52 files changed, 439 insertions, 231 deletions

diff --git a/net/8021q/vlan_dev.c b/net/8021q/vlan_dev.c
index 3d59c9bf8feb..3bccdd12a264 100644
--- a/net/8021q/vlan_dev.c
+++ b/net/8021q/vlan_dev.c
@@ -510,7 +510,8 @@ static int vlan_dev_open(struct net_device *dev)
         if (vlan->flags & VLAN_FLAG_GVRP)
                 vlan_gvrp_request_join(dev);
 
-        netif_carrier_on(dev);
+        if (netif_carrier_ok(real_dev))
+                netif_carrier_on(dev);
         return 0;
 
 clear_allmulti:
diff --git a/net/ax25/ax25_ds_timer.c b/net/ax25/ax25_ds_timer.c
index 2ce79df00680..c7d81436213d 100644
--- a/net/ax25/ax25_ds_timer.c
+++ b/net/ax25/ax25_ds_timer.c
@@ -112,8 +112,8 @@ void ax25_ds_heartbeat_expiry(ax25_cb *ax25)
                         if (sk) {
                                 sock_hold(sk);
                                 ax25_destroy_socket(ax25);
-                                sock_put(sk);
                                 bh_unlock_sock(sk);
+                                sock_put(sk);
                         } else
                                 ax25_destroy_socket(ax25);
                         return;
diff --git a/net/bluetooth/l2cap.c b/net/bluetooth/l2cap.c
index 3e3cd9d4e52c..fadf26b4ed7c 100644
--- a/net/bluetooth/l2cap.c
+++ b/net/bluetooth/l2cap.c
@@ -2705,8 +2705,9 @@ done:
                 case L2CAP_MODE_ERTM:
                         pi->remote_tx_win = rfc.txwin_size;
                         pi->remote_max_tx = rfc.max_transmit;
-                        if (rfc.max_pdu_size > pi->conn->mtu - 10)
-                                rfc.max_pdu_size = le16_to_cpu(pi->conn->mtu - 10);
+
+                        if (le16_to_cpu(rfc.max_pdu_size) > pi->conn->mtu - 10)
+                                rfc.max_pdu_size = cpu_to_le16(pi->conn->mtu - 10);
 
                         pi->remote_mps = le16_to_cpu(rfc.max_pdu_size);
 
@@ -2723,8 +2724,8 @@ done:
                         break;
 
                 case L2CAP_MODE_STREAMING:
-                        if (rfc.max_pdu_size > pi->conn->mtu - 10)
-                                rfc.max_pdu_size = le16_to_cpu(pi->conn->mtu - 10);
+                        if (le16_to_cpu(rfc.max_pdu_size) > pi->conn->mtu - 10)
+                                rfc.max_pdu_size = cpu_to_le16(pi->conn->mtu - 10);
 
                         pi->remote_mps = le16_to_cpu(rfc.max_pdu_size);
 
@@ -2806,7 +2807,6 @@ static int l2cap_parse_conf_rsp(struct sock *sk, void *rsp, int len, void *data,
         if (*result == L2CAP_CONF_SUCCESS) {
                 switch (rfc.mode) {
                 case L2CAP_MODE_ERTM:
-                        pi->remote_tx_win   = rfc.txwin_size;
                         pi->retrans_timeout = le16_to_cpu(rfc.retrans_timeout);
                         pi->monitor_timeout = le16_to_cpu(rfc.monitor_timeout);
                         pi->mps    = le16_to_cpu(rfc.max_pdu_size);
@@ -2862,7 +2862,6 @@ static void l2cap_conf_rfc_get(struct sock *sk, void *rsp, int len)
 done:
         switch (rfc.mode) {
         case L2CAP_MODE_ERTM:
-                pi->remote_tx_win   = rfc.txwin_size;
                 pi->retrans_timeout = le16_to_cpu(rfc.retrans_timeout);
                 pi->monitor_timeout = le16_to_cpu(rfc.monitor_timeout);
                 pi->mps    = le16_to_cpu(rfc.max_pdu_size);
diff --git a/net/bridge/br_netfilter.c b/net/bridge/br_netfilter.c
index 2c911c0759c2..137f23259a93 100644
--- a/net/bridge/br_netfilter.c
+++ b/net/bridge/br_netfilter.c
@@ -162,8 +162,8 @@ static inline struct nf_bridge_info *nf_bridge_unshare(struct sk_buff *skb)
                 if (tmp) {
                         memcpy(tmp, nf_bridge, sizeof(struct nf_bridge_info));
                         atomic_set(&tmp->use, 1);
-                        nf_bridge_put(nf_bridge);
                 }
+                nf_bridge_put(nf_bridge);
                 nf_bridge = tmp;
         }
         return nf_bridge;
@@ -761,9 +761,11 @@ static int br_nf_dev_queue_xmit(struct sk_buff *skb)
 {
         if (skb->nfct != NULL && skb->protocol == htons(ETH_P_IP) &&
             skb->len + nf_bridge_mtu_reduction(skb) > skb->dev->mtu &&
-            !skb_is_gso(skb))
+            !skb_is_gso(skb)) {
+                /* BUG: Should really parse the IP options here. */
+                memset(IPCB(skb), 0, sizeof(struct inet_skb_parm));
                 return ip_fragment(skb, br_dev_queue_push_xmit);
-        else
+        } else
                 return br_dev_queue_push_xmit(skb);
 }
 #else
diff --git a/net/caif/cfpkt_skbuff.c b/net/caif/cfpkt_skbuff.c
index 01f238ff2346..c49a6695793a 100644
--- a/net/caif/cfpkt_skbuff.c
+++ b/net/caif/cfpkt_skbuff.c
@@ -9,7 +9,7 @@
 #include <linux/hardirq.h>
 #include <net/caif/cfpkt.h>
 
-#define PKT_PREFIX  16
+#define PKT_PREFIX  48
 #define PKT_POSTFIX 2
 #define PKT_LEN_WHEN_EXTENDING 128
 #define PKT_ERROR(pkt, errmsg) do {        \
diff --git a/net/caif/cfrfml.c b/net/caif/cfrfml.c
index eb1602022ac0..9a699242d104 100644
--- a/net/caif/cfrfml.c
+++ b/net/caif/cfrfml.c
@@ -7,7 +7,7 @@
 #include <linux/stddef.h>
 #include <linux/spinlock.h>
 #include <linux/slab.h>
-#include <linux/unaligned/le_byteshift.h>
+#include <asm/unaligned.h>
 #include <net/caif/caif_layer.h>
 #include <net/caif/cfsrvl.h>
 #include <net/caif/cfpkt.h>
diff --git a/net/can/bcm.c b/net/can/bcm.c
index 9c65e9deb9c3..08ffe9e4be20 100644
--- a/net/can/bcm.c
+++ b/net/can/bcm.c
@@ -60,6 +60,13 @@
 #include <net/sock.h>
 #include <net/net_namespace.h>
 
+/*
+ * To send multiple CAN frame content within TX_SETUP or to filter
+ * CAN messages with multiplex index within RX_SETUP, the number of
+ * different filters is limited to 256 due to the one byte index value.
+ */
+#define MAX_NFRAMES 256
+
 /* use of last_frames[index].can_dlc */
 #define RX_RECV    0x40 /* received data for this element */
 #define RX_THR     0x80 /* element not been sent due to throttle feature */
@@ -89,16 +96,16 @@ struct bcm_op {
         struct list_head list;
         int ifindex;
         canid_t can_id;
-        int flags;
+        u32 flags;
         unsigned long frames_abs, frames_filtered;
         struct timeval ival1, ival2;
         struct hrtimer timer, thrtimer;
         struct tasklet_struct tsklet, thrtsklet;
         ktime_t rx_stamp, kt_ival1, kt_ival2, kt_lastmsg;
         int rx_ifindex;
-        int count;
-        int nframes;
-        int currframe;
+        u32 count;
+        u32 nframes;
+        u32 currframe;
         struct can_frame *frames;
         struct can_frame *last_frames;
         struct can_frame sframe;
@@ -175,7 +182,7 @@ static int bcm_proc_show(struct seq_file *m, void *v)
 
                 seq_printf(m, "rx_op: %03X %-5s ",
                                 op->can_id, bcm_proc_getifname(ifname, op->ifindex));
-                seq_printf(m, "[%d]%c ", op->nframes,
+                seq_printf(m, "[%u]%c ", op->nframes,
                                 (op->flags & RX_CHECK_DLC)?'d':' ');
                 if (op->kt_ival1.tv64)
                         seq_printf(m, "timeo=%lld ",
@@ -198,7 +205,7 @@ static int bcm_proc_show(struct seq_file *m, void *v)
 
         list_for_each_entry(op, &bo->tx_ops, list) {
 
-                seq_printf(m, "tx_op: %03X %s [%d] ",
+                seq_printf(m, "tx_op: %03X %s [%u] ",
                                 op->can_id,
                                 bcm_proc_getifname(ifname, op->ifindex),
                                 op->nframes);
@@ -283,7 +290,7 @@ static void bcm_send_to_user(struct bcm_op *op, struct bcm_msg_head *head,
         struct can_frame *firstframe;
         struct sockaddr_can *addr;
         struct sock *sk = op->sk;
-        int datalen = head->nframes * CFSIZ;
+        unsigned int datalen = head->nframes * CFSIZ;
         int err;
 
         skb = alloc_skb(sizeof(*head) + datalen, gfp_any());
@@ -468,7 +475,7 @@ rx_changed_settime:
  * bcm_rx_cmp_to_index - (bit)compares the currently received data to formerly
  *                       received data stored in op->last_frames[]
  */
-static void bcm_rx_cmp_to_index(struct bcm_op *op, int index,
+static void bcm_rx_cmp_to_index(struct bcm_op *op, unsigned int index,
                                 const struct can_frame *rxdata)
 {
         /*
@@ -554,7 +561,8 @@ static enum hrtimer_restart bcm_rx_timeout_handler(struct hrtimer *hrtimer)
 /*
  * bcm_rx_do_flush - helper for bcm_rx_thr_flush
  */
-static inline int bcm_rx_do_flush(struct bcm_op *op, int update, int index)
+static inline int bcm_rx_do_flush(struct bcm_op *op, int update,
+                                  unsigned int index)
 {
         if ((op->last_frames) && (op->last_frames[index].can_dlc & RX_THR)) {
                 if (update)
@@ -575,7 +583,7 @@ static int bcm_rx_thr_flush(struct bcm_op *op, int update)
         int updated = 0;
 
         if (op->nframes > 1) {
-                int i;
+                unsigned int i;
 
