+        if (port == 0)
-                ip_conntrack_expect_free(exp);
                return NF_DROP;
-        }
        sprintf(buffer, "%u", port);
        ret = ip_nat_mangle_udp_packet(pskb, exp->master, ctinfo,
diff --git a/net/ipv4/netfilter/ip_nat_ftp.c b/net/ipv4/netfilter/ip_nat_ftp.c
index c6000e794ad6..d83757a70d9f 100644
--- a/net/ipv4/netfilter/ip_nat_ftp.c
+++ b/net/ipv4/netfilter/ip_nat_ftp.c
@@ -143,10 +143,8 @@ static unsigned int ip_nat_ftp(struct sk_buff **pskb,
                        break;
        }
-        if (port == 0) {
+        if (port == 0)
-                ip_conntrack_expect_free(exp);
                return NF_DROP;
-        }
        if (!mangle[type](pskb, newip, port, matchoff, matchlen, ct, ctinfo,
                          seq)) {
diff --git a/net/ipv4/netfilter/ip_nat_irc.c b/net/ipv4/netfilter/ip_nat_irc.c
index 9c1ca3381d56..de31942babe3 100644
--- a/net/ipv4/netfilter/ip_nat_irc.c
+++ b/net/ipv4/netfilter/ip_nat_irc.c
@@ -65,10 +65,8 @@ static unsigned int help(struct sk_buff **pskb,
                        break;
        }
-        if (port == 0) {
+        if (port == 0)
-                ip_conntrack_expect_free(exp);
                return NF_DROP;
-        }
        /*      strlen("\1DCC CHAT chat AAAAAAAA P\1\n")=27
         *      strlen("\1DCC SCHAT chat AAAAAAAA P\1\n")=28
diff --git a/net/ipv4/netfilter/ip_nat_proto_icmp.c b/net/ipv4/netfilter/ip_nat_proto_icmp.c
index a558cf0eee8a..6596c9ee1655 100644
--- a/net/ipv4/netfilter/ip_nat_proto_icmp.c
+++ b/net/ipv4/netfilter/ip_nat_proto_icmp.c
@@ -35,16 +35,17 @@ icmp_unique_tuple(struct ip_conntrack_tuple *tuple,
                  const struct ip_conntrack *conntrack)
 {
        static u_int16_t id;
-        unsigned int range_size
+        unsigned int range_size;
-                = (unsigned int)range->max.icmp.id - range->min.icmp.id + 1;
        unsigned int i;
+        range_size = ntohs(range->max.icmp.id) - ntohs(range->min.icmp.id) + 1;
        /* If no range specified... */
        if (!(range->flags & IP_NAT_RANGE_PROTO_SPECIFIED))
                range_size = 0xFFFF;
        for (i = 0; i < range_size; i++, id++) {
-                tuple->src.u.icmp.id = range->min.icmp.id + (id % range_size);
+                tuple->src.u.icmp.id = htons(ntohs(range->min.icmp.id) +
+                                             (id % range_size));
                if (!ip_nat_used_tuple(tuple, conntrack))
                        return 1;
        }
diff --git a/net/ipv4/netfilter/ip_nat_proto_tcp.c b/net/ipv4/netfilter/ip_nat_proto_tcp.c
index a91cfceff272..a98e36d2b3c6 100644
--- a/net/ipv4/netfilter/ip_nat_proto_tcp.c
+++ b/net/ipv4/netfilter/ip_nat_proto_tcp.c
@@ -40,7 +40,8 @@ tcp_unique_tuple(struct ip_conntrack_tuple *tuple,
                 enum ip_nat_manip_type maniptype,
                 const struct ip_conntrack *conntrack)
 {
-        static u_int16_t port, *portptr;
+        static u_int16_t port;
+        u_int16_t *portptr;
        unsigned int range_size, min, i;
        if (maniptype == IP_NAT_MANIP_SRC)
diff --git a/net/ipv4/netfilter/ip_nat_proto_udp.c b/net/ipv4/netfilter/ip_nat_proto_udp.c
index c669e3b5f5d0..9f66e5625664 100644
--- a/net/ipv4/netfilter/ip_nat_proto_udp.c
+++ b/net/ipv4/netfilter/ip_nat_proto_udp.c
@@ -41,7 +41,8 @@ udp_unique_tuple(struct ip_conntrack_tuple *tuple,
                 enum ip_nat_manip_type maniptype,
                 const struct ip_conntrack *conntrack)
 {
-        static u_int16_t port, *portptr;
+        static u_int16_t port;
+        u_int16_t *portptr;
        unsigned int range_size, min, i;
        if (maniptype == IP_NAT_MANIP_SRC)
diff --git a/net/ipv4/netfilter/ip_nat_standalone.c b/net/ipv4/netfilter/ip_nat_standalone.c
index bc59d0d6e89e..91d5ea1dbbc9 100644
--- a/net/ipv4/netfilter/ip_nat_standalone.c
+++ b/net/ipv4/netfilter/ip_nat_standalone.c
@@ -102,6 +102,10 @@ ip_nat_fn(unsigned int hooknum,
                return NF_ACCEPT;
        }
+        /* Don't try to NAT if this packet is not conntracked */
+        if (ct == &ip_conntrack_untracked)
+                return NF_ACCEPT;
        switch (ctinfo) {
        case IP_CT_RELATED:
        case IP_CT_RELATED+IP_CT_IS_REPLY:
diff --git a/net/ipv4/netfilter/ip_nat_tftp.c b/net/ipv4/netfilter/ip_nat_tftp.c
index 0343e0d64674..2215317c76b7 100644
--- a/net/ipv4/netfilter/ip_nat_tftp.c
+++ b/net/ipv4/netfilter/ip_nat_tftp.c
@@ -45,10 +45,8 @@ static unsigned int help(struct sk_buff **pskb,
        exp->saved_proto.udp.port = exp->tuple.dst.u.tcp.port;
        exp->dir = IP_CT_DIR_REPLY;
        exp->expectfn = ip_nat_follow_master;
-        if (ip_conntrack_expect_related(exp) != 0) {
+        if (ip_conntrack_expect_related(exp) != 0)
-                ip_conntrack_expect_free(exp);
                return NF_DROP;
-        }
        return NF_ACCEPT;
 }
diff --git a/net/ipv4/netfilter/ip_queue.c b/net/ipv4/netfilter/ip_queue.c
index eda1fba431a4..c6baa8174389 100644
--- a/net/ipv4/netfilter/ip_queue.c
+++ b/net/ipv4/netfilter/ip_queue.c
@@ -214,6 +214,12 @@ ipq_build_packet_message(struct ipq_queue_entry *entry, int *errp)
                break;
        
        case IPQ_COPY_PACKET:
+                if (entry->skb->ip_summed == CHECKSUM_HW &&
+                    (*errp = skb_checksum_help(entry->skb,
+                                               entry->info->outdev == NULL))) {
+                        read_unlock_bh(&queue_lock);
+                        return NULL;
+                }
                if (copy_range == 0 || copy_range > entry->skb->len)
                        data_len = entry->skb->len;
                else
@@ -385,6 +391,7 @@ ipq_mangle_ipv4(ipq_verdict_msg_t *v, struct ipq_queue_entry *e)
        if (!skb_ip_make_writable(&e->skb, v->data_len))
                return -ENOMEM;
        memcpy(e->skb->data, v->payload, v->data_len);
+        e->skb->ip_summed = CHECKSUM_NONE;
        e->skb->nfcache |= NFC_ALTERED;
        /*
diff --git a/net/ipv4/netfilter/ipt_ECN.c b/net/ipv4/netfilter/ipt_ECN.c
index ada9911118e9..94a0ce1c1c9d 100644
--- a/net/ipv4/netfilter/ipt_ECN.c
+++ b/net/ipv4/netfilter/ipt_ECN.c
@@ -61,16 +61,20 @@ set_ect_tcp(struct sk_buff **pskb, const struct ipt_ECN_info *einfo, int inward)
        if (!tcph)
                return 0;
-        if (!(einfo->operation & IPT_ECN_OP_SET_ECE
+        if ((!(einfo->operation & IPT_ECN_OP_SET_ECE) ||
-              || tcph->ece == einfo->proto.tcp.ece)
+             tcph->ece == einfo->proto.tcp.ece) &&
-            && (!(einfo->operation & IPT_ECN_OP_SET_CWR
+            ((!(einfo->operation & IPT_ECN_OP_SET_CWR) ||
-                  || tcph->cwr == einfo->proto.tcp.cwr)))
+             tcph->cwr == einfo->proto.tcp.cwr)))
                return 1;
        if (!skb_ip_make_writable(pskb, (*pskb)->nh.iph->ihl*4+sizeof(*tcph)))
                return 0;
        tcph = (void *)(*pskb)->nh.iph + (*pskb)->nh.iph->ihl*4;
+        if ((*pskb)->ip_summed == CHECKSUM_HW &&
+            skb_checksum_help(*pskb, inward))
+                return 0;
        diffs[0] = ((u_int16_t *)tcph)[6];
        if (einfo->operation & IPT_ECN_OP_SET_ECE)
                tcph->ece = einfo->proto.tcp.ece;
@@ -79,13 +83,10 @@ set_ect_tcp(struct sk_buff **pskb, const struct ipt_ECN_info *einfo, int inward)
        diffs[1] = ((u_int16_t *)tcph)[6];
        diffs[0] = diffs[0] ^ 0xFFFF;
-        if ((*pskb)->ip_summed != CHECKSUM_HW)
+        if ((*pskb)->ip_summed != CHECKSUM_UNNECESSARY)
                tcph->check = csum_fold(csum_partial((char *)diffs,
                                                     sizeof(diffs),
                                                     tcph->check^0xFFFF));
-        else
