31 files changed, 187 insertions, 93 deletions

diff --git a/net/bridge/br_forward.c b/net/bridge/br_forward.c
index 2d24fb400e0c..56f3aa47e758 100644
--- a/net/bridge/br_forward.c
+++ b/net/bridge/br_forward.c
@@ -16,6 +16,7 @@
 #include <linux/kernel.h>
 #include <linux/netdevice.h>
 #include <linux/skbuff.h>
+#include <linux/if_vlan.h>
 #include <linux/netfilter_bridge.h>
 #include "br_private.h"
 
@@ -29,10 +30,15 @@ static inline int should_deliver(const struct net_bridge_port *p,
         return 1;
 }
 
+static inline unsigned packet_length(const struct sk_buff *skb)
+{
+        return skb->len - (skb->protocol == htons(ETH_P_8021Q) ? VLAN_HLEN : 0);
+}
+
 int br_dev_queue_push_xmit(struct sk_buff *skb)
 {
         /* drop mtu oversized packets except tso */
-        if (skb->len > skb->dev->mtu && !skb_shinfo(skb)->tso_size)
+        if (packet_length(skb) > skb->dev->mtu && !skb_shinfo(skb)->tso_size)
                 kfree_skb(skb);
         else {
 #ifdef CONFIG_BRIDGE_NETFILTER
diff --git a/net/bridge/netfilter/ebtables.c b/net/bridge/netfilter/ebtables.c
index 84b9af76f0a2..3a13ed643459 100644
--- a/net/bridge/netfilter/ebtables.c
+++ b/net/bridge/netfilter/ebtables.c
@@ -831,7 +831,7 @@ static int translate_table(struct ebt_replace *repl,
                         return -ENOMEM;
                 for_each_possible_cpu(i) {
                         newinfo->chainstack[i] =
-                           vmalloc(udc_cnt * sizeof(struct ebt_chainstack));
+                          vmalloc(udc_cnt * sizeof(*(newinfo->chainstack[0])));
                         if (!newinfo->chainstack[i]) {
                                 while (i)
                                         vfree(newinfo->chainstack[--i]);
@@ -841,8 +841,7 @@ static int translate_table(struct ebt_replace *repl,
                         }
                 }
 
-                cl_s = (struct ebt_cl_stack *)
-                   vmalloc(udc_cnt * sizeof(struct ebt_cl_stack));
+                cl_s = vmalloc(udc_cnt * sizeof(*cl_s));
                 if (!cl_s)
                         return -ENOMEM;
                 i = 0; /* the i'th udc */
@@ -944,8 +943,7 @@ static int do_replace(void __user *user, unsigned int len)
 
         countersize = COUNTER_OFFSET(tmp.nentries) * 
                                         (highest_possible_processor_id()+1);
-        newinfo = (struct ebt_table_info *)
-           vmalloc(sizeof(struct ebt_table_info) + countersize);
+        newinfo = vmalloc(sizeof(*newinfo) + countersize);
         if (!newinfo)
                 return -ENOMEM;
 
@@ -967,8 +965,7 @@ static int do_replace(void __user *user, unsigned int len)
         /* the user wants counters back
            the check on the size is done later, when we have the lock */
         if (tmp.num_counters) {
-                counterstmp = (struct ebt_counter *)
-                   vmalloc(tmp.num_counters * sizeof(struct ebt_counter));
+                counterstmp = vmalloc(tmp.num_counters * sizeof(*counterstmp));
                 if (!counterstmp) {
                         ret = -ENOMEM;
                         goto free_entries;
@@ -1148,8 +1145,7 @@ int ebt_register_table(struct ebt_table *table)
 
         countersize = COUNTER_OFFSET(table->table->nentries) *
                                         (highest_possible_processor_id()+1);
-        newinfo = (struct ebt_table_info *)
-           vmalloc(sizeof(struct ebt_table_info) + countersize);
+        newinfo = vmalloc(sizeof(*newinfo) + countersize);
         ret = -ENOMEM;
         if (!newinfo)
                 return -ENOMEM;
@@ -1247,8 +1243,7 @@ static int update_counters(void __user *user, unsigned int len)
         if (hlp.num_counters == 0)
                 return -EINVAL;
 
-        if ( !(tmp = (struct ebt_counter *)
-           vmalloc(hlp.num_counters * sizeof(struct ebt_counter))) ){
+        if (!(tmp = vmalloc(hlp.num_counters * sizeof(*tmp)))) {
                 MEMPRINT("Update_counters && nomemory\n");
                 return -ENOMEM;
         }
@@ -1377,8 +1372,7 @@ static int copy_everything_to_user(struct ebt_table *t, void __user *user,
                         BUGPRINT("Num_counters wrong\n");
                         return -EINVAL;
                 }
-                counterstmp = (struct ebt_counter *)
-                   vmalloc(nentries * sizeof(struct ebt_counter));
+                counterstmp = vmalloc(nentries * sizeof(*counterstmp));
                 if (!counterstmp) {
                         MEMPRINT("Couldn't copy counters, out of memory\n");
                         return -ENOMEM;
diff --git a/net/core/dev.c b/net/core/dev.c
index 83231a27ae02..3bad1afc89fa 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -2698,7 +2698,8 @@ int dev_ioctl(unsigned int cmd, void __user *arg)
                                 /* If command is `set a parameter', or
                                  * `get the encoding parameters', check if
                                  * the user has the right to do it */
-                                if (IW_IS_SET(cmd) || cmd == SIOCGIWENCODE) {
+                                if (IW_IS_SET(cmd) || cmd == SIOCGIWENCODE
+                                    || cmd == SIOCGIWENCODEEXT) {
                                         if (!capable(CAP_NET_ADMIN))
                                                 return -EPERM;
                                 }
diff --git a/net/core/filter.c b/net/core/filter.c
index 93fbd01d2259..5b4486a60cf6 100644
--- a/net/core/filter.c
+++ b/net/core/filter.c
@@ -34,6 +34,7 @@
 #include <linux/timer.h>
 #include <asm/system.h>
 #include <asm/uaccess.h>
+#include <asm/unaligned.h>
 #include <linux/filter.h>
 
