49 files changed, 204 insertions, 214 deletions
diff --git a/net/batman-adv/main.h b/net/batman-adv/main.h
index d4d9926c2201..65106fb61b8f 100644
--- a/net/batman-adv/main.h
+++ b/net/batman-adv/main.h
@@ -151,9 +151,9 @@ int debug_log(struct bat_priv *bat_priv, char *fmt, ...);
        }                                                       \
        while (0)
 #else /* !CONFIG_BATMAN_ADV_DEBUG */
-static inline void bat_dbg(char type __attribute__((unused)),
+static inline void bat_dbg(char type __always_unused,
-                           struct bat_priv *bat_priv __attribute__((unused)),
+                           struct bat_priv *bat_priv __always_unused,
-                           char *fmt __attribute__((unused)), ...)
+                           char *fmt __always_unused, ...)
 {
 }
 #endif
diff --git a/net/batman-adv/packet.h b/net/batman-adv/packet.h
index b49fdf70a6d5..2284e8129cb2 100644
--- a/net/batman-adv/packet.h
+++ b/net/batman-adv/packet.h
@@ -63,7 +63,7 @@ struct batman_packet {
        uint8_t  num_hna;
        uint8_t  gw_flags;  /* flags related to gateway class */
        uint8_t  align;
-} __attribute__((packed));
+} __packed;
 #define BAT_PACKET_LEN sizeof(struct batman_packet)
@@ -76,7 +76,7 @@ struct icmp_packet {
        uint8_t  orig[6];
        uint16_t seqno;
        uint8_t  uid;
-} __attribute__((packed));
+} __packed;
 #define BAT_RR_LEN 16
@@ -93,14 +93,14 @@ struct icmp_packet_rr {
        uint8_t  uid;
        uint8_t  rr_cur;
        uint8_t  rr[BAT_RR_LEN][ETH_ALEN];
-} __attribute__((packed));
+} __packed;
 struct unicast_packet {
        uint8_t  packet_type;
        uint8_t  version;  /* batman version field */
        uint8_t  dest[6];
        uint8_t  ttl;
-} __attribute__((packed));
+} __packed;
 struct unicast_frag_packet {
        uint8_t  packet_type;
@@ -110,7 +110,7 @@ struct unicast_frag_packet {
        uint8_t  flags;
        uint8_t  orig[6];
        uint16_t seqno;
-} __attribute__((packed));
+} __packed;
 struct bcast_packet {
        uint8_t  packet_type;
@@ -118,7 +118,7 @@ struct bcast_packet {
        uint8_t  orig[6];
        uint8_t  ttl;
        uint32_t seqno;
-} __attribute__((packed));
+} __packed;
 struct vis_packet {
        uint8_t  packet_type;
@@ -131,6 +131,6 @@ struct vis_packet {
                                  * neighbors */
        uint8_t  target_orig[6]; /* who should receive this packet */
        uint8_t  sender_orig[6]; /* who sent or rebroadcasted this packet */
-} __attribute__((packed));
+} __packed;
 #endif /* _NET_BATMAN_ADV_PACKET_H_ */
diff --git a/net/batman-adv/types.h b/net/batman-adv/types.h
index 97cb23dd3e69..bf3f6f5a12c4 100644
--- a/net/batman-adv/types.h
+++ b/net/batman-adv/types.h
@@ -246,13 +246,13 @@ struct vis_info {
        /* this packet might be part of the vis send queue. */
        struct sk_buff *skb_packet;
        /* vis_info may follow here*/
-} __attribute__((packed));
+} __packed;
 struct vis_info_entry {
        uint8_t  src[ETH_ALEN];
        uint8_t  dest[ETH_ALEN];
        uint8_t  quality;       /* quality = 0 means HNA */
-} __attribute__((packed));
+} __packed;
 struct recvlist_node {
        struct list_head list;
diff --git a/net/batman-adv/unicast.c b/net/batman-adv/unicast.c
index dc2e28bed844..ee41fef04b21 100644
--- a/net/batman-adv/unicast.c
+++ b/net/batman-adv/unicast.c
@@ -229,10 +229,12 @@ int frag_send_skb(struct sk_buff *skb, struct bat_priv *bat_priv,
        if (!bat_priv->primary_if)
                goto dropped;
-        unicast_packet = (struct unicast_packet *) skb->data;
+        frag_skb = dev_alloc_skb(data_len - (data_len / 2) + ucf_hdr_len);
+        if (!frag_skb)
+                goto dropped;
+        unicast_packet = (struct unicast_packet *) skb->data;
        memcpy(&tmp_uc, unicast_packet, uc_hdr_len);
-        frag_skb = dev_alloc_skb(data_len - (data_len / 2) + ucf_hdr_len);
        skb_split(skb, frag_skb, data_len / 2);
        if (my_skb_head_push(skb, ucf_hdr_len - uc_hdr_len) < 0 ||
diff --git a/net/bluetooth/hci_conn.c b/net/bluetooth/hci_conn.c
index 6b90a4191734..99cd8d9d891b 100644
--- a/net/bluetooth/hci_conn.c
+++ b/net/bluetooth/hci_conn.c
@@ -379,14 +379,10 @@ struct hci_conn *hci_connect(struct hci_dev *hdev, int type, bdaddr_t *dst, __u8
        hci_conn_hold(acl);
        if (acl->state == BT_OPEN || acl->state == BT_CLOSED) {
-                acl->sec_level = sec_level;
+                acl->sec_level = BT_SECURITY_LOW;
+                acl->pending_sec_level = sec_level;
                acl->auth_type = auth_type;
                hci_acl_connect(acl);
-        } else {
-                if (acl->sec_level < sec_level)
-                        acl->sec_level = sec_level;
-                if (acl->auth_type < auth_type)
-                        acl->auth_type = auth_type;
        }
        if (type == ACL_LINK)
@@ -442,11 +438,17 @@ static int hci_conn_auth(struct hci_conn *conn, __u8 sec_level, __u8 auth_type)
 {
        BT_DBG("conn %p", conn);
+        if (conn->pending_sec_level > sec_level)
+                sec_level = conn->pending_sec_level;
        if (sec_level > conn->sec_level)
-                conn->sec_level = sec_level;
+                conn->pending_sec_level = sec_level;
        else if (conn->link_mode & HCI_LM_AUTH)
                return 1;
+        /* Make sure we preserve an existing MITM requirement*/
+        auth_type |= (conn->auth_type & 0x01);
        conn->auth_type = auth_type;
        if (!test_and_set_bit(HCI_CONN_AUTH_PEND, &conn->pend)) {
diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c
index 8b602d881fd7..9c4541bc488a 100644
--- a/net/bluetooth/hci_core.c
+++ b/net/bluetooth/hci_core.c
@@ -1011,6 +1011,10 @@ int hci_unregister_dev(struct hci_dev *hdev)
        destroy_workqueue(hdev->workqueue);
+        hci_dev_lock_bh(hdev);
+        hci_blacklist_clear(hdev);
+        hci_dev_unlock_bh(hdev);
        __hci_dev_put(hdev);
        return 0;
diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c
index 38100170d380..a290854fdaa6 100644
--- a/net/bluetooth/hci_event.c
+++ b/net/bluetooth/hci_event.c
@@ -692,13 +692,13 @@ static int hci_outgoing_auth_needed(struct hci_dev *hdev,
        if (conn->state != BT_CONFIG || !conn->out)
                return 0;
-        if (conn->sec_level == BT_SECURITY_SDP)
+        if (conn->pending_sec_level == BT_SECURITY_SDP)
                return 0;
        /* Only request authentication for SSP connections or non-SSP
