47 files changed, 529 insertions, 560 deletions

diff --git a/net/8021q/vlan.c b/net/8021q/vlan.c
index 2b7390e377b3..d1e10546eb85 100644
--- a/net/8021q/vlan.c
+++ b/net/8021q/vlan.c
@@ -492,6 +492,7 @@ static int vlan_device_event(struct notifier_block *unused, unsigned long event,
                                 continue;
 
                         dev_change_flags(vlandev, flgs & ~IFF_UP);
+                        vlan_transfer_operstate(dev, vlandev);
                 }
                 break;
 
@@ -507,6 +508,7 @@ static int vlan_device_event(struct notifier_block *unused, unsigned long event,
                                 continue;
 
                         dev_change_flags(vlandev, flgs | IFF_UP);
+                        vlan_transfer_operstate(dev, vlandev);
                 }
                 break;
 
diff --git a/net/8021q/vlan_dev.c b/net/8021q/vlan_dev.c
index 6b0921364014..b4b9068e55a7 100644
--- a/net/8021q/vlan_dev.c
+++ b/net/8021q/vlan_dev.c
@@ -462,6 +462,7 @@ static int vlan_dev_open(struct net_device *dev)
         if (vlan->flags & VLAN_FLAG_GVRP)
                 vlan_gvrp_request_join(dev);
 
+        netif_carrier_on(dev);
         return 0;
 
 clear_allmulti:
@@ -471,6 +472,7 @@ del_unicast:
         if (compare_ether_addr(dev->dev_addr, real_dev->dev_addr))
                 dev_unicast_delete(real_dev, dev->dev_addr, ETH_ALEN);
 out:
+        netif_carrier_off(dev);
         return err;
 }
 
@@ -492,6 +494,7 @@ static int vlan_dev_stop(struct net_device *dev)
         if (compare_ether_addr(dev->dev_addr, real_dev->dev_addr))
                 dev_unicast_delete(real_dev, dev->dev_addr, dev->addr_len);
 
+        netif_carrier_off(dev);
         return 0;
 }
 
@@ -612,6 +615,8 @@ static int vlan_dev_init(struct net_device *dev)
         struct net_device *real_dev = vlan_dev_info(dev)->real_dev;
         int subclass = 0;
 
+        netif_carrier_off(dev);
+
         /* IFF_BROADCAST|IFF_MULTICAST; ??? */
         dev->flags  = real_dev->flags & ~(IFF_UP | IFF_PROMISC | IFF_ALLMULTI);
         dev->iflink = real_dev->ifindex;
diff --git a/net/9p/client.c b/net/9p/client.c
index 1eb580c38fbb..dd43a8289b0d 100644
--- a/net/9p/client.c
+++ b/net/9p/client.c
@@ -203,7 +203,6 @@ static struct p9_req_t *p9_tag_alloc(struct p9_client *c, u16 tag)
         p9pdu_reset(req->tc);
         p9pdu_reset(req->rc);
 
-        req->flush_tag = 0;
         req->tc->tag = tag-1;
         req->status = REQ_STATUS_ALLOC;
 
@@ -324,35 +323,9 @@ static void p9_free_req(struct p9_client *c, struct p9_req_t *r)
  */
 void p9_client_cb(struct p9_client *c, struct p9_req_t *req)
 {
-        struct p9_req_t *other_req;
-        unsigned long flags;
-
         P9_DPRINTK(P9_DEBUG_MUX, " tag %d\n", req->tc->tag);
-
-        if (req->status == REQ_STATUS_ERROR)
-                wake_up(req->wq);
-
-        if (req->flush_tag) {                   /* flush receive path */
-                P9_DPRINTK(P9_DEBUG_9P, "<<< RFLUSH %d\n", req->tc->tag);
-                spin_lock_irqsave(&c->lock, flags);
-                other_req = p9_tag_lookup(c, req->flush_tag);
-                if (other_req->status != REQ_STATUS_FLSH) /* stale flush */
-                        spin_unlock_irqrestore(&c->lock, flags);
-                else {
-                        other_req->status = REQ_STATUS_FLSHD;
-                        spin_unlock_irqrestore(&c->lock, flags);
-                        wake_up(other_req->wq);
-                }
-                p9_free_req(c, req);
-        } else {                                /* normal receive path */
-                P9_DPRINTK(P9_DEBUG_MUX, "normal: tag %d\n", req->tc->tag);
-                spin_lock_irqsave(&c->lock, flags);
-                if (req->status != REQ_STATUS_FLSHD)
-                        req->status = REQ_STATUS_RCVD;
-                spin_unlock_irqrestore(&c->lock, flags);
-                wake_up(req->wq);
-                P9_DPRINTK(P9_DEBUG_MUX, "wakeup: %d\n", req->tc->tag);
-        }
+        wake_up(req->wq);
+        P9_DPRINTK(P9_DEBUG_MUX, "wakeup: %d\n", req->tc->tag);
 }
 EXPORT_SYMBOL(p9_client_cb);
 
@@ -486,9 +459,15 @@ static int p9_client_flush(struct p9_client *c, struct p9_req_t *oldreq)
         if (IS_ERR(req))
                 return PTR_ERR(req);
 
-        req->flush_tag = oldtag;
 
-        /* we don't free anything here because RPC isn't complete */
+        /* if we haven't received a response for oldreq,
+           remove it from the list. */
+        spin_lock(&c->lock);
+        if (oldreq->status == REQ_STATUS_FLSH)
+                list_del(&oldreq->req_list);
+        spin_unlock(&c->lock);
+
+        p9_free_req(c, req);
         return 0;
 }
 
@@ -509,7 +488,6 @@ p9_client_rpc(struct p9_client *c, int8_t type, const char *fmt, ...)
         struct p9_req_t *req;
         unsigned long flags;
         int sigpending;
-        int flushed = 0;
 
         P9_DPRINTK(P9_DEBUG_MUX, "client %p op %d\n", c, type);
 
@@ -546,42 +524,28 @@ p9_client_rpc(struct p9_client *c, int8_t type, const char *fmt, ...)
                 goto reterr;
         }
 
-        /* if it was a flush we just transmitted, return our tag */
-        if (type == P9_TFLUSH)
-                return req;
-again:
         P9_DPRINTK(P9_DEBUG_MUX, "wait %p tag: %d\n", req->wq, tag);
         err = wait_event_interruptible(*req->wq,
                                                 req->status >= REQ_STATUS_RCVD);
-        P9_DPRINTK(P9_DEBUG_MUX, "wait %p tag: %d returned %d (flushed=%d)\n",
-                                                req->wq, tag, err, flushed);
+        P9_DPRINTK(P9_DEBUG_MUX, "wait %p tag: %d returned %d\n",
+                                                req->wq, tag, err);
 
         if (req->status == REQ_STATUS_ERROR) {
                 P9_DPRINTK(P9_DEBUG_ERROR, "req_status error %d\n", req->t_err);
                 err = req->t_err;
-        } else if (err == -ERESTARTSYS && flushed) {
-                P9_DPRINTK(P9_DEBUG_MUX, "flushed - going again\n");
-                goto again;
-        } else if (req->status == REQ_STATUS_FLSHD) {
-                P9_DPRINTK(P9_DEBUG_MUX, "flushed - erestartsys\n");
-                err = -ERESTARTSYS;
         }
 
-        if ((err == -ERESTARTSYS) && (c->status == Connected) && (!flushed)) {
+        if ((err == -ERESTARTSYS) && (c->status == Connected)) {
                 P9_DPRINTK(P9_DEBUG_MUX, "flushing\n");
-                spin_lock_irqsave(&c->lock, flags);
-                if (req->status == REQ_STATUS_SENT)
-                        req->status = REQ_STATUS_FLSH;
-                spin_unlock_irqrestore(&c->lock, flags);
                 sigpending = 1;
-                flushed = 1;
                 clear_thread_flag(TIF_SIGPENDING);
 
-                if (c->trans_mod->cancel(c, req)) {
-                        err = p9_client_flush(c, req);
-                        if (err == 0)
-                                goto again;
-                }
+                if (c->trans_mod->cancel(c, req))
+                        p9_client_flush(c, req);
+
+                /* if we received the response anyway, don't signal error */
+                if (req->status == REQ_STATUS_RCVD)
+                        err = 0;
         }
 
         if (sigpending) {
@@ -1244,19 +1208,53 @@ struct p9_wstat *p9_client_stat(struct p9_fid *fid)
                 ret->name, ret->uid, ret->gid, ret->muid, ret->extension,
                 ret->n_uid, ret->n_gid, ret->n_muid);
 