 /* No hurry in this branch */
@@ -177,7 +178,7 @@ unsigned int sk_run_filter(struct sk_buff *skb, struct sock_filter *filter, int
 load_w:
                         ptr = load_pointer(skb, k, 4, &tmp);
                         if (ptr != NULL) {
-                                A = ntohl(*(u32 *)ptr);
+                                A = ntohl(get_unaligned((u32 *)ptr));
                                 continue;
                         }
                         break;
@@ -186,7 +187,7 @@ load_w:
 load_h:
                         ptr = load_pointer(skb, k, 2, &tmp);
                         if (ptr != NULL) {
-                                A = ntohs(*(u16 *)ptr);
+                                A = ntohs(get_unaligned((u16 *)ptr));
                                 continue;
                         }
                         break;
diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index 09464fa8d72f..fb3770f9c094 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -112,6 +112,14 @@ void skb_under_panic(struct sk_buff *skb, int sz, void *here)
         BUG();
 }
 
+void skb_truesize_bug(struct sk_buff *skb)
+{
+        printk(KERN_ERR "SKB BUG: Invalid truesize (%u) "
+               "len=%u, sizeof(sk_buff)=%Zd\n",
+               skb->truesize, skb->len, sizeof(struct sk_buff));
+}
+EXPORT_SYMBOL(skb_truesize_bug);
+
 /*      Allocate a new skbuff. We do this ourselves so we can fill in a few
  *      'private' fields and also do memory statistics to find all the
  *      [BEEP] leaks.
diff --git a/net/core/stream.c b/net/core/stream.c
index 35e25259fd95..e9489696f694 100644
--- a/net/core/stream.c
+++ b/net/core/stream.c
@@ -176,6 +176,7 @@ void sk_stream_rfree(struct sk_buff *skb)
 {
         struct sock *sk = skb->sk;
 
+        skb_truesize_check(skb);
         atomic_sub(skb->truesize, &sk->sk_rmem_alloc);
         sk->sk_forward_alloc += skb->truesize;
 }
diff --git a/net/core/wireless.c b/net/core/wireless.c
index 81d6995fcfdb..d2bc72d318f7 100644
--- a/net/core/wireless.c
+++ b/net/core/wireless.c
@@ -1726,6 +1726,14 @@ int wireless_rtnetlink_get(struct net_device *	dev,
         if(!IW_IS_GET(request->cmd))
                 return -EOPNOTSUPP;
 
+        /* If command is `get the encoding parameters', check if
+         * the user has the right to do it */
+        if (request->cmd == SIOCGIWENCODE ||
+            request->cmd == SIOCGIWENCODEEXT) {
+                if (!capable(CAP_NET_ADMIN))
+                        return -EPERM;
+        }
+
         /* Special cases */
         if(request->cmd == SIOCGIWSTATS)
                 /* Get Wireless Stats */
diff --git a/net/ieee80211/softmac/Kconfig b/net/ieee80211/softmac/Kconfig
index 6cd9f3427be6..f2a27cc6ecb1 100644
--- a/net/ieee80211/softmac/Kconfig
+++ b/net/ieee80211/softmac/Kconfig
@@ -1,6 +1,7 @@
 config IEEE80211_SOFTMAC
         tristate "Software MAC add-on to the IEEE 802.11 networking stack"
         depends on IEEE80211 && EXPERIMENTAL
+        select WIRELESS_EXT
         ---help---
         This option enables the hardware independent software MAC addon
         for the IEEE 802.11 networking stack.
diff --git a/net/ieee80211/softmac/ieee80211softmac_assoc.c b/net/ieee80211/softmac/ieee80211softmac_assoc.c
index be61de78dfa4..fb79ce7d6439 100644
--- a/net/ieee80211/softmac/ieee80211softmac_assoc.c
+++ b/net/ieee80211/softmac/ieee80211softmac_assoc.c
@@ -101,6 +101,7 @@ ieee80211softmac_disassoc(struct ieee80211softmac_device *mac, u16 reason)
         /* Do NOT clear bssvalid as that will break ieee80211softmac_assoc_work! */
         mac->associated = 0;
         mac->associnfo.associating = 0;
+        ieee80211softmac_call_events_locked(mac, IEEE80211SOFTMAC_EVENT_DISASSOCIATED, NULL);
         spin_unlock_irqrestore(&mac->lock, flags);
 }
 