         * devices with sec_level HIGH */
        if (!(hdev->ssp_mode > 0 && conn->ssp_mode > 0) &&
-                                        conn->sec_level != BT_SECURITY_HIGH)
+                                conn->pending_sec_level != BT_SECURITY_HIGH)
                return 0;
        return 1;
@@ -1095,9 +1095,10 @@ static inline void hci_auth_complete_evt(struct hci_dev *hdev, struct sk_buff *s
        conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
        if (conn) {
-                if (!ev->status)
+                if (!ev->status) {
                        conn->link_mode |= HCI_LM_AUTH;
-                else
+                        conn->sec_level = conn->pending_sec_level;
+                } else
                        conn->sec_level = BT_SECURITY_LOW;
                clear_bit(HCI_CONN_AUTH_PEND, &conn->pend);
diff --git a/net/bluetooth/l2cap.c b/net/bluetooth/l2cap.c
index c791fcda7b2d..7550abb0c96a 100644
--- a/net/bluetooth/l2cap.c
+++ b/net/bluetooth/l2cap.c
@@ -305,33 +305,44 @@ static void l2cap_chan_del(struct sock *sk, int err)
        }
 }
-/* Service level security */
+static inline u8 l2cap_get_auth_type(struct sock *sk)
-static inline int l2cap_check_security(struct sock *sk)
 {
-        struct l2cap_conn *conn = l2cap_pi(sk)->conn;
+        if (sk->sk_type == SOCK_RAW) {
-        __u8 auth_type;
+                switch (l2cap_pi(sk)->sec_level) {
+                case BT_SECURITY_HIGH:
+                        return HCI_AT_DEDICATED_BONDING_MITM;
+                case BT_SECURITY_MEDIUM:
+                        return HCI_AT_DEDICATED_BONDING;
+                default:
+                        return HCI_AT_NO_BONDING;
+                }
+        } else if (l2cap_pi(sk)->psm == cpu_to_le16(0x0001)) {
+                if (l2cap_pi(sk)->sec_level == BT_SECURITY_LOW)
+                        l2cap_pi(sk)->sec_level = BT_SECURITY_SDP;
-        if (l2cap_pi(sk)->psm == cpu_to_le16(0x0001)) {
                if (l2cap_pi(sk)->sec_level == BT_SECURITY_HIGH)
-                        auth_type = HCI_AT_NO_BONDING_MITM;
+                        return HCI_AT_NO_BONDING_MITM;
                else
-                        auth_type = HCI_AT_NO_BONDING;
+                        return HCI_AT_NO_BONDING;
-                if (l2cap_pi(sk)->sec_level == BT_SECURITY_LOW)
-                        l2cap_pi(sk)->sec_level = BT_SECURITY_SDP;
        } else {
                switch (l2cap_pi(sk)->sec_level) {
                case BT_SECURITY_HIGH:
-                        auth_type = HCI_AT_GENERAL_BONDING_MITM;
+                        return HCI_AT_GENERAL_BONDING_MITM;
-                        break;
                case BT_SECURITY_MEDIUM:
-                        auth_type = HCI_AT_GENERAL_BONDING;
+                        return HCI_AT_GENERAL_BONDING;
-                        break;
                default:
-                        auth_type = HCI_AT_NO_BONDING;
+                        return HCI_AT_NO_BONDING;
-                        break;
                }
        }
+}
+/* Service level security */
+static inline int l2cap_check_security(struct sock *sk)
+{
+        struct l2cap_conn *conn = l2cap_pi(sk)->conn;
+        __u8 auth_type;
+        auth_type = l2cap_get_auth_type(sk);
        return hci_conn_security(conn->hcon, l2cap_pi(sk)->sec_level,
                                                                auth_type);
@@ -1068,39 +1079,7 @@ static int l2cap_do_connect(struct sock *sk)
        err = -ENOMEM;
-        if (sk->sk_type == SOCK_RAW) {
+        auth_type = l2cap_get_auth_type(sk);
-                switch (l2cap_pi(sk)->sec_level) {
-                case BT_SECURITY_HIGH:
-                        auth_type = HCI_AT_DEDICATED_BONDING_MITM;
-                        break;
-                case BT_SECURITY_MEDIUM:
-                        auth_type = HCI_AT_DEDICATED_BONDING;
-                        break;
-                default:
-                        auth_type = HCI_AT_NO_BONDING;
-                        break;
-                }
-        } else if (l2cap_pi(sk)->psm == cpu_to_le16(0x0001)) {
-                if (l2cap_pi(sk)->sec_level == BT_SECURITY_HIGH)
-                        auth_type = HCI_AT_NO_BONDING_MITM;
-                else
-                        auth_type = HCI_AT_NO_BONDING;
-                if (l2cap_pi(sk)->sec_level == BT_SECURITY_LOW)
-                        l2cap_pi(sk)->sec_level = BT_SECURITY_SDP;
-        } else {
-                switch (l2cap_pi(sk)->sec_level) {
-                case BT_SECURITY_HIGH:
-                        auth_type = HCI_AT_GENERAL_BONDING_MITM;
-                        break;
-                case BT_SECURITY_MEDIUM:
-                        auth_type = HCI_AT_GENERAL_BONDING;
-                        break;
-                default:
-                        auth_type = HCI_AT_NO_BONDING;
-                        break;
-                }
-        }
        hcon = hci_connect(hdev, ACL_LINK, dst,
                                        l2cap_pi(sk)->sec_level, auth_type);
@@ -1127,7 +1106,8 @@ static int l2cap_do_connect(struct sock *sk)
                if (sk->sk_type != SOCK_SEQPACKET &&
                                sk->sk_type != SOCK_STREAM) {
                        l2cap_sock_clear_timer(sk);
-                        sk->sk_state = BT_CONNECTED;
+                        if (l2cap_check_security(sk))
+                                sk->sk_state = BT_CONNECTED;
                } else
                        l2cap_do_start(sk);
        }
@@ -1893,8 +1873,8 @@ static int l2cap_sock_sendmsg(struct kiocb *iocb, struct socket *sock, struct ms
                if (pi->mode == L2CAP_MODE_STREAMING) {
                        l2cap_streaming_send(sk);
                } else {
-                        if (pi->conn_state & L2CAP_CONN_REMOTE_BUSY &&
+                        if ((pi->conn_state & L2CAP_CONN_REMOTE_BUSY) &&
-                                        pi->conn_state && L2CAP_CONN_WAIT_F) {
+                                        (pi->conn_state & L2CAP_CONN_WAIT_F)) {
                                err = len;
                                break;
                        }
diff --git a/net/bluetooth/rfcomm/core.c b/net/bluetooth/rfcomm/core.c
index ff8aaa736650..6b83776534fb 100644
--- a/net/bluetooth/rfcomm/core.c
+++ b/net/bluetooth/rfcomm/core.c
@@ -1164,7 +1164,8 @@ static int rfcomm_recv_ua(struct rfcomm_session *s, u8 dlci)