                 /* for MUX filter we start at index 1 */
                 for (i = 1; i < op->nframes; i++)
@@ -624,7 +632,7 @@ static void bcm_rx_handler(struct sk_buff *skb, void *data)
 {
         struct bcm_op *op = (struct bcm_op *)data;
         const struct can_frame *rxframe = (struct can_frame *)skb->data;
-        int i;
+        unsigned int i;
 
         /* disable timeout */
         hrtimer_cancel(&op->timer);
@@ -822,14 +830,15 @@ static int bcm_tx_setup(struct bcm_msg_head *msg_head, struct msghdr *msg,
 {
         struct bcm_sock *bo = bcm_sk(sk);
         struct bcm_op *op;
-        int i, err;
+        unsigned int i;
+        int err;
 
         /* we need a real device to send frames */
         if (!ifindex)
                 return -ENODEV;
 
-        /* we need at least one can_frame */
-        if (msg_head->nframes < 1)
+        /* check nframes boundaries - we need at least one can_frame */
+        if (msg_head->nframes < 1 || msg_head->nframes > MAX_NFRAMES)
                 return -EINVAL;
 
         /* check the given can_id */
@@ -993,6 +1002,10 @@ static int bcm_rx_setup(struct bcm_msg_head *msg_head, struct msghdr *msg,
                 msg_head->nframes = 0;
         }
 
+        /* the first element contains the mux-mask => MAX_NFRAMES + 1  */
+        if (msg_head->nframes > MAX_NFRAMES + 1)
+                return -EINVAL;
+
         if ((msg_head->flags & RX_RTR_FRAME) &&
             ((msg_head->nframes != 1) ||
              (!(msg_head->can_id & CAN_RTR_FLAG))))
diff --git a/net/core/dev.c b/net/core/dev.c
index 1ae654391442..3721fbb9a83c 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -3143,7 +3143,7 @@ pull:
                         put_page(skb_shinfo(skb)->frags[0].page);
                         memmove(skb_shinfo(skb)->frags,
                                 skb_shinfo(skb)->frags + 1,
-                                --skb_shinfo(skb)->nr_frags);
+                                --skb_shinfo(skb)->nr_frags * sizeof(skb_frag_t));
                 }
         }
 
diff --git a/net/core/gen_estimator.c b/net/core/gen_estimator.c
index 9fbe7f7429b0..6743146e4d6b 100644
--- a/net/core/gen_estimator.c
+++ b/net/core/gen_estimator.c
@@ -232,7 +232,7 @@ int gen_new_estimator(struct gnet_stats_basic_packed *bstats,
         est->last_packets = bstats->packets;
         est->avpps = rate_est->pps<<10;
 
-        spin_lock(&est_tree_lock);
+        spin_lock_bh(&est_tree_lock);
         if (!elist[idx].timer.function) {
                 INIT_LIST_HEAD(&elist[idx].list);
                 setup_timer(&elist[idx].timer, est_timer, idx);
@@ -243,7 +243,7 @@ int gen_new_estimator(struct gnet_stats_basic_packed *bstats,
 
         list_add_rcu(&est->list, &elist[idx].list);
         gen_add_node(est);
-        spin_unlock(&est_tree_lock);
+        spin_unlock_bh(&est_tree_lock);
 
         return 0;
 }
@@ -270,7 +270,7 @@ void gen_kill_estimator(struct gnet_stats_basic_packed *bstats,
 {
         struct gen_estimator *e;
 
-        spin_lock(&est_tree_lock);
+        spin_lock_bh(&est_tree_lock);
         while ((e = gen_find_node(bstats, rate_est))) {
                 rb_erase(&e->node, &est_root);
 
@@ -281,7 +281,7 @@ void gen_kill_estimator(struct gnet_stats_basic_packed *bstats,
                 list_del_rcu(&e->list);
                 call_rcu(&e->e_rcu, __gen_kill_estimator);
         }
-        spin_unlock(&est_tree_lock);
+        spin_unlock_bh(&est_tree_lock);
 }
 EXPORT_SYMBOL(gen_kill_estimator);
 
@@ -320,9 +320,9 @@ bool gen_estimator_active(const struct gnet_stats_basic_packed *bstats,
 
         ASSERT_RTNL();
 
-        spin_lock(&est_tree_lock);
+        spin_lock_bh(&est_tree_lock);
         res = gen_find_node(bstats, rate_est) != NULL;
-        spin_unlock(&est_tree_lock);
+        spin_unlock_bh(&est_tree_lock);
 
         return res;
 }
diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index 3a2513f0d0c3..26396ff67cf9 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -2573,6 +2573,10 @@ struct sk_buff *skb_segment(struct sk_buff *skb, int features)
                 __copy_skb_header(nskb, skb);
                 nskb->mac_len = skb->mac_len;
 
+                /* nskb and skb might have different headroom */
+                if (nskb->ip_summed == CHECKSUM_PARTIAL)
+                        nskb->csum_start += skb_headroom(nskb) - headroom;
+
                 skb_reset_mac_header(nskb);
                 skb_set_network_header(nskb, skb->mac_len);
                 nskb->transport_header = (nskb->network_header +
@@ -2702,8 +2706,8 @@ int skb_gro_receive(struct sk_buff **head, struct sk_buff *skb)
         } else if (skb_gro_len(p) != pinfo->gso_size)
                 return -E2BIG;
 
-        headroom = skb_headroom(p);
-        nskb = netdev_alloc_skb(p->dev, headroom + skb_gro_offset(p));
+        headroom = NET_SKB_PAD + NET_IP_ALIGN;
+        nskb = alloc_skb(headroom + skb_gro_offset(p), GFP_ATOMIC);
         if (unlikely(!nskb))
                 return -ENOMEM;
 
diff --git a/net/dns_resolver/dns_key.c b/net/dns_resolver/dns_key.c
index 400a04d5c9a1..739435a6af39 100644
--- a/net/dns_resolver/dns_key.c
+++ b/net/dns_resolver/dns_key.c
@@ -29,6 +29,7 @@
 #include <linux/kernel.h>
 #include <linux/keyctl.h>
 #include <linux/err.h>
+#include <linux/seq_file.h>
 #include <keys/dns_resolver-type.h>
 #include <keys/user-type.h>
 #include "internal.h"
@@ -43,6 +44,8 @@ MODULE_PARM_DESC(debug, "DNS Resolver debugging mask");
 
 const struct cred *dns_resolver_cache;
 
+#define DNS_ERRORNO_OPTION      "dnserror"
+
 /*
  * Instantiate a user defined key for dns_resolver.
  *
@@ -59,9 +62,10 @@ static int
 dns_resolver_instantiate(struct key *key, const void *_data, size_t datalen)
 {
         struct user_key_payload *upayload;
+        unsigned long derrno;
         int ret;
         size_t result_len = 0;
-        const char *data = _data, *opt;
+        const char *data = _data, *end, *opt;
 
         kenter("%%%d,%s,'%s',%zu",
                key->serial, key->description, data, datalen);
@@ -71,13 +75,77 @@ dns_resolver_instantiate(struct key *key, const void *_data, size_t datalen)
         datalen--;
 
         /* deal with any options embedded in the data */
+        end = data + datalen;
         opt = memchr(data, '#', datalen);
         if (!opt) {
-                kdebug("no options currently supported");
-                return -EINVAL;
+                /* no options: the entire data is the result */
+                kdebug("no options");
+                result_len = datalen;
+        } else {
+                const char *next_opt;
+
+                result_len = opt - data;
+                opt++;
+                kdebug("options: '%s'", opt);
+                do {
+                        const char *eq;
+                        int opt_len, opt_nlen, opt_vlen, tmp;
+
+                        next_opt = memchr(opt, '#', end - opt) ?: end;
+                        opt_len = next_opt - opt;
+                        if (!opt_len) {
+                                printk(KERN_WARNING
+                                       "Empty option to dns_resolver key %d\n",
+                                       key->serial);
+                                return -EINVAL;
+                        }
+
+                        eq = memchr(opt, '=', opt_len) ?: end;
+                        opt_nlen = eq - opt;
+                        eq++;
+                        opt_vlen = next_opt - eq; /* will be -1 if no value */
+
+                        tmp = opt_vlen >= 0 ? opt_vlen : 0;
+                        kdebug("option '%*.*s' val '%*.*s'",
+                               opt_nlen, opt_nlen, opt, tmp, tmp, eq);
+
+                        /* see if it's an error number representing a DNS error
+                         * that's to be recorded as the result in this key */
+                        if (opt_nlen == sizeof(DNS_ERRORNO_OPTION) - 1 &&
+                            memcmp(opt, DNS_ERRORNO_OPTION, opt_nlen) == 0) {
+                                kdebug("dns error number option");
+                                if (opt_vlen <= 0)
+                                        goto bad_option_value;
+
+                                ret = strict_strtoul(eq, 10, &derrno);
+                                if (ret < 0)
+                                        goto bad_option_value;
+
+                                if (derrno < 1 || derrno > 511)
+                                        goto bad_option_value;
+
+                                kdebug("dns error no. = %lu", derrno);
+                                key->type_data.x[0] = -derrno;
+                                continue;
+                        }
+
+                bad_option_value:
+                        printk(KERN_WARNING
+                               "Option '%*.*s' to dns_resolver key %d:"
+                               " bad/missing value\n",
+                               opt_nlen, opt_nlen, opt, key->serial);
+                        return -EINVAL;
+                } while (opt = next_opt + 1, opt < end);
+        }
+
+        /* don't cache the result if we're caching an error saying there's no
+         * result */
+        if (key->type_data.x[0]) {
+                kleave(" = 0 [h_error %ld]", key->type_data.x[0]);
+                return 0;
         }
 