@@ -143,6 +144,12 @@ network_matches_request(struct ieee80211softmac_device *mac, struct ieee80211_ne
         if (!we_support_all_basic_rates(mac, net->rates_ex, net->rates_ex_len))
                 return 0;
 
+        /* assume that users know what they're doing ...
+         * (note we don't let them select a net we're incompatible with) */
+        if (mac->associnfo.bssfixed) {
+                return !memcmp(mac->associnfo.bssid, net->bssid, ETH_ALEN);
+        }
+
         /* if 'ANY' network requested, take any that doesn't have privacy enabled */
         if (mac->associnfo.req_essid.len == 0 
             && !(net->capability & WLAN_CAPABILITY_PRIVACY))
@@ -175,7 +182,7 @@ ieee80211softmac_assoc_work(void *d)
                 ieee80211softmac_disassoc(mac, WLAN_REASON_DISASSOC_STA_HAS_LEFT);
 
         /* try to find the requested network in our list, if we found one already */
-        if (mac->associnfo.bssvalid)
+        if (mac->associnfo.bssvalid || mac->associnfo.bssfixed)
                 found = ieee80211softmac_get_network_by_bssid(mac, mac->associnfo.bssid);       
         
         /* Search the ieee80211 networks for this network if we didn't find it by bssid,
@@ -240,19 +247,25 @@ ieee80211softmac_assoc_work(void *d)
                         if (ieee80211softmac_start_scan(mac))
                                 dprintk(KERN_INFO PFX "Associate: failed to initiate scan. Is device up?\n");
                         return;
-                }
-                else {
+                } else {
                         spin_lock_irqsave(&mac->lock, flags);
                         mac->associnfo.associating = 0;
                         mac->associated = 0;
                         spin_unlock_irqrestore(&mac->lock, flags);
 
                         dprintk(KERN_INFO PFX "Unable to find matching network after scan!\n");
+                        /* reset the retry counter for the next user request since we
+                         * break out and don't reschedule ourselves after this point. */
+                        mac->associnfo.scan_retry = IEEE80211SOFTMAC_ASSOC_SCAN_RETRY_LIMIT;
                         ieee80211softmac_call_events(mac, IEEE80211SOFTMAC_EVENT_ASSOCIATE_NET_NOT_FOUND, NULL);
                         return;
                 }
         }
-        
+
+        /* reset the retry counter for the next user request since we
+         * now found a net and will try to associate to it, but not
+         * schedule this function again. */
+        mac->associnfo.scan_retry = IEEE80211SOFTMAC_ASSOC_SCAN_RETRY_LIMIT;
         mac->associnfo.bssvalid = 1;
         memcpy(mac->associnfo.bssid, found->bssid, ETH_ALEN);
         /* copy the ESSID for displaying it */
@@ -373,6 +386,7 @@ ieee80211softmac_handle_disassoc(struct net_device * dev,
         spin_lock_irqsave(&mac->lock, flags);
         mac->associnfo.bssvalid = 0;
         mac->associated = 0;
+        ieee80211softmac_call_events_locked(mac, IEEE80211SOFTMAC_EVENT_DISASSOCIATED, NULL);
         schedule_work(&mac->associnfo.work);
         spin_unlock_irqrestore(&mac->lock, flags);
         
@@ -391,6 +405,7 @@ ieee80211softmac_handle_reassoc_req(struct net_device * dev,
                 dprintkl(KERN_INFO PFX "reassoc request from unknown network\n");
                 return 0;
         }
-        ieee80211softmac_assoc(mac, network);
+        schedule_work(&mac->associnfo.work);
+
         return 0;
 }
diff --git a/net/ieee80211/softmac/ieee80211softmac_event.c b/net/ieee80211/softmac/ieee80211softmac_event.c
index 0a52bbda1e4c..8cc8f3f0f8e7 100644
--- a/net/ieee80211/softmac/ieee80211softmac_event.c
+++ b/net/ieee80211/softmac/ieee80211softmac_event.c
@@ -67,6 +67,7 @@ static char *event_descriptions[IEEE80211SOFTMAC_EVENT_LAST+1] = {
         "authenticating failed",
         "authenticating timed out",
         "associating failed because no suitable network was found",
+        "disassociated",
 };
 
 
@@ -128,13 +129,42 @@ void
 ieee80211softmac_call_events_locked(struct ieee80211softmac_device *mac, int event, void *event_ctx)
 {
         struct ieee80211softmac_event *eventptr, *tmp;
-        union iwreq_data wrqu;
-        char *msg;
+        struct ieee80211softmac_network *network;
         