                         * initiator rfcomm_process_rx already calls
                         * rfcomm_session_put() */
                        if (s->sock->sk->sk_state != BT_CLOSED)
-                                rfcomm_session_put(s);
+                                if (list_empty(&s->dlcs))
+                                        rfcomm_session_put(s);
                        break;
                }
        }
diff --git a/net/caif/cfcnfg.c b/net/caif/cfcnfg.c
index 21ede141018a..c665de778b60 100644
--- a/net/caif/cfcnfg.c
+++ b/net/caif/cfcnfg.c
@@ -191,6 +191,7 @@ int cfcnfg_disconn_adapt_layer(struct cfcnfg *cnfg, struct cflayer *adap_layer)
        struct cflayer *servl = NULL;
        struct cfcnfg_phyinfo *phyinfo = NULL;
        u8 phyid = 0;
        caif_assert(adap_layer != NULL);
        channel_id = adap_layer->id;
        if (adap_layer->dn == NULL || channel_id == 0) {
@@ -199,16 +200,16 @@ int cfcnfg_disconn_adapt_layer(struct cfcnfg *cnfg, struct cflayer *adap_layer)
                goto end;
        }
        servl = cfmuxl_remove_uplayer(cnfg->mux, channel_id);
-        if (servl == NULL)
-                goto end;
-        layer_set_up(servl, NULL);
-        ret = cfctrl_linkdown_req(cnfg->ctrl, channel_id, adap_layer);
        if (servl == NULL) {
                pr_err("PROTOCOL ERROR - Error removing service_layer Channel_Id(%d)",
                       channel_id);
                ret = -EINVAL;
                goto end;
        }
+        layer_set_up(servl, NULL);
+        ret = cfctrl_linkdown_req(cnfg->ctrl, channel_id, adap_layer);
+        if (ret)
+                goto end;
        caif_assert(channel_id == servl->id);
        if (adap_layer->dn != NULL) {
                phyid = cfsrvl_getphyid(adap_layer->dn);
diff --git a/net/can/bcm.c b/net/can/bcm.c
index 9d5e8accfab1..092dc88a7c64 100644
--- a/net/can/bcm.c
+++ b/net/can/bcm.c
@@ -1256,6 +1256,9 @@ static int bcm_sendmsg(struct kiocb *iocb, struct socket *sock,
                struct sockaddr_can *addr =
                        (struct sockaddr_can *)msg->msg_name;
+                if (msg->msg_namelen < sizeof(*addr))
+                        return -EINVAL;
                if (addr->can_family != AF_CAN)
                        return -EINVAL;
diff --git a/net/can/raw.c b/net/can/raw.c
index e88f610fdb7b..883e9d74fddf 100644
--- a/net/can/raw.c
+++ b/net/can/raw.c
@@ -649,6 +649,9 @@ static int raw_sendmsg(struct kiocb *iocb, struct socket *sock,
                struct sockaddr_can *addr =
                        (struct sockaddr_can *)msg->msg_name;
+                if (msg->msg_namelen < sizeof(*addr))
+                        return -EINVAL;
                if (addr->can_family != AF_CAN)
                        return -EINVAL;
diff --git a/net/core/dev.c b/net/core/dev.c
index 54277df0f735..24ea2d71e7ea 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -749,7 +749,8 @@ EXPORT_SYMBOL(dev_get_by_index);
 *      @ha: hardware address
 *
 *      Search for an interface by MAC address. Returns NULL if the device
- *      is not found or a pointer to the device. The caller must hold RCU
+ *      is not found or a pointer to the device.
+ *      The caller must hold RCU or RTNL.
 *      The returned device has not had its ref count increased
 *      and the caller must therefore be careful about locking
 *
@@ -2001,7 +2002,7 @@ static bool can_checksum_protocol(unsigned long features, __be16 protocol)
 static int harmonize_features(struct sk_buff *skb, __be16 protocol, int features)
 {
-        if (!can_checksum_protocol(protocol, features)) {
+        if (!can_checksum_protocol(features, protocol)) {
                features &= ~NETIF_F_ALL_CSUM;
                features &= ~NETIF_F_SG;
        } else if (illegal_highdma(skb->dev, skb)) {
@@ -2023,13 +2024,13 @@ int netif_skb_features(struct sk_buff *skb)
                return harmonize_features(skb, protocol, features);
        }
-        features &= skb->dev->vlan_features;
+        features &= (skb->dev->vlan_features | NETIF_F_HW_VLAN_TX);
        if (protocol != htons(ETH_P_8021Q)) {
                return harmonize_features(skb, protocol, features);
        } else {
                features &= NETIF_F_SG | NETIF_F_HIGHDMA | NETIF_F_FRAGLIST |
-                                NETIF_F_GEN_CSUM;
+                                NETIF_F_GEN_CSUM | NETIF_F_HW_VLAN_TX;
                return harmonize_features(skb, protocol, features);
        }
 }
diff --git a/net/core/ethtool.c b/net/core/ethtool.c
index 17741782a345..ff2302910b5e 100644
--- a/net/core/ethtool.c
+++ b/net/core/ethtool.c
@@ -817,7 +817,7 @@ static int ethtool_get_regs(struct net_device *dev, char __user *useraddr)
        if (regs.len > reglen)
                regs.len = reglen;
-        regbuf = vmalloc(reglen);
+        regbuf = vzalloc(reglen);
        if (!regbuf)
                return -ENOMEM;
diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
index a5f7535aab5b..750db57f3bb3 100644
--- a/net/core/rtnetlink.c
+++ b/net/core/rtnetlink.c
@@ -1820,7 +1820,7 @@ static int rtnetlink_rcv_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
        if (kind != 2 && security_netlink_recv(skb, CAP_NET_ADMIN))
                return -EPERM;
-        if (kind == 2 && (nlh->nlmsg_flags & NLM_F_DUMP) == NLM_F_DUMP) {
+        if (kind == 2 && nlh->nlmsg_flags&NLM_F_DUMP) {
                struct sock *rtnl;
                rtnl_dumpit_func dumpit;
diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index d31bb36ae0dc..7cd1bc86d591 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -2744,8 +2744,12 @@ int skb_gro_receive(struct sk_buff **head, struct sk_buff *skb)
 merge:
        if (offset > headlen) {
-                skbinfo->frags[0].page_offset += offset - headlen;
+                unsigned int eat = offset - headlen;
-                skbinfo->frags[0].size -= offset - headlen;
+                skbinfo->frags[0].page_offset += eat;
+                skbinfo->frags[0].size -= eat;
+                skb->data_len -= eat;
+                skb->len -= eat;
                offset = headlen;
        }
diff --git a/net/dcb/dcbnl.c b/net/dcb/dcbnl.c
index d900ab99814a..6b03f561caec 100644
--- a/net/dcb/dcbnl.c
+++ b/net/dcb/dcbnl.c
@@ -583,7 +583,7 @@ static int dcbnl_getapp(struct net_device *netdev, struct nlattr **tb,
        u8 up, idtype;
        int ret = -EINVAL;
-        if (!tb[DCB_ATTR_APP] || !netdev->dcbnl_ops->getapp)
+        if (!tb[DCB_ATTR_APP])