+        p9_free_req(clnt, req);
+        return ret;
+
 free_and_error:
         p9_free_req(clnt, req);
 error:
-        return ret;
+        kfree(ret);
+        return ERR_PTR(err);
 }
 EXPORT_SYMBOL(p9_client_stat);
 
+static int p9_client_statsize(struct p9_wstat *wst, int optional)
+{
+        int ret;
+
+        /* size[2] type[2] dev[4] qid[13] */
+        /* mode[4] atime[4] mtime[4] length[8]*/
+        /* name[s] uid[s] gid[s] muid[s] */
+        ret = 2+2+4+13+4+4+4+8+2+2+2+2;
+
+        if (wst->name)
+                ret += strlen(wst->name);
+        if (wst->uid)
+                ret += strlen(wst->uid);
+        if (wst->gid)
+                ret += strlen(wst->gid);
+        if (wst->muid)
+                ret += strlen(wst->muid);
+
+        if (optional) {
+                ret += 2+4+4+4; /* extension[s] n_uid[4] n_gid[4] n_muid[4] */
+                if (wst->extension)
+                        ret += strlen(wst->extension);
+        }
+
+        return ret;
+}
+
 int p9_client_wstat(struct p9_fid *fid, struct p9_wstat *wst)
 {
         int err;
         struct p9_req_t *req;
         struct p9_client *clnt;
 
+        err = 0;
+        clnt = fid->clnt;
+        wst->size = p9_client_statsize(wst, clnt->dotu);
         P9_DPRINTK(P9_DEBUG_9P, ">>> TWSTAT fid %d\n", fid->fid);
         P9_DPRINTK(P9_DEBUG_9P,
                 "     sz=%x type=%x dev=%x qid=%x.%llx.%x\n"
@@ -1268,10 +1266,8 @@ int p9_client_wstat(struct p9_fid *fid, struct p9_wstat *wst)
                 wst->atime, wst->mtime, (unsigned long long)wst->length,
                 wst->name, wst->uid, wst->gid, wst->muid, wst->extension,
                 wst->n_uid, wst->n_gid, wst->n_muid);
-        err = 0;
-        clnt = fid->clnt;
 
-        req = p9_client_rpc(clnt, P9_TWSTAT, "dwS", fid->fid, 0, wst);
+        req = p9_client_rpc(clnt, P9_TWSTAT, "dwS", fid->fid, wst->size, wst);
         if (IS_ERR(req)) {
                 err = PTR_ERR(req);
                 goto error;
diff --git a/net/9p/trans_fd.c b/net/9p/trans_fd.c
index c613ed08a5ee..a2a1814c7a8d 100644
--- a/net/9p/trans_fd.c
+++ b/net/9p/trans_fd.c
@@ -213,8 +213,8 @@ static void p9_conn_cancel(struct p9_conn *m, int err)
         spin_unlock_irqrestore(&m->client->lock, flags);
 
         list_for_each_entry_safe(req, rtmp, &cancel_list, req_list) {
-                list_del(&req->req_list);
                 P9_DPRINTK(P9_DEBUG_ERROR, "call back req %p\n", req);
+                list_del(&req->req_list);
                 p9_client_cb(m->client, req);
         }
 }
@@ -336,7 +336,8 @@ static void p9_read_work(struct work_struct *work)
                         "mux %p pkt: size: %d bytes tag: %d\n", m, n, tag);
 
                 m->req = p9_tag_lookup(m->client, tag);
-                if (!m->req) {
+                if (!m->req || (m->req->status != REQ_STATUS_SENT &&
+                                        m->req->status != REQ_STATUS_FLSH)) {
                         P9_DPRINTK(P9_DEBUG_ERROR, "Unexpected packet tag %d\n",
                                                                  tag);
                         err = -EIO;
@@ -361,10 +362,11 @@ static void p9_read_work(struct work_struct *work)
         if ((m->req) && (m->rpos == m->rsize)) { /* packet is read in */
                 P9_DPRINTK(P9_DEBUG_TRANS, "got new packet\n");
                 spin_lock(&m->client->lock);
+                if (m->req->status != REQ_STATUS_ERROR)
+                        m->req->status = REQ_STATUS_RCVD;
                 list_del(&m->req->req_list);
                 spin_unlock(&m->client->lock);
                 p9_client_cb(m->client, m->req);
-
                 m->rbuf = NULL;
                 m->rpos = 0;
                 m->rsize = 0;
@@ -454,6 +456,7 @@ static void p9_write_work(struct work_struct *work)
                 req = list_entry(m->unsent_req_list.next, struct p9_req_t,
                                req_list);
                 req->status = REQ_STATUS_SENT;
+                P9_DPRINTK(P9_DEBUG_TRANS, "move req %p\n", req);
                 list_move_tail(&req->req_list, &m->req_list);
 
                 m->wbuf = req->tc->sdata;
@@ -683,12 +686,13 @@ static int p9_fd_cancel(struct p9_client *client, struct p9_req_t *req)
         P9_DPRINTK(P9_DEBUG_TRANS, "client %p req %p\n", client, req);
 
         spin_lock(&client->lock);
-        list_del(&req->req_list);
 
         if (req->status == REQ_STATUS_UNSENT) {
+                list_del(&req->req_list);
                 req->status = REQ_STATUS_FLSHD;
                 ret = 0;
-        }
+        } else if (req->status == REQ_STATUS_SENT)
+                req->status = REQ_STATUS_FLSH;
 
         spin_unlock(&client->lock);
 
diff --git a/net/9p/trans_rdma.c b/net/9p/trans_rdma.c
index 7fa0eb20b2f6..ac4990041ebb 100644
--- a/net/9p/trans_rdma.c
+++ b/net/9p/trans_rdma.c
@@ -295,6 +295,7 @@ handle_recv(struct p9_client *client, struct p9_trans_rdma *rdma,
                 goto err_out;
 
         req->rc = c->rc;
+        req->status = REQ_STATUS_RCVD;
         p9_client_cb(client, req);
 
         return;
diff --git a/net/9p/trans_virtio.c b/net/9p/trans_virtio.c
index 2d7781ec663b..bb8579a141a8 100644
--- a/net/9p/trans_virtio.c
+++ b/net/9p/trans_virtio.c
@@ -134,6 +134,7 @@ static void req_done(struct virtqueue *vq)
                 P9_DPRINTK(P9_DEBUG_TRANS, ": rc %p\n", rc);
                 P9_DPRINTK(P9_DEBUG_TRANS, ": lookup tag %d\n", rc->tag);
                 req = p9_tag_lookup(chan->client, rc->tag);
+                req->status = REQ_STATUS_RCVD;
                 p9_client_cb(chan->client, req);
         }
 }
diff --git a/net/Kconfig b/net/Kconfig
index ce77db4fcec8..c19f549c8e74 100644
--- a/net/Kconfig
+++ b/net/Kconfig
@@ -119,12 +119,6 @@ menuconfig NETFILTER
           <file:Documentation/Changes> under "iptables" for the location of
           these packages.
 
-          Make sure to say N to "Fast switching" below if you intend to say Y
-          here, as Fast switching currently bypasses netfilter.
-
-          Chances are that you should say Y here if you compile a kernel which
-          will run as a router and N for regular hosts. If unsure, say N.
-
 if NETFILTER
 
 config NETFILTER_DEBUG
diff --git a/net/atm/br2684.c b/net/atm/br2684.c
index 334fcd4a4ea4..3100a8940afc 100644
--- a/net/atm/br2684.c
+++ b/net/atm/br2684.c
@@ -549,6 +549,7 @@ static void br2684_setup(struct net_device *netdev)
         struct br2684_dev *brdev = BRPRIV(netdev);
 
         ether_setup(netdev);
+        brdev->net_dev = netdev;
 
         netdev->netdev_ops = &br2684_netdev_ops;
 
diff --git a/net/bluetooth/hci_conn.c b/net/bluetooth/hci_conn.c
index 1181db08d9de..fa47d5d84f5c 100644
--- a/net/bluetooth/hci_conn.c
+++ b/net/bluetooth/hci_conn.c
@@ -171,10 +171,8 @@ static void hci_conn_timeout(unsigned long arg)
         switch (conn->state) {
         case BT_CONNECT:
         case BT_CONNECT2:
-                if (conn->type == ACL_LINK)
+                if (conn->type == ACL_LINK && conn->out)
                         hci_acl_connect_cancel(conn);
-                else
-                        hci_acl_disconn(conn, 0x13);
                 break;
         case BT_CONFIG:
         case BT_CONNECTED:
@@ -215,6 +213,7 @@ struct hci_conn *hci_conn_add(struct hci_dev *hdev, int type, bdaddr_t *dst)
         conn->state = BT_OPEN;
 
         conn->power_save = 1;
+        conn->disc_timeout = HCI_DISCONN_TIMEOUT;
 
         switch (type) {
         case ACL_LINK:
@@ -247,6 +246,8 @@ struct hci_conn *hci_conn_add(struct hci_dev *hdev, int type, bdaddr_t *dst)
         if (hdev->notify)
                 hdev->notify(hdev, HCI_NOTIFY_CONN_ADD);
 
