40 files changed, 223 insertions, 169 deletions
diff --git a/net/atm/atm_misc.c b/net/atm/atm_misc.c
index 223c7ad5bd0f..02cc7e71efea 100644
--- a/net/atm/atm_misc.c
+++ b/net/atm/atm_misc.c
@@ -74,11 +74,14 @@ struct sk_buff *atm_alloc_charge(struct atm_vcc *vcc,int pdu_size,
 */
-int atm_pcr_goal(struct atm_trafprm *tp)
+int atm_pcr_goal(const struct atm_trafprm *tp)
 {
-        if (tp->pcr && tp->pcr != ATM_MAX_PCR) return -tp->pcr;
+        if (tp->pcr && tp->pcr != ATM_MAX_PCR)
-        if (tp->min_pcr && !tp->pcr) return tp->min_pcr;
+                return -tp->pcr;
-        if (tp->max_pcr != ATM_MAX_PCR) return -tp->max_pcr;
+        if (tp->min_pcr && !tp->pcr)
+                return tp->min_pcr;
+        if (tp->max_pcr != ATM_MAX_PCR)
+                return -tp->max_pcr;
        return 0;
 }
diff --git a/net/atm/common.c b/net/atm/common.c
index 63feea49fb13..6656b111cc05 100644
--- a/net/atm/common.c
+++ b/net/atm/common.c
@@ -221,6 +221,29 @@ void vcc_release_async(struct atm_vcc *vcc, int reply)
 EXPORT_SYMBOL(vcc_release_async);
+void atm_dev_release_vccs(struct atm_dev *dev)
+{
+        int i;
+        write_lock_irq(&vcc_sklist_lock);
+        for (i = 0; i < VCC_HTABLE_SIZE; i++) {
+                struct hlist_head *head = &vcc_hash[i];
+                struct hlist_node *node, *tmp;
+                struct sock *s;
+                struct atm_vcc *vcc;
+                sk_for_each_safe(s, node, tmp, head) {
+                        vcc = atm_sk(s);
+                        if (vcc->dev == dev) {
+                                vcc_release_async(vcc, -EPIPE);
+                                sk_del_node_init(s);
+                        }
+                }
+        }
+        write_unlock_irq(&vcc_sklist_lock);
+}
 static int adjust_tp(struct atm_trafprm *tp,unsigned char aal)
 {
        int max_sdu;
@@ -332,12 +355,13 @@ static int __vcc_connect(struct atm_vcc *vcc, struct atm_dev *dev, short vpi,
                return -EINVAL;
        if (vci > 0 && vci < ATM_NOT_RSV_VCI && !capable(CAP_NET_BIND_SERVICE))
                return -EPERM;
-        error = 0;
+        error = -ENODEV;
        if (!try_module_get(dev->ops->owner))
-                return -ENODEV;
+                return error;
        vcc->dev = dev;
        write_lock_irq(&vcc_sklist_lock);
-        if ((error = find_ci(vcc, &vpi, &vci))) {
+        if (test_bit(ATM_DF_REMOVED, &dev->flags) || 
+            (error = find_ci(vcc, &vpi, &vci))) {
                write_unlock_irq(&vcc_sklist_lock);
                goto fail_module_put;
        }
@@ -423,33 +447,23 @@ int vcc_connect(struct socket *sock, int itf, short vpi, int vci)
        if (vcc->qos.txtp.traffic_class == ATM_ANYCLASS ||
            vcc->qos.rxtp.traffic_class == ATM_ANYCLASS)
                return -EINVAL;
-        if (itf != ATM_ITF_ANY) {
+        if (likely(itf != ATM_ITF_ANY)) {
-                dev = atm_dev_lookup(itf);
+                dev = try_then_request_module(atm_dev_lookup(itf), "atm-device-%d", itf);
-                if (!dev)
-                        return -ENODEV;
-                error = __vcc_connect(vcc, dev, vpi, vci);
-                if (error) {
-                        atm_dev_put(dev);
-                        return error;
-                }
        } else {
-                struct list_head *p, *next;
                dev = NULL;
-                spin_lock(&atm_dev_lock);
+                down(&atm_dev_mutex);
-                list_for_each_safe(p, next, &atm_devs) {
+                if (!list_empty(&atm_devs)) {
-                        dev = list_entry(p, struct atm_dev, dev_list);
+                        dev = list_entry(atm_devs.next, struct atm_dev, dev_list);
                        atm_dev_hold(dev);
-                        spin_unlock(&atm_dev_lock);
-                        if (!__vcc_connect(vcc, dev, vpi, vci))
-                                break;
-                        atm_dev_put(dev);
-                        dev = NULL;
-                        spin_lock(&atm_dev_lock);
                }
-                spin_unlock(&atm_dev_lock);
+                up(&atm_dev_mutex);
-                if (!dev)
+        }
-                        return -ENODEV;
+        if (!dev)
+                return -ENODEV;
+        error = __vcc_connect(vcc, dev, vpi, vci);
+        if (error) {
+                atm_dev_put(dev);
+                return error;
        }
        if (vpi == ATM_VPI_UNSPEC || vci == ATM_VCI_UNSPEC)
                set_bit(ATM_VF_PARTIAL,&vcc->flags);
diff --git a/net/atm/common.h b/net/atm/common.h
index e49ed41c0e33..4887c317cefe 100644
--- a/net/atm/common.h
+++ b/net/atm/common.h
@@ -47,4 +47,6 @@ static inline void atm_proc_exit(void)
 /* SVC */
 int svc_change_qos(struct atm_vcc *vcc,struct atm_qos *qos);
+void atm_dev_release_vccs(struct atm_dev *dev);
 #endif
diff --git a/net/atm/resources.c b/net/atm/resources.c
index 415d2615d475..c8c459fcb038 100644
--- a/net/atm/resources.c
+++ b/net/atm/resources.c
@@ -25,7 +25,7 @@
 LIST_HEAD(atm_devs);
-DEFINE_SPINLOCK(atm_dev_lock);
+DECLARE_MUTEX(atm_dev_mutex);
 static struct atm_dev *__alloc_atm_dev(const char *type)
 {
@@ -52,7 +52,7 @@ static struct atm_dev *__atm_dev_lookup(int number)
        list_for_each(p, &atm_devs) {
                dev = list_entry(p, struct atm_dev, dev_list);
-                if ((dev->ops) && (dev->number == number)) {
+                if (dev->number == number) {
                        atm_dev_hold(dev);
                        return dev;
                }
@@ -64,12 +64,13 @@ struct atm_dev *atm_dev_lookup(int number)
 {
        struct atm_dev *dev;
-        spin_lock(&atm_dev_lock);
+        down(&atm_dev_mutex);
        dev = __atm_dev_lookup(number);
-        spin_unlock(&atm_dev_lock);
+        up(&atm_dev_mutex);
        return dev;
 }
 struct atm_dev *atm_dev_register(const char *type, const struct atmdev_ops *ops,