-                if (skb_checksum_help(*pskb, inward))
-                        return 0;
        (*pskb)->nfcache |= NFC_ALTERED;
        return 1;
 }
diff --git a/net/ipv4/netfilter/ipt_TCPMSS.c b/net/ipv4/netfilter/ipt_TCPMSS.c
index 1049050b2bfb..7b84a254440e 100644
--- a/net/ipv4/netfilter/ipt_TCPMSS.c
+++ b/net/ipv4/netfilter/ipt_TCPMSS.c
@@ -61,6 +61,10 @@ ipt_tcpmss_target(struct sk_buff **pskb,
        if (!skb_ip_make_writable(pskb, (*pskb)->len))
                return NF_DROP;
+        if ((*pskb)->ip_summed == CHECKSUM_HW &&
+            skb_checksum_help(*pskb, out == NULL))
+                return NF_DROP;
        iph = (*pskb)->nh.iph;
        tcplen = (*pskb)->len - iph->ihl*4;
@@ -186,9 +190,6 @@ ipt_tcpmss_target(struct sk_buff **pskb,
               newmss);
 retmodified:
-        /* We never hw checksum SYN packets.  */
-        BUG_ON((*pskb)->ip_summed == CHECKSUM_HW);
        (*pskb)->nfcache |= NFC_UNKNOWN | NFC_ALTERED;
        return IPT_CONTINUE;
 }
diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
index ddb6ce4ecff2..69b1fcf70077 100644
--- a/net/ipv4/tcp.c
+++ b/net/ipv4/tcp.c
@@ -584,7 +584,7 @@ static inline void skb_entail(struct sock *sk, struct tcp_sock *tp,
        sk_charge_skb(sk, skb);
        if (!sk->sk_send_head)
                sk->sk_send_head = skb;
-        else if (tp->nonagle&TCP_NAGLE_PUSH)
+        if (tp->nonagle & TCP_NAGLE_PUSH)
                tp->nonagle &= ~TCP_NAGLE_PUSH; 
 }
diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
index 62f62bb05c2a..67c670886c1f 100644
--- a/net/ipv4/tcp_ipv4.c
+++ b/net/ipv4/tcp_ipv4.c
@@ -242,9 +242,14 @@ static int tcp_v4_get_port(struct sock *sk, unsigned short snum)
                tcp_port_rover = rover;
                spin_unlock(&tcp_portalloc_lock);
-                /* Exhausted local port range during search? */
+                /* Exhausted local port range during search?  It is not
+                 * possible for us to be holding one of the bind hash
+                 * locks if this test triggers, because if 'remaining'
+                 * drops to zero, we broke out of the do/while loop at
+                 * the top level, not from the 'break;' statement.
+                 */
                ret = 1;
-                if (remaining <= 0)
+                if (unlikely(remaining <= 0))
                        goto fail;
                /* OK, here is the one we will use.  HEAD is
@@ -1494,12 +1499,11 @@ int tcp_v4_conn_request(struct sock *sk, struct sk_buff *skb)
                         * to destinations, already remembered
                         * to the moment of synflood.
                         */
-                        NETDEBUG(if (net_ratelimit()) \
+                        LIMIT_NETDEBUG(printk(KERN_DEBUG "TCP: drop open "
-                                        printk(KERN_DEBUG "TCP: drop open "
+                                              "request from %u.%u."
-                                                          "request from %u.%u."
+                                              "%u.%u/%u\n",
-                                                          "%u.%u/%u\n", \
+                                              NIPQUAD(saddr),
-                                               NIPQUAD(saddr),
+                                              ntohs(skb->h.th->source)));
-                                               ntohs(skb->h.th->source)));
                        dst_release(dst);
                        goto drop_and_free;
                }
@@ -1627,8 +1631,7 @@ static int tcp_v4_checksum_init(struct sk_buff *skb)
                                  skb->nh.iph->daddr, skb->csum))
                        return 0;
-                NETDEBUG(if (net_ratelimit())
+                LIMIT_NETDEBUG(printk(KERN_DEBUG "hw tcp v4 csum failed\n"));
-                                printk(KERN_DEBUG "hw tcp v4 csum failed\n"));
                skb->ip_summed = CHECKSUM_NONE;
        }
        if (skb->len <= 76) {
diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
index e3f8ea1bfa9c..dd30dd137b74 100644
--- a/net/ipv4/tcp_output.c
+++ b/net/ipv4/tcp_output.c
@@ -403,11 +403,9 @@ static void tcp_queue_skb(struct sock *sk, struct sk_buff *skb)
                sk->sk_send_head = skb;
 }
-static void tcp_set_skb_tso_segs(struct sock *sk, struct sk_buff *skb)
+static void tcp_set_skb_tso_segs(struct sock *sk, struct sk_buff *skb, unsigned int mss_now)
 {
-        struct tcp_sock *tp = tcp_sk(sk);
+        if (skb->len <= mss_now ||
-        if (skb->len <= tp->mss_cache ||
            !(sk->sk_route_caps & NETIF_F_TSO)) {
                /* Avoid the costly divide in the normal
                 * non-TSO case.
@@ -417,10 +415,10 @@ static void tcp_set_skb_tso_segs(struct sock *sk, struct sk_buff *skb)
        } else {
                unsigned int factor;
-                factor = skb->len + (tp->mss_cache - 1);
+                factor = skb->len + (mss_now - 1);
-                factor /= tp->mss_cache;
+                factor /= mss_now;
                skb_shinfo(skb)->tso_segs = factor;
-                skb_shinfo(skb)->tso_size = tp->mss_cache;
+                skb_shinfo(skb)->tso_size = mss_now;
        }
 }
@@ -429,7 +427,7 @@ static void tcp_set_skb_tso_segs(struct sock *sk, struct sk_buff *skb)
 * packet to the list.  This won't be called frequently, I hope. 
 * Remember, these are still headerless SKBs at this point.
 */
-static int tcp_fragment(struct sock *sk, struct sk_buff *skb, u32 len)
+static int tcp_fragment(struct sock *sk, struct sk_buff *skb, u32 len, unsigned int mss_now)
 {
        struct tcp_sock *tp = tcp_sk(sk);
        struct sk_buff *buff;
@@ -492,8 +490,8 @@ static int tcp_fragment(struct sock *sk, struct sk_buff *skb, u32 len)
        }
        /* Fix up tso_factor for both original and new SKB.  */
-        tcp_set_skb_tso_segs(sk, skb);
+        tcp_set_skb_tso_segs(sk, skb, mss_now);
-        tcp_set_skb_tso_segs(sk, buff);
+        tcp_set_skb_tso_segs(sk, buff, mss_now);
        if (TCP_SKB_CB(skb)->sacked & TCPCB_LOST) {
                tp->lost_out += tcp_skb_pcount(skb);
@@ -569,7 +567,7 @@ int tcp_trim_head(struct sock *sk, struct sk_buff *skb, u32 len)
         * factor and mss.
         */
        if (tcp_skb_pcount(skb) > 1)
-                tcp_set_skb_tso_segs(sk, skb);
+                tcp_set_skb_tso_segs(sk, skb, tcp_current_mss(sk, 1));
        return 0;
 }
@@ -734,12 +732,14 @@ static inline unsigned int tcp_cwnd_test(struct tcp_sock *tp, struct sk_buff *sk
 /* This must be invoked the first time we consider transmitting
 * SKB onto the wire.
 */
-static inline int tcp_init_tso_segs(struct sock *sk, struct sk_buff *skb)
+static inline int tcp_init_tso_segs(struct sock *sk, struct sk_buff *skb, unsigned int mss_now)
 {
        int tso_segs = tcp_skb_pcount(skb);
-        if (!tso_segs) {
+        if (!tso_segs ||
-                tcp_set_skb_tso_segs(sk, skb);
+            (tso_segs > 1 &&
+             skb_shinfo(skb)->tso_size != mss_now)) {
+                tcp_set_skb_tso_segs(sk, skb, mss_now);
                tso_segs = tcp_skb_pcount(skb);
        }
        return tso_segs;
@@ -817,7 +817,7 @@ static unsigned int tcp_snd_test(struct sock *sk, struct sk_buff *skb,
        struct tcp_sock *tp = tcp_sk(sk);
        unsigned int cwnd_quota;
-        tcp_init_tso_segs(sk, skb);
+        tcp_init_tso_segs(sk, skb, cur_mss);
        if (!tcp_nagle_test(tp, skb, cur_mss, nonagle))
                return 0;
@@ -854,14 +854,15 @@ int tcp_may_send_now(struct sock *sk, struct tcp_sock *tp)
 * know that all the data is in scatter-gather pages, and that the
 * packet has never been sent out before (and thus is not cloned).