         if (event >= 0) {
-                msg = event_descriptions[event];
-                wrqu.data.length = strlen(msg);
-                wireless_send_event(mac->dev, IWEVCUSTOM, &wrqu, msg);
+                union iwreq_data wrqu;
+                int we_event;
+                char *msg = NULL;
+
+                switch(event) {
+                case IEEE80211SOFTMAC_EVENT_ASSOCIATED:
+                        network = (struct ieee80211softmac_network *)event_ctx;
+                        wrqu.data.length = 0;
+                        wrqu.data.flags = 0;
+                        memcpy(wrqu.ap_addr.sa_data, &network->bssid[0], ETH_ALEN);
+                        wrqu.ap_addr.sa_family = ARPHRD_ETHER;
+                        we_event = SIOCGIWAP;
+                        break;
+                case IEEE80211SOFTMAC_EVENT_DISASSOCIATED:
+                        wrqu.data.length = 0;
+                        wrqu.data.flags = 0;
+                        memset(&wrqu, '\0', sizeof (union iwreq_data));
+                        wrqu.ap_addr.sa_family = ARPHRD_ETHER;
+                        we_event = SIOCGIWAP;
+                        break;
+                case IEEE80211SOFTMAC_EVENT_SCAN_FINISHED:
+                        wrqu.data.length = 0;
+                        wrqu.data.flags = 0;
+                        memset(&wrqu, '\0', sizeof (union iwreq_data));
+                        we_event = SIOCGIWSCAN;
+                        break;
+                default:
+                        msg = event_descriptions[event];
+                        wrqu.data.length = strlen(msg);
+                        we_event = IWEVCUSTOM;
+                        break;
+                }
+                wireless_send_event(mac->dev, we_event, &wrqu, msg);
         }
 
         if (!list_empty(&mac->events))
diff --git a/net/ieee80211/softmac/ieee80211softmac_io.c b/net/ieee80211/softmac/ieee80211softmac_io.c
index febc51dbb412..cc6cd56c85b1 100644
--- a/net/ieee80211/softmac/ieee80211softmac_io.c
+++ b/net/ieee80211/softmac/ieee80211softmac_io.c
@@ -180,9 +180,21 @@ ieee80211softmac_assoc_req(struct ieee80211_assoc_request **pkt,
         ieee80211softmac_hdr_3addr(mac, &((*pkt)->header), IEEE80211_STYPE_ASSOC_REQ, net->bssid, net->bssid);
 
         /* Fill in capability Info */
-        (*pkt)->capability = (mac->ieee->iw_mode == IW_MODE_MASTER) || (mac->ieee->iw_mode == IW_MODE_INFRA) ?
-                cpu_to_le16(WLAN_CAPABILITY_ESS) :
-                cpu_to_le16(WLAN_CAPABILITY_IBSS);
+        switch (mac->ieee->iw_mode) {
+        case IW_MODE_INFRA:
+                (*pkt)->capability = cpu_to_le16(WLAN_CAPABILITY_ESS);
+                break;
+        case IW_MODE_ADHOC:
+                (*pkt)->capability = cpu_to_le16(WLAN_CAPABILITY_IBSS);
+                break;
+        case IW_MODE_AUTO:
+                (*pkt)->capability = net->capabilities & (WLAN_CAPABILITY_ESS|WLAN_CAPABILITY_IBSS);
+                break;
+        default:
+                /* bleh. we don't ever go to these modes */
+                printk(KERN_ERR PFX "invalid iw_mode!\n");
+                break;
+        }
         /* Need to add this
         (*pkt)->capability |= mac->ieee->short_slot ? 
                         cpu_to_le16(WLAN_CAPABILITY_SHORT_SLOT_TIME) : 0;
diff --git a/net/ieee80211/softmac/ieee80211softmac_module.c b/net/ieee80211/softmac/ieee80211softmac_module.c
index 60f06a31f0d1..be83bdc1644a 100644
--- a/net/ieee80211/softmac/ieee80211softmac_module.c
+++ b/net/ieee80211/softmac/ieee80211softmac_module.c
@@ -45,6 +45,8 @@ struct net_device *alloc_ieee80211softmac(int sizeof_priv)
         softmac->ieee->handle_disassoc = ieee80211softmac_handle_disassoc;
         softmac->scaninfo = NULL;
 
+        softmac->associnfo.scan_retry = IEEE80211SOFTMAC_ASSOC_SCAN_RETRY_LIMIT;
+
         /* TODO: initialise all the other callbacks in the ieee struct
          *       (once they're written)
          */
diff --git a/net/ieee80211/softmac/ieee80211softmac_scan.c b/net/ieee80211/softmac/ieee80211softmac_scan.c
index bb9ab8b45d09..2b9e7edfa3ce 100644
--- a/net/ieee80211/softmac/ieee80211softmac_scan.c
+++ b/net/ieee80211/softmac/ieee80211softmac_scan.c
@@ -47,6 +47,7 @@ ieee80211softmac_start_scan(struct ieee80211softmac_device *sm)
         sm->scanning = 1;
         spin_unlock_irqrestore(&sm->lock, flags);
 
+        netif_tx_disable(sm->ieee->dev);
         ret = sm->start_scan(sm->dev);
         if (ret) {
                 spin_lock_irqsave(&sm->lock, flags);
@@ -239,6 +240,7 @@ void ieee80211softmac_scan_finished(struct ieee80211softmac_device *sm)
                 if (net)
                         sm->set_channel(sm->dev, net->channel);
         }
+        netif_wake_queue(sm->ieee->dev);
         ieee80211softmac_call_events(sm, IEEE80211SOFTMAC_EVENT_SCAN_FINISHED, NULL);
 }
 EXPORT_SYMBOL_GPL(ieee80211softmac_scan_finished);
diff --git a/net/ieee80211/softmac/ieee80211softmac_wx.c b/net/ieee80211/softmac/ieee80211softmac_wx.c
index b559aa9b5507..27edb2b5581a 100644
--- a/net/ieee80211/softmac/ieee80211softmac_wx.c
+++ b/net/ieee80211/softmac/ieee80211softmac_wx.c
@@ -27,7 +27,8 @@
 #include "ieee80211softmac_priv.h"
 