                                 int number, unsigned long *flags)
 {
@@ -81,11 +82,11 @@ struct atm_dev *atm_dev_register(const char *type, const struct atmdev_ops *ops,
                    type);
                return NULL;
        }
-        spin_lock(&atm_dev_lock);
+        down(&atm_dev_mutex);
        if (number != -1) {
                if ((inuse = __atm_dev_lookup(number))) {
                        atm_dev_put(inuse);
-                        spin_unlock(&atm_dev_lock);
+                        up(&atm_dev_mutex);
                        kfree(dev);
                        return NULL;
                }
@@ -105,19 +106,17 @@ struct atm_dev *atm_dev_register(const char *type, const struct atmdev_ops *ops,
                memset(&dev->flags, 0, sizeof(dev->flags));
        memset(&dev->stats, 0, sizeof(dev->stats));
        atomic_set(&dev->refcnt, 1);
-        list_add_tail(&dev->dev_list, &atm_devs);
-        spin_unlock(&atm_dev_lock);
        if (atm_proc_dev_register(dev) < 0) {
                printk(KERN_ERR "atm_dev_register: "
                       "atm_proc_dev_register failed for dev %s\n",
                       type);
-                spin_lock(&atm_dev_lock);
+                up(&atm_dev_mutex);
-                list_del(&dev->dev_list);
-                spin_unlock(&atm_dev_lock);
                kfree(dev);
                return NULL;
        }
+        list_add_tail(&dev->dev_list, &atm_devs);
+        up(&atm_dev_mutex);
        return dev;
 }
@@ -125,37 +124,22 @@ struct atm_dev *atm_dev_register(const char *type, const struct atmdev_ops *ops,
 void atm_dev_deregister(struct atm_dev *dev)
 {
-        unsigned long warning_time;
+        BUG_ON(test_bit(ATM_DF_REMOVED, &dev->flags));
+        set_bit(ATM_DF_REMOVED, &dev->flags);
+        /*
+         * if we remove current device from atm_devs list, new device 
+         * with same number can appear, such we need deregister proc, 
+         * release async all vccs and remove them from vccs list too
+         */
+        down(&atm_dev_mutex);
+        list_del(&dev->dev_list);
+        up(&atm_dev_mutex);
+        atm_dev_release_vccs(dev);
        atm_proc_dev_deregister(dev);
-        spin_lock(&atm_dev_lock);
+        atm_dev_put(dev);
-        list_del(&dev->dev_list);
-        spin_unlock(&atm_dev_lock);
-        warning_time = jiffies;
-        while (atomic_read(&dev->refcnt) != 1) {
-                msleep(250);
-                if ((jiffies - warning_time) > 10 * HZ) {
-                        printk(KERN_EMERG "atm_dev_deregister: waiting for "
-                               "dev %d to become free. Usage count = %d\n",
-                               dev->number, atomic_read(&dev->refcnt));
-                        warning_time = jiffies;
-                }
-        }
-        kfree(dev);
-}
-void shutdown_atm_dev(struct atm_dev *dev)
-{
-        if (atomic_read(&dev->refcnt) > 1) {
-                set_bit(ATM_DF_CLOSE, &dev->flags);
-                return;
-        }
-        if (dev->ops->dev_close)
-                dev->ops->dev_close(dev);
-        atm_dev_deregister(dev);
 }
@@ -211,16 +195,16 @@ int atm_dev_ioctl(unsigned int cmd, void __user *arg)
                                return -EFAULT;
                        if (get_user(len, &iobuf->length))
                                return -EFAULT;
-                        spin_lock(&atm_dev_lock);
+                        down(&atm_dev_mutex);
                        list_for_each(p, &atm_devs)
                                size += sizeof(int);
                        if (size > len) {
-                                spin_unlock(&atm_dev_lock);
+                                up(&atm_dev_mutex);
                                return -E2BIG;
                        }
                        tmp_buf = kmalloc(size, GFP_ATOMIC);
                        if (!tmp_buf) {
-                                spin_unlock(&atm_dev_lock);
+                                up(&atm_dev_mutex);
                                return -ENOMEM;
                        }
                        tmp_p = tmp_buf;
@@ -228,7 +212,7 @@ int atm_dev_ioctl(unsigned int cmd, void __user *arg)
                                dev = list_entry(p, struct atm_dev, dev_list);
                                *tmp_p++ = dev->number;
                        }
-                        spin_unlock(&atm_dev_lock);
+                        up(&atm_dev_mutex);
                        error = ((copy_to_user(buf, tmp_buf, size)) ||
                                        put_user(size, &iobuf->length))
                                                ? -EFAULT : 0;
@@ -245,7 +229,8 @@ int atm_dev_ioctl(unsigned int cmd, void __user *arg)
        if (get_user(number, &sioc->number))
                return -EFAULT;
-        if (!(dev = atm_dev_lookup(number)))
+        if (!(dev = try_then_request_module(atm_dev_lookup(number),
+                                            "atm-device-%d", number)))
                return -ENODEV;
        
        switch (cmd) {
@@ -414,13 +399,13 @@ static __inline__ void *dev_get_idx(loff_t left)
 void *atm_dev_seq_start(struct seq_file *seq, loff_t *pos)
 {
-        spin_lock(&atm_dev_lock);
+        down(&atm_dev_mutex);
        return *pos ? dev_get_idx(*pos) : (void *) 1;
 }
 void atm_dev_seq_stop(struct seq_file *seq, void *v)
 {
-        spin_unlock(&atm_dev_lock);
+        up(&atm_dev_mutex);
 }
 
 void *atm_dev_seq_next(struct seq_file *seq, void *v, loff_t *pos)
@@ -434,4 +419,3 @@ void *atm_dev_seq_next(struct seq_file *seq, void *v, loff_t *pos)
 EXPORT_SYMBOL(atm_dev_register);
 EXPORT_SYMBOL(atm_dev_deregister);
 EXPORT_SYMBOL(atm_dev_lookup);
-EXPORT_SYMBOL(shutdown_atm_dev);
diff --git a/net/atm/resources.h b/net/atm/resources.h
index 12910619dbb6..b7fb82a93b42 100644
--- a/net/atm/resources.h
+++ b/net/atm/resources.h
@@ -11,8 +11,7 @@
 extern struct list_head atm_devs;
-extern spinlock_t atm_dev_lock;