 */
-static int tso_fragment(struct sock *sk, struct sk_buff *skb, unsigned int len)
+static int tso_fragment(struct sock *sk, struct sk_buff *skb, unsigned int len, unsigned int mss_now)
 {
        struct sk_buff *buff;
        int nlen = skb->len - len;
        u16 flags;
        /* All of a TSO frame must be composed of paged data.  */
-        BUG_ON(skb->len != skb->data_len);
+        if (skb->len != skb->data_len)
+                return tcp_fragment(sk, skb, len, mss_now);
        buff = sk_stream_alloc_pskb(sk, 0, 0, GFP_ATOMIC);
        if (unlikely(buff == NULL))
@@ -887,8 +888,8 @@ static int tso_fragment(struct sock *sk, struct sk_buff *skb, unsigned int len)
        skb_split(skb, buff, len);
        /* Fix up tso_factor for both original and new SKB.  */
-        tcp_set_skb_tso_segs(sk, skb);
+        tcp_set_skb_tso_segs(sk, skb, mss_now);
-        tcp_set_skb_tso_segs(sk, buff);
+        tcp_set_skb_tso_segs(sk, buff, mss_now);
        /* Link BUFF into the send queue. */
        skb_header_release(buff);
@@ -924,10 +925,6 @@ static int tcp_tso_should_defer(struct sock *sk, struct tcp_sock *tp, struct sk_
        limit = min(send_win, cong_win);
-        /* If sk_send_head can be sent fully now, just do it.  */
-        if (skb->len <= limit)
-                return 0;
        if (sysctl_tcp_tso_win_divisor) {
                u32 chunk = min(tp->snd_wnd, tp->snd_cwnd * tp->mss_cache);
@@ -972,19 +969,20 @@ static int tcp_write_xmit(struct sock *sk, unsigned int mss_now, int nonagle)
        if (unlikely(sk->sk_state == TCP_CLOSE))
                return 0;
-        skb = sk->sk_send_head;
-        if (unlikely(!skb))
-                return 0;
-        tso_segs = tcp_init_tso_segs(sk, skb);
-        cwnd_quota = tcp_cwnd_test(tp, skb);
-        if (unlikely(!cwnd_quota))
-                goto out;
        sent_pkts = 0;
-        while (likely(tcp_snd_wnd_test(tp, skb, mss_now))) {
+        while ((skb = sk->sk_send_head)) {
+                unsigned int limit;
+                tso_segs = tcp_init_tso_segs(sk, skb, mss_now);
                BUG_ON(!tso_segs);
+                cwnd_quota = tcp_cwnd_test(tp, skb);
+                if (!cwnd_quota)
+                        break;
+                if (unlikely(!tcp_snd_wnd_test(tp, skb, mss_now)))
+                        break;
                if (tso_segs == 1) {
                        if (unlikely(!tcp_nagle_test(tp, skb, mss_now,
                                                     (tcp_skb_is_last(sk, skb) ?
@@ -995,9 +993,10 @@ static int tcp_write_xmit(struct sock *sk, unsigned int mss_now, int nonagle)
                                break;
                }
+                limit = mss_now;
                if (tso_segs > 1) {
-                        u32 limit = tcp_window_allows(tp, skb,
+                        limit = tcp_window_allows(tp, skb,
-                                                      mss_now, cwnd_quota);
+                                                  mss_now, cwnd_quota);
                        if (skb->len < limit) {
                                unsigned int trim = skb->len % mss_now;
@@ -1005,15 +1004,12 @@ static int tcp_write_xmit(struct sock *sk, unsigned int mss_now, int nonagle)
                                if (trim)
                                        limit = skb->len - trim;
                        }
-                        if (skb->len > limit) {
-                                if (tso_fragment(sk, skb, limit))
-                                        break;
-                        }
-                } else if (unlikely(skb->len > mss_now)) {
-                        if (unlikely(tcp_fragment(sk, skb,  mss_now)))
-                                break;
                }
+                if (skb->len > limit &&
+                    unlikely(tso_fragment(sk, skb, limit, mss_now)))
+                        break;
                TCP_SKB_CB(skb)->when = tcp_time_stamp;
                if (unlikely(tcp_transmit_skb(sk, skb_clone(skb, GFP_ATOMIC))))
@@ -1026,27 +1022,12 @@ static int tcp_write_xmit(struct sock *sk, unsigned int mss_now, int nonagle)
                tcp_minshall_update(tp, mss_now, skb);
                sent_pkts++;
-                /* Do not optimize this to use tso_segs. If we chopped up
-                 * the packet above, tso_segs will no longer be valid.
-                 */
-                cwnd_quota -= tcp_skb_pcount(skb);
-                BUG_ON(cwnd_quota < 0);
-                if (!cwnd_quota)
-                        break;
-                skb = sk->sk_send_head;
-                if (!skb)
-                        break;
-                tso_segs = tcp_init_tso_segs(sk, skb);
        }
        if (likely(sent_pkts)) {
                tcp_cwnd_validate(sk, tp);
                return 0;
        }
-out:
        return !tp->packets_out && sk->sk_send_head;
 }
@@ -1076,15 +1057,18 @@ void tcp_push_one(struct sock *sk, unsigned int mss_now)
        BUG_ON(!skb || skb->len < mss_now);
-        tso_segs = tcp_init_tso_segs(sk, skb);
+        tso_segs = tcp_init_tso_segs(sk, skb, mss_now);
        cwnd_quota = tcp_snd_test(sk, skb, mss_now, TCP_NAGLE_PUSH);
        if (likely(cwnd_quota)) {
+                unsigned int limit;
                BUG_ON(!tso_segs);
+                limit = mss_now;
                if (tso_segs > 1) {
-                        u32 limit = tcp_window_allows(tp, skb,
+                        limit = tcp_window_allows(tp, skb,
-                                                      mss_now, cwnd_quota);
+                                                  mss_now, cwnd_quota);
                        if (skb->len < limit) {
                                unsigned int trim = skb->len % mss_now;
@@ -1092,15 +1076,12 @@ void tcp_push_one(struct sock *sk, unsigned int mss_now)
                                if (trim)
                                        limit = skb->len - trim;
                        }
-                        if (skb->len > limit) {
-                                if (unlikely(tso_fragment(sk, skb, limit)))
-                                        return;
-                        }
-                } else if (unlikely(skb->len > mss_now)) {
-                        if (unlikely(tcp_fragment(sk, skb, mss_now)))
-                                return;
                }
+                if (skb->len > limit &&
+                    unlikely(tso_fragment(sk, skb, limit, mss_now)))
+                        return;
                /* Send it out now. */
                TCP_SKB_CB(skb)->when = tcp_time_stamp;
@@ -1386,15 +1367,21 @@ int tcp_retransmit_skb(struct sock *sk, struct sk_buff *skb)
        if (skb->len > cur_mss) {
                int old_factor = tcp_skb_pcount(skb);
-                int new_factor;
+                int diff;
-                if (tcp_fragment(sk, skb, cur_mss))
+                if (tcp_fragment(sk, skb, cur_mss, cur_mss))
                        return -ENOMEM; /* We'll try again later. */
                /* New SKB created, account for it. */
-                new_factor = tcp_skb_pcount(skb);
+                diff = old_factor - tcp_skb_pcount(skb) -
-                tp->packets_out -= old_factor - new_factor;
+                       tcp_skb_pcount(skb->next);
-                tp->packets_out += tcp_skb_pcount(skb->next);
+                tp->packets_out -= diff;
+                if (diff > 0) {
+                        tp->fackets_out -= diff;
+                        if ((int)tp->fackets_out < 0)
+                                tp->fackets_out = 0;
+                }
        }
        /* Collapse two adjacent packets if worthwhile and we can. */
@@ -1991,7 +1978,7 @@ int tcp_write_wakeup(struct sock *sk)
                            skb->len > mss) {
                                seg_size = min(seg_size, mss);
                                TCP_SKB_CB(skb)->flags |= TCPCB_FLAG_PSH;
-                                if (tcp_fragment(sk, skb, seg_size))
+                                if (tcp_fragment(sk, skb, seg_size, mss))
                                        return -1;
                                /* SWS override triggered forced fragmentation.