 #include <net/iw_handler.h>
-
+/* for is_broadcast_ether_addr and is_zero_ether_addr */
+#include <linux/etherdevice.h>
 
 int
 ieee80211softmac_wx_trigger_scan(struct net_device *net_dev,
@@ -41,13 +42,23 @@ ieee80211softmac_wx_trigger_scan(struct net_device *net_dev,
 EXPORT_SYMBOL_GPL(ieee80211softmac_wx_trigger_scan);
 
 
+/* if we're still scanning, return -EAGAIN so that userspace tools
+ * can get the complete scan results, otherwise return 0. */
 int
 ieee80211softmac_wx_get_scan_results(struct net_device *net_dev,
                                      struct iw_request_info *info,
                                      union iwreq_data *data,
                                      char *extra)
 {
+        unsigned long flags;
         struct ieee80211softmac_device *sm = ieee80211_priv(net_dev);
+
+        spin_lock_irqsave(&sm->lock, flags);
+        if (sm->scanning) {
+                spin_unlock_irqrestore(&sm->lock, flags);
+                return -EAGAIN;
+        }
+        spin_unlock_irqrestore(&sm->lock, flags);
         return ieee80211_wx_get_scan(sm->ieee, info, data, extra);
 }
 EXPORT_SYMBOL_GPL(ieee80211softmac_wx_get_scan_results);
@@ -73,7 +84,6 @@ ieee80211softmac_wx_set_essid(struct net_device *net_dev,
                         sm->associnfo.static_essid = 1;
                 }
         }
-        sm->associnfo.scan_retry = IEEE80211SOFTMAC_ASSOC_SCAN_RETRY_LIMIT;
 
         /* set our requested ESSID length.
          * If applicable, we have already copied the data in */
@@ -300,8 +310,6 @@ ieee80211softmac_wx_set_wap(struct net_device *net_dev,
                             char *extra)
 {
         struct ieee80211softmac_device *mac = ieee80211_priv(net_dev);
-        static const unsigned char any[] = {0xff, 0xff, 0xff, 0xff, 0xff, 0xff};
-        static const unsigned char off[] = {0x00, 0x00, 0x00, 0x00, 0x00, 0x00};
         unsigned long flags;
 
         /* sanity check */
@@ -310,10 +318,17 @@ ieee80211softmac_wx_set_wap(struct net_device *net_dev,
         }
 
         spin_lock_irqsave(&mac->lock, flags);
-        if (!memcmp(any, data->ap_addr.sa_data, ETH_ALEN) ||
-            !memcmp(off, data->ap_addr.sa_data, ETH_ALEN)) {
-                schedule_work(&mac->associnfo.work);
-                goto out;
+        if (is_broadcast_ether_addr(data->ap_addr.sa_data)) {
+                /* the bssid we have is not to be fixed any longer,
+                 * and we should reassociate to the best AP. */
+                mac->associnfo.bssfixed = 0;
+                /* force reassociation */
+                mac->associnfo.bssvalid = 0;
+                if (mac->associated)
+                        schedule_work(&mac->associnfo.work);
+        } else if (is_zero_ether_addr(data->ap_addr.sa_data)) {
+                /* the bssid we have is no longer fixed */
+                mac->associnfo.bssfixed = 0;
         } else {
                 if (!memcmp(mac->associnfo.bssid, data->ap_addr.sa_data, ETH_ALEN)) {
                         if (mac->associnfo.associating || mac->associated) {
@@ -323,12 +338,14 @@ ieee80211softmac_wx_set_wap(struct net_device *net_dev,
                 } else {
                         /* copy new value in data->ap_addr.sa_data to bssid */
                         memcpy(mac->associnfo.bssid, data->ap_addr.sa_data, ETH_ALEN);
-                }       
+                }
+                /* tell the other code that this bssid should be used no matter what */
+                mac->associnfo.bssfixed = 1;
                 /* queue associate if new bssid or (old one again and not associated) */
                 schedule_work(&mac->associnfo.work);
         }
 
-out:
+ out:
         spin_unlock_irqrestore(&mac->lock, flags);
         return 0;
 }
diff --git a/net/ipv4/ipcomp.c b/net/ipv4/ipcomp.c
index 04a429465665..cd810f41af1a 100644
--- a/net/ipv4/ipcomp.c
+++ b/net/ipv4/ipcomp.c
@@ -290,11 +290,8 @@ static void ipcomp_free_scratches(void)
         if (!scratches)
                 return;
 
-        for_each_possible_cpu(i) {
-                void *scratch = *per_cpu_ptr(scratches, i);
-                if (scratch)
-                        vfree(scratch);
-        }
+        for_each_possible_cpu(i)
+                vfree(*per_cpu_ptr(scratches, i));
 
         free_percpu(scratches);
 }
diff --git a/net/ipv4/netfilter/Kconfig b/net/ipv4/netfilter/Kconfig
index c60fd5c4ea1e..3d560dec63ab 100644
--- a/net/ipv4/netfilter/Kconfig
+++ b/net/ipv4/netfilter/Kconfig
@@ -345,7 +345,7 @@ config IP_NF_TARGET_LOG
           To compile it as a module, choose M here.  If unsure, say N.
 