+extern struct semaphore atm_dev_mutex;
 int atm_dev_ioctl(unsigned int cmd, void __user *arg);
diff --git a/net/ipv4/af_inet.c b/net/ipv4/af_inet.c
index eaa150c33b04..d368cf249000 100644
--- a/net/ipv4/af_inet.c
+++ b/net/ipv4/af_inet.c
@@ -228,13 +228,14 @@ static int inet_create(struct socket *sock, int protocol)
        unsigned char answer_flags;
        char answer_no_check;
        int try_loading_module = 0;
-        int err = -ESOCKTNOSUPPORT;
+        int err;
        sock->state = SS_UNCONNECTED;
        /* Look for the requested type/protocol pair. */
        answer = NULL;
 lookup_protocol:
+        err = -ESOCKTNOSUPPORT;
        rcu_read_lock();
        list_for_each_rcu(p, &inetsw[sock->type]) {
                answer = list_entry(p, struct inet_protosw, list);
@@ -252,6 +253,7 @@ lookup_protocol:
                        if (IPPROTO_IP == answer->protocol)
                                break;
                }
+                err = -EPROTONOSUPPORT;
                answer = NULL;
        }
@@ -280,9 +282,6 @@ lookup_protocol:
        err = -EPERM;
        if (answer->capability > 0 && !capable(answer->capability))
                goto out_rcu_unlock;
-        err = -EPROTONOSUPPORT;
-        if (!protocol)
-                goto out_rcu_unlock;
        sock->ops = answer->ops;
        answer_prot = answer->prot;
diff --git a/net/ipv4/fib_frontend.c b/net/ipv4/fib_frontend.c
index 882f88f6d13b..19b1b984d687 100644
--- a/net/ipv4/fib_frontend.c
+++ b/net/ipv4/fib_frontend.c
@@ -544,12 +544,16 @@ static void nl_fib_input(struct sock *sk, int len)
        struct sk_buff *skb = NULL;
        struct nlmsghdr *nlh = NULL;
        struct fib_result_nl *frn;
-        int err;
        u32 pid;     
        struct fib_table *tb;
        
-        skb = skb_recv_datagram(sk, 0, 0, &err);
+        skb = skb_dequeue(&sk->sk_receive_queue);
        nlh = (struct nlmsghdr *)skb->data;
+        if (skb->len < NLMSG_SPACE(0) || skb->len < nlh->nlmsg_len ||
+            nlh->nlmsg_len < NLMSG_LENGTH(sizeof(*frn))) {
+                kfree_skb(skb);
+                return;
+        }
        
        frn = (struct fib_result_nl *) NLMSG_DATA(nlh);
        tb = fib_get_table(frn->tb_id_in);
diff --git a/net/ipv4/fib_hash.c b/net/ipv4/fib_hash.c
index 2a8c9afc3695..7ea0209cb169 100644
--- a/net/ipv4/fib_hash.c
+++ b/net/ipv4/fib_hash.c
@@ -975,7 +975,7 @@ static void fib_seq_stop(struct seq_file *seq, void *v)
 static unsigned fib_flag_trans(int type, u32 mask, struct fib_info *fi)
 {
-        static unsigned type2flags[RTN_MAX + 1] = {
+        static const unsigned type2flags[RTN_MAX + 1] = {
                [7] = RTF_REJECT, [8] = RTF_REJECT,
        };
        unsigned flags = type2flags[type];
diff --git a/net/ipv4/fib_semantics.c b/net/ipv4/fib_semantics.c
index 186f20c4a45e..6d2a6ac070e3 100644
--- a/net/ipv4/fib_semantics.c
+++ b/net/ipv4/fib_semantics.c
@@ -83,7 +83,7 @@ for (nhsel=0; nhsel < 1; nhsel++)
 #define endfor_nexthops(fi) }
-static struct 
+static const struct 
 {
        int     error;
        u8      scope;
diff --git a/net/ipv4/icmp.c b/net/ipv4/icmp.c
index e3eceecd0496..92e23b2ad4d2 100644
--- a/net/ipv4/icmp.c
+++ b/net/ipv4/icmp.c
@@ -220,7 +220,7 @@ struct icmp_control {
        short   error;          /* This ICMP is classed as an error message */
 };
-static struct icmp_control icmp_pointers[NR_ICMP_TYPES+1];
+static const struct icmp_control icmp_pointers[NR_ICMP_TYPES+1];
 /*
 *      The ICMP socket(s). This is the most convenient way to flow control
@@ -994,7 +994,7 @@ error:
 /*
 *      This table is the definition of how we handle ICMP.
 */
-static struct icmp_control icmp_pointers[NR_ICMP_TYPES + 1] = {
+static const struct icmp_control icmp_pointers[NR_ICMP_TYPES + 1] = {
        [ICMP_ECHOREPLY] = {
                .output_entry = ICMP_MIB_OUTECHOREPS,
                .input_entry = ICMP_MIB_INECHOREPS,
diff --git a/net/ipv4/igmp.c b/net/ipv4/igmp.c
index c04607b49212..4a195c724f01 100644
--- a/net/ipv4/igmp.c
+++ b/net/ipv4/igmp.c
@@ -897,7 +897,10 @@ int igmp_rcv(struct sk_buff *skb)
                /* Is it our report looped back? */
                if (((struct rtable*)skb->dst)->fl.iif == 0)
                        break;
-                igmp_heard_report(in_dev, ih->group);
+                /* don't rely on MC router hearing unicast reports */
+                if (skb->pkt_type == PACKET_MULTICAST ||
+                    skb->pkt_type == PACKET_BROADCAST)
+                        igmp_heard_report(in_dev, ih->group);
                break;
        case IGMP_PIM:
 #ifdef CONFIG_IP_PIMSM_V1
diff --git a/net/ipv4/ip_gre.c b/net/ipv4/ip_gre.c
index 4e9c74b54b15..a4c347c3b8e3 100644
--- a/net/ipv4/ip_gre.c
+++ b/net/ipv4/ip_gre.c
@@ -1217,7 +1217,7 @@ static int ipgre_tunnel_init(struct net_device *dev)
        return 0;
 }
-int __init ipgre_fb_tunnel_init(struct net_device *dev)
+static int __init ipgre_fb_tunnel_init(struct net_device *dev)
 {
        struct ip_tunnel *tunnel = (struct ip_tunnel*)dev->priv;
        struct iphdr *iph = &tunnel->parms.iph;
diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c
index 11c2f68254f0..eba64e2bd397 100644
--- a/net/ipv4/ip_output.c
+++ b/net/ipv4/ip_output.c
@@ -690,7 +690,7 @@ csum_page(struct page *page, int offset, int copy)
        return csum;
 }
-inline int ip_ufo_append_data(struct sock *sk,
+static inline int ip_ufo_append_data(struct sock *sk,
                        int getfrag(void *from, char *to, int offset, int len,
                               int odd, struct sk_buff *skb),
                        void *from, int length, int hh_len, int fragheaderlen,
diff --git a/net/ipv4/ipvs/ip_vs_conn.c b/net/ipv4/ipvs/ip_vs_conn.c
index f828fa2eb7de..2a3a8c59c655 100644
--- a/net/ipv4/ipvs/ip_vs_conn.c
+++ b/net/ipv4/ipvs/ip_vs_conn.c
@@ -771,7 +771,7 @@ static inline int todrop_entry(struct ip_vs_conn *cp)
         * The drop rate array needs tuning for real environments.