                goto out;
        ret = nla_parse_nested(app_tb, DCB_APP_ATTR_MAX, tb[DCB_ATTR_APP],
@@ -604,7 +604,16 @@ static int dcbnl_getapp(struct net_device *netdev, struct nlattr **tb,
                goto out;
        id = nla_get_u16(app_tb[DCB_APP_ATTR_ID]);
-        up = netdev->dcbnl_ops->getapp(netdev, idtype, id);
+        if (netdev->dcbnl_ops->getapp) {
+                up = netdev->dcbnl_ops->getapp(netdev, idtype, id);
+        } else {
+                struct dcb_app app = {
+                                        .selector = idtype,
+                                        .protocol = id,
+                                     };
+                up = dcb_getapp(netdev, &app);
+        }
        /* send this back */
        dcbnl_skb = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
diff --git a/net/dsa/dsa.c b/net/dsa/dsa.c
index 0c877a74e1f4..3fb14b7c13cf 100644
--- a/net/dsa/dsa.c
+++ b/net/dsa/dsa.c
@@ -428,7 +428,7 @@ static void __exit dsa_cleanup_module(void)
 }
 module_exit(dsa_cleanup_module);
-MODULE_AUTHOR("Lennert Buytenhek <buytenh@wantstofly.org>")
+MODULE_AUTHOR("Lennert Buytenhek <buytenh@wantstofly.org>");
 MODULE_DESCRIPTION("Driver for Distributed Switch Architecture switch chips");
 MODULE_LICENSE("GPL");
 MODULE_ALIAS("platform:dsa");
diff --git a/net/ipv4/arp.c b/net/ipv4/arp.c
index 04c8b69fd426..7927589813b5 100644
--- a/net/ipv4/arp.c
+++ b/net/ipv4/arp.c
@@ -1017,14 +1017,13 @@ static int arp_req_set_proxy(struct net *net, struct net_device *dev, int on)
                IPV4_DEVCONF_ALL(net, PROXY_ARP) = on;
                return 0;
        }
-        if (__in_dev_get_rcu(dev)) {
+        if (__in_dev_get_rtnl(dev)) {
-                IN_DEV_CONF_SET(__in_dev_get_rcu(dev), PROXY_ARP, on);
+                IN_DEV_CONF_SET(__in_dev_get_rtnl(dev), PROXY_ARP, on);
                return 0;
        }
        return -ENXIO;
 }
-/* must be called with rcu_read_lock() */
 static int arp_req_set_public(struct net *net, struct arpreq *r,
                struct net_device *dev)
 {
@@ -1233,10 +1232,10 @@ int arp_ioctl(struct net *net, unsigned int cmd, void __user *arg)
        if (!(r.arp_flags & ATF_NETMASK))
                ((struct sockaddr_in *)&r.arp_netmask)->sin_addr.s_addr =
                                                           htonl(0xFFFFFFFFUL);
-        rcu_read_lock();
+        rtnl_lock();
        if (r.arp_dev[0]) {
                err = -ENODEV;
-                dev = dev_get_by_name_rcu(net, r.arp_dev);
+                dev = __dev_get_by_name(net, r.arp_dev);
                if (dev == NULL)
                        goto out;
@@ -1263,7 +1262,7 @@ int arp_ioctl(struct net *net, unsigned int cmd, void __user *arg)
                break;
        }
 out:
-        rcu_read_unlock();
+        rtnl_unlock();
        if (cmd == SIOCGARP && !err && copy_to_user(arg, &r, sizeof(r)))
                err = -EFAULT;
        return err;
diff --git a/net/ipv4/inet_diag.c b/net/ipv4/inet_diag.c
index 2746c1fa6417..2ada17129fce 100644
--- a/net/ipv4/inet_diag.c
+++ b/net/ipv4/inet_diag.c
@@ -858,7 +858,7 @@ static int inet_diag_rcv_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
            nlmsg_len(nlh) < hdrlen)
                return -EINVAL;
-        if ((nlh->nlmsg_flags & NLM_F_DUMP) == NLM_F_DUMP) {
+        if (nlh->nlmsg_flags & NLM_F_DUMP) {
                if (nlmsg_attrlen(nlh, hdrlen)) {
                        struct nlattr *attr;
diff --git a/net/ipv4/inetpeer.c b/net/ipv4/inetpeer.c
index d9bc85751c74..a96e65674ac3 100644
--- a/net/ipv4/inetpeer.c
+++ b/net/ipv4/inetpeer.c
@@ -475,7 +475,7 @@ static int cleanup_once(unsigned long ttl)
 struct inet_peer *inet_getpeer(struct inetpeer_addr *daddr, int create)
 {
        struct inet_peer __rcu **stack[PEER_MAXDEPTH], ***stackptr;
-        struct inet_peer_base *base = family_to_base(AF_INET);
+        struct inet_peer_base *base = family_to_base(daddr->family);
        struct inet_peer *p;
        /* Look up for the address quickly, lockless.
diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
index 2549b29b062d..eb7f82ebf4a3 100644
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -4399,7 +4399,7 @@ static void tcp_data_queue(struct sock *sk, struct sk_buff *skb)
                        if (!skb_copy_datagram_iovec(skb, 0, tp->ucopy.iov, chunk)) {
                                tp->ucopy.len -= chunk;
                                tp->copied_seq += chunk;
-                                eaten = (chunk == skb->len && !th->fin);
+                                eaten = (chunk == skb->len);
                                tcp_rcv_space_adjust(sk);
                        }
                        local_bh_disable();
diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
index 856f68466d49..02f583b3744a 100644
--- a/net/ipv4/tcp_ipv4.c
+++ b/net/ipv4/tcp_ipv4.c
@@ -1994,7 +1994,6 @@ static void *listening_get_next(struct seq_file *seq, void *cur)
                                }
                                req = req->dl_next;
                        }
-                        st->offset = 0;
                        if (++st->sbucket >= icsk->icsk_accept_queue.listen_opt->nr_table_entries)
                                break;
 get_req:
diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index 5b189c97c2fc..fd6782e3a038 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -420,9 +420,6 @@ static struct inet6_dev * ipv6_add_dev(struct net_device *dev)
            dev->type == ARPHRD_TUNNEL6 ||
            dev->type == ARPHRD_SIT ||
            dev->type == ARPHRD_NONE) {
-                printk(KERN_INFO
-                       "%s: Disabled Privacy Extensions\n",
-                       dev->name);
                ndev->cnf.use_tempaddr = -1;
        } else {
                in6_dev_hold(ndev);
@@ -2664,14 +2661,12 @@ static int addrconf_ifdown(struct net_device *dev, int how)
        struct net *net = dev_net(dev);
        struct inet6_dev *idev;
        struct inet6_ifaddr *ifa;
-        LIST_HEAD(keep_list);
+        int state, i;
-        int state;
        ASSERT_RTNL();
-        /* Flush routes if device is being removed or it is not loopback */
+        rt6_ifdown(net, dev);
-        if (how || !(dev->flags & IFF_LOOPBACK))
+        neigh_ifdown(&nd_tbl, dev);
-                rt6_ifdown(net, dev);
        idev = __in6_dev_get(dev);
        if (idev == NULL)
@@ -2692,6 +2687,23 @@ static int addrconf_ifdown(struct net_device *dev, int how)