                                 * Disable TSO, the connection is too sick. */
@@ -2000,7 +1987,7 @@ int tcp_write_wakeup(struct sock *sk)
                                        sk->sk_route_caps &= ~NETIF_F_TSO;
                                }
                        } else if (!tcp_skb_pcount(skb))
-                                tcp_set_skb_tso_segs(sk, skb);
+                                tcp_set_skb_tso_segs(sk, skb, mss);
                        TCP_SKB_CB(skb)->flags |= TCPCB_FLAG_PSH;
                        TCP_SKB_CB(skb)->when = tcp_time_stamp;
diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
index 7c24e64b443f..dc4d07357e3a 100644
--- a/net/ipv4/udp.c
+++ b/net/ipv4/udp.c
@@ -628,7 +628,7 @@ back_from_confirm:
                /* ... which is an evident application bug. --ANK */
                release_sock(sk);
-                NETDEBUG(if (net_ratelimit()) printk(KERN_DEBUG "udp cork app bug 2\n"));
+                LIMIT_NETDEBUG(printk(KERN_DEBUG "udp cork app bug 2\n"));
                err = -EINVAL;
                goto out;
        }
@@ -693,7 +693,7 @@ static int udp_sendpage(struct sock *sk, struct page *page, int offset,
        if (unlikely(!up->pending)) {
                release_sock(sk);
-                NETDEBUG(if (net_ratelimit()) printk(KERN_DEBUG "udp cork app bug 3\n"));
+                LIMIT_NETDEBUG(printk(KERN_DEBUG "udp cork app bug 3\n"));
                return -EINVAL;
        }
@@ -1102,7 +1102,7 @@ static int udp_checksum_init(struct sk_buff *skb, struct udphdr *uh,
                skb->ip_summed = CHECKSUM_UNNECESSARY;
                if (!udp_check(uh, ulen, saddr, daddr, skb->csum))
                        return 0;
-                NETDEBUG(if (net_ratelimit()) printk(KERN_DEBUG "udp v4 hw csum failure.\n"));
+                LIMIT_NETDEBUG(printk(KERN_DEBUG "udp v4 hw csum failure.\n"));
                skb->ip_summed = CHECKSUM_NONE;
        }
        if (skb->ip_summed != CHECKSUM_UNNECESSARY)
@@ -1181,14 +1181,13 @@ int udp_rcv(struct sk_buff *skb)
        return(0);
 short_packet:
-        NETDEBUG(if (net_ratelimit())
+        LIMIT_NETDEBUG(printk(KERN_DEBUG "UDP: short packet: From %u.%u.%u.%u:%u %d/%d to %u.%u.%u.%u:%u\n",
-                printk(KERN_DEBUG "UDP: short packet: From %u.%u.%u.%u:%u %d/%d to %u.%u.%u.%u:%u\n",
+                              NIPQUAD(saddr),
-                        NIPQUAD(saddr),
+                              ntohs(uh->source),
-                        ntohs(uh->source),
+                              ulen,
-                        ulen,
+                              len,
-                        len,
+                              NIPQUAD(daddr),
-                        NIPQUAD(daddr),
+                              ntohs(uh->dest)));
-                        ntohs(uh->dest)));
 no_header:
        UDP_INC_STATS_BH(UDP_MIB_INERRORS);
        kfree_skb(skb);
@@ -1199,13 +1198,12 @@ csum_error:
         * RFC1122: OK.  Discards the bad packet silently (as far as 
         * the network is concerned, anyway) as per 4.1.3.4 (MUST). 
         */
-        NETDEBUG(if (net_ratelimit())
+        LIMIT_NETDEBUG(printk(KERN_DEBUG "UDP: bad checksum. From %d.%d.%d.%d:%d to %d.%d.%d.%d:%d ulen %d\n",
-                 printk(KERN_DEBUG "UDP: bad checksum. From %d.%d.%d.%d:%d to %d.%d.%d.%d:%d ulen %d\n",
+                              NIPQUAD(saddr),
-                        NIPQUAD(saddr),
+                              ntohs(uh->source),
-                        ntohs(uh->source),
+                              NIPQUAD(daddr),
-                        NIPQUAD(daddr),
+                              ntohs(uh->dest),
-                        ntohs(uh->dest),
+                              ulen));
-                        ulen));
 drop:
        UDP_INC_STATS_BH(UDP_MIB_INERRORS);
        kfree_skb(skb);
diff --git a/net/ipv4/utils.c b/net/ipv4/utils.c
deleted file mode 100644
index 6aecd7a43534..000000000000
--- a/net/ipv4/utils.c
+++ /dev/null
@@ -1,59 +0,0 @@
-/*
- * INET         An implementation of the TCP/IP protocol suite for the LINUX
- *              operating system.  INET is implemented using the  BSD Socket
- *              interface as the means of communication with the user level.
- *
- *              Various kernel-resident INET utility functions; mainly
- *              for format conversion and debugging output.
- *
- * Version:     $Id: utils.c,v 1.8 2000/10/03 07:29:01 anton Exp $
- *
- * Author:      Fred N. van Kempen, <waltje@uWalt.NL.Mugnet.ORG>
- *
- * Fixes:
- *              Alan Cox        :       verify_area check.
- *              Alan Cox        :       removed old debugging.
- *              Andi Kleen      :       add net_ratelimit()  
- *
- *              This program is free software; you can redistribute it and/or
- *              modify it under the terms of the GNU General Public License
- *              as published by the Free Software Foundation; either version
- *              2 of the License, or (at your option) any later version.
- */
-#include <linux/module.h>
-#include <linux/types.h>
-#include <asm/byteorder.h>
-/*
- *      Convert an ASCII string to binary IP. 
- */
- 
-__u32 in_aton(const char *str)
-{
-        unsigned long l;
-        unsigned int val;
-        int i;
-        l = 0;
-        for (i = 0; i < 4; i++) 
-        {
-                l <<= 8;
-                if (*str != '\0') 
-                {
-                        val = 0;
-                        while (*str != '\0' && *str != '.') 
-                        {
-                                val *= 10;
-                                val += *str - '0';
-                                str++;
-                        }
-                        l |= val;
-                        if (*str != '\0') 
-                                str++;
-                }
-        }
-        return(htonl(l));
-}
-EXPORT_SYMBOL(in_aton);
diff --git a/net/ipv4/xfrm4_tunnel.c b/net/ipv4/xfrm4_tunnel.c
index e1fe360ed27a..afbb0d4cc305 100644
--- a/net/ipv4/xfrm4_tunnel.c
+++ b/net/ipv4/xfrm4_tunnel.c
@@ -78,10 +78,9 @@ static int ipip_rcv(struct sk_buff *skb)
 static void ipip_err(struct sk_buff *skb, u32 info)
 {
        struct xfrm_tunnel *handler = ipip_handler;
-        u32 arg = info;
        if (handler)
-                handler->err_handler(skb, &arg);
+                handler->err_handler(skb, info);
 }
 static int ipip_init_state(struct xfrm_state *x)
diff --git a/net/ipv6/Kconfig b/net/ipv6/Kconfig
index 95163cd52ae0..ab7a9124f985 100644
--- a/net/ipv6/Kconfig
+++ b/net/ipv6/Kconfig
@@ -91,7 +91,6 @@ config INET6_TUNNEL
 config IPV6_TUNNEL
        tristate "IPv6: IPv6-in-IPv6 tunnel"
        depends on IPV6
-        select INET6_TUNNEL
        ---help---
          Support for IPv6-in-IPv6 tunnels described in RFC 2473.