         * Called from timer bh only => no locking
         */
-        static char todrop_rate[9] = {0, 1, 2, 3, 4, 5, 6, 7, 8};
+        static const char todrop_rate[9] = {0, 1, 2, 3, 4, 5, 6, 7, 8};
        static char todrop_counter[9] = {0};
        int i;
diff --git a/net/ipv4/ipvs/ip_vs_ctl.c b/net/ipv4/ipvs/ip_vs_ctl.c
index 2d66848e7aa0..9bdcf31b760e 100644
--- a/net/ipv4/ipvs/ip_vs_ctl.c
+++ b/net/ipv4/ipvs/ip_vs_ctl.c
@@ -1909,7 +1909,7 @@ static int ip_vs_set_timeout(struct ip_vs_timeout_user *u)
 #define DAEMON_ARG_LEN          (sizeof(struct ip_vs_daemon_user))
 #define MAX_ARG_LEN             SVCDEST_ARG_LEN
-static unsigned char set_arglen[SET_CMDID(IP_VS_SO_SET_MAX)+1] = {
+static const unsigned char set_arglen[SET_CMDID(IP_VS_SO_SET_MAX)+1] = {
        [SET_CMDID(IP_VS_SO_SET_ADD)]           = SERVICE_ARG_LEN,
        [SET_CMDID(IP_VS_SO_SET_EDIT)]          = SERVICE_ARG_LEN,
        [SET_CMDID(IP_VS_SO_SET_DEL)]           = SERVICE_ARG_LEN,
@@ -2180,7 +2180,7 @@ __ip_vs_get_timeouts(struct ip_vs_timeout_user *u)
 #define GET_TIMEOUT_ARG_LEN     (sizeof(struct ip_vs_timeout_user))
 #define GET_DAEMON_ARG_LEN      (sizeof(struct ip_vs_daemon_user) * 2)
-static unsigned char get_arglen[GET_CMDID(IP_VS_SO_GET_MAX)+1] = {
+static const unsigned char get_arglen[GET_CMDID(IP_VS_SO_GET_MAX)+1] = {
        [GET_CMDID(IP_VS_SO_GET_VERSION)]       = 64,
        [GET_CMDID(IP_VS_SO_GET_INFO)]          = GET_INFO_ARG_LEN,
        [GET_CMDID(IP_VS_SO_GET_SERVICES)]      = GET_SERVICES_ARG_LEN,
diff --git a/net/ipv4/ipvs/ip_vs_proto_tcp.c b/net/ipv4/ipvs/ip_vs_proto_tcp.c
index c19408973c09..0e878fd6215c 100644
--- a/net/ipv4/ipvs/ip_vs_proto_tcp.c
+++ b/net/ipv4/ipvs/ip_vs_proto_tcp.c
@@ -251,7 +251,7 @@ tcp_csum_check(struct sk_buff *skb, struct ip_vs_protocol *pp)
 #define TCP_DIR_OUTPUT          4
 #define TCP_DIR_INPUT_ONLY      8
-static int tcp_state_off[IP_VS_DIR_LAST] = {
+static const int tcp_state_off[IP_VS_DIR_LAST] = {
        [IP_VS_DIR_INPUT]               =       TCP_DIR_INPUT,
        [IP_VS_DIR_OUTPUT]              =       TCP_DIR_OUTPUT,
        [IP_VS_DIR_INPUT_ONLY]          =       TCP_DIR_INPUT_ONLY,
diff --git a/net/ipv4/netfilter/ip_conntrack_amanda.c b/net/ipv4/netfilter/ip_conntrack_amanda.c
index fa3f914117ec..e52847fa10f5 100644
--- a/net/ipv4/netfilter/ip_conntrack_amanda.c
+++ b/net/ipv4/netfilter/ip_conntrack_amanda.c
@@ -37,7 +37,7 @@ MODULE_LICENSE("GPL");
 module_param(master_timeout, int, 0600);
 MODULE_PARM_DESC(master_timeout, "timeout for the master connection");
-static char *conns[] = { "DATA ", "MESG ", "INDEX " };
+static const char *conns[] = { "DATA ", "MESG ", "INDEX " };
 /* This is slow, but it's simple. --RR */
 static char *amanda_buffer;
diff --git a/net/ipv4/netfilter/ip_conntrack_core.c b/net/ipv4/netfilter/ip_conntrack_core.c
index 422ab68ee7fb..7a4ecddd597b 100644
--- a/net/ipv4/netfilter/ip_conntrack_core.c
+++ b/net/ipv4/netfilter/ip_conntrack_core.c
@@ -1354,7 +1354,7 @@ static void free_conntrack_hash(struct list_head *hash, int vmalloced,int size)
                           get_order(sizeof(struct list_head) * size));
 }
-void ip_conntrack_flush()
+void ip_conntrack_flush(void)
 {
        /* This makes sure all current packets have passed through
           netfilter framework.  Roll on, two-stage module
@@ -1408,7 +1408,7 @@ static struct list_head *alloc_hashtable(int size, int *vmalloced)
        return hash;
 }
-int set_hashsize(const char *val, struct kernel_param *kp)
+static int set_hashsize(const char *val, struct kernel_param *kp)
 {
        int i, bucket, hashsize, vmalloced;
        int old_vmalloced, old_size;
diff --git a/net/ipv4/netfilter/ip_conntrack_ftp.c b/net/ipv4/netfilter/ip_conntrack_ftp.c
index 59e12b02b22c..68b173bcda60 100644
--- a/net/ipv4/netfilter/ip_conntrack_ftp.c
+++ b/net/ipv4/netfilter/ip_conntrack_ftp.c
@@ -55,7 +55,7 @@ static int try_rfc959(const char *, size_t, u_int32_t [], char);
 static int try_eprt(const char *, size_t, u_int32_t [], char);
 static int try_epsv_response(const char *, size_t, u_int32_t [], char);
-static struct ftp_search {
+static const struct ftp_search {
        enum ip_conntrack_dir dir;
        const char *pattern;
        size_t plen;
diff --git a/net/ipv4/netfilter/ip_conntrack_irc.c b/net/ipv4/netfilter/ip_conntrack_irc.c
index 2dea1db14406..d7c40421d0d1 100644
--- a/net/ipv4/netfilter/ip_conntrack_irc.c
+++ b/net/ipv4/netfilter/ip_conntrack_irc.c
@@ -59,7 +59,7 @@ MODULE_PARM_DESC(max_dcc_channels, "max number of expected DCC channels per IRC
 module_param(dcc_timeout, int, 0400);
 MODULE_PARM_DESC(dcc_timeout, "timeout on for unestablished DCC channels");
-static char *dccprotos[] = { "SEND ", "CHAT ", "MOVE ", "TSEND ", "SCHAT " };
+static const char *dccprotos[] = { "SEND ", "CHAT ", "MOVE ", "TSEND ", "SCHAT " };
 #define MINMATCHLEN     5
 #if 0
diff --git a/net/ipv4/netfilter/ip_conntrack_proto_icmp.c b/net/ipv4/netfilter/ip_conntrack_proto_icmp.c
index e4d6b268e8c4..5f9925db608e 100644
--- a/net/ipv4/netfilter/ip_conntrack_proto_icmp.c
+++ b/net/ipv4/netfilter/ip_conntrack_proto_icmp.c
@@ -51,7 +51,7 @@ static int icmp_invert_tuple(struct ip_conntrack_tuple *tuple,
                             const struct ip_conntrack_tuple *orig)
 {
        /* Add 1; spaces filled with 0. */
-        static u_int8_t invmap[]
+        static const u_int8_t invmap[]
                = { [ICMP_ECHO] = ICMP_ECHOREPLY + 1,
                    [ICMP_ECHOREPLY] = ICMP_ECHO + 1,
                    [ICMP_TIMESTAMP] = ICMP_TIMESTAMPREPLY + 1,
@@ -110,7 +110,7 @@ static int icmp_packet(struct ip_conntrack *ct,
        return NF_ACCEPT;
 }
-static u_int8_t valid_new[] = { 
+static const u_int8_t valid_new[] = { 
        [ICMP_ECHO] = 1,
        [ICMP_TIMESTAMP] = 1,
        [ICMP_INFO_REQUEST] = 1,
diff --git a/net/ipv4/netfilter/ip_conntrack_proto_sctp.c b/net/ipv4/netfilter/ip_conntrack_proto_sctp.c
index 59a4a0111dd3..977fb59d4563 100644
--- a/net/ipv4/netfilter/ip_conntrack_proto_sctp.c
+++ b/net/ipv4/netfilter/ip_conntrack_proto_sctp.c
@@ -65,7 +65,7 @@ static unsigned long ip_ct_sctp_timeout_shutdown_sent     = 300 SECS / 1000;
 static unsigned long ip_ct_sctp_timeout_shutdown_recd     = 300 SECS / 1000;
 static unsigned long ip_ct_sctp_timeout_shutdown_ack_sent =   3 SECS;
-static unsigned long * sctp_timeouts[]
+static const unsigned long * sctp_timeouts[]
 = { NULL,                                  /* SCTP_CONNTRACK_NONE  */
    &ip_ct_sctp_timeout_closed,            /* SCTP_CONNTRACK_CLOSED */
    &ip_ct_sctp_timeout_cookie_wait,       /* SCTP_CONNTRACK_COOKIE_WAIT */
@@ -118,7 +118,7 @@ cookie echoed to closed.