-        result_len = datalen;
+        kdebug("store result");
         ret = key_payload_reserve(key, result_len);
         if (ret < 0)
                 return -EINVAL;
@@ -135,13 +203,27 @@ no_match:
         return ret;
 }
 
+/*
+ * Describe a DNS key
+ */
+static void dns_resolver_describe(const struct key *key, struct seq_file *m)
+{
+        int err = key->type_data.x[0];
+
+        seq_puts(m, key->description);
+        if (err)
+                seq_printf(m, ": %d", err);
+        else
+                seq_printf(m, ": %u", key->datalen);
+}
+
 struct key_type key_type_dns_resolver = {
         .name           = "dns_resolver",
         .instantiate    = dns_resolver_instantiate,
         .match          = dns_resolver_match,
         .revoke         = user_revoke,
         .destroy        = user_destroy,
-        .describe       = user_describe,
+        .describe       = dns_resolver_describe,
         .read           = user_read,
 };
 
diff --git a/net/dns_resolver/dns_query.c b/net/dns_resolver/dns_query.c
index 03d5255f5cf2..c32be292c7e3 100644
--- a/net/dns_resolver/dns_query.c
+++ b/net/dns_resolver/dns_query.c
@@ -136,6 +136,11 @@ int dns_query(const char *type, const char *name, size_t namelen,
         if (ret < 0)
                 goto put;
 
+        /* If the DNS server gave an error, return that to the caller */
+        ret = rkey->type_data.x[0];
+        if (ret)
+                goto put;
+
         upayload = rcu_dereference_protected(rkey->payload.data,
                                              lockdep_is_held(&rkey->sem));
         len = upayload->datalen;
diff --git a/net/dsa/Kconfig b/net/dsa/Kconfig
index 11201784d29a..87bb5f4de0e8 100644
--- a/net/dsa/Kconfig
+++ b/net/dsa/Kconfig
@@ -1,7 +1,7 @@
 menuconfig NET_DSA
         bool "Distributed Switch Architecture support"
         default n
-        depends on EXPERIMENTAL && NET_ETHERNET && !S390
+        depends on EXPERIMENTAL && NETDEVICES && !S390
         select PHYLIB
         ---help---
           This allows you to use hardware switch chips that use
diff --git a/net/ipv4/Kconfig b/net/ipv4/Kconfig
index 7c3a7d191249..571f8950ed06 100644
--- a/net/ipv4/Kconfig
+++ b/net/ipv4/Kconfig
@@ -46,7 +46,7 @@ config IP_ADVANCED_ROUTER
           rp_filter on use:
 
           echo 1 > /proc/sys/net/ipv4/conf/<device>/rp_filter
-           and
+           or
           echo 1 > /proc/sys/net/ipv4/conf/all/rp_filter
 
           Note that some distributions enable it in startup scripts.
diff --git a/net/ipv4/netfilter/arp_tables.c b/net/ipv4/netfilter/arp_tables.c
index 6bccba31d132..e8f4f9a57f12 100644
--- a/net/ipv4/netfilter/arp_tables.c
+++ b/net/ipv4/netfilter/arp_tables.c
@@ -735,6 +735,7 @@ static void get_counters(const struct xt_table_info *t,
                 if (cpu == curcpu)
                         continue;
                 i = 0;
+                local_bh_disable();
                 xt_info_wrlock(cpu);
                 xt_entry_foreach(iter, t->entries[cpu], t->size) {
                         ADD_COUNTER(counters[i], iter->counters.bcnt,
@@ -742,6 +743,7 @@ static void get_counters(const struct xt_table_info *t,
                         ++i;
                 }
                 xt_info_wrunlock(cpu);
+                local_bh_enable();
         }
         put_cpu();
 }
@@ -1418,6 +1420,9 @@ static int translate_compat_table(const char *name,
                 if (ret != 0)
                         break;
                 ++i;
+                if (strcmp(arpt_get_target(iter1)->u.user.name,
+                    XT_ERROR_TARGET) == 0)
+                        ++newinfo->stacksize;
         }
         if (ret) {
                 /*
diff --git a/net/ipv4/netfilter/ip_tables.c b/net/ipv4/netfilter/ip_tables.c
index c439721b165a..d163f2e3b2e9 100644
--- a/net/ipv4/netfilter/ip_tables.c
+++ b/net/ipv4/netfilter/ip_tables.c
@@ -909,6 +909,7 @@ get_counters(const struct xt_table_info *t,
                 if (cpu == curcpu)
                         continue;
                 i = 0;
+                local_bh_disable();
                 xt_info_wrlock(cpu);
                 xt_entry_foreach(iter, t->entries[cpu], t->size) {
                         ADD_COUNTER(counters[i], iter->counters.bcnt,
@@ -916,6 +917,7 @@ get_counters(const struct xt_table_info *t,
                         ++i; /* macro does multi eval of i */
                 }
                 xt_info_wrunlock(cpu);
+                local_bh_enable();
         }
         put_cpu();
 }
@@ -1749,6 +1751,9 @@ translate_compat_table(struct net *net,
                 if (ret != 0)
                         break;
                 ++i;
+                if (strcmp(ipt_get_target(iter1)->u.user.name,
+                    XT_ERROR_TARGET) == 0)
+                        ++newinfo->stacksize;
         }
         if (ret) {
                 /*
diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
index 176e11aaea77..3fb1428e526e 100644
--- a/net/ipv4/tcp.c
+++ b/net/ipv4/tcp.c
@@ -451,7 +451,8 @@ unsigned int tcp_poll(struct file *file, struct socket *sock, poll_table *wait)
                                 if (sk_stream_wspace(sk) >= sk_stream_min_wspace(sk))
                                         mask |= POLLOUT | POLLWRNORM;
                         }
-                }
+                } else
+                        mask |= POLLOUT | POLLWRNORM;
 
                 if (tp->urg_data & TCP_URG_VALID)
                         mask |= POLLPRI;
@@ -2011,11 +2012,8 @@ adjudge_to_death:
                 }
         }
         if (sk->sk_state != TCP_CLOSE) {
-                int orphan_count = percpu_counter_read_positive(
-                                                sk->sk_prot->orphan_count);
-
                 sk_mem_reclaim(sk);
-                if (tcp_too_many_orphans(sk, orphan_count)) {
+                if (tcp_too_many_orphans(sk, 0)) {
                         if (net_ratelimit())
                                 printk(KERN_INFO "TCP: too many of orphaned "
                                        "sockets\n");
@@ -3212,7 +3210,7 @@ void __init tcp_init(void)
 {
         struct sk_buff *skb = NULL;
         unsigned long nr_pages, limit;
-        int order, i, max_share;
+        int i, max_share, cnt;
         unsigned long jiffy = jiffies;
 
         BUILD_BUG_ON(sizeof(struct tcp_skb_cb) > sizeof(skb->cb));
@@ -3261,22 +3259,12 @@ void __init tcp_init(void)
                 INIT_HLIST_HEAD(&tcp_hashinfo.bhash[i].chain);
         }
 
-        /* Try to be a bit smarter and adjust defaults depending
-         * on available memory.
-         */
-        for (order = 0; ((1 << order) << PAGE_SHIFT) <
-                        (tcp_hashinfo.bhash_size * sizeof(struct inet_bind_hashbucket));
-                        order++)
-                ;
-        if (order >= 4) {
-                tcp_death_row.sysctl_max_tw_buckets = 180000;
-                sysctl_tcp_max_orphans = 4096 << (order - 4);
-                sysctl_max_syn_backlog = 1024;
-        } else if (order < 3) {
-                tcp_death_row.sysctl_max_tw_buckets >>= (3 - order);
-                sysctl_tcp_max_orphans >>= (3 - order);
-                sysctl_max_syn_backlog = 128;
-        }
+
+        cnt = tcp_hashinfo.ehash_mask + 1;
+
+        tcp_death_row.sysctl_max_tw_buckets = cnt / 2;
+        sysctl_tcp_max_orphans = cnt / 2;
+        sysctl_max_syn_backlog = max(128, cnt / 256);
 
         /* Set the pressure threshold to be a fraction of global memory that
          * is up to 1/2 at 256 MB, decreasing toward zero with the amount of
diff --git a/net/ipv4/tcp_cong.c b/net/ipv4/tcp_cong.c
index 0ec9bd0ae94f..850c737e08e2 100644
--- a/net/ipv4/tcp_cong.c
+++ b/net/ipv4/tcp_cong.c
@@ -196,10 +196,10 @@ void tcp_get_allowed_congestion_control(char *buf, size_t maxlen)
 int tcp_set_allowed_congestion_control(char *val)
 {
         struct tcp_congestion_ops *ca;
-        char *clone, *name;
+        char *saved_clone, *clone, *name;
         int ret = 0;
 
-        clone = kstrdup(val, GFP_USER);
+        saved_clone = clone = kstrdup(val, GFP_USER);
         if (!clone)
                 return -ENOMEM;
 