+        hci_conn_init_sysfs(conn);
+
         tasklet_enable(&hdev->tx_task);
 
         return conn;
@@ -289,6 +290,8 @@ int hci_conn_del(struct hci_conn *conn)
 
         hci_conn_del_sysfs(conn);
 
+        hci_dev_put(hdev);
+
         return 0;
 }
 
@@ -424,12 +427,9 @@ int hci_conn_security(struct hci_conn *conn, __u8 sec_level, __u8 auth_type)
         if (sec_level == BT_SECURITY_SDP)
                 return 1;
 
-        if (sec_level == BT_SECURITY_LOW) {
-                if (conn->ssp_mode > 0 && conn->hdev->ssp_mode > 0)
-                        return hci_conn_auth(conn, sec_level, auth_type);
-                else
-                        return 1;
-        }
+        if (sec_level == BT_SECURITY_LOW &&
+                                (!conn->ssp_mode || !conn->hdev->ssp_mode))
+                return 1;
 
         if (conn->link_mode & HCI_LM_ENCRYPT)
                 return hci_conn_auth(conn, sec_level, auth_type);
diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c
index 15f40ea8d544..184ba0a88ec0 100644
--- a/net/bluetooth/hci_event.c
+++ b/net/bluetooth/hci_event.c
@@ -883,6 +883,7 @@ static inline void hci_conn_complete_evt(struct hci_dev *hdev, struct sk_buff *s
                 if (conn->type == ACL_LINK) {
                         conn->state = BT_CONFIG;
                         hci_conn_hold(conn);
+                        conn->disc_timeout = HCI_DISCONN_TIMEOUT;
                 } else
                         conn->state = BT_CONNECTED;
 
@@ -1063,9 +1064,14 @@ static inline void hci_auth_complete_evt(struct hci_dev *hdev, struct sk_buff *s
                                 hci_proto_connect_cfm(conn, ev->status);
                                 hci_conn_put(conn);
                         }
-                } else
+                } else {
                         hci_auth_cfm(conn, ev->status);
 
+                        hci_conn_hold(conn);
+                        conn->disc_timeout = HCI_DISCONN_TIMEOUT;
+                        hci_conn_put(conn);
+                }
+
                 if (test_bit(HCI_CONN_ENCRYPT_PEND, &conn->pend)) {
                         if (!ev->status) {
                                 struct hci_cp_set_conn_encrypt cp;
@@ -1479,7 +1485,21 @@ static inline void hci_mode_change_evt(struct hci_dev *hdev, struct sk_buff *skb
 
 static inline void hci_pin_code_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
 {
+        struct hci_ev_pin_code_req *ev = (void *) skb->data;
+        struct hci_conn *conn;
+
         BT_DBG("%s", hdev->name);
+
+        hci_dev_lock(hdev);
+
+        conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
+        if (conn && conn->state == BT_CONNECTED) {
+                hci_conn_hold(conn);
+                conn->disc_timeout = HCI_PAIRING_TIMEOUT;
+                hci_conn_put(conn);
+        }
+
+        hci_dev_unlock(hdev);
 }
 
 static inline void hci_link_key_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
@@ -1489,7 +1509,21 @@ static inline void hci_link_key_request_evt(struct hci_dev *hdev, struct sk_buff
 
 static inline void hci_link_key_notify_evt(struct hci_dev *hdev, struct sk_buff *skb)
 {
+        struct hci_ev_link_key_notify *ev = (void *) skb->data;
+        struct hci_conn *conn;
+
         BT_DBG("%s", hdev->name);
+
+        hci_dev_lock(hdev);
+
+        conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
+        if (conn) {
+                hci_conn_hold(conn);
+                conn->disc_timeout = HCI_DISCONN_TIMEOUT;
+                hci_conn_put(conn);
+        }
+
+        hci_dev_unlock(hdev);
 }
 
 static inline void hci_clock_offset_evt(struct hci_dev *hdev, struct sk_buff *skb)
diff --git a/net/bluetooth/hci_sysfs.c b/net/bluetooth/hci_sysfs.c
index ed82796d4a0f..4cc3624bd22d 100644
--- a/net/bluetooth/hci_sysfs.c
+++ b/net/bluetooth/hci_sysfs.c
@@ -9,8 +9,7 @@
 struct class *bt_class = NULL;
 EXPORT_SYMBOL_GPL(bt_class);
 
-static struct workqueue_struct *btaddconn;
-static struct workqueue_struct *btdelconn;
+static struct workqueue_struct *bt_workq;
 
 static inline char *link_typetostr(int type)
 {
@@ -88,35 +87,20 @@ static struct device_type bt_link = {
 
 static void add_conn(struct work_struct *work)
 {
-        struct hci_conn *conn = container_of(work, struct hci_conn, work);
+        struct hci_conn *conn = container_of(work, struct hci_conn, work_add);
+        struct hci_dev *hdev = conn->hdev;
+
+        /* ensure previous del is complete */
+        flush_work(&conn->work_del);
 
-        flush_workqueue(btdelconn);
+        dev_set_name(&conn->dev, "%s:%d", hdev->name, conn->handle);
 
         if (device_add(&conn->dev) < 0) {
                 BT_ERR("Failed to register connection device");
                 return;
         }
-}
-
-void hci_conn_add_sysfs(struct hci_conn *conn)
-{
-        struct hci_dev *hdev = conn->hdev;
-
-        BT_DBG("conn %p", conn);
-
-        conn->dev.type = &bt_link;
-        conn->dev.class = bt_class;
-        conn->dev.parent = &hdev->dev;
-
-        dev_set_name(&conn->dev, "%s:%d", hdev->name, conn->handle);
-
-        dev_set_drvdata(&conn->dev, conn);
-
-        device_initialize(&conn->dev);
 
-        INIT_WORK(&conn->work, add_conn);
-
-        queue_work(btaddconn, &conn->work);
+        hci_dev_hold(hdev);
 }
 
 /*
@@ -131,9 +115,15 @@ static int __match_tty(struct device *dev, void *data)
 
 static void del_conn(struct work_struct *work)
 {
-        struct hci_conn *conn = container_of(work, struct hci_conn, work);
+        struct hci_conn *conn = container_of(work, struct hci_conn, work_del);
         struct hci_dev *hdev = conn->hdev;
 
+        /* ensure previous add is complete */
+        flush_work(&conn->work_add);
+
+        if (!device_is_registered(&conn->dev))
+                return;
+
         while (1) {
                 struct device *dev;
 
@@ -146,19 +136,40 @@ static void del_conn(struct work_struct *work)
 
         device_del(&conn->dev);
         put_device(&conn->dev);
+
         hci_dev_put(hdev);
 }
 
-void hci_conn_del_sysfs(struct hci_conn *conn)
+void hci_conn_init_sysfs(struct hci_conn *conn)
 {
+        struct hci_dev *hdev = conn->hdev;
+
         BT_DBG("conn %p", conn);
 
-        if (!device_is_registered(&conn->dev))
-                return;
+        conn->dev.type = &bt_link;
+        conn->dev.class = bt_class;
+        conn->dev.parent = &hdev->dev;
+
+        dev_set_drvdata(&conn->dev, conn);
+
+        device_initialize(&conn->dev);
+
+        INIT_WORK(&conn->work_add, add_conn);
+        INIT_WORK(&conn->work_del, del_conn);
+}
 
-        INIT_WORK(&conn->work, del_conn);
+void hci_conn_add_sysfs(struct hci_conn *conn)
+{
+        BT_DBG("conn %p", conn);
 
-        queue_work(btdelconn, &conn->work);
+        queue_work(bt_workq, &conn->work_add);
+}
+
+void hci_conn_del_sysfs(struct hci_conn *conn)
+{
+        BT_DBG("conn %p", conn);
+
+        queue_work(bt_workq, &conn->work_del);
 }
 
 static inline char *host_typetostr(int type)
@@ -435,20 +446,13 @@ void hci_unregister_sysfs(struct hci_dev *hdev)
 
 int __init bt_sysfs_init(void)
 {
-        btaddconn = create_singlethread_workqueue("btaddconn");
-        if (!btaddconn)
+        bt_workq = create_singlethread_workqueue("bluetooth");
+        if (!bt_workq)
                 return -ENOMEM;
 