diff --git a/net/ipv6/ip6_input.c b/net/ipv6/ip6_input.c
index 866f10726c58..10fbb50daea4 100644
--- a/net/ipv6/ip6_input.c
+++ b/net/ipv6/ip6_input.c
@@ -198,12 +198,13 @@ resubmit:
                if (!raw_sk) {
                        if (xfrm6_policy_check(NULL, XFRM_POLICY_IN, skb)) {
                                IP6_INC_STATS_BH(IPSTATS_MIB_INUNKNOWNPROTOS);
-                                icmpv6_param_prob(skb, ICMPV6_UNK_NEXTHDR, nhoff);
+                                icmpv6_send(skb, ICMPV6_PARAMPROB,
+                                            ICMPV6_UNK_NEXTHDR, nhoff,
+                                            skb->dev);
                        }
-                } else {
+                } else
                        IP6_INC_STATS_BH(IPSTATS_MIB_INDELIVERS);
-                        kfree_skb(skb);
+                kfree_skb(skb);
-                }
        }
        rcu_read_unlock();
        return 0;
diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
index 1f2c2f9e353f..ae652ca14bc9 100644
--- a/net/ipv6/ip6_output.c
+++ b/net/ipv6/ip6_output.c
@@ -792,13 +792,8 @@ int ip6_dst_lookup(struct sock *sk, struct dst_entry **dst, struct flowi *fl)
        if (ipv6_addr_any(&fl->fl6_src)) {
                err = ipv6_get_saddr(*dst, &fl->fl6_dst, &fl->fl6_src);
-                if (err) {
+                if (err)
-#if IP6_DEBUG >= 2
-                        printk(KERN_DEBUG "ip6_dst_lookup: "
-                               "no available source address\n");
-#endif
                        goto out_err_release;
-                }
        }
        return 0;
diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c
index ba3b0c267f75..09613729404c 100644
--- a/net/ipv6/ip6_tunnel.c
+++ b/net/ipv6/ip6_tunnel.c
@@ -1110,11 +1110,39 @@ ip6ip6_fb_tnl_dev_init(struct net_device *dev)
        return 0;
 }
+#ifdef CONFIG_INET6_TUNNEL
 static struct xfrm6_tunnel ip6ip6_handler = {
-        .handler = ip6ip6_rcv,
+        .handler        = ip6ip6_rcv,
-        .err_handler = ip6ip6_err,
+        .err_handler    = ip6ip6_err,
 };
+static inline int ip6ip6_register(void)
+{
+        return xfrm6_tunnel_register(&ip6ip6_handler);
+}
+static inline int ip6ip6_unregister(void)
+{
+        return xfrm6_tunnel_deregister(&ip6ip6_handler);
+}
+#else
+static struct inet6_protocol xfrm6_tunnel_protocol = {
+        .handler        = ip6ip6_rcv,
+        .err_handler    = ip6ip6_err,
+        .flags          = INET6_PROTO_NOPOLICY|INET6_PROTO_FINAL,
+};
+static inline int ip6ip6_register(void)
+{
+        return inet6_add_protocol(&xfrm6_tunnel_protocol, IPPROTO_IPV6);
+}
+static inline int ip6ip6_unregister(void)
+{
+        return inet6_del_protocol(&xfrm6_tunnel_protocol, IPPROTO_IPV6);
+}
+#endif
 /**
 * ip6_tunnel_init - register protocol and reserve needed resources
 *
@@ -1125,7 +1153,7 @@ static int __init ip6_tunnel_init(void)
 {
        int  err;
-        if (xfrm6_tunnel_register(&ip6ip6_handler) < 0) {
+        if (ip6ip6_register() < 0) {
                printk(KERN_ERR "ip6ip6 init: can't register tunnel\n");
                return -EAGAIN;
        }
@@ -1144,7 +1172,7 @@ static int __init ip6_tunnel_init(void)
        }
        return 0;
 fail:
-        xfrm6_tunnel_deregister(&ip6ip6_handler);
+        ip6ip6_unregister();
        return err;
 }
@@ -1154,7 +1182,7 @@ fail:
 static void __exit ip6_tunnel_cleanup(void)
 {
-        if (xfrm6_tunnel_deregister(&ip6ip6_handler) < 0)
+        if (ip6ip6_unregister() < 0)
                printk(KERN_INFO "ip6ip6 close: can't deregister tunnel\n");
        unregister_netdev(ip6ip6_fb_tnl_dev);
diff --git a/net/ipv6/ipcomp6.c b/net/ipv6/ipcomp6.c
index 423feb46ccc0..135383ef538f 100644
--- a/net/ipv6/ipcomp6.c
+++ b/net/ipv6/ipcomp6.c
@@ -354,7 +354,7 @@ static struct crypto_tfm **ipcomp6_alloc_tfms(const char *alg_name)
        int cpu;
        /* This can be any valid CPU ID so we don't need locking. */
-        cpu = smp_processor_id();
+        cpu = raw_smp_processor_id();
        list_for_each_entry(pos, &ipcomp6_tfms_list, list) {
                struct crypto_tfm *tfm;
diff --git a/net/ipv6/ipv6_sockglue.c b/net/ipv6/ipv6_sockglue.c
index f3ef4c38d315..3bc144a79fa5 100644
--- a/net/ipv6/ipv6_sockglue.c
+++ b/net/ipv6/ipv6_sockglue.c
@@ -504,6 +504,9 @@ done:
                break;
        case IPV6_IPSEC_POLICY:
        case IPV6_XFRM_POLICY:
+                retv = -EPERM;
+                if (!capable(CAP_NET_ADMIN))
+                        break;
                retv = xfrm_user_policy(sk, optname, optval, optlen);
                break;
diff --git a/net/ipv6/netfilter/ip6_queue.c b/net/ipv6/netfilter/ip6_queue.c
index 750943e2d34e..a16df5b27c84 100644
--- a/net/ipv6/netfilter/ip6_queue.c
+++ b/net/ipv6/netfilter/ip6_queue.c
@@ -76,7 +76,9 @@ static DECLARE_MUTEX(ipqnl_sem);
 static void
 ipq_issue_verdict(struct ipq_queue_entry *entry, int verdict)
 {
+        local_bh_disable();
        nf_reinject(entry->skb, entry->info, verdict);
+        local_bh_enable();
        kfree(entry);
 }
@@ -209,6 +211,12 @@ ipq_build_packet_message(struct ipq_queue_entry *entry, int *errp)
                break;
        
        case IPQ_COPY_PACKET:
+                if (entry->skb->ip_summed == CHECKSUM_HW &&
+                    (*errp = skb_checksum_help(entry->skb,
+                                               entry->info->outdev == NULL))) {
+                        read_unlock_bh(&queue_lock);
+                        return NULL;
+                }
                if (copy_range == 0 || copy_range > entry->skb->len)
                        data_len = entry->skb->len;
                else
@@ -379,6 +387,7 @@ ipq_mangle_ipv6(ipq_verdict_msg_t *v, struct ipq_queue_entry *e)
        if (!skb_ip_make_writable(&e->skb, v->data_len))
                return -ENOMEM;
        memcpy(e->skb->data, v->payload, v->data_len);
+        e->skb->ip_summed = CHECKSUM_NONE;
        e->skb->nfcache |= NFC_ALTERED;
        /*
diff --git a/net/ipv6/netfilter/ip6t_LOG.c b/net/ipv6/netfilter/ip6t_LOG.c
index c44685e391b7..a692e26a4fa3 100644
--- a/net/ipv6/netfilter/ip6t_LOG.c
+++ b/net/ipv6/netfilter/ip6t_LOG.c
@@ -373,9 +373,10 @@ ip6t_log_packet(unsigned int hooknum,
                in ? in->name : "",
                out ? out->name : "");
        if (in && !out) {
+                unsigned int len;
                /* MAC logging for input chain only. */
                printk("MAC=");
-                if (skb->dev && skb->dev->hard_header_len &&
+                if (skb->dev && (len = skb->dev->hard_header_len) &&
                    skb->mac.raw != skb->nh.raw) {
                        unsigned char *p = skb->mac.raw;
                        int i;
@@ -384,9 +385,11 @@ ip6t_log_packet(unsigned int hooknum,
                            (p -= ETH_HLEN) < skb->head)
                                p = NULL;
-                        if (p != NULL)
+                        if (p != NULL) {
-                                for (i = 0; i < skb->dev->hard_header_len; i++)
+                                for (i = 0; i < len; i++)
-                                        printk("%02x", p[i]);
+                                        printk("%02x%s", p[i],
+                                               i == len - 1 ? "" : ":");
+                        }
                        printk(" ");
                        if (skb->dev->type == ARPHRD_SIT) {
diff --git a/net/ipv6/raw.c b/net/ipv6/raw.c
index e2b848ec9851..1d4d75b34d32 100644
--- a/net/ipv6/raw.c
+++ b/net/ipv6/raw.c
@@ -328,6 +328,8 @@ int rawv6_rcv(struct sock *sk, struct sk_buff *skb)
        if (skb->ip_summed != CHECKSUM_UNNECESSARY) {
                if (skb->ip_summed == CHECKSUM_HW) {
+                        skb_postpull_rcsum(skb, skb->nh.raw,
+                                           skb->h.raw - skb->nh.raw);
                        skb->ip_summed = CHECKSUM_UNNECESSARY;
                        if (csum_ipv6_magic(&skb->nh.ipv6h->saddr,
                                            &skb->nh.ipv6h->daddr,
diff --git a/net/ipv6/sit.c b/net/ipv6/sit.c
index b788f55e139b..e553e5b80d6e 100644
--- a/net/ipv6/sit.c
+++ b/net/ipv6/sit.c
@@ -195,7 +195,6 @@ static struct ip_tunnel * ipip6_tunnel_locate(struct ip_tunnel_parm *parms, int
        dev_hold(dev);
        ipip6_tunnel_link(nt);
-        /* Do not decrement MOD_USE_COUNT here. */
        return nt;
 failed:
@@ -794,10 +793,28 @@ static struct net_protocol sit_protocol = {
        .err_handler    =       ipip6_err,
 };
+static void __exit sit_destroy_tunnels(void)
+{
+        int prio;
+        for (prio = 1; prio < 4; prio++) {
+                int h;
+                for (h = 0; h < HASH_SIZE; h++) {
+                        struct ip_tunnel *t;
+                        while ((t = tunnels[prio][h]) != NULL)
+                                unregister_netdevice(t->dev);
+                }
+        }
+}
 void __exit sit_cleanup(void)
 {
        inet_del_protocol(&sit_protocol, IPPROTO_IPV6);
-        unregister_netdev(ipip6_fb_tunnel_dev);
+        rtnl_lock();
+        sit_destroy_tunnels();
+        unregister_netdevice(ipip6_fb_tunnel_dev);
+        rtnl_unlock();
 }
 int __init sit_init(void)
diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
index f6e288dc116e..ef29cfd936d3 100644
--- a/net/ipv6/tcp_ipv6.c
+++ b/net/ipv6/tcp_ipv6.c
@@ -158,9 +158,14 @@ static int tcp_v6_get_port(struct sock *sk, unsigned short snum)
                tcp_port_rover = rover;
                spin_unlock(&tcp_portalloc_lock);
-                /* Exhausted local port range during search? */
+                /* Exhausted local port range during search?  It is not
+                 * possible for us to be holding one of the bind hash
+                 * locks if this test triggers, because if 'remaining'
+                 * drops to zero, we broke out of the do/while loop at
+                 * the top level, not from the 'break;' statement.