        }
+        /* Step 2: clear hash table */
+        for (i = 0; i < IN6_ADDR_HSIZE; i++) {
+                struct hlist_head *h = &inet6_addr_lst[i];
+                struct hlist_node *n;
+                spin_lock_bh(&addrconf_hash_lock);
+        restart:
+                hlist_for_each_entry_rcu(ifa, n, h, addr_lst) {
+                        if (ifa->idev == idev) {
+                                hlist_del_init_rcu(&ifa->addr_lst);
+                                addrconf_del_timer(ifa);
+                                goto restart;
+                        }
+                }
+                spin_unlock_bh(&addrconf_hash_lock);
+        }
        write_lock_bh(&idev->lock);
        /* Step 2: clear flags for stateless addrconf */
@@ -2725,52 +2737,23 @@ static int addrconf_ifdown(struct net_device *dev, int how)
                                       struct inet6_ifaddr, if_list);
                addrconf_del_timer(ifa);
-                /* If just doing link down, and address is permanent
+                list_del(&ifa->if_list);
-                   and not link-local, then retain it. */
-                if (!how &&
-                    (ifa->flags&IFA_F_PERMANENT) &&
-                    !(ipv6_addr_type(&ifa->addr) & IPV6_ADDR_LINKLOCAL)) {
-                        list_move_tail(&ifa->if_list, &keep_list);
-                        /* If not doing DAD on this address, just keep it. */
-                        if ((dev->flags&(IFF_NOARP|IFF_LOOPBACK)) ||
-                            idev->cnf.accept_dad <= 0 ||
-                            (ifa->flags & IFA_F_NODAD))
-                                continue;
-                        /* If it was tentative already, no need to notify */
+                write_unlock_bh(&idev->lock);
-                        if (ifa->flags & IFA_F_TENTATIVE)
-                                continue;
-                        /* Flag it for later restoration when link comes up */
+                spin_lock_bh(&ifa->state_lock);
-                        ifa->flags |= IFA_F_TENTATIVE;
+                state = ifa->state;
-                        ifa->state = INET6_IFADDR_STATE_DAD;
+                ifa->state = INET6_IFADDR_STATE_DEAD;
-                } else {
+                spin_unlock_bh(&ifa->state_lock);
-                        list_del(&ifa->if_list);
-                        /* clear hash table */
-                        spin_lock_bh(&addrconf_hash_lock);
-                        hlist_del_init_rcu(&ifa->addr_lst);
-                        spin_unlock_bh(&addrconf_hash_lock);
-                        write_unlock_bh(&idev->lock);
-                        spin_lock_bh(&ifa->state_lock);
-                        state = ifa->state;
-                        ifa->state = INET6_IFADDR_STATE_DEAD;
-                        spin_unlock_bh(&ifa->state_lock);
-                        if (state != INET6_IFADDR_STATE_DEAD) {
-                                __ipv6_ifa_notify(RTM_DELADDR, ifa);
-                                atomic_notifier_call_chain(&inet6addr_chain,
-                                                           NETDEV_DOWN, ifa);
-                        }
-                        in6_ifa_put(ifa);
+                if (state != INET6_IFADDR_STATE_DEAD) {
-                        write_lock_bh(&idev->lock);
+                        __ipv6_ifa_notify(RTM_DELADDR, ifa);
+                        atomic_notifier_call_chain(&inet6addr_chain, NETDEV_DOWN, ifa);
                }
-        }
+                in6_ifa_put(ifa);
-        list_splice(&keep_list, &idev->addr_list);
+                write_lock_bh(&idev->lock);
+        }
        write_unlock_bh(&idev->lock);
@@ -4159,8 +4142,7 @@ static void __ipv6_ifa_notify(int event, struct inet6_ifaddr *ifp)
                addrconf_leave_solict(ifp->idev, &ifp->addr);
                dst_hold(&ifp->rt->dst);
-                if (ifp->state == INET6_IFADDR_STATE_DEAD &&
+                if (ip6_del_rt(ifp->rt))
-                    ip6_del_rt(ifp->rt))
                        dst_free(&ifp->rt->dst);
                break;
        }
diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index 373bd0416f69..1534508f6c68 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -72,8 +72,6 @@
 #define RT6_TRACE(x...) do { ; } while (0)
 #endif
-#define CLONE_OFFLINK_ROUTE 0
 static struct rt6_info * ip6_rt_copy(struct rt6_info *ort);
 static struct dst_entry *ip6_dst_check(struct dst_entry *dst, u32 cookie);
 static unsigned int      ip6_default_advmss(const struct dst_entry *dst);
@@ -738,13 +736,8 @@ restart:
        if (!rt->rt6i_nexthop && !(rt->rt6i_flags & RTF_NONEXTHOP))
                nrt = rt6_alloc_cow(rt, &fl->fl6_dst, &fl->fl6_src);
-        else {
+        else
-#if CLONE_OFFLINK_ROUTE
                nrt = rt6_alloc_clone(rt, &fl->fl6_dst);
-#else
-                goto out2;
-#endif
-        }
        dst_release(&rt->dst);
        rt = nrt ? : net->ipv6.ip6_null_entry;
diff --git a/net/ipv6/xfrm6_policy.c b/net/ipv6/xfrm6_policy.c
index 7e74023ea6e4..da87428681cc 100644
--- a/net/ipv6/xfrm6_policy.c
+++ b/net/ipv6/xfrm6_policy.c
@@ -98,6 +98,10 @@ static int xfrm6_fill_dst(struct xfrm_dst *xdst, struct net_device *dev,
        if (!xdst->u.rt6.rt6i_idev)
                return -ENODEV;
+        xdst->u.rt6.rt6i_peer = rt->rt6i_peer;
+        if (rt->rt6i_peer)
+                atomic_inc(&rt->rt6i_peer->refcnt);
        /* Sheit... I remember I did this right. Apparently,
         * it was magically lost, so this code needs audit */
        xdst->u.rt6.rt6i_flags = rt->rt6i_flags & (RTF_ANYCAST |
@@ -216,6 +220,8 @@ static void xfrm6_dst_destroy(struct dst_entry *dst)
        if (likely(xdst->u.rt6.rt6i_idev))
                in6_dev_put(xdst->u.rt6.rt6i_idev);
+        if (likely(xdst->u.rt6.rt6i_peer))
+                inet_putpeer(xdst->u.rt6.rt6i_peer);
        xfrm_dst_destroy(xdst);
 }
diff --git a/net/mac80211/Kconfig b/net/mac80211/Kconfig
index 9109262abd24..c766056d0488 100644
--- a/net/mac80211/Kconfig
+++ b/net/mac80211/Kconfig
@@ -20,7 +20,7 @@ config MAC80211_HAS_RC
        def_bool n
 config MAC80211_RC_PID
-        bool "PID controller based rate control algorithm" if EMBEDDED
+        bool "PID controller based rate control algorithm" if EXPERT
        select MAC80211_HAS_RC
        ---help---
          This option enables a TX rate control algorithm for
@@ -28,14 +28,14 @@ config MAC80211_RC_PID
          rate.