 */
 /* SCTP conntrack state transitions */
-static enum sctp_conntrack sctp_conntracks[2][9][SCTP_CONNTRACK_MAX] = {
+static const enum sctp_conntrack sctp_conntracks[2][9][SCTP_CONNTRACK_MAX] = {
        {
 /*      ORIGINAL        */
 /*                  sNO, sCL, sCW, sCE, sES, sSS, sSR, sSA */
diff --git a/net/ipv4/netfilter/ip_conntrack_proto_tcp.c b/net/ipv4/netfilter/ip_conntrack_proto_tcp.c
index ee3b7d6c4d2e..aeb7353d4777 100644
--- a/net/ipv4/netfilter/ip_conntrack_proto_tcp.c
+++ b/net/ipv4/netfilter/ip_conntrack_proto_tcp.c
@@ -99,7 +99,7 @@ unsigned long ip_ct_tcp_timeout_close =        10 SECS;
   to ~13-30min depending on RTO. */
 unsigned long ip_ct_tcp_timeout_max_retrans =     5 MINS;
 
-static unsigned long * tcp_timeouts[]
+static const unsigned long * tcp_timeouts[]
 = { NULL,                              /*      TCP_CONNTRACK_NONE */
    &ip_ct_tcp_timeout_syn_sent,       /*      TCP_CONNTRACK_SYN_SENT, */
    &ip_ct_tcp_timeout_syn_recv,       /*      TCP_CONNTRACK_SYN_RECV, */
@@ -170,7 +170,7 @@ enum tcp_bit_set {
 *      if they are invalid
 *      or we do not support the request (simultaneous open)
 */
-static enum tcp_conntrack tcp_conntracks[2][6][TCP_CONNTRACK_MAX] = {
+static const enum tcp_conntrack tcp_conntracks[2][6][TCP_CONNTRACK_MAX] = {
        {
 /* ORIGINAL */
 /*           sNO, sSS, sSR, sES, sFW, sCW, sLA, sTW, sCL, sLI   */
@@ -272,9 +272,9 @@ static enum tcp_conntrack tcp_conntracks[2][6][TCP_CONNTRACK_MAX] = {
 *      sCL -> sCL
 */
 /*           sNO, sSS, sSR, sES, sFW, sCW, sLA, sTW, sCL, sLI   */
-/*ack*/    { sIV, sIV, sSR, sES, sCW, sCW, sTW, sTW, sCL, sIV },
+/*ack*/    { sIV, sIG, sSR, sES, sCW, sCW, sTW, sTW, sCL, sIV },
 /*
- *      sSS -> sIV      Might be a half-open connection.
+ *      sSS -> sIG      Might be a half-open connection.
 *      sSR -> sSR      Might answer late resent SYN.
 *      sES -> sES      :-)
 *      sFW -> sCW      Normal close request answered by ACK.
@@ -817,7 +817,7 @@ void ip_conntrack_tcp_update(struct sk_buff *skb,
 #define TH_CWR  0x80
 /* table of valid flag combinations - ECE and CWR are always valid */
-static u8 tcp_valid_flags[(TH_FIN|TH_SYN|TH_RST|TH_PUSH|TH_ACK|TH_URG) + 1] =
+static const u8 tcp_valid_flags[(TH_FIN|TH_SYN|TH_RST|TH_PUSH|TH_ACK|TH_URG) + 1] =
 {
        [TH_SYN]                        = 1,
        [TH_SYN|TH_ACK]                 = 1,
@@ -917,8 +917,12 @@ static int tcp_packet(struct ip_conntrack *conntrack,
        switch (new_state) {
        case TCP_CONNTRACK_IGNORE:
-                /* Either SYN in ORIGINAL
+                /* Ignored packets:
-                 * or SYN/ACK in REPLY. */
+                 * 
+                 * a) SYN in ORIGINAL
+                 * b) SYN/ACK in REPLY
+                 * c) ACK in reply direction after initial SYN in original.
+                 */
                if (index == TCP_SYNACK_SET
                    && conntrack->proto.tcp.last_index == TCP_SYN_SET
                    && conntrack->proto.tcp.last_dir != dir
@@ -985,13 +989,20 @@ static int tcp_packet(struct ip_conntrack *conntrack,
                }
        case TCP_CONNTRACK_CLOSE:
                if (index == TCP_RST_SET
-                    && test_bit(IPS_SEEN_REPLY_BIT, &conntrack->status)
+                    && ((test_bit(IPS_SEEN_REPLY_BIT, &conntrack->status)
-                    && conntrack->proto.tcp.last_index == TCP_SYN_SET
+                         && conntrack->proto.tcp.last_index == TCP_SYN_SET)
+                        || (!test_bit(IPS_ASSURED_BIT, &conntrack->status)
+                            && conntrack->proto.tcp.last_index == TCP_ACK_SET))
                    && ntohl(th->ack_seq) == conntrack->proto.tcp.last_end) {
-                        /* RST sent to invalid SYN we had let trough
+                        /* RST sent to invalid SYN or ACK we had let trough
-                         * SYN was in window then, tear down connection.
+                         * at a) and c) above:
+                         *
+                         * a) SYN was in window then
+                         * c) we hold a half-open connection.
+                         *
+                         * Delete our connection entry.