 config IP_NF_TARGET_ULOG
-        tristate "ULOG target support (OBSOLETE)"
+        tristate "ULOG target support"
         depends on IP_NF_IPTABLES
         ---help---
 
diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
index b871db6adc55..a28ae593b976 100644
--- a/net/ipv4/tcp_output.c
+++ b/net/ipv4/tcp_output.c
@@ -533,6 +533,7 @@ int tcp_fragment(struct sock *sk, struct sk_buff *skb, u32 len, unsigned int mss
         struct tcp_sock *tp = tcp_sk(sk);
         struct sk_buff *buff;
         int nsize, old_factor;
+        int nlen;
         u16 flags;
 
         BUG_ON(len > skb->len);
@@ -551,7 +552,11 @@ int tcp_fragment(struct sock *sk, struct sk_buff *skb, u32 len, unsigned int mss
         buff = sk_stream_alloc_skb(sk, nsize, GFP_ATOMIC);
         if (buff == NULL)
                 return -ENOMEM; /* We'll just try again later. */
+
         sk_charge_skb(sk, buff);
+        nlen = skb->len - len - nsize;
+        buff->truesize += nlen;
+        skb->truesize -= nlen;
 
         /* Correct the sequence numbers. */
         TCP_SKB_CB(buff)->seq = TCP_SKB_CB(skb)->seq + len;
@@ -1037,7 +1042,8 @@ static int tso_fragment(struct sock *sk, struct sk_buff *skb, unsigned int len,
         if (unlikely(buff == NULL))
                 return -ENOMEM;
 
-        buff->truesize = nlen;
+        sk_charge_skb(sk, buff);
+        buff->truesize += nlen;
         skb->truesize -= nlen;
 
         /* Correct the sequence numbers. */
diff --git a/net/ipv6/exthdrs.c b/net/ipv6/exthdrs.c
index 2a1e7e45b890..a18d4256372c 100644
--- a/net/ipv6/exthdrs.c
+++ b/net/ipv6/exthdrs.c
@@ -485,15 +485,27 @@ static struct tlvtype_proc tlvprochopopt_lst[] = {
         { -1, }
 };
 
-int ipv6_parse_hopopts(struct sk_buff *skb, int nhoff)
+int ipv6_parse_hopopts(struct sk_buff *skb)
 {
         struct inet6_skb_parm *opt = IP6CB(skb);
 
+        /*
+         * skb->nh.raw is equal to skb->data, and
+         * skb->h.raw - skb->nh.raw is always equal to
+         * sizeof(struct ipv6hdr) by definition of
+         * hop-by-hop options.
+         */
+        if (!pskb_may_pull(skb, sizeof(struct ipv6hdr) + 8) ||
+            !pskb_may_pull(skb, sizeof(struct ipv6hdr) + ((skb->h.raw[1] + 1) << 3))) {
+                kfree_skb(skb);
+                return -1;
+        }
+
         opt->hop = sizeof(struct ipv6hdr);
         if (ip6_parse_tlv(tlvprochopopt_lst, skb)) {
                 skb->h.raw += (skb->h.raw[1]+1)<<3;
                 opt->nhoff = sizeof(struct ipv6hdr);
-                return sizeof(struct ipv6hdr);
+                return 1;
         }
         return -1;
 }
diff --git a/net/ipv6/ip6_input.c b/net/ipv6/ip6_input.c
index 29f73592e68e..aceee252503d 100644
--- a/net/ipv6/ip6_input.c
+++ b/net/ipv6/ip6_input.c
@@ -114,11 +114,10 @@ int ipv6_rcv(struct sk_buff *skb, struct net_device *dev, struct packet_type *pt
         }
 
         if (hdr->nexthdr == NEXTHDR_HOP) {
-                if (ipv6_parse_hopopts(skb, IP6CB(skb)->nhoff) < 0) {
+                if (ipv6_parse_hopopts(skb) < 0) {
                         IP6_INC_STATS_BH(IPSTATS_MIB_INHDRERRORS);
                         return 0;
                 }
-                hdr = skb->nh.ipv6h;
         }
 
         return NF_HOOK(PF_INET6,NF_IP6_PRE_ROUTING, skb, dev, NULL, ip6_rcv_finish);
diff --git a/net/ipv6/netfilter/ip6_tables.c b/net/ipv6/netfilter/ip6_tables.c
index 642b4b11464f..0a673038344f 100644
--- a/net/ipv6/netfilter/ip6_tables.c
+++ b/net/ipv6/netfilter/ip6_tables.c
@@ -288,19 +288,6 @@ ip6t_do_table(struct sk_buff **pskb,
         table_base = (void *)private->entries[smp_processor_id()];
         e = get_entry(table_base, private->hook_entry[hook]);
 