-        btdelconn = create_singlethread_workqueue("btdelconn");
-        if (!btdelconn) {
-                destroy_workqueue(btaddconn);
-                return -ENOMEM;
-        }
-
         bt_class = class_create(THIS_MODULE, "bluetooth");
         if (IS_ERR(bt_class)) {
-                destroy_workqueue(btdelconn);
-                destroy_workqueue(btaddconn);
+                destroy_workqueue(bt_workq);
                 return PTR_ERR(bt_class);
         }
 
@@ -457,8 +461,7 @@ int __init bt_sysfs_init(void)
 
 void bt_sysfs_cleanup(void)
 {
-        destroy_workqueue(btaddconn);
-        destroy_workqueue(btdelconn);
+        destroy_workqueue(bt_workq);
 
         class_destroy(bt_class);
 }
diff --git a/net/bridge/br_netfilter.c b/net/bridge/br_netfilter.c
index 3953ac4214c8..e4a418fcb35b 100644
--- a/net/bridge/br_netfilter.c
+++ b/net/bridge/br_netfilter.c
@@ -788,15 +788,23 @@ static unsigned int br_nf_local_out(unsigned int hook, struct sk_buff *skb,
         return NF_STOLEN;
 }
 
+#if defined(CONFIG_NF_CONNTRACK_IPV4) || defined(CONFIG_NF_CONNTRACK_IPV4_MODULE)
 static int br_nf_dev_queue_xmit(struct sk_buff *skb)
 {
-        if (skb->protocol == htons(ETH_P_IP) &&
+        if (skb->nfct != NULL &&
+            (skb->protocol == htons(ETH_P_IP) || IS_VLAN_IP(skb)) &&
             skb->len > skb->dev->mtu &&
             !skb_is_gso(skb))
                 return ip_fragment(skb, br_dev_queue_push_xmit);
         else
                 return br_dev_queue_push_xmit(skb);
 }
+#else
+static int br_nf_dev_queue_xmit(struct sk_buff *skb)
+{
+        return br_dev_queue_push_xmit(skb);
+}
+#endif
 
 /* PF_BRIDGE/POST_ROUTING ********************************************/
 static unsigned int br_nf_post_routing(unsigned int hook, struct sk_buff *skb,
diff --git a/net/core/datagram.c b/net/core/datagram.c
index d0de644b378d..b01a76abe1d2 100644
--- a/net/core/datagram.c
+++ b/net/core/datagram.c
@@ -64,13 +64,25 @@ static inline int connection_based(struct sock *sk)
         return sk->sk_type == SOCK_SEQPACKET || sk->sk_type == SOCK_STREAM;
 }
 
+static int receiver_wake_function(wait_queue_t *wait, unsigned mode, int sync,
+                                  void *key)
+{
+        unsigned long bits = (unsigned long)key;
+
+        /*
+         * Avoid a wakeup if event not interesting for us
+         */
+        if (bits && !(bits & (POLLIN | POLLERR)))
+                return 0;
+        return autoremove_wake_function(wait, mode, sync, key);
+}
 /*
  * Wait for a packet..
  */
 static int wait_for_packet(struct sock *sk, int *err, long *timeo_p)
 {
         int error;
-        DEFINE_WAIT(wait);
+        DEFINE_WAIT_FUNC(wait, receiver_wake_function);
 
         prepare_to_wait_exclusive(sk->sk_sleep, &wait, TASK_INTERRUPTIBLE);
 
diff --git a/net/core/dev.c b/net/core/dev.c
index 308a7d0c277f..e2e9e4af3ace 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -1735,11 +1735,12 @@ u16 skb_tx_hash(const struct net_device *dev, const struct sk_buff *skb)
 {
         u32 hash;
 
-        if (skb_rx_queue_recorded(skb)) {
-                hash = skb_get_rx_queue(skb);
-        } else if (skb->sk && skb->sk->sk_hash) {
+        if (skb_rx_queue_recorded(skb))
+                return skb_get_rx_queue(skb) % dev->real_num_tx_queues;
+
+        if (skb->sk && skb->sk->sk_hash)
                 hash = skb->sk->sk_hash;
-        } else
+        else
                 hash = skb->protocol;
 
         hash = jhash_1word(hash, skb_tx_hashrnd);
diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index ce6356cd9f71..d152394b2611 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -502,7 +502,9 @@ int skb_recycle_check(struct sk_buff *skb, int skb_size)
         shinfo->gso_segs = 0;
         shinfo->gso_type = 0;
         shinfo->ip6_frag_id = 0;
+        shinfo->tx_flags.flags = 0;
         shinfo->frag_list = NULL;
+        memset(&shinfo->hwtstamps, 0, sizeof(shinfo->hwtstamps));
 
         memset(skb, 0, offsetof(struct sk_buff, tail));
         skb->data = skb->head + NET_SKB_PAD;
@@ -1365,9 +1367,8 @@ static void sock_spd_release(struct splice_pipe_desc *spd, unsigned int i)
 
 static inline struct page *linear_to_page(struct page *page, unsigned int *len,
                                           unsigned int *offset,
-                                          struct sk_buff *skb)
+                                          struct sk_buff *skb, struct sock *sk)
 {
-        struct sock *sk = skb->sk;
         struct page *p = sk->sk_sndmsg_page;
         unsigned int off;
 
@@ -1405,13 +1406,14 @@ new_page:
  */
 static inline int spd_fill_page(struct splice_pipe_desc *spd, struct page *page,
                                 unsigned int *len, unsigned int offset,
-                                struct sk_buff *skb, int linear)
+                                struct sk_buff *skb, int linear,
+                                struct sock *sk)
 {
         if (unlikely(spd->nr_pages == PIPE_BUFFERS))
                 return 1;
 
         if (linear) {
-                page = linear_to_page(page, len, &offset, skb);
+                page = linear_to_page(page, len, &offset, skb, sk);
                 if (!page)
                         return 1;
         } else
@@ -1442,7 +1444,8 @@ static inline void __segment_seek(struct page **page, unsigned int *poff,
 static inline int __splice_segment(struct page *page, unsigned int poff,
                                    unsigned int plen, unsigned int *off,
                                    unsigned int *len, struct sk_buff *skb,
-                                   struct splice_pipe_desc *spd, int linear)
+                                   struct splice_pipe_desc *spd, int linear,
+                                   struct sock *sk)
 {
         if (!*len)
                 return 1;
@@ -1465,7 +1468,7 @@ static inline int __splice_segment(struct page *page, unsigned int poff,
                 /* the linear region may spread across several pages  */
                 flen = min_t(unsigned int, flen, PAGE_SIZE - poff);
 
-                if (spd_fill_page(spd, page, &flen, poff, skb, linear))
+                if (spd_fill_page(spd, page, &flen, poff, skb, linear, sk))
                         return 1;
 
                 __segment_seek(&page, &poff, &plen, flen);
@@ -1481,8 +1484,8 @@ static inline int __splice_segment(struct page *page, unsigned int poff,
  * pipe is full or if we already spliced the requested length.
  */
 static int __skb_splice_bits(struct sk_buff *skb, unsigned int *offset,
-                      unsigned int *len,
-                      struct splice_pipe_desc *spd)
+                             unsigned int *len, struct splice_pipe_desc *spd,
+                             struct sock *sk)
 {
         int seg;
 
@@ -1492,7 +1495,7 @@ static int __skb_splice_bits(struct sk_buff *skb, unsigned int *offset,
         if (__splice_segment(virt_to_page(skb->data),
                              (unsigned long) skb->data & (PAGE_SIZE - 1),
                              skb_headlen(skb),
-                             offset, len, skb, spd, 1))
+                             offset, len, skb, spd, 1, sk))
                 return 1;
 
         /*
@@ -1502,7 +1505,7 @@ static int __skb_splice_bits(struct sk_buff *skb, unsigned int *offset,
                 const skb_frag_t *f = &skb_shinfo(skb)->frags[seg];
 
                 if (__splice_segment(f->page, f->page_offset, f->size,
-                                     offset, len, skb, spd, 0))
+                                     offset, len, skb, spd, 0, sk))
                         return 1;
         }
 