                         * We skip window checking, because packet might ACK
-                         * segments we ignored in the SYN. */
+                         * segments we ignored. */
                        goto in_window;
                }
                /* Just fall trough */
diff --git a/net/ipv4/netfilter/ip_nat_core.c b/net/ipv4/netfilter/ip_nat_core.c
index 762f4d93936b..c1a61462507f 100644
--- a/net/ipv4/netfilter/ip_nat_core.c
+++ b/net/ipv4/netfilter/ip_nat_core.c
@@ -49,7 +49,7 @@ static unsigned int ip_nat_htable_size;
 static struct list_head *bysource;
 #define MAX_IP_NAT_PROTO 256
-struct ip_nat_protocol *ip_nat_protos[MAX_IP_NAT_PROTO];
+static struct ip_nat_protocol *ip_nat_protos[MAX_IP_NAT_PROTO];
 static inline struct ip_nat_protocol *
 __ip_nat_proto_find(u_int8_t protonum)
diff --git a/net/ipv4/netfilter/ip_tables.c b/net/ipv4/netfilter/ip_tables.c
index 75c27e92f6ab..45886c8475e8 100644
--- a/net/ipv4/netfilter/ip_tables.c
+++ b/net/ipv4/netfilter/ip_tables.c
@@ -1892,7 +1892,7 @@ static int ipt_get_matches(char *buffer, char **start, off_t offset, int length)
        return pos;
 }
-static struct { char *name; get_info_t *get_info; } ipt_proc_entry[] =
+static const struct { char *name; get_info_t *get_info; } ipt_proc_entry[] =
 { { "ip_tables_names", ipt_get_tables },
  { "ip_tables_targets", ipt_get_targets },
  { "ip_tables_matches", ipt_get_matches },
diff --git a/net/ipv4/netfilter/ipt_LOG.c b/net/ipv4/netfilter/ipt_LOG.c
index 92ed050fac69..30be0f1dae37 100644
--- a/net/ipv4/netfilter/ipt_LOG.c
+++ b/net/ipv4/netfilter/ipt_LOG.c
@@ -197,7 +197,7 @@ static void dump_packet(const struct nf_loginfo *info,
        }
        case IPPROTO_ICMP: {
                struct icmphdr _icmph, *ich;
-                static size_t required_len[NR_ICMP_TYPES+1]
+                static const size_t required_len[NR_ICMP_TYPES+1]
                        = { [ICMP_ECHOREPLY] = 4,
                            [ICMP_DEST_UNREACH]
                            = 8 + sizeof(struct iphdr),
@@ -351,7 +351,7 @@ static void dump_packet(const struct nf_loginfo *info,
        /* maxlen = 230+   91  + 230 + 252 = 803 */
 }
-struct nf_loginfo default_loginfo = {
+static struct nf_loginfo default_loginfo = {
        .type   = NF_LOG_TYPE_LOG,
        .u = {
                .log = {
diff --git a/net/ipv4/netfilter/ipt_recent.c b/net/ipv4/netfilter/ipt_recent.c
index 2d44b07688af..261cbb4d4c49 100644
--- a/net/ipv4/netfilter/ipt_recent.c
+++ b/net/ipv4/netfilter/ipt_recent.c
@@ -532,6 +532,7 @@ match(const struct sk_buff *skb,
                        }
                        if(info->seconds && info->hit_count) {
                                for(pkt_count = 0, hits_found = 0; pkt_count < ip_pkt_list_tot; pkt_count++) {
+                                        if(r_list[location].last_pkts[pkt_count] == 0) break;
                                        if(time_before_eq(now,r_list[location].last_pkts[pkt_count]+info->seconds*HZ)) hits_found++;
                                }
                                if(hits_found >= info->hit_count) ans = !info->invert; else ans = info->invert;
diff --git a/net/ipv4/proc.c b/net/ipv4/proc.c
index a65e508fbd40..0d7dc668db46 100644
--- a/net/ipv4/proc.c
+++ b/net/ipv4/proc.c
@@ -98,7 +98,7 @@ fold_field(void *mib[], int offt)
 }
 /* snmp items */
-static struct snmp_mib snmp4_ipstats_list[] = {
+static const struct snmp_mib snmp4_ipstats_list[] = {
        SNMP_MIB_ITEM("InReceives", IPSTATS_MIB_INRECEIVES),
        SNMP_MIB_ITEM("InHdrErrors", IPSTATS_MIB_INHDRERRORS),
        SNMP_MIB_ITEM("InAddrErrors", IPSTATS_MIB_INADDRERRORS),
@@ -119,7 +119,7 @@ static struct snmp_mib snmp4_ipstats_list[] = {
        SNMP_MIB_SENTINEL
 };
-static struct snmp_mib snmp4_icmp_list[] = {
+static const struct snmp_mib snmp4_icmp_list[] = {
        SNMP_MIB_ITEM("InMsgs", ICMP_MIB_INMSGS),
        SNMP_MIB_ITEM("InErrors", ICMP_MIB_INERRORS),
        SNMP_MIB_ITEM("InDestUnreachs", ICMP_MIB_INDESTUNREACHS),
@@ -149,7 +149,7 @@ static struct snmp_mib snmp4_icmp_list[] = {
        SNMP_MIB_SENTINEL
 };
-static struct snmp_mib snmp4_tcp_list[] = {
+static const struct snmp_mib snmp4_tcp_list[] = {
        SNMP_MIB_ITEM("RtoAlgorithm", TCP_MIB_RTOALGORITHM),
        SNMP_MIB_ITEM("RtoMin", TCP_MIB_RTOMIN),
        SNMP_MIB_ITEM("RtoMax", TCP_MIB_RTOMAX),
@@ -167,7 +167,7 @@ static struct snmp_mib snmp4_tcp_list[] = {
        SNMP_MIB_SENTINEL
 };
-static struct snmp_mib snmp4_udp_list[] = {
+static const struct snmp_mib snmp4_udp_list[] = {
        SNMP_MIB_ITEM("InDatagrams", UDP_MIB_INDATAGRAMS),
        SNMP_MIB_ITEM("NoPorts", UDP_MIB_NOPORTS),
        SNMP_MIB_ITEM("InErrors", UDP_MIB_INERRORS),
@@ -175,7 +175,7 @@ static struct snmp_mib snmp4_udp_list[] = {
        SNMP_MIB_SENTINEL
 };
-static struct snmp_mib snmp4_net_list[] = {
+static const struct snmp_mib snmp4_net_list[] = {
        SNMP_MIB_ITEM("SyncookiesSent", LINUX_MIB_SYNCOOKIESSENT),
        SNMP_MIB_ITEM("SyncookiesRecv", LINUX_MIB_SYNCOOKIESRECV),
        SNMP_MIB_ITEM("SyncookiesFailed", LINUX_MIB_SYNCOOKIESFAILED),
diff --git a/net/ipv4/route.c b/net/ipv4/route.c
index 381dd6a6aebb..f701a136a6ae 100644
--- a/net/ipv4/route.c
+++ b/net/ipv4/route.c
@@ -1371,7 +1371,7 @@ out:	kfree_skb(skb);
 *      are needed for AMPRnet AX.25 paths.
 */
-static unsigned short mtu_plateau[] =
+static const unsigned short mtu_plateau[] =
 {32000, 17914, 8166, 4352, 2002, 1492, 576, 296, 216, 128 };
 static __inline__ unsigned short guess_mtu(unsigned short old_mtu)
@@ -3149,8 +3149,7 @@ int __init ip_rt_init(void)
                                        sizeof(struct rt_hash_bucket),
                                        rhash_entries,
                                        (num_physpages >= 128 * 1024) ?