-#ifdef CONFIG_NETFILTER_DEBUG
-        /* Check noone else using our table */
-        if (((struct ip6t_entry *)table_base)->comefrom != 0xdead57ac
-            && ((struct ip6t_entry *)table_base)->comefrom != 0xeeeeeeec) {
-                printk("ASSERT: CPU #%u, %s comefrom(%p) = %X\n",
-                       smp_processor_id(),
-                       table->name,
-                       &((struct ip6t_entry *)table_base)->comefrom,
-                       ((struct ip6t_entry *)table_base)->comefrom);
-        }
-        ((struct ip6t_entry *)table_base)->comefrom = 0x57acc001;
-#endif
-
         /* For return from builtin chain */
         back = get_entry(table_base, private->underflow[hook]);
 
diff --git a/net/ipv6/xfrm6_policy.c b/net/ipv6/xfrm6_policy.c
index 91cce8b2d7a5..88c840f1beb6 100644
--- a/net/ipv6/xfrm6_policy.c
+++ b/net/ipv6/xfrm6_policy.c
@@ -191,16 +191,18 @@ error:
 static inline void
 _decode_session6(struct sk_buff *skb, struct flowi *fl)
 {
-        u16 offset = sizeof(struct ipv6hdr);
+        u16 offset = skb->h.raw - skb->nh.raw;
         struct ipv6hdr *hdr = skb->nh.ipv6h;
-        struct ipv6_opt_hdr *exthdr = (struct ipv6_opt_hdr*)(skb->nh.raw + offset);
-        u8 nexthdr = skb->nh.ipv6h->nexthdr;
+        struct ipv6_opt_hdr *exthdr;
+        u8 nexthdr = skb->nh.raw[IP6CB(skb)->nhoff];
 
         memset(fl, 0, sizeof(struct flowi));
         ipv6_addr_copy(&fl->fl6_dst, &hdr->daddr);
         ipv6_addr_copy(&fl->fl6_src, &hdr->saddr);
 
         while (pskb_may_pull(skb, skb->nh.raw + offset + 1 - skb->data)) {
+                exthdr = (struct ipv6_opt_hdr*)(skb->nh.raw + offset);
+
                 switch (nexthdr) {
                 case NEXTHDR_ROUTING:
                 case NEXTHDR_HOP:
diff --git a/net/llc/llc_input.c b/net/llc/llc_input.c
index 8f3addf0724c..d62e0f9b9da3 100644
--- a/net/llc/llc_input.c
+++ b/net/llc/llc_input.c
@@ -118,7 +118,8 @@ static inline int llc_fixup_skb(struct sk_buff *skb)
                 u16 pdulen = eth_hdr(skb)->h_proto,
                     data_size = ntohs(pdulen) - llc_len;
 
-                skb_trim(skb, data_size);
+                if (unlikely(pskb_trim_rcsum(skb, data_size)))
+                        return 0;
         }
         return 1;
 }
diff --git a/net/netfilter/nf_conntrack_core.c b/net/netfilter/nf_conntrack_core.c
index e581190fb6c3..f9b83f91371a 100644
--- a/net/netfilter/nf_conntrack_core.c
+++ b/net/netfilter/nf_conntrack_core.c
@@ -178,9 +178,6 @@ static struct {
         /* allocated slab cache + modules which uses this slab cache */
         int use;
 
-        /* Initialization */
-        int (*init_conntrack)(struct nf_conn *, u_int32_t);
-
 } nf_ct_cache[NF_CT_F_NUM];
 
 /* protect members of nf_ct_cache except of "use" */
@@ -208,10 +205,8 @@ nf_ct_proto_find_get(u_int16_t l3proto, u_int8_t protocol)
 
         preempt_disable();
         p = __nf_ct_proto_find(l3proto, protocol);
-        if (p) {
-                if (!try_module_get(p->me))
-                        p = &nf_conntrack_generic_protocol;
-        }
+        if (!try_module_get(p->me))
+                p = &nf_conntrack_generic_protocol;
         preempt_enable();
         
         return p;
@@ -229,10 +224,8 @@ nf_ct_l3proto_find_get(u_int16_t l3proto)
 
         preempt_disable();
         p = __nf_ct_l3proto_find(l3proto);
-        if (p) {
-                if (!try_module_get(p->me))
-                        p = &nf_conntrack_generic_l3proto;
-        }
+        if (!try_module_get(p->me))
+                p = &nf_conntrack_generic_l3proto;
         preempt_enable();
 
         return p;
diff --git a/net/netfilter/nf_conntrack_l3proto_generic.c b/net/netfilter/nf_conntrack_l3proto_generic.c
index 7de4f06c63c5..3fc58e454d4e 100644
--- a/net/netfilter/nf_conntrack_l3proto_generic.c
+++ b/net/netfilter/nf_conntrack_l3proto_generic.c
@@ -94,5 +94,4 @@ struct nf_conntrack_l3proto nf_conntrack_generic_l3proto = {
         .print_conntrack = generic_print_conntrack,
         .prepare         = generic_prepare,
         .get_features    = generic_get_features,
-        .me              = THIS_MODULE,
 };
diff --git a/net/netfilter/x_tables.c b/net/netfilter/x_tables.c
index 00cf0a4f4d92..17abf60f9570 100644
--- a/net/netfilter/x_tables.c
+++ b/net/netfilter/x_tables.c
@@ -529,6 +529,7 @@ int xt_register_table(struct xt_table *table,
 
         /* Simplifies replace_table code. */
         table->private = bootstrap;
+        rwlock_init(&table->lock);
         if (!xt_replace_table(table, 0, newinfo, &ret))
                 goto unlock;
 
@@ -538,7 +539,6 @@ int xt_register_table(struct xt_table *table,
         /* save number of initial entries */
         private->initial_entries = private->number;
 