@@ -226,6 +226,7 @@ int tcp_set_allowed_congestion_control(char *val)
         }
 out:
         spin_unlock(&tcp_cong_list_lock);
+        kfree(saved_clone);
 
         return ret;
 }
diff --git a/net/ipv4/tcp_timer.c b/net/ipv4/tcp_timer.c
index 808bb920c9f5..c35b469e851c 100644
--- a/net/ipv4/tcp_timer.c
+++ b/net/ipv4/tcp_timer.c
@@ -66,18 +66,18 @@ static void tcp_write_err(struct sock *sk)
 static int tcp_out_of_resources(struct sock *sk, int do_reset)
 {
         struct tcp_sock *tp = tcp_sk(sk);
-        int orphans = percpu_counter_read_positive(&tcp_orphan_count);
+        int shift = 0;
 
         /* If peer does not open window for long time, or did not transmit
          * anything for long time, penalize it. */
         if ((s32)(tcp_time_stamp - tp->lsndtime) > 2*TCP_RTO_MAX || !do_reset)
-                orphans <<= 1;
+                shift++;
 
         /* If some dubious ICMP arrived, penalize even more. */
         if (sk->sk_err_soft)
-                orphans <<= 1;
+                shift++;
 
-        if (tcp_too_many_orphans(sk, orphans)) {
+        if (tcp_too_many_orphans(sk, shift)) {
                 if (net_ratelimit())
                         printk(KERN_INFO "Out of socket memory\n");
 
diff --git a/net/ipv6/netfilter/ip6_tables.c b/net/ipv6/netfilter/ip6_tables.c
index 5359ef4daac5..8e754be92c24 100644
--- a/net/ipv6/netfilter/ip6_tables.c
+++ b/net/ipv6/netfilter/ip6_tables.c
@@ -922,6 +922,7 @@ get_counters(const struct xt_table_info *t,
                 if (cpu == curcpu)
                         continue;
                 i = 0;
+                local_bh_disable();
                 xt_info_wrlock(cpu);
                 xt_entry_foreach(iter, t->entries[cpu], t->size) {
                         ADD_COUNTER(counters[i], iter->counters.bcnt,
@@ -929,6 +930,7 @@ get_counters(const struct xt_table_info *t,
                         ++i;
                 }
                 xt_info_wrunlock(cpu);
+                local_bh_enable();
         }
         put_cpu();
 }
@@ -1764,6 +1766,9 @@ translate_compat_table(struct net *net,
                 if (ret != 0)
                         break;
                 ++i;
+                if (strcmp(ip6t_get_target(iter1)->u.user.name,
+                    XT_ERROR_TARGET) == 0)
+                        ++newinfo->stacksize;
         }
         if (ret) {
                 /*
diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index 8f2d0400cf8a..d126365ac046 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -2580,7 +2580,7 @@ ctl_table ipv6_route_table_template[] = {
                 .data           =       &init_net.ipv6.sysctl.ip6_rt_gc_elasticity,
                 .maxlen         =       sizeof(int),
                 .mode           =       0644,
-                .proc_handler   =       proc_dointvec_jiffies,
+                .proc_handler   =       proc_dointvec,
         },
         {
                 .procname       =       "mtu_expires",
@@ -2594,7 +2594,7 @@ ctl_table ipv6_route_table_template[] = {
                 .data           =       &init_net.ipv6.sysctl.ip6_rt_min_advmss,
                 .maxlen         =       sizeof(int),
                 .mode           =       0644,
-                .proc_handler   =       proc_dointvec_jiffies,
+                .proc_handler   =       proc_dointvec,
         },
         {
                 .procname       =       "gc_min_interval_ms",
diff --git a/net/irda/af_irda.c b/net/irda/af_irda.c
index 79986a674f6e..fd55b5135de5 100644
--- a/net/irda/af_irda.c
+++ b/net/irda/af_irda.c
@@ -824,8 +824,8 @@ static int irda_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
 
         err = irda_open_tsap(self, addr->sir_lsap_sel, addr->sir_name);
         if (err < 0) {
-                kfree(self->ias_obj->name);
-                kfree(self->ias_obj);
+                irias_delete_object(self->ias_obj);
+                self->ias_obj = NULL;
                 goto out;
         }
 
diff --git a/net/irda/irlan/irlan_eth.c b/net/irda/irlan/irlan_eth.c
index 9616c32d1076..5bb8353105cc 100644
--- a/net/irda/irlan/irlan_eth.c
+++ b/net/irda/irlan/irlan_eth.c
@@ -169,6 +169,7 @@ static netdev_tx_t irlan_eth_xmit(struct sk_buff *skb,
 {
         struct irlan_cb *self = netdev_priv(dev);
         int ret;
+        unsigned int len;
 
         /* skb headroom large enough to contain all IrDA-headers? */
         if ((skb_headroom(skb) < self->max_header_size) || (skb_shared(skb))) {
@@ -188,6 +189,7 @@ static netdev_tx_t irlan_eth_xmit(struct sk_buff *skb,
 
         dev->trans_start = jiffies;
 
+        len = skb->len;
         /* Now queue the packet in the transport layer */
         if (self->use_udata)
                 ret = irttp_udata_request(self->tsap_data, skb);
@@ -209,7 +211,7 @@ static netdev_tx_t irlan_eth_xmit(struct sk_buff *skb,
                 self->stats.tx_dropped++;
         } else {
                 self->stats.tx_packets++;
-                self->stats.tx_bytes += skb->len;
+                self->stats.tx_bytes += len;
         }
 
         return NETDEV_TX_OK;
diff --git a/net/l2tp/l2tp_eth.c b/net/l2tp/l2tp_eth.c
index 58c6c4cda73b..1ae697681bc7 100644
--- a/net/l2tp/l2tp_eth.c
+++ b/net/l2tp/l2tp_eth.c
@@ -132,7 +132,7 @@ static void l2tp_eth_dev_recv(struct l2tp_session *session, struct sk_buff *skb,
                 printk("\n");
         }
 
-        if (data_len < ETH_HLEN)
+        if (!pskb_may_pull(skb, sizeof(ETH_HLEN)))
                 goto error;
 
         secpath_reset(skb);
diff --git a/net/mac80211/main.c b/net/mac80211/main.c
index 798a91b100cc..ded5c3843e06 100644
--- a/net/mac80211/main.c
+++ b/net/mac80211/main.c
@@ -732,6 +732,12 @@ void ieee80211_unregister_hw(struct ieee80211_hw *hw)
 
         rtnl_unlock();
 
+        /*
+         * Now all work items will be gone, but the
+         * timer might still be armed, so delete it
+         */
+        del_timer_sync(&local->work_timer);
+
         cancel_work_sync(&local->reconfig_filter);
 
         ieee80211_clear_tx_pending(local);
diff --git a/net/mac80211/rate.c b/net/mac80211/rate.c
index 6d0bd198af19..be04d46110fe 100644
--- a/net/mac80211/rate.c
+++ b/net/mac80211/rate.c
@@ -103,6 +103,7 @@ ieee80211_rate_control_ops_get(const char *name)
         struct rate_control_ops *ops;
         const char *alg_name;
 
+        kparam_block_sysfs_write(ieee80211_default_rc_algo);
         if (!name)
                 alg_name = ieee80211_default_rc_algo;
         else
@@ -120,6 +121,7 @@ ieee80211_rate_control_ops_get(const char *name)
         /* try built-in one if specific alg requested but not found */
         if (!ops && strlen(CONFIG_MAC80211_RC_DEFAULT))
                 ops = ieee80211_try_rate_control_ops_get(CONFIG_MAC80211_RC_DEFAULT);
+        kparam_unblock_sysfs_write(ieee80211_default_rc_algo);
 
         return ops;
 }
diff --git a/net/netfilter/ipvs/ip_vs_ftp.c b/net/netfilter/ipvs/ip_vs_ftp.c
index f228a17ec649..33b329bfc2d2 100644
--- a/net/netfilter/ipvs/ip_vs_ftp.c
+++ b/net/netfilter/ipvs/ip_vs_ftp.c
@@ -45,6 +45,7 @@
 #include <linux/netfilter.h>
 #include <net/netfilter/nf_conntrack.h>
 #include <net/netfilter/nf_conntrack_expect.h>
+#include <net/netfilter/nf_nat.h>
 #include <net/netfilter/nf_nat_helper.h>
 #include <linux/gfp.h>
 #include <net/protocol.h>
@@ -359,7 +360,7 @@ static int ip_vs_ftp_out(struct ip_vs_app *app, struct ip_vs_conn *cp,
                 buf_len = strlen(buf);
 
                 ct = nf_ct_get(skb, &ctinfo);
-                if (ct && !nf_ct_is_untracked(ct)) {
+                if (ct && !nf_ct_is_untracked(ct) && nfct_nat(ct)) {
                         /* If mangling fails this function will return 0
                          * which will cause the packet to be dropped.
                          * Mangling can only fail under memory pressure,
diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c
index 2cbf380377d5..cd96ed3ccee4 100644
--- a/net/netlink/af_netlink.c
+++ b/net/netlink/af_netlink.c
@@ -1406,7 +1406,7 @@ static int netlink_recvmsg(struct kiocb *kiocb, struct socket *sock,
         struct netlink_sock *nlk = nlk_sk(sk);
         int noblock = flags&MSG_DONTWAIT;
         size_t copied;
-        struct sk_buff *skb;
+        struct sk_buff *skb, *data_skb;
         int err;
 
         if (flags&MSG_OOB)
@@ -1418,59 +1418,35 @@ static int netlink_recvmsg(struct kiocb *kiocb, struct socket *sock,
         if (skb == NULL)
                 goto out;
 