-                                                (27 - PAGE_SHIFT) :
+                                        15 : 17,
-                                                (29 - PAGE_SHIFT),
                                        HASH_HIGHMEM,
                                        &rt_hash_log,
                                        &rt_hash_mask,
diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
index 9ac7a4f46bd8..ef98b14ac56d 100644
--- a/net/ipv4/tcp.c
+++ b/net/ipv4/tcp.c
@@ -1413,7 +1413,7 @@ recv_urg:
 *      closed.
 */
-static unsigned char new_state[16] = {
+static const unsigned char new_state[16] = {
  /* current state:        new state:      action:      */
  /* (Invalid)          */ TCP_CLOSE,
  /* TCP_ESTABLISHED    */ TCP_FIN_WAIT1 | TCP_ACTION_FIN,
@@ -2065,8 +2065,7 @@ void __init tcp_init(void)
                                        sizeof(struct inet_ehash_bucket),
                                        thash_entries,
                                        (num_physpages >= 128 * 1024) ?
-                                                (25 - PAGE_SHIFT) :
+                                        13 : 15,
-                                                (27 - PAGE_SHIFT),
                                        HASH_HIGHMEM,
                                        &tcp_hashinfo.ehash_size,
                                        NULL,
@@ -2082,8 +2081,7 @@ void __init tcp_init(void)
                                        sizeof(struct inet_bind_hashbucket),
                                        tcp_hashinfo.ehash_size,
                                        (num_physpages >= 128 * 1024) ?
-                                                (25 - PAGE_SHIFT) :
+                                        13 : 15,
-                                                (27 - PAGE_SHIFT),
                                        HASH_HIGHMEM,
                                        &tcp_hashinfo.bhash_size,
                                        NULL,
diff --git a/net/ipv6/af_inet6.c b/net/ipv6/af_inet6.c
index c63b8ce0e1b5..d9546380fa04 100644
--- a/net/ipv6/af_inet6.c
+++ b/net/ipv6/af_inet6.c
@@ -92,10 +92,13 @@ static int inet6_create(struct socket *sock, int protocol)
        struct proto *answer_prot;
        unsigned char answer_flags;
        char answer_no_check;
-        int rc;
+        int try_loading_module = 0;
+        int err;
        /* Look for the requested type/protocol pair. */
        answer = NULL;
+lookup_protocol:
+        err = -ESOCKTNOSUPPORT;
        rcu_read_lock();
        list_for_each_rcu(p, &inetsw6[sock->type]) {
                answer = list_entry(p, struct inet_protosw, list);
@@ -113,21 +116,37 @@ static int inet6_create(struct socket *sock, int protocol)
                        if (IPPROTO_IP == answer->protocol)
                                break;
                }
+                err = -EPROTONOSUPPORT;
                answer = NULL;
        }
-        rc = -ESOCKTNOSUPPORT;
+        if (!answer) {
-        if (!answer)
+                if (try_loading_module < 2) {
-                goto out_rcu_unlock;
+                        rcu_read_unlock();
-        rc = -EPERM;
+                        /*
+                         * Be more specific, e.g. net-pf-10-proto-132-type-1
+                         * (net-pf-PF_INET6-proto-IPPROTO_SCTP-type-SOCK_STREAM)
+                         */
+                        if (++try_loading_module == 1)
+                                request_module("net-pf-%d-proto-%d-type-%d",
+                                                PF_INET6, protocol, sock->type);
+                        /*
+                         * Fall back to generic, e.g. net-pf-10-proto-132
+                         * (net-pf-PF_INET6-proto-IPPROTO_SCTP)
+                         */
+                        else
+                                request_module("net-pf-%d-proto-%d",
+                                                PF_INET6, protocol);
+                        goto lookup_protocol;
+                } else
+                        goto out_rcu_unlock;
+        }
+        err = -EPERM;
        if (answer->capability > 0 && !capable(answer->capability))
                goto out_rcu_unlock;
-        rc = -EPROTONOSUPPORT;
-        if (!protocol)
-                goto out_rcu_unlock;
        sock->ops = answer->ops;
        answer_prot = answer->prot;
        answer_no_check = answer->no_check;
        answer_flags = answer->flags;
@@ -135,14 +154,14 @@ static int inet6_create(struct socket *sock, int protocol)
        BUG_TRAP(answer_prot->slab != NULL);
-        rc = -ENOBUFS;
+        err = -ENOBUFS;
        sk = sk_alloc(PF_INET6, GFP_KERNEL, answer_prot, 1);
        if (sk == NULL)
                goto out;
        sock_init_data(sock, sk);
-        rc = 0;
+        err = 0;
        sk->sk_no_check = answer_no_check;
        if (INET_PROTOSW_REUSE & answer_flags)
                sk->sk_reuse = 1;
@@ -202,14 +221,14 @@ static int inet6_create(struct socket *sock, int protocol)
                sk->sk_prot->hash(sk);
        }
        if (sk->sk_prot->init) {
-                rc = sk->sk_prot->init(sk);
+                err = sk->sk_prot->init(sk);
-                if (rc) {
+                if (err) {
                        sk_common_release(sk);
                        goto out;
                }
        }
 out:
-        return rc;
+        return err;
 out_rcu_unlock:
        rcu_read_unlock();
        goto out;
diff --git a/net/ipv6/icmp.c b/net/ipv6/icmp.c
index 1bdf0fb8bf8a..34a332225c17 100644
--- a/net/ipv6/icmp.c
+++ b/net/ipv6/icmp.c
@@ -751,7 +751,7 @@ void icmpv6_cleanup(void)
        inet6_del_protocol(&icmpv6_protocol, IPPROTO_ICMPV6);
 }
-static struct icmp6_err {
+static const struct icmp6_err {
        int err;
        int fatal;
 } tab_unreach[] = {
diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
index c1fa693511a1..8523c76ebf76 100644
--- a/net/ipv6/ip6_output.c
+++ b/net/ipv6/ip6_output.c
@@ -774,7 +774,8 @@ out_err_release:
        *dst = NULL;
        return err;
 }
-inline int ip6_ufo_append_data(struct sock *sk,
+static inline int ip6_ufo_append_data(struct sock *sk,
                        int getfrag(void *from, char *to, int offset, int len,
                        int odd, struct sk_buff *skb),
                        void *from, int length, int hh_len, int fragheaderlen,
diff --git a/net/ipv6/ipv6_sockglue.c b/net/ipv6/ipv6_sockglue.c
index 25757ade989f..3620718defe6 100644
--- a/net/ipv6/ipv6_sockglue.c
+++ b/net/ipv6/ipv6_sockglue.c
@@ -628,8 +628,8 @@ e_inval:
        return -EINVAL;
 }
-int ipv6_getsockopt_sticky(struct sock *sk, struct ipv6_opt_hdr *hdr,
+static int ipv6_getsockopt_sticky(struct sock *sk, struct ipv6_opt_hdr *hdr,
-                           char __user *optval, int len)
+                                  char __user *optval, int len)
 {
        if (!hdr)
                return 0;
diff --git a/net/ipv6/mcast.c b/net/ipv6/mcast.c
index f15e04ad026e..fd939da090c4 100644
--- a/net/ipv6/mcast.c
+++ b/net/ipv6/mcast.c
@@ -1231,6 +1231,11 @@ int igmp6_event_report(struct sk_buff *skb)
        if (skb->pkt_type == PACKET_LOOPBACK)
                return 0;
+        /* send our report if the MC router may not have heard this report */
+        if (skb->pkt_type != PACKET_MULTICAST &&
+            skb->pkt_type != PACKET_BROADCAST)
+                return 0;
        if (!pskb_may_pull(skb, sizeof(struct in6_addr)))
                return -EINVAL;
diff --git a/net/ipv6/netfilter/ip6_tables.c b/net/ipv6/netfilter/ip6_tables.c
index 7d492226c16e..95d469271c4d 100644
--- a/net/ipv6/netfilter/ip6_tables.c
+++ b/net/ipv6/netfilter/ip6_tables.c
@@ -1972,7 +1972,7 @@ static int ip6t_get_matches(char *buffer, char **start, off_t offset, int length
        return pos;
 }
-static struct { char *name; get_info_t *get_info; } ip6t_proc_entry[] =
+static const struct { char *name; get_info_t *get_info; } ip6t_proc_entry[] =
 { { "ip6_tables_names", ip6t_get_tables },
  { "ip6_tables_targets", ip6t_get_targets },
  { "ip6_tables_matches", ip6t_get_matches },
diff --git a/net/netfilter/nf_conntrack_proto_tcp.c b/net/netfilter/nf_conntrack_proto_tcp.c
index 5a6fcf349bdf..6035633d8225 100644
--- a/net/netfilter/nf_conntrack_proto_tcp.c
+++ b/net/netfilter/nf_conntrack_proto_tcp.c
@@ -280,9 +280,9 @@ static enum tcp_conntrack tcp_conntracks[2][6][TCP_CONNTRACK_MAX] = {
 *      sCL -> sCL
 */
 /*           sNO, sSS, sSR, sES, sFW, sCW, sLA, sTW, sCL, sLI   */
-/*ack*/    { sIV, sIV, sSR, sES, sCW, sCW, sTW, sTW, sCL, sIV },
+/*ack*/    { sIV, sIG, sSR, sES, sCW, sCW, sTW, sTW, sCL, sIV },
 /*
- *      sSS -> sIV      Might be a half-open connection.