 config MAC80211_RC_MINSTREL
-        bool "Minstrel" if EMBEDDED
+        bool "Minstrel" if EXPERT
        select MAC80211_HAS_RC
        default y
        ---help---
          This option enables the 'minstrel' TX rate control algorithm
 config MAC80211_RC_MINSTREL_HT
-        bool "Minstrel 802.11n support" if EMBEDDED
+        bool "Minstrel 802.11n support" if EXPERT
        depends on MAC80211_RC_MINSTREL
        default y
        ---help---
diff --git a/net/mac80211/agg-rx.c b/net/mac80211/agg-rx.c
index f138b195d657..227ca82eef72 100644
--- a/net/mac80211/agg-rx.c
+++ b/net/mac80211/agg-rx.c
@@ -185,8 +185,6 @@ void ieee80211_process_addba_request(struct ieee80211_local *local,
                                     struct ieee80211_mgmt *mgmt,
                                     size_t len)
 {
-        struct ieee80211_hw *hw = &local->hw;
-        struct ieee80211_conf *conf = &hw->conf;
        struct tid_ampdu_rx *tid_agg_rx;
        u16 capab, tid, timeout, ba_policy, buf_size, start_seq_num, status;
        u8 dialog_token;
@@ -231,13 +229,8 @@ void ieee80211_process_addba_request(struct ieee80211_local *local,
                goto end_no_lock;
        }
        /* determine default buffer size */
-        if (buf_size == 0) {
+        if (buf_size == 0)
-                struct ieee80211_supported_band *sband;
+                buf_size = IEEE80211_MAX_AMPDU_BUF;
-                sband = local->hw.wiphy->bands[conf->channel->band];
-                buf_size = IEEE80211_MIN_AMPDU_BUF;
-                buf_size = buf_size << sband->ht_cap.ampdu_factor;
-        }
        /* examine state machine */
diff --git a/net/mac80211/main.c b/net/mac80211/main.c
index 485d36bc9a46..a46ff06d7cb8 100644
--- a/net/mac80211/main.c
+++ b/net/mac80211/main.c
@@ -39,6 +39,8 @@ module_param(ieee80211_disable_40mhz_24ghz, bool, 0644);
 MODULE_PARM_DESC(ieee80211_disable_40mhz_24ghz,
                 "Disable 40MHz support in the 2.4GHz band");
+static struct lock_class_key ieee80211_rx_skb_queue_class;
 void ieee80211_configure_filter(struct ieee80211_local *local)
 {
        u64 mc;
@@ -569,7 +571,15 @@ struct ieee80211_hw *ieee80211_alloc_hw(size_t priv_data_len,
        spin_lock_init(&local->filter_lock);
        spin_lock_init(&local->queue_stop_reason_lock);
-        skb_queue_head_init(&local->rx_skb_queue);
+        /*
+         * The rx_skb_queue is only accessed from tasklets,
+         * but other SKB queues are used from within IRQ
+         * context. Therefore, this one needs a different
+         * locking class so our direct, non-irq-safe use of
+         * the queue's lock doesn't throw lockdep warnings.
+         */
+        skb_queue_head_init_class(&local->rx_skb_queue,
+                                  &ieee80211_rx_skb_queue_class);
        INIT_DELAYED_WORK(&local->scan_work, ieee80211_scan_work);
diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c
index 5950e3abead9..b64b42bc774b 100644
--- a/net/mac80211/tx.c
+++ b/net/mac80211/tx.c
@@ -2230,6 +2230,9 @@ struct sk_buff *ieee80211_beacon_get_tim(struct ieee80211_hw *hw,
        sdata = vif_to_sdata(vif);
+        if (!ieee80211_sdata_running(sdata))
+                goto out;
        if (tim_offset)
                *tim_offset = 0;
        if (tim_length)
diff --git a/net/netfilter/nf_conntrack_netlink.c b/net/netfilter/nf_conntrack_netlink.c
index 2b7eef37875c..93297aaceb2b 100644
--- a/net/netfilter/nf_conntrack_netlink.c
+++ b/net/netfilter/nf_conntrack_netlink.c
@@ -924,7 +924,7 @@ ctnetlink_get_conntrack(struct sock *ctnl, struct sk_buff *skb,
        u16 zone;
        int err;
-        if ((nlh->nlmsg_flags & NLM_F_DUMP) == NLM_F_DUMP)
+        if (nlh->nlmsg_flags & NLM_F_DUMP)
                return netlink_dump_start(ctnl, skb, nlh, ctnetlink_dump_table,
                                          ctnetlink_done);
@@ -1787,7 +1787,7 @@ ctnetlink_get_expect(struct sock *ctnl, struct sk_buff *skb,
        u16 zone;
        int err;
-        if ((nlh->nlmsg_flags & NLM_F_DUMP) == NLM_F_DUMP) {
+        if (nlh->nlmsg_flags & NLM_F_DUMP) {
                return netlink_dump_start(ctnl, skb, nlh,
                                          ctnetlink_exp_dump_table,
                                          ctnetlink_exp_done);
diff --git a/net/netlink/genetlink.c b/net/netlink/genetlink.c
index f83cb370292b..1781d99145e2 100644
--- a/net/netlink/genetlink.c
+++ b/net/netlink/genetlink.c
@@ -519,7 +519,7 @@ static int genl_rcv_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
            security_netlink_recv(skb, CAP_NET_ADMIN))
                return -EPERM;
-        if ((nlh->nlmsg_flags & NLM_F_DUMP) == NLM_F_DUMP) {
+        if (nlh->nlmsg_flags & NLM_F_DUMP) {
                if (ops->dumpit == NULL)
                        return -EOPNOTSUPP;
diff --git a/net/rfkill/Kconfig b/net/rfkill/Kconfig
index eaf765876458..7fce6dfd2180 100644
--- a/net/rfkill/Kconfig
+++ b/net/rfkill/Kconfig
@@ -18,7 +18,7 @@ config RFKILL_LEDS
        default y
 config RFKILL_INPUT
-        bool "RF switch input support" if EMBEDDED
+        bool "RF switch input support" if EXPERT
        depends on RFKILL
        depends on INPUT = y || RFKILL = INPUT
-        default y if !EMBEDDED
+        default y if !EXPERT
diff --git a/net/sched/sch_cbq.c b/net/sched/sch_cbq.c
index c80d1c210c5d..5f63ec58942c 100644
--- a/net/sched/sch_cbq.c
+++ b/net/sched/sch_cbq.c
@@ -390,7 +390,6 @@ cbq_enqueue(struct sk_buff *skb, struct Qdisc *sch)
        ret = qdisc_enqueue(skb, cl->q);
        if (ret == NET_XMIT_SUCCESS) {
                sch->q.qlen++;
-                qdisc_bstats_update(sch, skb);
                cbq_mark_toplevel(q, cl);
                if (!cl->next_alive)
                        cbq_activate_class(cl);
@@ -649,7 +648,6 @@ static int cbq_reshape_fail(struct sk_buff *skb, struct Qdisc *child)
                ret = qdisc_enqueue(skb, cl->q);
                if (ret == NET_XMIT_SUCCESS) {
                        sch->q.qlen++;
-                        qdisc_bstats_update(sch, skb);
                        if (!cl->next_alive)
                                cbq_activate_class(cl);
                        return 0;
@@ -971,6 +969,7 @@ cbq_dequeue(struct Qdisc *sch)
                skb = cbq_dequeue_1(sch);