+        data_skb = skb;
+
 #ifdef CONFIG_COMPAT_NETLINK_MESSAGES
         if (unlikely(skb_shinfo(skb)->frag_list)) {
-                bool need_compat = !!(flags & MSG_CMSG_COMPAT);
-
                 /*
-                 * If this skb has a frag_list, then here that means that
-                 * we will have to use the frag_list skb for compat tasks
-                 * and the regular skb for non-compat tasks.
+                 * If this skb has a frag_list, then here that means that we
+                 * will have to use the frag_list skb's data for compat tasks
+                 * and the regular skb's data for normal (non-compat) tasks.
                  *
-                 * The skb might (and likely will) be cloned, so we can't
-                 * just reset frag_list and go on with things -- we need to
-                 * keep that. For the compat case that's easy -- simply get
-                 * a reference to the compat skb and free the regular one
-                 * including the frag. For the non-compat case, we need to
-                 * avoid sending the frag to the user -- so assign NULL but
-                 * restore it below before freeing the skb.
+                 * If we need to send the compat skb, assign it to the
+                 * 'data_skb' variable so that it will be used below for data
+                 * copying. We keep 'skb' for everything else, including
+                 * freeing both later.
                  */
-                if (need_compat) {
-                        struct sk_buff *compskb = skb_shinfo(skb)->frag_list;
-                        skb_get(compskb);
-                        kfree_skb(skb);
-                        skb = compskb;
-                } else {
-                        /*
-                         * Before setting frag_list to NULL, we must get a
-                         * private copy of skb if shared (because of MSG_PEEK)
-                         */
-                        if (skb_shared(skb)) {
-                                struct sk_buff *nskb;
-
-                                nskb = pskb_copy(skb, GFP_KERNEL);
-                                kfree_skb(skb);
-                                skb = nskb;
-                                err = -ENOMEM;
-                                if (!skb)
-                                        goto out;
-                        }
-                        kfree_skb(skb_shinfo(skb)->frag_list);
-                        skb_shinfo(skb)->frag_list = NULL;
-                }
+                if (flags & MSG_CMSG_COMPAT)
+                        data_skb = skb_shinfo(skb)->frag_list;
         }
 #endif
 
         msg->msg_namelen = 0;
 
-        copied = skb->len;
+        copied = data_skb->len;
         if (len < copied) {
                 msg->msg_flags |= MSG_TRUNC;
                 copied = len;
         }
 
-        skb_reset_transport_header(skb);
-        err = skb_copy_datagram_iovec(skb, 0, msg->msg_iov, copied);
+        skb_reset_transport_header(data_skb);
+        err = skb_copy_datagram_iovec(data_skb, 0, msg->msg_iov, copied);
 
         if (msg->msg_name) {
                 struct sockaddr_nl *addr = (struct sockaddr_nl *)msg->msg_name;
@@ -1490,7 +1466,7 @@ static int netlink_recvmsg(struct kiocb *kiocb, struct socket *sock,
         }
         siocb->scm->creds = *NETLINK_CREDS(skb);
         if (flags & MSG_TRUNC)
-                copied = skb->len;
+                copied = data_skb->len;
 
         skb_free_datagram(sk, skb);
 
@@ -2126,6 +2102,26 @@ static void __net_exit netlink_net_exit(struct net *net)
 #endif
 }
 
+static void __init netlink_add_usersock_entry(void)
+{
+        unsigned long *listeners;
+        int groups = 32;
+
+        listeners = kzalloc(NLGRPSZ(groups) + sizeof(struct listeners_rcu_head),
+                            GFP_KERNEL);
+        if (!listeners)
+                panic("netlink_add_usersock_entry: Cannot allocate listneres\n");
+
+        netlink_table_grab();
+
+        nl_table[NETLINK_USERSOCK].groups = groups;
+        nl_table[NETLINK_USERSOCK].listeners = listeners;
+        nl_table[NETLINK_USERSOCK].module = THIS_MODULE;
+        nl_table[NETLINK_USERSOCK].registered = 1;
+
+        netlink_table_ungrab();
+}
+
 static struct pernet_operations __net_initdata netlink_net_ops = {
         .init = netlink_net_init,
         .exit = netlink_net_exit,
@@ -2174,6 +2170,8 @@ static int __init netlink_proto_init(void)
                 hash->rehash_time = jiffies;
         }
 
+        netlink_add_usersock_entry();
+
         sock_register(&netlink_family_ops);
         register_pernet_subsys(&netlink_net_ops);
         /* The netlink device handler may be needed early. */
diff --git a/net/rds/recv.c b/net/rds/recv.c
index 795a00b7f2cb..c93588c2d553 100644
--- a/net/rds/recv.c
+++ b/net/rds/recv.c
@@ -297,7 +297,7 @@ static int rds_still_queued(struct rds_sock *rs, struct rds_incoming *inc,
 int rds_notify_queue_get(struct rds_sock *rs, struct msghdr *msghdr)
 {
         struct rds_notifier *notifier;
-        struct rds_rdma_notify cmsg;
+        struct rds_rdma_notify cmsg = { 0 }; /* fill holes with zero */
         unsigned int count = 0, max_messages = ~0U;
         unsigned long flags;
         LIST_HEAD(copy);
diff --git a/net/rxrpc/ar-internal.h b/net/rxrpc/ar-internal.h
index 7043b294bb67..8e22bd345e71 100644
--- a/net/rxrpc/ar-internal.h
+++ b/net/rxrpc/ar-internal.h
@@ -597,12 +597,6 @@ extern unsigned rxrpc_debug;
 #define dbgprintk(FMT,...) \
         printk("[%-6.6s] "FMT"\n", current->comm ,##__VA_ARGS__)
 
-/* make sure we maintain the format strings, even when debugging is disabled */
-static inline __attribute__((format(printf,1,2)))
-void _dbprintk(const char *fmt, ...)
-{
-}
-
 #define kenter(FMT,...) dbgprintk("==> %s("FMT")",__func__ ,##__VA_ARGS__)
 #define kleave(FMT,...) dbgprintk("<== %s()"FMT"",__func__ ,##__VA_ARGS__)
 #define kdebug(FMT,...) dbgprintk("    "FMT ,##__VA_ARGS__)
@@ -655,11 +649,11 @@ do {							\
 } while (0)
 
 #else
-#define _enter(FMT,...) _dbprintk("==> %s("FMT")",__func__ ,##__VA_ARGS__)
-#define _leave(FMT,...) _dbprintk("<== %s()"FMT"",__func__ ,##__VA_ARGS__)
-#define _debug(FMT,...) _dbprintk("    "FMT ,##__VA_ARGS__)
-#define _proto(FMT,...) _dbprintk("### "FMT ,##__VA_ARGS__)
-#define _net(FMT,...)   _dbprintk("@@@ "FMT ,##__VA_ARGS__)
+#define _enter(FMT,...) no_printk("==> %s("FMT")",__func__ ,##__VA_ARGS__)
+#define _leave(FMT,...) no_printk("<== %s()"FMT"",__func__ ,##__VA_ARGS__)
+#define _debug(FMT,...) no_printk("    "FMT ,##__VA_ARGS__)
+#define _proto(FMT,...) no_printk("### "FMT ,##__VA_ARGS__)
+#define _net(FMT,...)   no_printk("@@@ "FMT ,##__VA_ARGS__)
 #endif
 
 /*
diff --git a/net/sched/act_gact.c b/net/sched/act_gact.c
index 8406c6654990..c2ed90a4c0b4 100644
--- a/net/sched/act_gact.c
+++ b/net/sched/act_gact.c
@@ -152,21 +152,24 @@ static int tcf_gact(struct sk_buff *skb, struct tc_action *a, struct tcf_result
 static int tcf_gact_dump(struct sk_buff *skb, struct tc_action *a, int bind, int ref)
 {
         unsigned char *b = skb_tail_pointer(skb);
-        struct tc_gact opt;
         struct tcf_gact *gact = a->priv;
+        struct tc_gact opt = {
+                .index   = gact->tcf_index,
+                .refcnt  = gact->tcf_refcnt - ref,
+                .bindcnt = gact->tcf_bindcnt - bind,
+                .action  = gact->tcf_action,
+        };
         struct tcf_t t;
 
-        opt.index = gact->tcf_index;
-        opt.refcnt = gact->tcf_refcnt - ref;
-        opt.bindcnt = gact->tcf_bindcnt - bind;
-        opt.action = gact->tcf_action;
         NLA_PUT(skb, TCA_GACT_PARMS, sizeof(opt), &opt);
 #ifdef CONFIG_GACT_PROB
         if (gact->tcfg_ptype) {
-                struct tc_gact_p p_opt;
-                p_opt.paction = gact->tcfg_paction;
-                p_opt.pval = gact->tcfg_pval;
-                p_opt.ptype = gact->tcfg_ptype;
+                struct tc_gact_p p_opt = {
+                        .paction = gact->tcfg_paction,
+                        .pval    = gact->tcfg_pval,
+                        .ptype   = gact->tcfg_ptype,
+                };
+
                 NLA_PUT(skb, TCA_GACT_PROB, sizeof(p_opt), &p_opt);
         }
 #endif
diff --git a/net/sched/act_mirred.c b/net/sched/act_mirred.c
index 11f195af2da0..0c311be92827 100644
--- a/net/sched/act_mirred.c
+++ b/net/sched/act_mirred.c
@@ -219,15 +219,16 @@ static int tcf_mirred_dump(struct sk_buff *skb, struct tc_action *a, int bind, i
 {
         unsigned char *b = skb_tail_pointer(skb);
         struct tcf_mirred *m = a->priv;
-        struct tc_mirred opt;
+        struct tc_mirred opt = {
+                .index   = m->tcf_index,
+                .action  = m->tcf_action,
+                .refcnt  = m->tcf_refcnt - ref,
+                .bindcnt = m->tcf_bindcnt - bind,
+                .eaction = m->tcfm_eaction,
+                .ifindex = m->tcfm_ifindex,
+        };
         struct tcf_t t;
 