-        rwlock_init(&table->lock);
         list_prepend(&xt[table->af].tables, table);
 
         ret = 0;
diff --git a/net/sched/act_ipt.c b/net/sched/act_ipt.c
index 6056d20ef429..37640c6fc014 100644
--- a/net/sched/act_ipt.c
+++ b/net/sched/act_ipt.c
@@ -69,6 +69,11 @@ ipt_init_target(struct ipt_entry_target *t, char *table, unsigned int hook)
         DPRINTK("ipt_init_target: found %s\n", target->name);
         t->u.kernel.target = target;
 
+        ret = xt_check_target(target, AF_INET, t->u.target_size - sizeof(*t),
+                              table, hook, 0, 0);
+        if (ret)
+                return ret;
+
         if (t->u.kernel.target->checkentry
             && !t->u.kernel.target->checkentry(table, NULL,
                                                t->u.kernel.target, t->data,
diff --git a/net/socket.c b/net/socket.c
index 23898f45f713..0ce12dfc7a71 100644
--- a/net/socket.c
+++ b/net/socket.c
@@ -490,6 +490,7 @@ static struct socket *sockfd_lookup_light(int fd, int *err, int *fput_needed)
         struct file *file;
         struct socket *sock;
 
+        *err = -EBADF;
         file = fget_light(fd, fput_needed);
         if (file) {
                 sock = sock_from_file(file, err);
diff --git a/net/sunrpc/auth_gss/auth_gss.c b/net/sunrpc/auth_gss/auth_gss.c
index 900ef31f5a0e..519ebc17c028 100644
--- a/net/sunrpc/auth_gss/auth_gss.c
+++ b/net/sunrpc/auth_gss/auth_gss.c
@@ -794,7 +794,6 @@ gss_create_cred(struct rpc_auth *auth, struct auth_cred *acred, int flags)
 
 out_err:
         dprintk("RPC:      gss_create_cred failed with error %d\n", err);
-        if (cred) gss_destroy_cred(&cred->gc_base);
         return ERR_PTR(err);
 }
 
diff --git a/net/sunrpc/auth_gss/gss_krb5_crypto.c b/net/sunrpc/auth_gss/gss_krb5_crypto.c
index 97c981fa6b8e..76b969e6904f 100644
--- a/net/sunrpc/auth_gss/gss_krb5_crypto.c
+++ b/net/sunrpc/auth_gss/gss_krb5_crypto.c
@@ -212,7 +212,6 @@ make_checksum(s32 cksumtype, char *header, int hdrlen, struct xdr_buf *body,
         char                            *cksumname;
         struct crypto_tfm               *tfm = NULL; /* XXX add to ctx? */
         struct scatterlist              sg[1];
-        u32                             code = GSS_S_FAILURE;
 
         switch (cksumtype) {
                 case CKSUMTYPE_RSA_MD5:
@@ -221,13 +220,11 @@ make_checksum(s32 cksumtype, char *header, int hdrlen, struct xdr_buf *body,
                 default:
                         dprintk("RPC:      krb5_make_checksum:"
                                 " unsupported checksum %d", cksumtype);
-                        goto out;
+                        return GSS_S_FAILURE;
         }
         if (!(tfm = crypto_alloc_tfm(cksumname, CRYPTO_TFM_REQ_MAY_SLEEP)))
-                goto out;
+                return GSS_S_FAILURE;
         cksum->len = crypto_tfm_alg_digestsize(tfm);
-        if ((cksum->data = kmalloc(cksum->len, GFP_KERNEL)) == NULL)
-                goto out;
 
         crypto_digest_init(tfm);
         sg_set_buf(sg, header, hdrlen);
@@ -235,10 +232,8 @@ make_checksum(s32 cksumtype, char *header, int hdrlen, struct xdr_buf *body,
         process_xdr_buf(body, body_offset, body->len - body_offset,
                         checksummer, tfm);
         crypto_digest_final(tfm, cksum->data);
-        code = 0;
-out:
         crypto_free_tfm(tfm);
-        return code;
+        return 0;
 }
 
 EXPORT_SYMBOL(make_checksum);
diff --git a/net/sunrpc/stats.c b/net/sunrpc/stats.c
index dea529666d69..15c2db26767b 100644
--- a/net/sunrpc/stats.c
+++ b/net/sunrpc/stats.c
@@ -176,7 +176,8 @@ void rpc_count_iostats(struct rpc_task *task)
         op_metrics->om_execute += execute;
 }
 
-void _print_name(struct seq_file *seq, unsigned int op, struct rpc_procinfo *procs)
+static void _print_name(struct seq_file *seq, unsigned int op,
+                        struct rpc_procinfo *procs)
 {
         if (procs[op].p_name)
                 seq_printf(seq, "\t%12s: ", procs[op].p_name);
diff --git a/net/tipc/name_distr.c b/net/tipc/name_distr.c
index 953307a9df1d..a3bbc891f959 100644
--- a/net/tipc/name_distr.c
+++ b/net/tipc/name_distr.c
@@ -229,8 +229,7 @@ static void node_is_down(struct publication *publ)
                                      publ->node, publ->ref, publ->key);
         assert(p == publ);
         write_unlock_bh(&tipc_nametbl_lock);
-        if (publ)
-                kfree(publ);
+        kfree(publ);
 }
 
 /**