+                 */
                ret = 1;
-                if (remaining <= 0)
+                if (unlikely(remaining <= 0))
                        goto fail;
                /* OK, here is the one we will use. */
diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c
index 3405fdf41b93..ff774a06c89d 100644
--- a/net/netlink/af_netlink.c
+++ b/net/netlink/af_netlink.c
@@ -648,7 +648,8 @@ void netlink_detachskb(struct sock *sk, struct sk_buff *skb)
        sock_put(sk);
 }
-static inline struct sk_buff *netlink_trim(struct sk_buff *skb, int allocation)
+static inline struct sk_buff *netlink_trim(struct sk_buff *skb,
+                                           unsigned int __nocast allocation)
 {
        int delta;
@@ -717,7 +718,7 @@ struct netlink_broadcast_data {
        int failure;
        int congested;
        int delivered;
-        int allocation;
+        unsigned int allocation;
        struct sk_buff *skb, *skb2;
 };
diff --git a/net/netrom/af_netrom.c b/net/netrom/af_netrom.c
index 31ed4a9a1d06..162a85fed150 100644
--- a/net/netrom/af_netrom.c
+++ b/net/netrom/af_netrom.c
@@ -459,12 +459,7 @@ static struct sock *nr_make_new(struct sock *osk)
        sk->sk_sndbuf   = osk->sk_sndbuf;
        sk->sk_state    = TCP_ESTABLISHED;
        sk->sk_sleep    = osk->sk_sleep;
+        sock_copy_flags(sk, osk);
-        if (sock_flag(osk, SOCK_ZAPPED))
-                sock_set_flag(sk, SOCK_ZAPPED);
-        if (sock_flag(osk, SOCK_DBG))
-                sock_set_flag(sk, SOCK_DBG);
        skb_queue_head_init(&nr->ack_queue);
        skb_queue_head_init(&nr->reseq_queue);
@@ -541,7 +536,8 @@ static int nr_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
        struct nr_sock *nr = nr_sk(sk);
        struct full_sockaddr_ax25 *addr = (struct full_sockaddr_ax25 *)uaddr;
        struct net_device *dev;
-        ax25_address *user, *source;
+        ax25_uid_assoc *user;
+        ax25_address *source;
        lock_sock(sk);
        if (!sock_flag(sk, SOCK_ZAPPED)) {
@@ -580,16 +576,19 @@ static int nr_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
        } else {
                source = &addr->fsa_ax25.sax25_call;
-                if ((user = ax25_findbyuid(current->euid)) == NULL) {
+                user = ax25_findbyuid(current->euid);
+                if (user) {
+                        nr->user_addr   = user->call;
+                        ax25_uid_put(user);
+                } else {
                        if (ax25_uid_policy && !capable(CAP_NET_BIND_SERVICE)) {
                                release_sock(sk);
                                dev_put(dev);
                                return -EPERM;
                        }
-                        user = source;
+                        nr->user_addr   = *source;
                }
-                nr->user_addr   = *user;
                nr->source_addr = *source;
        }
@@ -609,7 +608,8 @@ static int nr_connect(struct socket *sock, struct sockaddr *uaddr,
        struct sock *sk = sock->sk;
        struct nr_sock *nr = nr_sk(sk);
        struct sockaddr_ax25 *addr = (struct sockaddr_ax25 *)uaddr;
-        ax25_address *user, *source = NULL;
+        ax25_address *source = NULL;
+        ax25_uid_assoc *user;
        struct net_device *dev;
        lock_sock(sk);
@@ -650,16 +650,19 @@ static int nr_connect(struct socket *sock, struct sockaddr *uaddr,
                }
                source = (ax25_address *)dev->dev_addr;
-                if ((user = ax25_findbyuid(current->euid)) == NULL) {
+                user = ax25_findbyuid(current->euid);
+                if (user) {
+                        nr->user_addr   = user->call;
+                        ax25_uid_put(user);
+                } else {
                        if (ax25_uid_policy && !capable(CAP_NET_ADMIN)) {
                                dev_put(dev);
                                release_sock(sk);
                                return -EPERM;
                        }
-                        user = source;
+                        nr->user_addr   = *source;
                }
-                nr->user_addr   = *user;
                nr->source_addr = *source;
                nr->device      = dev;
diff --git a/net/rose/af_rose.c b/net/rose/af_rose.c
index 7eb6a5bf93ea..5480caf8ccc2 100644
--- a/net/rose/af_rose.c
+++ b/net/rose/af_rose.c
@@ -556,12 +556,7 @@ static struct sock *rose_make_new(struct sock *osk)
        sk->sk_sndbuf   = osk->sk_sndbuf;
        sk->sk_state    = TCP_ESTABLISHED;
        sk->sk_sleep    = osk->sk_sleep;
+        sock_copy_flags(sk, osk);
-        if (sock_flag(osk, SOCK_ZAPPED))
-                sock_set_flag(sk, SOCK_ZAPPED);
-        if (sock_flag(osk, SOCK_DBG))
-                sock_set_flag(sk, SOCK_DBG);
        init_timer(&rose->timer);
        init_timer(&rose->idletimer);
@@ -631,7 +626,8 @@ static int rose_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
        struct rose_sock *rose = rose_sk(sk);
        struct sockaddr_rose *addr = (struct sockaddr_rose *)uaddr;
        struct net_device *dev;
-        ax25_address *user, *source;
+        ax25_address *source;
+        ax25_uid_assoc *user;
        int n;
        if (!sock_flag(sk, SOCK_ZAPPED))
@@ -656,14 +652,17 @@ static int rose_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
        source = &addr->srose_call;
-        if ((user = ax25_findbyuid(current->euid)) == NULL) {
+        user = ax25_findbyuid(current->euid);
+        if (user) {
+                rose->source_call = user->call;
+                ax25_uid_put(user);
+        } else {
                if (ax25_uid_policy && !capable(CAP_NET_BIND_SERVICE))
                        return -EACCES;
-                user = source;
+                rose->source_call   = *source;
        }
        rose->source_addr   = addr->srose_addr;
-        rose->source_call   = *user;
        rose->device        = dev;
        rose->source_ndigis = addr->srose_ndigis;
@@ -690,8 +689,8 @@ static int rose_connect(struct socket *sock, struct sockaddr *uaddr, int addr_le
        struct rose_sock *rose = rose_sk(sk);
        struct sockaddr_rose *addr = (struct sockaddr_rose *)uaddr;
        unsigned char cause, diagnostic;
-        ax25_address *user;
        struct net_device *dev;
+        ax25_uid_assoc *user;
        int n;
        if (sk->sk_state == TCP_ESTABLISHED && sock->state == SS_CONNECTING) {
@@ -741,12 +740,14 @@ static int rose_connect(struct socket *sock, struct sockaddr *uaddr, int addr_le
                if ((dev = rose_dev_first()) == NULL)
                        return -ENETUNREACH;
-                if ((user = ax25_findbyuid(current->euid)) == NULL)
+                user = ax25_findbyuid(current->euid);
+                if (!user)
                        return -EINVAL;
                memcpy(&rose->source_addr, dev->dev_addr, ROSE_ADDR_LEN);
-                rose->source_call = *user;
+                rose->source_call = user->call;
                rose->device      = dev;
+                ax25_uid_put(user);
                rose_insert_socket(sk);         /* Finish the bind */
        }
diff --git a/net/rose/rose_route.c b/net/rose/rose_route.c
index ff73ebb912b8..25da6f699fd0 100644
--- a/net/rose/rose_route.c
+++ b/net/rose/rose_route.c
@@ -994,8 +994,10 @@ int rose_route_frame(struct sk_buff *skb, ax25_cb *ax25)
         *      1. The frame isn't for us,
         *      2. It isn't "owned" by any existing route.