-        opt.index = m->tcf_index;
-        opt.action = m->tcf_action;
-        opt.refcnt = m->tcf_refcnt - ref;
-        opt.bindcnt = m->tcf_bindcnt - bind;
-        opt.eaction = m->tcfm_eaction;
-        opt.ifindex = m->tcfm_ifindex;
         NLA_PUT(skb, TCA_MIRRED_PARMS, sizeof(opt), &opt);
         t.install = jiffies_to_clock_t(jiffies - m->tcf_tm.install);
         t.lastuse = jiffies_to_clock_t(jiffies - m->tcf_tm.lastuse);
diff --git a/net/sched/act_nat.c b/net/sched/act_nat.c
index 509a2d53a99d..186eb837e600 100644
--- a/net/sched/act_nat.c
+++ b/net/sched/act_nat.c
@@ -272,19 +272,19 @@ static int tcf_nat_dump(struct sk_buff *skb, struct tc_action *a,
 {
         unsigned char *b = skb_tail_pointer(skb);
         struct tcf_nat *p = a->priv;
-        struct tc_nat opt;
+        struct tc_nat opt = {
+                .old_addr = p->old_addr,
+                .new_addr = p->new_addr,
+                .mask     = p->mask,
+                .flags    = p->flags,
+
+                .index    = p->tcf_index,
+                .action   = p->tcf_action,
+                .refcnt   = p->tcf_refcnt - ref,
+                .bindcnt  = p->tcf_bindcnt - bind,
+        };
         struct tcf_t t;
 
-        opt.old_addr = p->old_addr;
-        opt.new_addr = p->new_addr;
-        opt.mask = p->mask;
-        opt.flags = p->flags;
-
-        opt.index = p->tcf_index;
-        opt.action = p->tcf_action;
-        opt.refcnt = p->tcf_refcnt - ref;
-        opt.bindcnt = p->tcf_bindcnt - bind;
-
         NLA_PUT(skb, TCA_NAT_PARMS, sizeof(opt), &opt);
         t.install = jiffies_to_clock_t(jiffies - p->tcf_tm.install);
         t.lastuse = jiffies_to_clock_t(jiffies - p->tcf_tm.lastuse);
diff --git a/net/sched/act_police.c b/net/sched/act_police.c
index 537a48732e9e..7ebf7439b478 100644
--- a/net/sched/act_police.c
+++ b/net/sched/act_police.c
@@ -350,22 +350,19 @@ tcf_act_police_dump(struct sk_buff *skb, struct tc_action *a, int bind, int ref)
 {
         unsigned char *b = skb_tail_pointer(skb);
         struct tcf_police *police = a->priv;
-        struct tc_police opt;
-
-        opt.index = police->tcf_index;
-        opt.action = police->tcf_action;
-        opt.mtu = police->tcfp_mtu;
-        opt.burst = police->tcfp_burst;
-        opt.refcnt = police->tcf_refcnt - ref;
-        opt.bindcnt = police->tcf_bindcnt - bind;
+        struct tc_police opt = {
+                .index = police->tcf_index,
+                .action = police->tcf_action,
+                .mtu = police->tcfp_mtu,
+                .burst = police->tcfp_burst,
+                .refcnt = police->tcf_refcnt - ref,
+                .bindcnt = police->tcf_bindcnt - bind,
+        };
+
         if (police->tcfp_R_tab)
                 opt.rate = police->tcfp_R_tab->rate;
-        else
-                memset(&opt.rate, 0, sizeof(opt.rate));
         if (police->tcfp_P_tab)
                 opt.peakrate = police->tcfp_P_tab->rate;
-        else
-                memset(&opt.peakrate, 0, sizeof(opt.peakrate));
         NLA_PUT(skb, TCA_POLICE_TBF, sizeof(opt), &opt);
         if (police->tcfp_result)
                 NLA_PUT_U32(skb, TCA_POLICE_RESULT, police->tcfp_result);
diff --git a/net/sched/act_simple.c b/net/sched/act_simple.c
index 4a1d640b0cf1..97e84f3ee775 100644
--- a/net/sched/act_simple.c
+++ b/net/sched/act_simple.c
@@ -164,13 +164,14 @@ static inline int tcf_simp_dump(struct sk_buff *skb, struct tc_action *a,
 {
         unsigned char *b = skb_tail_pointer(skb);
         struct tcf_defact *d = a->priv;
-        struct tc_defact opt;
+        struct tc_defact opt = {
+                .index   = d->tcf_index,
+                .refcnt  = d->tcf_refcnt - ref,
+                .bindcnt = d->tcf_bindcnt - bind,
+                .action  = d->tcf_action,
+        };
         struct tcf_t t;
 
-        opt.index = d->tcf_index;
-        opt.refcnt = d->tcf_refcnt - ref;
-        opt.bindcnt = d->tcf_bindcnt - bind;
-        opt.action = d->tcf_action;
         NLA_PUT(skb, TCA_DEF_PARMS, sizeof(opt), &opt);
         NLA_PUT_STRING(skb, TCA_DEF_DATA, d->tcfd_defdata);
         t.install = jiffies_to_clock_t(jiffies - d->tcf_tm.install);
diff --git a/net/sched/act_skbedit.c b/net/sched/act_skbedit.c
index e9607fe55b58..66cbf4eb8855 100644
--- a/net/sched/act_skbedit.c
+++ b/net/sched/act_skbedit.c
@@ -159,13 +159,14 @@ static inline int tcf_skbedit_dump(struct sk_buff *skb, struct tc_action *a,
 {
         unsigned char *b = skb_tail_pointer(skb);
         struct tcf_skbedit *d = a->priv;
-        struct tc_skbedit opt;
+        struct tc_skbedit opt = {
+                .index   = d->tcf_index,
+                .refcnt  = d->tcf_refcnt - ref,
+                .bindcnt = d->tcf_bindcnt - bind,
+                .action  = d->tcf_action,
+        };
         struct tcf_t t;
 
-        opt.index = d->tcf_index;
-        opt.refcnt = d->tcf_refcnt - ref;
-        opt.bindcnt = d->tcf_bindcnt - bind;
-        opt.action = d->tcf_action;
         NLA_PUT(skb, TCA_SKBEDIT_PARMS, sizeof(opt), &opt);
         if (d->flags & SKBEDIT_F_PRIORITY)
                 NLA_PUT(skb, TCA_SKBEDIT_PRIORITY, sizeof(d->priority),
diff --git a/net/sched/sch_api.c b/net/sched/sch_api.c
index b9e8c3b7d406..408eea7086aa 100644
--- a/net/sched/sch_api.c
+++ b/net/sched/sch_api.c
@@ -150,22 +150,34 @@ int register_qdisc(struct Qdisc_ops *qops)
         if (qops->enqueue == NULL)
                 qops->enqueue = noop_qdisc_ops.enqueue;
         if (qops->peek == NULL) {
-                if (qops->dequeue == NULL) {
+                if (qops->dequeue == NULL)
                         qops->peek = noop_qdisc_ops.peek;
-                } else {
-                        rc = -EINVAL;
-                        goto out;
-                }
+                else
+                        goto out_einval;
         }
         if (qops->dequeue == NULL)
                 qops->dequeue = noop_qdisc_ops.dequeue;
 
+        if (qops->cl_ops) {
+                const struct Qdisc_class_ops *cops = qops->cl_ops;
+
+                if (!(cops->get && cops->put && cops->walk && cops->leaf))
+                        goto out_einval;
+
+                if (cops->tcf_chain && !(cops->bind_tcf && cops->unbind_tcf))
+                        goto out_einval;
+        }
+
         qops->next = NULL;
         *qp = qops;
         rc = 0;
 out:
         write_unlock(&qdisc_mod_lock);
         return rc;
+
+out_einval:
+        rc = -EINVAL;
+        goto out;
 }
 EXPORT_SYMBOL(register_qdisc);
 
diff --git a/net/sched/sch_atm.c b/net/sched/sch_atm.c
index e114f23d5eae..340662789529 100644
--- a/net/sched/sch_atm.c
+++ b/net/sched/sch_atm.c
@@ -418,7 +418,7 @@ static int atm_tc_enqueue(struct sk_buff *skb, struct Qdisc *sch)
         }
 
         ret = qdisc_enqueue(skb, flow->q);
-        if (ret != 0) {
+        if (ret != NET_XMIT_SUCCESS) {
 drop: __maybe_unused
                 if (net_xmit_drop_count(ret)) {
                         sch->qstats.drops++;
@@ -442,7 +442,7 @@ drop: __maybe_unused
          */
         if (flow == &p->link) {
                 sch->q.qlen++;
-                return 0;
+                return NET_XMIT_SUCCESS;
         }
         tasklet_schedule(&p->task);
         return NET_XMIT_SUCCESS | __NET_XMIT_BYPASS;
diff --git a/net/sched/sch_hfsc.c b/net/sched/sch_hfsc.c
index abd904be4287..47496098d35c 100644
--- a/net/sched/sch_hfsc.c
+++ b/net/sched/sch_hfsc.c
@@ -761,8 +761,8 @@ init_vf(struct hfsc_class *cl, unsigned int len)
                 if (f != cl->cl_f) {
                         cl->cl_f = f;
                         cftree_update(cl);
-                        update_cfmin(cl->cl_parent);
                 }
+                update_cfmin(cl->cl_parent);
         }
 }
 
diff --git a/net/sched/sch_sfq.c b/net/sched/sch_sfq.c
index 534f33231c17..201cbac2b32c 100644
--- a/net/sched/sch_sfq.c
+++ b/net/sched/sch_sfq.c
@@ -334,7 +334,7 @@ sfq_enqueue(struct sk_buff *skb, struct Qdisc *sch)
         if (++sch->q.qlen <= q->limit) {
                 sch->bstats.bytes += qdisc_pkt_len(skb);
                 sch->bstats.packets++;
-                return 0;
+                return NET_XMIT_SUCCESS;
         }
 
         sfq_drop(sch);
@@ -508,6 +508,11 @@ nla_put_failure:
         return -1;
 }
 
+static struct Qdisc *sfq_leaf(struct Qdisc *sch, unsigned long arg)
+{
+        return NULL;
+}
+
 static unsigned long sfq_get(struct Qdisc *sch, u32 classid)
 {
         return 0;
@@ -519,6 +524,10 @@ static unsigned long sfq_bind(struct Qdisc *sch, unsigned long parent,
         return 0;
 }
 