@@ -1528,12 +1531,13 @@ int skb_splice_bits(struct sk_buff *skb, unsigned int offset,
                 .ops = &sock_pipe_buf_ops,
                 .spd_release = sock_spd_release,
         };
+        struct sock *sk = skb->sk;
 
         /*
          * __skb_splice_bits() only fails if the output has no room left,
          * so no point in going over the frag_list for the error case.
          */
-        if (__skb_splice_bits(skb, &offset, &tlen, &spd))
+        if (__skb_splice_bits(skb, &offset, &tlen, &spd, sk))
                 goto done;
         else if (!tlen)
                 goto done;
@@ -1545,14 +1549,13 @@ int skb_splice_bits(struct sk_buff *skb, unsigned int offset,
                 struct sk_buff *list = skb_shinfo(skb)->frag_list;
 
                 for (; list && tlen; list = list->next) {
-                        if (__skb_splice_bits(list, &offset, &tlen, &spd))
+                        if (__skb_splice_bits(list, &offset, &tlen, &spd, sk))
                                 break;
                 }
         }
 
 done:
         if (spd.nr_pages) {
-                struct sock *sk = skb->sk;
                 int ret;
 
                 /*
diff --git a/net/ipv4/Kconfig b/net/ipv4/Kconfig
index b2cf91e4ccaa..9d26a3da37e5 100644
--- a/net/ipv4/Kconfig
+++ b/net/ipv4/Kconfig
@@ -407,7 +407,7 @@ config INET_XFRM_MODE_BEET
           If unsure, say Y.
 
 config INET_LRO
-        tristate "Large Receive Offload (ipv4/tcp)"
+        bool "Large Receive Offload (ipv4/tcp)"
 
         ---help---
           Support for Large Receive Offload (ipv4/tcp).
diff --git a/net/ipv4/netfilter/arp_tables.c b/net/ipv4/netfilter/arp_tables.c
index 5ba533d234db..831fe1879dc0 100644
--- a/net/ipv4/netfilter/arp_tables.c
+++ b/net/ipv4/netfilter/arp_tables.c
@@ -253,9 +253,9 @@ unsigned int arpt_do_table(struct sk_buff *skb,
         indev = in ? in->name : nulldevname;
         outdev = out ? out->name : nulldevname;
 
-        rcu_read_lock_bh();
-        private = rcu_dereference(table->private);
-        table_base = rcu_dereference(private->entries[smp_processor_id()]);
+        xt_info_rdlock_bh();
+        private = table->private;
+        table_base = private->entries[smp_processor_id()];
 
         e = get_entry(table_base, private->hook_entry[hook]);
         back = get_entry(table_base, private->underflow[hook]);
@@ -273,6 +273,7 @@ unsigned int arpt_do_table(struct sk_buff *skb,
 
                         hdr_len = sizeof(*arp) + (2 * sizeof(struct in_addr)) +
                                 (2 * skb->dev->addr_len);
+
                         ADD_COUNTER(e->counters, hdr_len, 1);
 
                         t = arpt_get_target(e);
@@ -328,8 +329,7 @@ unsigned int arpt_do_table(struct sk_buff *skb,
                         e = (void *)e + e->next_offset;
                 }
         } while (!hotdrop);
-
-        rcu_read_unlock_bh();
+        xt_info_rdunlock_bh();
 
         if (hotdrop)
                 return NF_DROP;
@@ -711,9 +711,12 @@ static void get_counters(const struct xt_table_info *t,
         /* Instead of clearing (by a previous call to memset())
          * the counters and using adds, we set the counters
          * with data used by 'current' CPU
-         * We dont care about preemption here.
+         *
+         * Bottom half has to be disabled to prevent deadlock
+         * if new softirq were to run and call ipt_do_table
          */
-        curcpu = raw_smp_processor_id();
+        local_bh_disable();
+        curcpu = smp_processor_id();
 
         i = 0;
         ARPT_ENTRY_ITERATE(t->entries[curcpu],
@@ -726,73 +729,22 @@ static void get_counters(const struct xt_table_info *t,
                 if (cpu == curcpu)
                         continue;
                 i = 0;
+                xt_info_wrlock(cpu);
                 ARPT_ENTRY_ITERATE(t->entries[cpu],
                                    t->size,
                                    add_entry_to_counter,
                                    counters,
                                    &i);
+                xt_info_wrunlock(cpu);
         }
-}
-
-
-/* We're lazy, and add to the first CPU; overflow works its fey magic
- * and everything is OK. */
-static int
-add_counter_to_entry(struct arpt_entry *e,
-                     const struct xt_counters addme[],
-                     unsigned int *i)
-{
-        ADD_COUNTER(e->counters, addme[*i].bcnt, addme[*i].pcnt);
-
-        (*i)++;
-        return 0;
-}
-
-/* Take values from counters and add them back onto the current cpu */
-static void put_counters(struct xt_table_info *t,
-                         const struct xt_counters counters[])
-{
-        unsigned int i, cpu;
-
-        local_bh_disable();
-        cpu = smp_processor_id();
-        i = 0;
-        ARPT_ENTRY_ITERATE(t->entries[cpu],
-                          t->size,
-                          add_counter_to_entry,
-                          counters,
-                          &i);
         local_bh_enable();
 }
 
-static inline int
-zero_entry_counter(struct arpt_entry *e, void *arg)
-{
-        e->counters.bcnt = 0;
-        e->counters.pcnt = 0;
-        return 0;
-}
-
-static void
-clone_counters(struct xt_table_info *newinfo, const struct xt_table_info *info)
-{
-        unsigned int cpu;
-        const void *loc_cpu_entry = info->entries[raw_smp_processor_id()];
-
-        memcpy(newinfo, info, offsetof(struct xt_table_info, entries));
-        for_each_possible_cpu(cpu) {
-                memcpy(newinfo->entries[cpu], loc_cpu_entry, info->size);
-                ARPT_ENTRY_ITERATE(newinfo->entries[cpu], newinfo->size,
-                                  zero_entry_counter, NULL);
-        }
-}
-
 static struct xt_counters *alloc_counters(struct xt_table *table)
 {
         unsigned int countersize;
         struct xt_counters *counters;
         struct xt_table_info *private = table->private;
-        struct xt_table_info *info;
 
         /* We need atomic snapshot of counters: rest doesn't change
          * (other than comefrom, which userspace doesn't care
@@ -802,30 +754,11 @@ static struct xt_counters *alloc_counters(struct xt_table *table)
         counters = vmalloc_node(countersize, numa_node_id());
 
         if (counters == NULL)
-                goto nomem;
-
-        info = xt_alloc_table_info(private->size);
-        if (!info)
-                goto free_counters;
-
-        clone_counters(info, private);
-
-        mutex_lock(&table->lock);
-        xt_table_entry_swap_rcu(private, info);
-        synchronize_net();      /* Wait until smoke has cleared */
+                return ERR_PTR(-ENOMEM);
 
-        get_counters(info, counters);
-        put_counters(private, counters);
-        mutex_unlock(&table->lock);
-
-        xt_free_table_info(info);
+        get_counters(private, counters);
 
         return counters;
-
- free_counters:
-        vfree(counters);
- nomem:
-        return ERR_PTR(-ENOMEM);
 }
 
 static int copy_entries_to_user(unsigned int total_size,
@@ -1094,8 +1027,9 @@ static int __do_replace(struct net *net, const char *name,
             (newinfo->number <= oldinfo->initial_entries))
                 module_put(t->me);
 
-        /* Get the old counters. */
+        /* Get the old counters, and synchronize with replace */
         get_counters(oldinfo, counters);
+
         /* Decrease module usage counts and free resource */
         loc_cpu_old_entry = oldinfo->entries[raw_smp_processor_id()];
         ARPT_ENTRY_ITERATE(loc_cpu_old_entry, oldinfo->size, cleanup_entry,
@@ -1165,10 +1099,23 @@ static int do_replace(struct net *net, void __user *user, unsigned int len)
         return ret;
 }
 
+/* We're lazy, and add to the first CPU; overflow works its fey magic
+ * and everything is OK. */
+static int
+add_counter_to_entry(struct arpt_entry *e,
+                     const struct xt_counters addme[],
+                     unsigned int *i)
+{
+        ADD_COUNTER(e->counters, addme[*i].bcnt, addme[*i].pcnt);
+
+        (*i)++;
+        return 0;
+}
+
 static int do_add_counters(struct net *net, void __user *user, unsigned int len,
                            int compat)
 {
-        unsigned int i;
+        unsigned int i, curcpu;
         struct xt_counters_info tmp;
         struct xt_counters *paddc;
         unsigned int num_counters;
@@ -1224,26 +1171,26 @@ static int do_add_counters(struct net *net, void __user *user, unsigned int len,
                 goto free;
         }
 