         */
-        if (frametype != ROSE_CALL_REQUEST)     /* XXX */
+        if (frametype != ROSE_CALL_REQUEST) {   /* XXX */
-                return 0;
+                res = 0;
+                goto out;
+        }
        len  = (((skb->data[3] >> 4) & 0x0F) + 1) / 2;
        len += (((skb->data[3] >> 0) & 0x0F) + 1) / 2;
diff --git a/net/sched/em_meta.c b/net/sched/em_meta.c
index 53d98f8d3d80..00eae5f9a01a 100644
--- a/net/sched/em_meta.c
+++ b/net/sched/em_meta.c
@@ -27,17 +27,17 @@
 *               lvalue                                   rvalue
 *            +-----------+                           +-----------+
 *            | type: INT |                           | type: INT |
- *       def  | id: INDEV |                           | id: VALUE |
+ *       def  | id: DEV   |                           | id: VALUE |
 *            | data:     |                           | data: 3   |
 *            +-----------+                           +-----------+
 *                  |                                       |
- *                  ---> meta_ops[INT][INDEV](...)          |
+ *                  ---> meta_ops[INT][DEV](...)            |
 *                            |                             |
 *                  -----------                             |
 *                  V                                       V
 *            +-----------+                           +-----------+
 *            | type: INT |                           | type: INT |
- *       obj  | id: INDEV |                           | id: VALUE |
+ *       obj  | id: DEV |                             | id: VALUE |
 *            | data: 2   |<--data got filled out     | data: 3   |
 *            +-----------+                           +-----------+
 *                  |                                         |
@@ -170,26 +170,6 @@ META_COLLECTOR(var_dev)
        *err = var_dev(skb->dev, dst);
 }
-META_COLLECTOR(int_indev)
-{
-        *err = int_dev(skb->input_dev, dst);
-}
-META_COLLECTOR(var_indev)
-{
-        *err = var_dev(skb->input_dev, dst);
-}
-META_COLLECTOR(int_realdev)
-{
-        *err = int_dev(skb->real_dev, dst);
-}
-META_COLLECTOR(var_realdev)
-{
-        *err = var_dev(skb->real_dev, dst);
-}
 /**************************************************************************
 * skb attributes
 **************************************************************************/
@@ -229,12 +209,14 @@ META_COLLECTOR(int_maclen)
 * Netfilter
 **************************************************************************/
-#ifdef CONFIG_NETFILTER
 META_COLLECTOR(int_nfmark)
 {
+#ifdef CONFIG_NETFILTER
        dst->value = skb->nfmark;
-}
+#else
+        dst->value = 0;
 #endif
+}
 /**************************************************************************
 * Traffic Control
@@ -245,31 +227,21 @@ META_COLLECTOR(int_tcindex)
        dst->value = skb->tc_index;
 }
-#ifdef CONFIG_NET_CLS_ACT
-META_COLLECTOR(int_tcverd)
-{
-        dst->value = skb->tc_verd;
-}
-META_COLLECTOR(int_tcclassid)
-{
-        dst->value = skb->tc_classid;
-}
-#endif
 /**************************************************************************
 * Routing
 **************************************************************************/
-#ifdef CONFIG_NET_CLS_ROUTE
 META_COLLECTOR(int_rtclassid)
 {
        if (unlikely(skb->dst == NULL))
                *err = -1;
        else
+#ifdef CONFIG_NET_CLS_ROUTE
                dst->value = skb->dst->tclassid;
-}
+#else
+                dst->value = 0;
 #endif
+}
 META_COLLECTOR(int_rtiif)
 {
@@ -505,8 +477,6 @@ struct meta_ops
 static struct meta_ops __meta_ops[TCF_META_TYPE_MAX+1][TCF_META_ID_MAX+1] = {
        [TCF_META_TYPE_VAR] = {
                [META_ID(DEV)]                  = META_FUNC(var_dev),
-                [META_ID(INDEV)]                = META_FUNC(var_indev),
-                [META_ID(REALDEV)]              = META_FUNC(var_realdev),
                [META_ID(SK_BOUND_IF)]          = META_FUNC(var_sk_bound_if),
        },
        [TCF_META_TYPE_INT] = {
@@ -515,25 +485,15 @@ static struct meta_ops __meta_ops[TCF_META_TYPE_MAX+1][TCF_META_ID_MAX+1] = {
                [META_ID(LOADAVG_1)]            = META_FUNC(int_loadavg_1),
                [META_ID(LOADAVG_2)]            = META_FUNC(int_loadavg_2),
                [META_ID(DEV)]                  = META_FUNC(int_dev),
-                [META_ID(INDEV)]                = META_FUNC(int_indev),
-                [META_ID(REALDEV)]              = META_FUNC(int_realdev),
                [META_ID(PRIORITY)]             = META_FUNC(int_priority),
                [META_ID(PROTOCOL)]             = META_FUNC(int_protocol),
                [META_ID(PKTTYPE)]              = META_FUNC(int_pkttype),
                [META_ID(PKTLEN)]               = META_FUNC(int_pktlen),
                [META_ID(DATALEN)]              = META_FUNC(int_datalen),
                [META_ID(MACLEN)]               = META_FUNC(int_maclen),
-#ifdef CONFIG_NETFILTER
                [META_ID(NFMARK)]               = META_FUNC(int_nfmark),
-#endif
                [META_ID(TCINDEX)]              = META_FUNC(int_tcindex),
-#ifdef CONFIG_NET_CLS_ACT
-                [META_ID(TCVERDICT)]            = META_FUNC(int_tcverd),
-                [META_ID(TCCLASSID)]            = META_FUNC(int_tcclassid),
-#endif
-#ifdef CONFIG_NET_CLS_ROUTE
                [META_ID(RTCLASSID)]            = META_FUNC(int_rtclassid),
-#endif
                [META_ID(RTIIF)]                = META_FUNC(int_rtiif),
                [META_ID(SK_FAMILY)]            = META_FUNC(int_sk_family),
                [META_ID(SK_STATE)]             = META_FUNC(int_sk_state),
diff --git a/net/sched/em_text.c b/net/sched/em_text.c
index 873840d8d072..77beabc91fa3 100644
--- a/net/sched/em_text.c
+++ b/net/sched/em_text.c
@@ -55,9 +55,6 @@ static int em_text_change(struct tcf_proto *tp, void *data, int len,
        struct ts_config *ts_conf;
        int flags = 0;
-        printk("Configuring text: %s from %d:%d to %d:%d len %d\n", conf->algo, conf->from_offset,
-            conf->from_layer, conf->to_offset, conf->to_layer, conf->pattern_len);
        if (len < sizeof(*conf) || len < (sizeof(*conf) + conf->pattern_len))
                return -EINVAL;
diff --git a/net/sched/sch_generic.c b/net/sched/sch_generic.c
index 73e218e646ac..0d066c965342 100644
--- a/net/sched/sch_generic.c
+++ b/net/sched/sch_generic.c
@@ -331,11 +331,10 @@ static struct sk_buff *pfifo_fast_dequeue(struct Qdisc* qdisc)
        int prio;
        struct sk_buff_head *list = qdisc_priv(qdisc);
-        for (prio = 0; prio < PFIFO_FAST_BANDS; prio++, list++) {
+        for (prio = 0; prio < PFIFO_FAST_BANDS; prio++) {
-                struct sk_buff *skb = __qdisc_dequeue_head(qdisc, list);
+                if (!skb_queue_empty(list + prio)) {
-                if (skb) {
                        qdisc->q.qlen--;
-                        return skb;
+                        return __qdisc_dequeue_head(qdisc, list + prio);
                }
        }
@@ -439,6 +438,7 @@ struct Qdisc * qdisc_create_dflt(struct net_device *dev, struct Qdisc_ops *ops)
        if (!ops->init || ops->init(sch, NULL) == 0)
                return sch;
+        qdisc_destroy(sch);
 errout:
        return NULL;
 }
diff --git a/net/sctp/input.c b/net/sctp/input.c
index 5e085e041a6e..742be9171b7d 100644
--- a/net/sctp/input.c
+++ b/net/sctp/input.c
@@ -351,7 +351,6 @@ void sctp_icmp_frag_needed(struct sock *sk, struct sctp_association *asoc,
 *
 */
 void sctp_icmp_proto_unreachable(struct sock *sk,
-                           struct sctp_endpoint *ep,
                           struct sctp_association *asoc,
                           struct sctp_transport *t)
 {
@@ -367,7 +366,6 @@ void sctp_icmp_proto_unreachable(struct sock *sk,
 /* Common lookup code for icmp/icmpv6 error handler. */
 struct sock *sctp_err_lookup(int family, struct sk_buff *skb,
                             struct sctphdr *sctphdr,
-                             struct sctp_endpoint **epp,
                             struct sctp_association **app,
                             struct sctp_transport **tpp)
 {
@@ -375,11 +373,10 @@ struct sock *sctp_err_lookup(int family, struct sk_buff *skb,
        union sctp_addr daddr;
        struct sctp_af *af;
        struct sock *sk = NULL;
-        struct sctp_endpoint *ep = NULL;
        struct sctp_association *asoc = NULL;
        struct sctp_transport *transport = NULL;
-        *app = NULL; *epp = NULL; *tpp = NULL;
+        *app = NULL; *tpp = NULL;
        af = sctp_get_af_specific(family);
        if (unlikely(!af)) {
@@ -394,26 +391,15 @@ struct sock *sctp_err_lookup(int family, struct sk_buff *skb,
         * packet.
         */
        asoc = __sctp_lookup_association(&saddr, &daddr, &transport);
-        if (!asoc) {
+        if (!asoc)
-                /* If there is no matching association, see if it matches any
+                return NULL;
-                 * endpoint. This may happen for an ICMP error generated in
-                 * response to an INIT_ACK.