+static void sfq_put(struct Qdisc *q, unsigned long cl)
+{
+}
+
 static struct tcf_proto **sfq_find_tcf(struct Qdisc *sch, unsigned long cl)
 {
         struct sfq_sched_data *q = qdisc_priv(sch);
@@ -571,9 +580,12 @@ static void sfq_walk(struct Qdisc *sch, struct qdisc_walker *arg)
 }
 
 static const struct Qdisc_class_ops sfq_class_ops = {
+        .leaf           =       sfq_leaf,
         .get            =       sfq_get,
+        .put            =       sfq_put,
         .tcf_chain      =       sfq_find_tcf,
         .bind_tcf       =       sfq_bind,
+        .unbind_tcf     =       sfq_put,
         .dump           =       sfq_dump_class,
         .dump_stats     =       sfq_dump_class_stats,
         .walk           =       sfq_walk,
diff --git a/net/sched/sch_tbf.c b/net/sched/sch_tbf.c
index 0991c640cd3e..641a30d64635 100644
--- a/net/sched/sch_tbf.c
+++ b/net/sched/sch_tbf.c
@@ -127,7 +127,7 @@ static int tbf_enqueue(struct sk_buff *skb, struct Qdisc* sch)
                 return qdisc_reshape_fail(skb, sch);
 
         ret = qdisc_enqueue(skb, q->qdisc);
-        if (ret != 0) {
+        if (ret != NET_XMIT_SUCCESS) {
                 if (net_xmit_drop_count(ret))
                         sch->qstats.drops++;
                 return ret;
@@ -136,7 +136,7 @@ static int tbf_enqueue(struct sk_buff *skb, struct Qdisc* sch)
         sch->q.qlen++;
         sch->bstats.bytes += qdisc_pkt_len(skb);
         sch->bstats.packets++;
-        return 0;
+        return NET_XMIT_SUCCESS;
 }
 
 static unsigned int tbf_drop(struct Qdisc* sch)
diff --git a/net/sched/sch_teql.c b/net/sched/sch_teql.c
index 807643bdcbac..feaabc103ce6 100644
--- a/net/sched/sch_teql.c
+++ b/net/sched/sch_teql.c
@@ -85,7 +85,7 @@ teql_enqueue(struct sk_buff *skb, struct Qdisc* sch)
                 __skb_queue_tail(&q->q, skb);
                 sch->bstats.bytes += qdisc_pkt_len(skb);
                 sch->bstats.packets++;
-                return 0;
+                return NET_XMIT_SUCCESS;
         }
 
         kfree_skb(skb);
diff --git a/net/sunrpc/Kconfig b/net/sunrpc/Kconfig
index 443c161eb8bd..3376d7657185 100644
--- a/net/sunrpc/Kconfig
+++ b/net/sunrpc/Kconfig
@@ -18,10 +18,11 @@ config SUNRPC_XPRT_RDMA
           If unsure, say N.
 
 config RPCSEC_GSS_KRB5
-        tristate "Secure RPC: Kerberos V mechanism (EXPERIMENTAL)"
-        depends on SUNRPC && EXPERIMENTAL
+        tristate
+        depends on SUNRPC && CRYPTO
+        prompt "Secure RPC: Kerberos V mechanism" if !(NFS_V4 || NFSD_V4)
+        default y
         select SUNRPC_GSS
-        select CRYPTO
         select CRYPTO_MD5
         select CRYPTO_DES
         select CRYPTO_CBC
@@ -34,7 +35,7 @@ config RPCSEC_GSS_KRB5
           available from http://linux-nfs.org/.  In addition, user-space
           Kerberos support should be installed.
 
-          If unsure, say N.
+          If unsure, say Y.
 
 config RPCSEC_GSS_SPKM3
         tristate "Secure RPC: SPKM3 mechanism (EXPERIMENTAL)"
diff --git a/net/sunrpc/auth.c b/net/sunrpc/auth.c
index 880d0de3f50f..36cb66022a27 100644
--- a/net/sunrpc/auth.c
+++ b/net/sunrpc/auth.c
@@ -39,7 +39,7 @@ static LIST_HEAD(cred_unused);
 static unsigned long number_cred_unused;
 
 #define MAX_HASHTABLE_BITS (10) 
-static int param_set_hashtbl_sz(const char *val, struct kernel_param *kp)
+static int param_set_hashtbl_sz(const char *val, const struct kernel_param *kp)
 {
         unsigned long num;
         unsigned int nbits;
@@ -61,7 +61,7 @@ out_inval:
         return -EINVAL;
 }
 
-static int param_get_hashtbl_sz(char *buffer, struct kernel_param *kp)
+static int param_get_hashtbl_sz(char *buffer, const struct kernel_param *kp)
 {
         unsigned int nbits;
 
@@ -71,6 +71,11 @@ static int param_get_hashtbl_sz(char *buffer, struct kernel_param *kp)
 
 #define param_check_hashtbl_sz(name, p) __param_check(name, p, unsigned int);
 
+static struct kernel_param_ops param_ops_hashtbl_sz = {
+        .set = param_set_hashtbl_sz,
+        .get = param_get_hashtbl_sz,
+};
+
 module_param_named(auth_hashtable_size, auth_hashbits, hashtbl_sz, 0644);
 MODULE_PARM_DESC(auth_hashtable_size, "RPC credential cache hashtable size");
 
diff --git a/net/sunrpc/xprtrdma/rpc_rdma.c b/net/sunrpc/xprtrdma/rpc_rdma.c
index e5e28d1946a4..2ac3f6e8adff 100644
--- a/net/sunrpc/xprtrdma/rpc_rdma.c
+++ b/net/sunrpc/xprtrdma/rpc_rdma.c
@@ -249,6 +249,8 @@ rpcrdma_create_chunks(struct rpc_rqst *rqst, struct xdr_buf *target,
         req->rl_nchunks = nchunks;
 
         BUG_ON(nchunks == 0);
+        BUG_ON((r_xprt->rx_ia.ri_memreg_strategy == RPCRDMA_FRMR)
+               && (nchunks > 3));
 
         /*
          * finish off header. If write, marshal discrim and nchunks.
diff --git a/net/sunrpc/xprtrdma/verbs.c b/net/sunrpc/xprtrdma/verbs.c
index 27015c6d8eb5..5f4c7b3bc711 100644
--- a/net/sunrpc/xprtrdma/verbs.c
+++ b/net/sunrpc/xprtrdma/verbs.c
@@ -650,10 +650,22 @@ rpcrdma_ep_create(struct rpcrdma_ep *ep, struct rpcrdma_ia *ia,
         ep->rep_attr.cap.max_send_wr = cdata->max_requests;
         switch (ia->ri_memreg_strategy) {
         case RPCRDMA_FRMR:
-                /* Add room for frmr register and invalidate WRs */
-                ep->rep_attr.cap.max_send_wr *= 3;
-                if (ep->rep_attr.cap.max_send_wr > devattr.max_qp_wr)
-                        return -EINVAL;
+                /* Add room for frmr register and invalidate WRs.
+                 * 1. FRMR reg WR for head
+                 * 2. FRMR invalidate WR for head
+                 * 3. FRMR reg WR for pagelist
+                 * 4. FRMR invalidate WR for pagelist
+                 * 5. FRMR reg WR for tail
+                 * 6. FRMR invalidate WR for tail
+                 * 7. The RDMA_SEND WR
+                 */
+                ep->rep_attr.cap.max_send_wr *= 7;
+                if (ep->rep_attr.cap.max_send_wr > devattr.max_qp_wr) {
+                        cdata->max_requests = devattr.max_qp_wr / 7;
+                        if (!cdata->max_requests)
+                                return -EINVAL;
+                        ep->rep_attr.cap.max_send_wr = cdata->max_requests * 7;
+                }
                 break;
         case RPCRDMA_MEMWINDOWS_ASYNC:
         case RPCRDMA_MEMWINDOWS:
@@ -1490,7 +1502,7 @@ rpcrdma_register_frmr_external(struct rpcrdma_mr_seg *seg,
         memset(&frmr_wr, 0, sizeof frmr_wr);
         frmr_wr.opcode = IB_WR_FAST_REG_MR;
         frmr_wr.send_flags = 0;                 /* unsignaled */
-        frmr_wr.wr.fast_reg.iova_start = (unsigned long)seg1->mr_dma;
+        frmr_wr.wr.fast_reg.iova_start = seg1->mr_dma;
         frmr_wr.wr.fast_reg.page_list = seg1->mr_chunk.rl_mw->r.frmr.fr_pgl;
         frmr_wr.wr.fast_reg.page_list_len = i;
         frmr_wr.wr.fast_reg.page_shift = PAGE_SHIFT;
diff --git a/net/sunrpc/xprtsock.c b/net/sunrpc/xprtsock.c
index 7ca65c7005ea..b6309db56226 100644
--- a/net/sunrpc/xprtsock.c
+++ b/net/sunrpc/xprtsock.c
@@ -1305,10 +1305,11 @@ static void xs_tcp_state_change(struct sock *sk)
         if (!(xprt = xprt_from_sock(sk)))
                 goto out;
         dprintk("RPC:       xs_tcp_state_change client %p...\n", xprt);
-        dprintk("RPC:       state %x conn %d dead %d zapped %d\n",
+        dprintk("RPC:       state %x conn %d dead %d zapped %d sk_shutdown %d\n",
                         sk->sk_state, xprt_connected(xprt),
                         sock_flag(sk, SOCK_DEAD),
-                        sock_flag(sk, SOCK_ZAPPED));
+                        sock_flag(sk, SOCK_ZAPPED),
+                        sk->sk_shutdown);
 
         switch (sk->sk_state) {
         case TCP_ESTABLISHED:
@@ -1779,10 +1780,25 @@ static void xs_tcp_reuse_connection(struct rpc_xprt *xprt, struct sock_xprt *tra
 {
         unsigned int state = transport->inet->sk_state;
 