-        mutex_lock(&t->lock);
+        local_bh_disable();
         private = t->private;
         if (private->number != num_counters) {
                 ret = -EINVAL;
                 goto unlock_up_free;
         }
 
-        preempt_disable();
         i = 0;
         /* Choose the copy that is on our node */
-        loc_cpu_entry = private->entries[smp_processor_id()];
+        curcpu = smp_processor_id();
+        loc_cpu_entry = private->entries[curcpu];
+        xt_info_wrlock(curcpu);
         ARPT_ENTRY_ITERATE(loc_cpu_entry,
                            private->size,
                            add_counter_to_entry,
                            paddc,
                            &i);
-        preempt_enable();
+        xt_info_wrunlock(curcpu);
  unlock_up_free:
-        mutex_unlock(&t->lock);
-
+        local_bh_enable();
         xt_table_unlock(t);
         module_put(t->me);
  free:
diff --git a/net/ipv4/netfilter/ip_tables.c b/net/ipv4/netfilter/ip_tables.c
index 810c0b62c7d4..2ec8d7290c40 100644
--- a/net/ipv4/netfilter/ip_tables.c
+++ b/net/ipv4/netfilter/ip_tables.c
@@ -338,10 +338,9 @@ ipt_do_table(struct sk_buff *skb,
         tgpar.hooknum = hook;
 
         IP_NF_ASSERT(table->valid_hooks & (1 << hook));
-
-        rcu_read_lock_bh();
-        private = rcu_dereference(table->private);
-        table_base = rcu_dereference(private->entries[smp_processor_id()]);
+        xt_info_rdlock_bh();
+        private = table->private;
+        table_base = private->entries[smp_processor_id()];
 
         e = get_entry(table_base, private->hook_entry[hook]);
 
@@ -436,8 +435,7 @@ ipt_do_table(struct sk_buff *skb,
                         e = (void *)e + e->next_offset;
                 }
         } while (!hotdrop);
-
-        rcu_read_unlock_bh();
+        xt_info_rdunlock_bh();
 
 #ifdef DEBUG_ALLOW_ALL
         return NF_ACCEPT;
@@ -896,10 +894,13 @@ get_counters(const struct xt_table_info *t,
 
         /* Instead of clearing (by a previous call to memset())
          * the counters and using adds, we set the counters
-         * with data used by 'current' CPU
-         * We dont care about preemption here.
+         * with data used by 'current' CPU.
+         *
+         * Bottom half has to be disabled to prevent deadlock
+         * if new softirq were to run and call ipt_do_table
          */
-        curcpu = raw_smp_processor_id();
+        local_bh_disable();
+        curcpu = smp_processor_id();
 
         i = 0;
         IPT_ENTRY_ITERATE(t->entries[curcpu],
@@ -912,74 +913,22 @@ get_counters(const struct xt_table_info *t,
                 if (cpu == curcpu)
                         continue;
                 i = 0;
+                xt_info_wrlock(cpu);
                 IPT_ENTRY_ITERATE(t->entries[cpu],
                                   t->size,
                                   add_entry_to_counter,
                                   counters,
                                   &i);
+                xt_info_wrunlock(cpu);
         }
-
-}
-
-/* We're lazy, and add to the first CPU; overflow works its fey magic
- * and everything is OK. */
-static int
-add_counter_to_entry(struct ipt_entry *e,
-                     const struct xt_counters addme[],
-                     unsigned int *i)
-{
-        ADD_COUNTER(e->counters, addme[*i].bcnt, addme[*i].pcnt);
-
-        (*i)++;
-        return 0;
-}
-
-/* Take values from counters and add them back onto the current cpu */
-static void put_counters(struct xt_table_info *t,
-                         const struct xt_counters counters[])
-{
-        unsigned int i, cpu;
-
-        local_bh_disable();
-        cpu = smp_processor_id();
-        i = 0;
-        IPT_ENTRY_ITERATE(t->entries[cpu],
-                          t->size,
-                          add_counter_to_entry,
-                          counters,
-                          &i);
         local_bh_enable();
 }
 
-
-static inline int
-zero_entry_counter(struct ipt_entry *e, void *arg)
-{
-        e->counters.bcnt = 0;
-        e->counters.pcnt = 0;
-        return 0;
-}
-
-static void
-clone_counters(struct xt_table_info *newinfo, const struct xt_table_info *info)
-{
-        unsigned int cpu;
-        const void *loc_cpu_entry = info->entries[raw_smp_processor_id()];
-
-        memcpy(newinfo, info, offsetof(struct xt_table_info, entries));
-        for_each_possible_cpu(cpu) {
-                memcpy(newinfo->entries[cpu], loc_cpu_entry, info->size);
-                IPT_ENTRY_ITERATE(newinfo->entries[cpu], newinfo->size,
-                                  zero_entry_counter, NULL);
-        }
-}
-
 static struct xt_counters * alloc_counters(struct xt_table *table)
 {
         unsigned int countersize;
         struct xt_counters *counters;
         struct xt_table_info *private = table->private;
-        struct xt_table_info *info;
 
         /* We need atomic snapshot of counters: rest doesn't change
            (other than comefrom, which userspace doesn't care
@@ -988,30 +937,11 @@ static struct xt_counters * alloc_counters(struct xt_table *table)
         counters = vmalloc_node(countersize, numa_node_id());
 
         if (counters == NULL)
-                goto nomem;
+                return ERR_PTR(-ENOMEM);
 
-        info = xt_alloc_table_info(private->size);
-        if (!info)
-                goto free_counters;
-
-        clone_counters(info, private);
-
-        mutex_lock(&table->lock);
-        xt_table_entry_swap_rcu(private, info);
-        synchronize_net();      /* Wait until smoke has cleared */
-
-        get_counters(info, counters);
-        put_counters(private, counters);
-        mutex_unlock(&table->lock);
-
-        xt_free_table_info(info);
+        get_counters(private, counters);
 
         return counters;
-
- free_counters:
-        vfree(counters);
- nomem:
-        return ERR_PTR(-ENOMEM);
 }
 
 static int
@@ -1306,8 +1236,9 @@ __do_replace(struct net *net, const char *name, unsigned int valid_hooks,
             (newinfo->number <= oldinfo->initial_entries))
                 module_put(t->me);
 
-        /* Get the old counters. */
+        /* Get the old counters, and synchronize with replace */
         get_counters(oldinfo, counters);
+
         /* Decrease module usage counts and free resource */
         loc_cpu_old_entry = oldinfo->entries[raw_smp_processor_id()];
         IPT_ENTRY_ITERATE(loc_cpu_old_entry, oldinfo->size, cleanup_entry,
@@ -1377,11 +1308,23 @@ do_replace(struct net *net, void __user *user, unsigned int len)
         return ret;
 }
 
+/* We're lazy, and add to the first CPU; overflow works its fey magic
+ * and everything is OK. */
+static int
+add_counter_to_entry(struct ipt_entry *e,
+                     const struct xt_counters addme[],
+                     unsigned int *i)
+{
+        ADD_COUNTER(e->counters, addme[*i].bcnt, addme[*i].pcnt);
+
+        (*i)++;
+        return 0;
+}
 
 static int
 do_add_counters(struct net *net, void __user *user, unsigned int len, int compat)
 {
-        unsigned int i;
+        unsigned int i, curcpu;
         struct xt_counters_info tmp;
         struct xt_counters *paddc;
         unsigned int num_counters;
@@ -1437,25 +1380,26 @@ do_add_counters(struct net *net, void __user *user, unsigned int len, int compat
                 goto free;
         }
 
-        mutex_lock(&t->lock);
+        local_bh_disable();
         private = t->private;
         if (private->number != num_counters) {
                 ret = -EINVAL;
                 goto unlock_up_free;
         }
 