                if (skb) {
+                        qdisc_bstats_update(sch, skb);
                        sch->q.qlen--;
                        sch->flags &= ~TCQ_F_THROTTLED;
                        return skb;
diff --git a/net/sched/sch_drr.c b/net/sched/sch_drr.c
index de55e642eafc..6b7fe4a84f13 100644
--- a/net/sched/sch_drr.c
+++ b/net/sched/sch_drr.c
@@ -376,7 +376,6 @@ static int drr_enqueue(struct sk_buff *skb, struct Qdisc *sch)
        }
        bstats_update(&cl->bstats, skb);
-        qdisc_bstats_update(sch, skb);
        sch->q.qlen++;
        return err;
@@ -403,6 +402,7 @@ static struct sk_buff *drr_dequeue(struct Qdisc *sch)
                        skb = qdisc_dequeue_peeked(cl->qdisc);
                        if (cl->qdisc->q.qlen == 0)
                                list_del(&cl->alist);
+                        qdisc_bstats_update(sch, skb);
                        sch->q.qlen--;
                        return skb;
                }
diff --git a/net/sched/sch_dsmark.c b/net/sched/sch_dsmark.c
index 60f4bdd4408e..0f7bf3fdfea5 100644
--- a/net/sched/sch_dsmark.c
+++ b/net/sched/sch_dsmark.c
@@ -260,7 +260,6 @@ static int dsmark_enqueue(struct sk_buff *skb, struct Qdisc *sch)
                return err;
        }
-        qdisc_bstats_update(sch, skb);
        sch->q.qlen++;
        return NET_XMIT_SUCCESS;
@@ -283,6 +282,7 @@ static struct sk_buff *dsmark_dequeue(struct Qdisc *sch)
        if (skb == NULL)
                return NULL;
+        qdisc_bstats_update(sch, skb);
        sch->q.qlen--;
        index = skb->tc_index & (p->indices - 1);
diff --git a/net/sched/sch_fifo.c b/net/sched/sch_fifo.c
index aa4d6337e43c..d468b479aa93 100644
--- a/net/sched/sch_fifo.c
+++ b/net/sched/sch_fifo.c
@@ -46,17 +46,14 @@ static int pfifo_enqueue(struct sk_buff *skb, struct Qdisc* sch)
 static int pfifo_tail_enqueue(struct sk_buff *skb, struct Qdisc* sch)
 {
-        struct sk_buff *skb_head;
        struct fifo_sched_data *q = qdisc_priv(sch);
        if (likely(skb_queue_len(&sch->q) < q->limit))
                return qdisc_enqueue_tail(skb, sch);
        /* queue full, remove one skb to fulfill the limit */
-        skb_head = qdisc_dequeue_head(sch);
+        __qdisc_queue_drop_head(sch, &sch->q);
        sch->qstats.drops++;
-        kfree_skb(skb_head);
        qdisc_enqueue_tail(skb, sch);
        return NET_XMIT_CN;
diff --git a/net/sched/sch_hfsc.c b/net/sched/sch_hfsc.c
index 2e45791d4f6c..14a799de1c35 100644
--- a/net/sched/sch_hfsc.c
+++ b/net/sched/sch_hfsc.c
@@ -1600,7 +1600,6 @@ hfsc_enqueue(struct sk_buff *skb, struct Qdisc *sch)
                set_active(cl, qdisc_pkt_len(skb));
        bstats_update(&cl->bstats, skb);
-        qdisc_bstats_update(sch, skb);
        sch->q.qlen++;
        return NET_XMIT_SUCCESS;
@@ -1666,6 +1665,7 @@ hfsc_dequeue(struct Qdisc *sch)
        }
        sch->flags &= ~TCQ_F_THROTTLED;
+        qdisc_bstats_update(sch, skb);
        sch->q.qlen--;
        return skb;
diff --git a/net/sched/sch_htb.c b/net/sched/sch_htb.c
index 984c1b0c6836..fc12fe6f5597 100644
--- a/net/sched/sch_htb.c
+++ b/net/sched/sch_htb.c
@@ -574,7 +574,6 @@ static int htb_enqueue(struct sk_buff *skb, struct Qdisc *sch)
        }
        sch->q.qlen++;
-        qdisc_bstats_update(sch, skb);
        return NET_XMIT_SUCCESS;
 }
@@ -842,7 +841,7 @@ next:
 static struct sk_buff *htb_dequeue(struct Qdisc *sch)
 {
-        struct sk_buff *skb = NULL;
+        struct sk_buff *skb;
        struct htb_sched *q = qdisc_priv(sch);
        int level;
        psched_time_t next_event;
@@ -851,6 +850,8 @@ static struct sk_buff *htb_dequeue(struct Qdisc *sch)
        /* try to dequeue direct packets as high prio (!) to minimize cpu work */
        skb = __skb_dequeue(&q->direct_queue);
        if (skb != NULL) {
+ok:
+                qdisc_bstats_update(sch, skb);
                sch->flags &= ~TCQ_F_THROTTLED;
                sch->q.qlen--;
                return skb;
@@ -884,11 +885,8 @@ static struct sk_buff *htb_dequeue(struct Qdisc *sch)
                        int prio = ffz(m);
                        m |= 1 << prio;
                        skb = htb_dequeue_tree(q, prio, level);
-                        if (likely(skb != NULL)) {
+                        if (likely(skb != NULL))
-                                sch->q.qlen--;
+                                goto ok;
-                                sch->flags &= ~TCQ_F_THROTTLED;
-                                goto fin;
-                        }
                }
        }
        sch->qstats.overlimits++;
diff --git a/net/sched/sch_multiq.c b/net/sched/sch_multiq.c
index 21f13da24763..436a2e75b322 100644
--- a/net/sched/sch_multiq.c
+++ b/net/sched/sch_multiq.c
@@ -83,7 +83,6 @@ multiq_enqueue(struct sk_buff *skb, struct Qdisc *sch)
        ret = qdisc_enqueue(skb, qdisc);
        if (ret == NET_XMIT_SUCCESS) {
-                qdisc_bstats_update(sch, skb);
                sch->q.qlen++;
                return NET_XMIT_SUCCESS;
        }
@@ -112,6 +111,7 @@ static struct sk_buff *multiq_dequeue(struct Qdisc *sch)
                        qdisc = q->queues[q->curband];
                        skb = qdisc->dequeue(qdisc);
                        if (skb) {
+                                qdisc_bstats_update(sch, skb);
                                sch->q.qlen--;
                                return skb;
                        }
diff --git a/net/sched/sch_netem.c b/net/sched/sch_netem.c
index 1c4bce863479..6a3006b38dc5 100644
--- a/net/sched/sch_netem.c
+++ b/net/sched/sch_netem.c
@@ -240,7 +240,6 @@ static int netem_enqueue(struct sk_buff *skb, struct Qdisc *sch)
        if (likely(ret == NET_XMIT_SUCCESS)) {
                sch->q.qlen++;
-                qdisc_bstats_update(sch, skb);
        } else if (net_xmit_drop_count(ret)) {
                sch->qstats.drops++;
        }
@@ -289,6 +288,7 @@ static struct sk_buff *netem_dequeue(struct Qdisc *sch)
                                skb->tstamp.tv64 = 0;
 #endif
                        pr_debug("netem_dequeue: return skb=%p\n", skb);
+                        qdisc_bstats_update(sch, skb);
                        sch->q.qlen--;
                        return skb;
                }