+ *      sSS -> sIG      Might be a half-open connection.
 *      sSR -> sSR      Might answer late resent SYN.
 *      sES -> sES      :-)
 *      sFW -> sCW      Normal close request answered by ACK.
@@ -912,8 +912,12 @@ static int tcp_packet(struct nf_conn *conntrack,
        switch (new_state) {
        case TCP_CONNTRACK_IGNORE:
-                /* Either SYN in ORIGINAL
+                /* Ignored packets:
-                 * or SYN/ACK in REPLY. */
+                 *
+                 * a) SYN in ORIGINAL
+                 * b) SYN/ACK in REPLY
+                 * c) ACK in reply direction after initial SYN in original. 
+                 */
                if (index == TCP_SYNACK_SET
                    && conntrack->proto.tcp.last_index == TCP_SYN_SET
                    && conntrack->proto.tcp.last_dir != dir
@@ -979,13 +983,20 @@ static int tcp_packet(struct nf_conn *conntrack,
                }
        case TCP_CONNTRACK_CLOSE:
                if (index == TCP_RST_SET
-                    && test_bit(IPS_SEEN_REPLY_BIT, &conntrack->status)
+                    && ((test_bit(IPS_SEEN_REPLY_BIT, &conntrack->status)
-                    && conntrack->proto.tcp.last_index == TCP_SYN_SET
+                         && conntrack->proto.tcp.last_index == TCP_SYN_SET)
+                        || (!test_bit(IPS_ASSURED_BIT, &conntrack->status)
+                            && conntrack->proto.tcp.last_index == TCP_ACK_SET))
                    && ntohl(th->ack_seq) == conntrack->proto.tcp.last_end) {
-                        /* RST sent to invalid SYN we had let trough
+                        /* RST sent to invalid SYN or ACK we had let trough
-                         * SYN was in window then, tear down connection.
+                         * at a) and c) above:
+                         *
+                         * a) SYN was in window then
+                         * c) we hold a half-open connection.
+                         *
+                         * Delete our connection entry.
                         * We skip window checking, because packet might ACK
-                         * segments we ignored in the SYN. */
+                         * segments we ignored. */
                        goto in_window;
                }
                /* Just fall trough */
diff --git a/net/sctp/socket.c b/net/sctp/socket.c
index abab81f3818f..d890dfa8818f 100644
--- a/net/sctp/socket.c
+++ b/net/sctp/socket.c
@@ -4743,11 +4743,6 @@ static struct sk_buff *sctp_skb_recv_datagram(struct sock *sk, int flags,
        struct sk_buff *skb;
        long timeo;
-        /* Caller is allowed not to check sk->sk_err before calling.  */
-        error = sock_error(sk);
-        if (error)
-                goto no_packet;
        timeo = sock_rcvtimeo(sk, noblock);
        SCTP_DEBUG_PRINTK("Timeout: timeo: %ld, MAX: %ld.\n",
@@ -4774,6 +4769,11 @@ static struct sk_buff *sctp_skb_recv_datagram(struct sock *sk, int flags,
                if (skb)
                        return skb;
+                /* Caller is allowed not to check sk->sk_err before calling. */
+                error = sock_error(sk);
+                if (error)
+                        goto no_packet;
                if (sk->sk_shutdown & RCV_SHUTDOWN)
                        break;
diff --git a/net/sctp/transport.c b/net/sctp/transport.c
index 6bc27200e6ca..268ddaf2dc0f 100644
--- a/net/sctp/transport.c
+++ b/net/sctp/transport.c
@@ -261,7 +261,8 @@ void sctp_transport_route(struct sctp_transport *transport,
                 * association's active path for getsockname().
                 */ 
                if (asoc && (transport == asoc->peer.active_path))
-                        af->to_sk_saddr(&transport->saddr, asoc->base.sk);
+                        opt->pf->af->to_sk_saddr(&transport->saddr,
+                                                 asoc->base.sk);
        } else
                transport->pmtu = SCTP_DEFAULT_MAXSEGMENT;
 }
diff --git a/net/sunrpc/rpc_pipe.c b/net/sunrpc/rpc_pipe.c
index e3b242daf53c..c76ea221798c 100644
--- a/net/sunrpc/rpc_pipe.c
+++ b/net/sunrpc/rpc_pipe.c
@@ -59,7 +59,6 @@ __rpc_purge_upcall(struct inode *inode, int err)
        struct rpc_inode *rpci = RPC_I(inode);
        __rpc_purge_list(rpci, &rpci->pipe, err);
-        __rpc_purge_list(rpci, &rpci->in_upcall, err);
        rpci->pipelen = 0;
        wake_up(&rpci->waitq);
 }
@@ -119,6 +118,7 @@ rpc_close_pipes(struct inode *inode)
        down(&inode->i_sem);
        if (rpci->ops != NULL) {
                rpci->nreaders = 0;
+                __rpc_purge_list(rpci, &rpci->in_upcall, -EPIPE);
                __rpc_purge_upcall(inode, -EPIPE);
                rpci->nwriters = 0;
                if (rpci->ops->release_pipe)