-        if (state == TCP_CLOSE && transport->sock->state == SS_UNCONNECTED)
-                return;
-        if ((1 << state) & (TCPF_ESTABLISHED|TCPF_SYN_SENT))
-                return;
+        if (state == TCP_CLOSE && transport->sock->state == SS_UNCONNECTED) {
+                /* we don't need to abort the connection if the socket
+                 * hasn't undergone a shutdown
+                 */
+                if (transport->inet->sk_shutdown == 0)
+                        return;
+                dprintk("RPC:       %s: TCP_CLOSEd and sk_shutdown set to %d\n",
+                                __func__, transport->inet->sk_shutdown);
+        }
+        if ((1 << state) & (TCPF_ESTABLISHED|TCPF_SYN_SENT)) {
+                /* we don't need to abort the connection if the socket
+                 * hasn't undergone a shutdown
+                 */
+                if (transport->inet->sk_shutdown == 0)
+                        return;
+                dprintk("RPC:       %s: ESTABLISHED/SYN_SENT "
+                                "sk_shutdown set to %d\n",
+                                __func__, transport->inet->sk_shutdown);
+        }
         xs_abort_connection(xprt, transport);
 }
 
@@ -2577,7 +2593,8 @@ void cleanup_socket_xprt(void)
         xprt_unregister_transport(&xs_bc_tcp_transport);
 }
 
-static int param_set_uint_minmax(const char *val, struct kernel_param *kp,
+static int param_set_uint_minmax(const char *val,
+                const struct kernel_param *kp,
                 unsigned int min, unsigned int max)
 {
         unsigned long num;
@@ -2592,34 +2609,37 @@ static int param_set_uint_minmax(const char *val, struct kernel_param *kp,
         return 0;
 }
 
-static int param_set_portnr(const char *val, struct kernel_param *kp)
+static int param_set_portnr(const char *val, const struct kernel_param *kp)
 {
         return param_set_uint_minmax(val, kp,
                         RPC_MIN_RESVPORT,
                         RPC_MAX_RESVPORT);
 }
 
-static int param_get_portnr(char *buffer, struct kernel_param *kp)
-{
-        return param_get_uint(buffer, kp);
-}
+static struct kernel_param_ops param_ops_portnr = {
+        .set = param_set_portnr,
+        .get = param_get_uint,
+};
+
 #define param_check_portnr(name, p) \
         __param_check(name, p, unsigned int);
 
 module_param_named(min_resvport, xprt_min_resvport, portnr, 0644);
 module_param_named(max_resvport, xprt_max_resvport, portnr, 0644);
 
-static int param_set_slot_table_size(const char *val, struct kernel_param *kp)
+static int param_set_slot_table_size(const char *val,
+                                     const struct kernel_param *kp)
 {
         return param_set_uint_minmax(val, kp,
                         RPC_MIN_SLOT_TABLE,
                         RPC_MAX_SLOT_TABLE);
 }
 
-static int param_get_slot_table_size(char *buffer, struct kernel_param *kp)
-{
-        return param_get_uint(buffer, kp);
-}
+static struct kernel_param_ops param_ops_slot_table_size = {
+        .set = param_set_slot_table_size,
+        .get = param_get_uint,
+};
+
 #define param_check_slot_table_size(name, p) \
         __param_check(name, p, unsigned int);
 
diff --git a/net/wireless/core.c b/net/wireless/core.c
index 541e2fff5e9c..d6d046b9f6f2 100644
--- a/net/wireless/core.c
+++ b/net/wireless/core.c
@@ -475,12 +475,10 @@ int wiphy_register(struct wiphy *wiphy)
         mutex_lock(&cfg80211_mutex);
 
         res = device_add(&rdev->wiphy.dev);
-        if (res)
-                goto out_unlock;
-
-        res = rfkill_register(rdev->rfkill);
-        if (res)
-                goto out_rm_dev;
+        if (res) {
+                mutex_unlock(&cfg80211_mutex);
+                return res;
+        }
 
         /* set up regulatory info */
         wiphy_update_regulatory(wiphy, NL80211_REGDOM_SET_BY_CORE);
@@ -509,13 +507,18 @@ int wiphy_register(struct wiphy *wiphy)
         cfg80211_debugfs_rdev_add(rdev);
         mutex_unlock(&cfg80211_mutex);
 
+        /*
+         * due to a locking dependency this has to be outside of the
+         * cfg80211_mutex lock
+         */
+        res = rfkill_register(rdev->rfkill);
+        if (res)
+                goto out_rm_dev;
+
         return 0;
 
 out_rm_dev:
         device_del(&rdev->wiphy.dev);
-
-out_unlock:
-        mutex_unlock(&cfg80211_mutex);
         return res;
 }
 EXPORT_SYMBOL(wiphy_register);
diff --git a/net/wireless/mlme.c b/net/wireless/mlme.c
index e74a1a2119d3..d1a3fb99fdf2 100644
--- a/net/wireless/mlme.c
+++ b/net/wireless/mlme.c
@@ -843,13 +843,19 @@ int cfg80211_mlme_action(struct cfg80211_registered_device *rdev,
                 return -EINVAL;
         if (mgmt->u.action.category != WLAN_CATEGORY_PUBLIC) {
                 /* Verify that we are associated with the destination AP */
+                wdev_lock(wdev);
+
                 if (!wdev->current_bss ||
                     memcmp(wdev->current_bss->pub.bssid, mgmt->bssid,
                            ETH_ALEN) != 0 ||
                     (wdev->iftype == NL80211_IFTYPE_STATION &&
                      memcmp(wdev->current_bss->pub.bssid, mgmt->da,
-                            ETH_ALEN) != 0))
+                            ETH_ALEN) != 0)) {
+                        wdev_unlock(wdev);
                         return -ENOTCONN;
+                }
+
+                wdev_unlock(wdev);
         }
 
         if (memcmp(mgmt->sa, dev->dev_addr, ETH_ALEN) != 0)
diff --git a/net/wireless/wext-compat.c b/net/wireless/wext-compat.c
index bb5e0a5ecfa1..7e5c3a45f811 100644
--- a/net/wireless/wext-compat.c
+++ b/net/wireless/wext-compat.c
@@ -1420,6 +1420,9 @@ int cfg80211_wext_giwessid(struct net_device *dev,
 {
         struct wireless_dev *wdev = dev->ieee80211_ptr;
 
+        data->flags = 0;
+        data->length = 0;
+
         switch (wdev->iftype) {
         case NL80211_IFTYPE_ADHOC:
                 return cfg80211_ibss_wext_giwessid(dev, info, data, ssid);
diff --git a/net/wireless/wext-core.c b/net/wireless/wext-core.c
index 0ef17bc42bac..8f5116f5af19 100644
--- a/net/wireless/wext-core.c
+++ b/net/wireless/wext-core.c
@@ -782,6 +782,22 @@ static int ioctl_standard_iw_point(struct iw_point *iwp, unsigned int cmd,
                 }
         }
 
+        if (IW_IS_GET(cmd) && !(descr->flags & IW_DESCR_FLAG_NOMAX)) {
+                /*
+                 * If this is a GET, but not NOMAX, it means that the extra
+                 * data is not bounded by userspace, but by max_tokens. Thus
+                 * set the length to max_tokens. This matches the extra data
+                 * allocation.
+                 * The driver should fill it with the number of tokens it
+                 * provided, and it may check iwp->length rather than having
+                 * knowledge of max_tokens. If the driver doesn't change the
+                 * iwp->length, this ioctl just copies back max_token tokens
+                 * filled with zeroes. Hopefully the driver isn't claiming
+                 * them to be valid data.
+                 */
+                iwp->length = descr->max_tokens;
+        }
+
         err = handler(dev, info, (union iwreq_data *) iwp, extra);
 
         iwp->length += essid_compat;
diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c
index ba59983aaffe..8bae6b22c846 100644
--- a/net/xfrm/xfrm_user.c
+++ b/net/xfrm/xfrm_user.c
@@ -1801,7 +1801,7 @@ static int xfrm_add_sa_expire(struct sk_buff *skb, struct nlmsghdr *nlh,
         struct xfrm_user_expire *ue = nlmsg_data(nlh);
         struct xfrm_usersa_info *p = &ue->state;
         struct xfrm_mark m;
-        u32 mark = xfrm_mark_get(attrs, &m);;
+        u32 mark = xfrm_mark_get(attrs, &m);
 
         x = xfrm_state_lookup(net, mark, &p->id.daddr, p->id.spi, p->id.proto, p->family);
 
@@ -2504,7 +2504,7 @@ static struct xfrm_policy *xfrm_compile_policy(struct sock *sk, int opt,
         if (p->dir > XFRM_POLICY_OUT)
                 return NULL;
 
-        xp = xfrm_policy_alloc(net, GFP_KERNEL);
+        xp = xfrm_policy_alloc(net, GFP_ATOMIC);
         if (xp == NULL) {
                 *dir = -ENOBUFS;
                 return NULL;