-        preempt_disable();
         i = 0;
         /* Choose the copy that is on our node */
-        loc_cpu_entry = private->entries[raw_smp_processor_id()];
+        curcpu = smp_processor_id();
+        loc_cpu_entry = private->entries[curcpu];
+        xt_info_wrlock(curcpu);
         IPT_ENTRY_ITERATE(loc_cpu_entry,
                           private->size,
                           add_counter_to_entry,
                           paddc,
                           &i);
-        preempt_enable();
+        xt_info_wrunlock(curcpu);
  unlock_up_free:
-        mutex_unlock(&t->lock);
+        local_bh_enable();
         xt_table_unlock(t);
         module_put(t->me);
  free:
diff --git a/net/ipv4/route.c b/net/ipv4/route.c
index c40debe51b38..c4c60e9f068a 100644
--- a/net/ipv4/route.c
+++ b/net/ipv4/route.c
@@ -3397,7 +3397,7 @@ int __init ip_rt_init(void)
                                         0,
                                         &rt_hash_log,
                                         &rt_hash_mask,
-                                        0);
+                                        rhash_entries ? 0 : 512 * 1024);
         memset(rt_hash_table, 0, (rt_hash_mask + 1) * sizeof(struct rt_hash_bucket));
         rt_hash_lock_init();
 
diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
index c96a6bb25430..eec3e6f9956c 100644
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -597,16 +597,6 @@ static void tcp_event_data_recv(struct sock *sk, struct sk_buff *skb)
                 tcp_grow_window(sk, skb);
 }
 
-static u32 tcp_rto_min(struct sock *sk)
-{
-        struct dst_entry *dst = __sk_dst_get(sk);
-        u32 rto_min = TCP_RTO_MIN;
-
-        if (dst && dst_metric_locked(dst, RTAX_RTO_MIN))
-                rto_min = dst_metric_rtt(dst, RTAX_RTO_MIN);
-        return rto_min;
-}
-
 /* Called to compute a smoothed rtt estimate. The data fed to this
  * routine either comes from timestamps, or from segments that were
  * known _not_ to have been retransmitted [see Karn/Partridge
diff --git a/net/ipv6/netfilter/ip6_tables.c b/net/ipv6/netfilter/ip6_tables.c
index 800ae8542471..219e165aea10 100644
--- a/net/ipv6/netfilter/ip6_tables.c
+++ b/net/ipv6/netfilter/ip6_tables.c
@@ -365,9 +365,9 @@ ip6t_do_table(struct sk_buff *skb,
 
         IP_NF_ASSERT(table->valid_hooks & (1 << hook));
 
-        rcu_read_lock_bh();
-        private = rcu_dereference(table->private);
-        table_base = rcu_dereference(private->entries[smp_processor_id()]);
+        xt_info_rdlock_bh();
+        private = table->private;
+        table_base = private->entries[smp_processor_id()];
 
         e = get_entry(table_base, private->hook_entry[hook]);
 
@@ -466,7 +466,7 @@ ip6t_do_table(struct sk_buff *skb,
 #ifdef CONFIG_NETFILTER_DEBUG
         ((struct ip6t_entry *)table_base)->comefrom = NETFILTER_LINK_POISON;
 #endif
-        rcu_read_unlock_bh();
+        xt_info_rdunlock_bh();
 
 #ifdef DEBUG_ALLOW_ALL
         return NF_ACCEPT;
@@ -926,9 +926,12 @@ get_counters(const struct xt_table_info *t,
         /* Instead of clearing (by a previous call to memset())
          * the counters and using adds, we set the counters
          * with data used by 'current' CPU
-         * We dont care about preemption here.
+         *
+         * Bottom half has to be disabled to prevent deadlock
+         * if new softirq were to run and call ipt_do_table
          */
-        curcpu = raw_smp_processor_id();
+        local_bh_disable();
+        curcpu = smp_processor_id();
 
         i = 0;
         IP6T_ENTRY_ITERATE(t->entries[curcpu],
@@ -941,72 +944,22 @@ get_counters(const struct xt_table_info *t,
                 if (cpu == curcpu)
                         continue;
                 i = 0;
+                xt_info_wrlock(cpu);
                 IP6T_ENTRY_ITERATE(t->entries[cpu],
                                   t->size,
                                   add_entry_to_counter,
                                   counters,
                                   &i);
+                xt_info_wrunlock(cpu);
         }
-}
-
-/* We're lazy, and add to the first CPU; overflow works its fey magic
- * and everything is OK. */
-static int
-add_counter_to_entry(struct ip6t_entry *e,
-                     const struct xt_counters addme[],
-                     unsigned int *i)
-{
-        ADD_COUNTER(e->counters, addme[*i].bcnt, addme[*i].pcnt);
-
-        (*i)++;
-        return 0;
-}
-
-/* Take values from counters and add them back onto the current cpu */
-static void put_counters(struct xt_table_info *t,
-                         const struct xt_counters counters[])
-{
-        unsigned int i, cpu;
-
-        local_bh_disable();
-        cpu = smp_processor_id();
-        i = 0;
-        IP6T_ENTRY_ITERATE(t->entries[cpu],
-                           t->size,
-                           add_counter_to_entry,
-                           counters,
-                           &i);
         local_bh_enable();
 }
 
-static inline int
-zero_entry_counter(struct ip6t_entry *e, void *arg)
-{
-        e->counters.bcnt = 0;
-        e->counters.pcnt = 0;
-        return 0;
-}
-
-static void
-clone_counters(struct xt_table_info *newinfo, const struct xt_table_info *info)
-{
-        unsigned int cpu;
-        const void *loc_cpu_entry = info->entries[raw_smp_processor_id()];
-
-        memcpy(newinfo, info, offsetof(struct xt_table_info, entries));
-        for_each_possible_cpu(cpu) {
-                memcpy(newinfo->entries[cpu], loc_cpu_entry, info->size);
-                IP6T_ENTRY_ITERATE(newinfo->entries[cpu], newinfo->size,
-                                   zero_entry_counter, NULL);
-        }
-}
-
 static struct xt_counters *alloc_counters(struct xt_table *table)
 {
         unsigned int countersize;
         struct xt_counters *counters;
         struct xt_table_info *private = table->private;
-        struct xt_table_info *info;
 
         /* We need atomic snapshot of counters: rest doesn't change
            (other than comefrom, which userspace doesn't care
@@ -1015,30 +968,11 @@ static struct xt_counters *alloc_counters(struct xt_table *table)
         counters = vmalloc_node(countersize, numa_node_id());
 
         if (counters == NULL)
-                goto nomem;
+                return ERR_PTR(-ENOMEM);
 
-        info = xt_alloc_table_info(private->size);
-        if (!info)
-                goto free_counters;
-
-        clone_counters(info, private);
-
-        mutex_lock(&table->lock);
-        xt_table_entry_swap_rcu(private, info);
-        synchronize_net();      /* Wait until smoke has cleared */
-
-        get_counters(info, counters);
-        put_counters(private, counters);
-        mutex_unlock(&table->lock);
-
-        xt_free_table_info(info);
+        get_counters(private, counters);
 
         return counters;
-
- free_counters:
-        vfree(counters);
- nomem:
-        return ERR_PTR(-ENOMEM);
 }
 
 static int
@@ -1334,8 +1268,9 @@ __do_replace(struct net *net, const char *name, unsigned int valid_hooks,
             (newinfo->number <= oldinfo->initial_entries))
                 module_put(t->me);
 
-        /* Get the old counters. */
+        /* Get the old counters, and synchronize with replace */
         get_counters(oldinfo, counters);
+
         /* Decrease module usage counts and free resource */
         loc_cpu_old_entry = oldinfo->entries[raw_smp_processor_id()];
         IP6T_ENTRY_ITERATE(loc_cpu_old_entry, oldinfo->size, cleanup_entry,
@@ -1405,11 +1340,24 @@ do_replace(struct net *net, void __user *user, unsigned int len)
         return ret;
 }
 
+/* We're lazy, and add to the first CPU; overflow works its fey magic
+ * and everything is OK. */
+static int
+add_counter_to_entry(struct ip6t_entry *e,
+                     const struct xt_counters addme[],
+                     unsigned int *i)
+{
+        ADD_COUNTER(e->counters, addme[*i].bcnt, addme[*i].pcnt);
+
+        (*i)++;
+        return 0;
+}
+
 static int
 do_add_counters(struct net *net, void __user *user, unsigned int len,
                 int compat)
 {
-        unsigned int i;
+        unsigned int i, curcpu;
         struct xt_counters_info tmp;
         struct xt_counters *paddc;
         unsigned int num_counters;
@@ -1465,25 +1413,28 @@ do_add_counters(struct net *net, void __user *user, unsigned int len,
                 goto free;
         }
 
-        mutex_lock(&t->lock);
+
+        local_bh_disable();
         private = t->private;
         if (private->number != num_counters) {
                 ret = -EINVAL;
                 goto unlock_up_free;
         }
 