-                 */
-                ep = __sctp_rcv_lookup_endpoint(&daddr);
-                if (!ep) {
-                        return NULL;
-                }
-        }
-        if (asoc) {
+        sk = asoc->base.sk;
-                sk = asoc->base.sk;
-                if (ntohl(sctphdr->vtag) != asoc->c.peer_vtag) {
+        if (ntohl(sctphdr->vtag) != asoc->c.peer_vtag) {
-                        ICMP_INC_STATS_BH(ICMP_MIB_INERRORS);
+                ICMP_INC_STATS_BH(ICMP_MIB_INERRORS);
-                        goto out;
+                goto out;
-                }
+        }
-        } else
-                sk = ep->base.sk;
        sctp_bh_lock_sock(sk);
@@ -423,7 +409,6 @@ struct sock *sctp_err_lookup(int family, struct sk_buff *skb,
        if (sock_owned_by_user(sk))
                NET_INC_STATS_BH(LINUX_MIB_LOCKDROPPEDICMPS);
-        *epp = ep;
        *app = asoc;
        *tpp = transport;
        return sk;
@@ -432,21 +417,16 @@ out:
        sock_put(sk);
        if (asoc)
                sctp_association_put(asoc);
-        if (ep)
-                sctp_endpoint_put(ep);
        return NULL;
 }
 /* Common cleanup code for icmp/icmpv6 error handler. */
-void sctp_err_finish(struct sock *sk, struct sctp_endpoint *ep,
+void sctp_err_finish(struct sock *sk, struct sctp_association *asoc)
-                     struct sctp_association *asoc)
 {
        sctp_bh_unlock_sock(sk);
        sock_put(sk);
        if (asoc)
                sctp_association_put(asoc);
-        if (ep)
-                sctp_endpoint_put(ep);
 }
 /*
@@ -471,7 +451,6 @@ void sctp_v4_err(struct sk_buff *skb, __u32 info)
        int type = skb->h.icmph->type;
        int code = skb->h.icmph->code;
        struct sock *sk;
-        struct sctp_endpoint *ep;
        struct sctp_association *asoc;
        struct sctp_transport *transport;
        struct inet_sock *inet;
@@ -488,7 +467,7 @@ void sctp_v4_err(struct sk_buff *skb, __u32 info)
        savesctp  = skb->h.raw;
        skb->nh.iph = iph;
        skb->h.raw = (char *)sh;
-        sk = sctp_err_lookup(AF_INET, skb, sh, &ep, &asoc, &transport);
+        sk = sctp_err_lookup(AF_INET, skb, sh, &asoc, &transport);
        /* Put back, the original pointers. */
        skb->nh.raw = saveip;
        skb->h.raw = savesctp;
@@ -515,7 +494,7 @@ void sctp_v4_err(struct sk_buff *skb, __u32 info)
                }
                else {
                        if (ICMP_PROT_UNREACH == code) {
-                                sctp_icmp_proto_unreachable(sk, ep, asoc,
+                                sctp_icmp_proto_unreachable(sk, asoc,
                                                            transport);
                                goto out_unlock;
                        }
@@ -544,7 +523,7 @@ void sctp_v4_err(struct sk_buff *skb, __u32 info)
        }
 out_unlock:
-        sctp_err_finish(sk, ep, asoc);
+        sctp_err_finish(sk, asoc);
 }
 /*
diff --git a/net/sctp/ipv6.c b/net/sctp/ipv6.c
index c7e42d125b9c..e9b2fd480d61 100644
--- a/net/sctp/ipv6.c
+++ b/net/sctp/ipv6.c
@@ -91,7 +91,6 @@ SCTP_STATIC void sctp_v6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
        struct ipv6hdr *iph = (struct ipv6hdr *)skb->data;
        struct sctphdr *sh = (struct sctphdr *)(skb->data + offset);
        struct sock *sk;
-        struct sctp_endpoint *ep;
        struct sctp_association *asoc;
        struct sctp_transport *transport;
        struct ipv6_pinfo *np;
@@ -105,7 +104,7 @@ SCTP_STATIC void sctp_v6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
        savesctp  = skb->h.raw;
        skb->nh.ipv6h = iph;
        skb->h.raw = (char *)sh;
-        sk = sctp_err_lookup(AF_INET6, skb, sh, &ep, &asoc, &transport);
+        sk = sctp_err_lookup(AF_INET6, skb, sh, &asoc, &transport);
        /* Put back, the original pointers. */
        skb->nh.raw = saveip;
        skb->h.raw = savesctp;
@@ -124,7 +123,7 @@ SCTP_STATIC void sctp_v6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
                goto out_unlock;
        case ICMPV6_PARAMPROB:
                if (ICMPV6_UNK_NEXTHDR == code) {
-                        sctp_icmp_proto_unreachable(sk, ep, asoc, transport);
+                        sctp_icmp_proto_unreachable(sk, asoc, transport);
                        goto out_unlock;
                }
                break;
@@ -142,7 +141,7 @@ SCTP_STATIC void sctp_v6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
        }
 out_unlock:
-        sctp_err_finish(sk, ep, asoc);
+        sctp_err_finish(sk, asoc);
 out:
        if (likely(idev != NULL))
                in6_dev_put(idev);
diff --git a/net/sctp/objcnt.c b/net/sctp/objcnt.c
index 0781e5d509fd..8ff588f0d76a 100644
--- a/net/sctp/objcnt.c
+++ b/net/sctp/objcnt.c
@@ -127,8 +127,12 @@ done:
 /* Initialize the objcount in the proc filesystem.  */
 void sctp_dbg_objcnt_init(void)
 {
-        create_proc_read_entry("sctp_dbg_objcnt", 0, proc_net_sctp,
+        struct proc_dir_entry *ent;
+        ent = create_proc_read_entry("sctp_dbg_objcnt", 0, proc_net_sctp,
                               sctp_dbg_objcnt_read, NULL);
+        if (!ent)
+                printk(KERN_WARNING 
+                        "sctp_dbg_objcnt: Unable to create /proc entry.\n");
 }
 /* Cleanup the objcount entry in the proc filesystem.  */
diff --git a/net/sctp/proc.c b/net/sctp/proc.c
index 98d49ec9b74b..b74f7772b576 100644
--- a/net/sctp/proc.c
+++ b/net/sctp/proc.c
@@ -57,6 +57,7 @@ static struct snmp_mib sctp_snmp_list[] = {
        SNMP_MIB_ITEM("SctpReasmUsrMsgs", SCTP_MIB_REASMUSRMSGS),
        SNMP_MIB_ITEM("SctpOutSCTPPacks", SCTP_MIB_OUTSCTPPACKS),
        SNMP_MIB_ITEM("SctpInSCTPPacks", SCTP_MIB_INSCTPPACKS),
+        SNMP_MIB_SENTINEL
 };
 /* Return the current value of a particular entry in the mib by adding its
diff --git a/net/sunrpc/auth_gss/gss_krb5_crypto.c b/net/sunrpc/auth_gss/gss_krb5_crypto.c
index 24c21f2a33a7..5a7265aeaf83 100644
--- a/net/sunrpc/auth_gss/gss_krb5_crypto.c
+++ b/net/sunrpc/auth_gss/gss_krb5_crypto.c
@@ -185,9 +185,7 @@ make_checksum(s32 cksumtype, char *header, int hdrlen, struct xdr_buf *body,
                        sg->page = body->pages[i];
                        sg->offset = offset;
                        sg->length = thislen;
-                        kmap(sg->page); /* XXX kmap_atomic? */
                        crypto_digest_update(tfm, sg, 1);
-                        kunmap(sg->page);
                        len -= thislen;
                        i++;
                        offset = 0;
diff --git a/net/sunrpc/svcsock.c b/net/sunrpc/svcsock.c
index 56db8f13e6cb..d0c3120d0233 100644
--- a/net/sunrpc/svcsock.c
+++ b/net/sunrpc/svcsock.c
@@ -586,7 +586,7 @@ svc_udp_recvfrom(struct svc_rqst *rqstp)
        }
        if (skb->stamp.tv_sec == 0) {
                skb->stamp.tv_sec = xtime.tv_sec; 
-                skb->stamp.tv_usec = xtime.tv_nsec * 1000; 
+                skb->stamp.tv_usec = xtime.tv_nsec / NSEC_PER_USEC; 
                /* Don't enable netstamp, sunrpc doesn't 
                   need that much accuracy */
        }
diff --git a/net/sunrpc/xdr.c b/net/sunrpc/xdr.c
index 8a4d9c106af1..fde16f40a581 100644
--- a/net/sunrpc/xdr.c
+++ b/net/sunrpc/xdr.c
@@ -993,6 +993,7 @@ xdr_xcode_array2(struct xdr_buf *buf, unsigned int base,
                        return -EINVAL;
        } else {
                if (xdr_decode_word(buf, base, &desc->array_len) != 0 ||
+                    desc->array_len > desc->array_maxlen ||
                    (unsigned long) base + 4 + desc->array_len *
                                    desc->elem_size > buf->len)
                        return -EINVAL;
diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c
index ecade4893a13..8da3e25b2c4c 100644
--- a/net/xfrm/xfrm_user.c
+++ b/net/xfrm/xfrm_user.c
@@ -1350,6 +1350,9 @@ static struct xfrm_policy *xfrm_compile_policy(u16 family, int opt,
        if (nr > XFRM_MAX_DEPTH)
                return NULL;
+        if (p->dir > XFRM_POLICY_OUT)
+                return NULL;
        xp = xfrm_policy_alloc(GFP_KERNEL);
        if (xp == NULL) {
                *dir = -ENOBUFS;