@@ -476,7 +476,6 @@ static int tfifo_enqueue(struct sk_buff *nskb, struct Qdisc *sch)
                __skb_queue_after(list, skb, nskb);
                sch->qstats.backlog += qdisc_pkt_len(nskb);
-                qdisc_bstats_update(sch, nskb);
                return NET_XMIT_SUCCESS;
        }
diff --git a/net/sched/sch_prio.c b/net/sched/sch_prio.c
index 966158d49dd1..fbd710d619bf 100644
--- a/net/sched/sch_prio.c
+++ b/net/sched/sch_prio.c
@@ -84,7 +84,6 @@ prio_enqueue(struct sk_buff *skb, struct Qdisc *sch)
        ret = qdisc_enqueue(skb, qdisc);
        if (ret == NET_XMIT_SUCCESS) {
-                qdisc_bstats_update(sch, skb);
                sch->q.qlen++;
                return NET_XMIT_SUCCESS;
        }
@@ -116,6 +115,7 @@ static struct sk_buff *prio_dequeue(struct Qdisc* sch)
                struct Qdisc *qdisc = q->queues[prio];
                struct sk_buff *skb = qdisc->dequeue(qdisc);
                if (skb) {
+                        qdisc_bstats_update(sch, skb);
                        sch->q.qlen--;
                        return skb;
                }
diff --git a/net/sched/sch_red.c b/net/sched/sch_red.c
index a6009c5a2c97..9f98dbd32d4c 100644
--- a/net/sched/sch_red.c
+++ b/net/sched/sch_red.c
@@ -94,7 +94,6 @@ static int red_enqueue(struct sk_buff *skb, struct Qdisc* sch)
        ret = qdisc_enqueue(skb, child);
        if (likely(ret == NET_XMIT_SUCCESS)) {
-                qdisc_bstats_update(sch, skb);
                sch->q.qlen++;
        } else if (net_xmit_drop_count(ret)) {
                q->stats.pdrop++;
@@ -114,11 +113,13 @@ static struct sk_buff * red_dequeue(struct Qdisc* sch)
        struct Qdisc *child = q->qdisc;
        skb = child->dequeue(child);
-        if (skb)
+        if (skb) {
+                qdisc_bstats_update(sch, skb);
                sch->q.qlen--;
-        else if (!red_is_idling(&q->parms))
+        } else {
-                red_start_of_idle_period(&q->parms);
+                if (!red_is_idling(&q->parms))
+                        red_start_of_idle_period(&q->parms);
+        }
        return skb;
 }
diff --git a/net/sched/sch_sfq.c b/net/sched/sch_sfq.c
index 239ec53a634d..edea8cefec6c 100644
--- a/net/sched/sch_sfq.c
+++ b/net/sched/sch_sfq.c
@@ -402,10 +402,8 @@ sfq_enqueue(struct sk_buff *skb, struct Qdisc *sch)
                q->tail = slot;
                slot->allot = q->scaled_quantum;
        }
-        if (++sch->q.qlen <= q->limit) {
+        if (++sch->q.qlen <= q->limit)
-                qdisc_bstats_update(sch, skb);
                return NET_XMIT_SUCCESS;
-        }
        sfq_drop(sch);
        return NET_XMIT_CN;
@@ -445,6 +443,7 @@ next_slot:
        }
        skb = slot_dequeue_head(slot);
        sfq_dec(q, a);
+        qdisc_bstats_update(sch, skb);
        sch->q.qlen--;
        sch->qstats.backlog -= qdisc_pkt_len(skb);
diff --git a/net/sched/sch_tbf.c b/net/sched/sch_tbf.c
index 77565e721811..e93165820c3f 100644
--- a/net/sched/sch_tbf.c
+++ b/net/sched/sch_tbf.c
@@ -134,7 +134,6 @@ static int tbf_enqueue(struct sk_buff *skb, struct Qdisc* sch)
        }
        sch->q.qlen++;
-        qdisc_bstats_update(sch, skb);
        return NET_XMIT_SUCCESS;
 }
@@ -187,6 +186,7 @@ static struct sk_buff *tbf_dequeue(struct Qdisc* sch)
                        q->ptokens = ptoks;
                        sch->q.qlen--;
                        sch->flags &= ~TCQ_F_THROTTLED;
+                        qdisc_bstats_update(sch, skb);
                        return skb;
                }
diff --git a/net/sched/sch_teql.c b/net/sched/sch_teql.c
index 84ce48eadff4..d84e7329660f 100644
--- a/net/sched/sch_teql.c
+++ b/net/sched/sch_teql.c
@@ -87,7 +87,6 @@ teql_enqueue(struct sk_buff *skb, struct Qdisc* sch)
        if (q->q.qlen < dev->tx_queue_len) {
                __skb_queue_tail(&q->q, skb);
-                qdisc_bstats_update(sch, skb);
                return NET_XMIT_SUCCESS;
        }
@@ -111,6 +110,8 @@ teql_dequeue(struct Qdisc* sch)
                        dat->m->slaves = sch;
                        netif_wake_queue(m);
                }
+        } else {
+                qdisc_bstats_update(sch, skb);
        }
        sch->q.qlen = dat->q.qlen + dat_queue->qdisc->q.qlen;
        return skb;
diff --git a/net/sctp/socket.c b/net/sctp/socket.c
index a09b0dd25f50..8e02550ff3e8 100644
--- a/net/sctp/socket.c
+++ b/net/sctp/socket.c
@@ -3428,7 +3428,7 @@ SCTP_STATIC int sctp_setsockopt(struct sock *sk, int level, int optname,
                retval = sctp_setsockopt_peer_addr_params(sk, optval, optlen);
                break;
-        case SCTP_DELAYED_ACK:
+        case SCTP_DELAYED_SACK:
                retval = sctp_setsockopt_delayed_ack(sk, optval, optlen);
                break;
        case SCTP_PARTIAL_DELIVERY_POINT:
@@ -5333,7 +5333,7 @@ SCTP_STATIC int sctp_getsockopt(struct sock *sk, int level, int optname,
                retval = sctp_getsockopt_peer_addr_params(sk, len, optval,
                                                          optlen);
                break;
-        case SCTP_DELAYED_ACK:
+        case SCTP_DELAYED_SACK:
                retval = sctp_getsockopt_delayed_ack(sk, len, optval,
                                                          optlen);
                break;
diff --git a/net/wireless/Kconfig b/net/wireless/Kconfig
index d0ee29063e5d..1f1ef70f34f2 100644
--- a/net/wireless/Kconfig
+++ b/net/wireless/Kconfig
@@ -95,7 +95,7 @@ config CFG80211_DEBUGFS
          If unsure, say N.
 config CFG80211_INTERNAL_REGDB
-        bool "use statically compiled regulatory rules database" if EMBEDDED
+        bool "use statically compiled regulatory rules database" if EXPERT
        default n
        depends on CFG80211
        ---help---
diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c
index d5e1e0b08890..61291965c5f6 100644
--- a/net/xfrm/xfrm_user.c
+++ b/net/xfrm/xfrm_user.c
@@ -2189,7 +2189,7 @@ static int xfrm_user_rcv_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
        if ((type == (XFRM_MSG_GETSA - XFRM_MSG_BASE) ||
             type == (XFRM_MSG_GETPOLICY - XFRM_MSG_BASE)) &&
-            (nlh->nlmsg_flags & NLM_F_DUMP) == NLM_F_DUMP) {
+            (nlh->nlmsg_flags & NLM_F_DUMP)) {
                if (link->dump == NULL)
                        return -EINVAL;