-        preempt_disable();
         i = 0;
         /* Choose the copy that is on our node */
-        loc_cpu_entry = private->entries[raw_smp_processor_id()];
+        curcpu = smp_processor_id();
+        xt_info_wrlock(curcpu);
+        loc_cpu_entry = private->entries[curcpu];
         IP6T_ENTRY_ITERATE(loc_cpu_entry,
                           private->size,
                           add_counter_to_entry,
                           paddc,
                           &i);
-        preempt_enable();
+        xt_info_wrunlock(curcpu);
+
  unlock_up_free:
-        mutex_unlock(&t->lock);
+        local_bh_enable();
         xt_table_unlock(t);
         module_put(t->me);
  free:
diff --git a/net/ipv6/netfilter/ip6t_ipv6header.c b/net/ipv6/netfilter/ip6t_ipv6header.c
index 14e6724d5672..91490ad9302c 100644
--- a/net/ipv6/netfilter/ip6t_ipv6header.c
+++ b/net/ipv6/netfilter/ip6t_ipv6header.c
@@ -50,14 +50,14 @@ ipv6header_mt6(const struct sk_buff *skb, const struct xt_match_param *par)
                 struct ipv6_opt_hdr _hdr;
                 int hdrlen;
 
-                /* Is there enough space for the next ext header? */
-                if (len < (int)sizeof(struct ipv6_opt_hdr))
-                        return false;
                 /* No more exthdr -> evaluate */
                 if (nexthdr == NEXTHDR_NONE) {
                         temp |= MASK_NONE;
                         break;
                 }
+                /* Is there enough space for the next ext header? */
+                if (len < (int)sizeof(struct ipv6_opt_hdr))
+                        return false;
                 /* ESP -> evaluate */
                 if (nexthdr == NEXTHDR_ESP) {
                         temp |= MASK_ESP;
diff --git a/net/mac80211/main.c b/net/mac80211/main.c
index fbcbed6cad01..14134193cd17 100644
--- a/net/mac80211/main.c
+++ b/net/mac80211/main.c
@@ -757,6 +757,7 @@ struct ieee80211_hw *ieee80211_alloc_hw(size_t priv_data_len,
         local->hw.conf.long_frame_max_tx_count = 4;
         local->hw.conf.short_frame_max_tx_count = 7;
         local->hw.conf.radio_enabled = true;
+        local->user_power_level = -1;
 
         INIT_LIST_HEAD(&local->interfaces);
         mutex_init(&local->iflist_mtx);
@@ -909,6 +910,13 @@ int ieee80211_register_hw(struct ieee80211_hw *hw)
         if (result < 0)
                 goto fail_sta_info;
 
+        result = ieee80211_wep_init(local);
+        if (result < 0) {
+                printk(KERN_DEBUG "%s: Failed to initialize wep: %d\n",
+                       wiphy_name(local->hw.wiphy), result);
+                goto fail_wep;
+        }
+
         rtnl_lock();
         result = dev_alloc_name(local->mdev, local->mdev->name);
         if (result < 0)
@@ -930,14 +938,6 @@ int ieee80211_register_hw(struct ieee80211_hw *hw)
                 goto fail_rate;
         }
 
-        result = ieee80211_wep_init(local);
-
-        if (result < 0) {
-                printk(KERN_DEBUG "%s: Failed to initialize wep: %d\n",
-                       wiphy_name(local->hw.wiphy), result);
-                goto fail_wep;
-        }
-
         /* add one default STA interface if supported */
         if (local->hw.wiphy->interface_modes & BIT(NL80211_IFTYPE_STATION)) {
                 result = ieee80211_if_add(local, "wlan%d", NULL,
@@ -967,13 +967,13 @@ int ieee80211_register_hw(struct ieee80211_hw *hw)
 
         return 0;
 
-fail_wep:
-        rate_control_deinitialize(local);
 fail_rate:
         unregister_netdevice(local->mdev);
         local->mdev = NULL;
 fail_dev:
         rtnl_unlock();
+        ieee80211_wep_free(local);
+fail_wep:
         sta_info_stop(local);
 fail_sta_info:
         debugfs_hw_del(local);
diff --git a/net/mac80211/rc80211_minstrel.c b/net/mac80211/rc80211_minstrel.c
index 3824990d340b..d9233ec50610 100644
--- a/net/mac80211/rc80211_minstrel.c
+++ b/net/mac80211/rc80211_minstrel.c
@@ -476,8 +476,8 @@ minstrel_alloc_sta(void *priv, struct ieee80211_sta *sta, gfp_t gfp)
                 return NULL;
 
         for (i = 0; i < IEEE80211_NUM_BANDS; i++) {
-                sband = hw->wiphy->bands[hw->conf.channel->band];
-                if (sband->n_bitrates > max_rates)
+                sband = hw->wiphy->bands[i];
+                if (sband && sband->n_bitrates > max_rates)
                         max_rates = sband->n_bitrates;
         }
 
diff --git a/net/mac80211/rc80211_pid_algo.c b/net/mac80211/rc80211_pid_algo.c
index b16801cde06f..8bef9a1262ff 100644
--- a/net/mac80211/rc80211_pid_algo.c
+++ b/net/mac80211/rc80211_pid_algo.c
@@ -317,13 +317,44 @@ rate_control_pid_rate_init(void *priv, struct ieee80211_supported_band *sband,
                            struct ieee80211_sta *sta, void *priv_sta)
 {
         struct rc_pid_sta_info *spinfo = priv_sta;
+        struct rc_pid_info *pinfo = priv;
+        struct rc_pid_rateinfo *rinfo = pinfo->rinfo;
         struct sta_info *si;
+        int i, j, tmp;
+        bool s;
 
         /* TODO: This routine should consider using RSSI from previous packets
          * as we need to have IEEE 802.1X auth succeed immediately after assoc..
          * Until that method is implemented, we will use the lowest supported
          * rate as a workaround. */
 
+        /* Sort the rates. This is optimized for the most common case (i.e.
+         * almost-sorted CCK+OFDM rates). Kind of bubble-sort with reversed
+         * mapping too. */
+        for (i = 0; i < sband->n_bitrates; i++) {
+                rinfo[i].index = i;
+                rinfo[i].rev_index = i;
+                if (RC_PID_FAST_START)
+                        rinfo[i].diff = 0;
+                else
+                        rinfo[i].diff = i * pinfo->norm_offset;
+        }
+        for (i = 1; i < sband->n_bitrates; i++) {
+                s = 0;
+                for (j = 0; j < sband->n_bitrates - i; j++)
+                        if (unlikely(sband->bitrates[rinfo[j].index].bitrate >
+                                     sband->bitrates[rinfo[j + 1].index].bitrate)) {
+                                tmp = rinfo[j].index;
+                                rinfo[j].index = rinfo[j + 1].index;
+                                rinfo[j + 1].index = tmp;
+                                rinfo[rinfo[j].index].rev_index = j;
+                                rinfo[rinfo[j + 1].index].rev_index = j + 1;
+                                s = 1;
+                        }
+                if (!s)
+                        break;
+        }
+
         spinfo->txrate_idx = rate_lowest_index(sband, sta);
         /* HACK */
         si = container_of(sta, struct sta_info, sta);
@@ -336,21 +367,22 @@ static void *rate_control_pid_alloc(struct ieee80211_hw *hw,
         struct rc_pid_info *pinfo;
         struct rc_pid_rateinfo *rinfo;
         struct ieee80211_supported_band *sband;
-        int i, j, tmp;
-        bool s;
+        int i, max_rates = 0;
 #ifdef CONFIG_MAC80211_DEBUGFS
         struct rc_pid_debugfs_entries *de;
 #endif
 
-        sband = hw->wiphy->bands[hw->conf.channel->band];
-
         pinfo = kmalloc(sizeof(*pinfo), GFP_ATOMIC);
         if (!pinfo)
                 return NULL;
 
-        /* We can safely assume that sband won't change unless we get
-         * reinitialized. */
-        rinfo = kmalloc(sizeof(*rinfo) * sband->n_bitrates, GFP_ATOMIC);
+        for (i = 0; i < IEEE80211_NUM_BANDS; i++) {
+                sband = hw->wiphy->bands[i];
+                if (sband && sband->n_bitrates > max_rates)
+                        max_rates = sband->n_bitrates;
+        }
+
+        rinfo = kmalloc(sizeof(*rinfo) * max_rates, GFP_ATOMIC);
         if (!rinfo) {
                 kfree(pinfo);
                 return NULL;
@@ -368,33 +400,6 @@ static void *rate_control_pid_alloc(struct ieee80211_hw *hw,
         pinfo->rinfo = rinfo;
         pinfo->oldrate = 0;
 
-        /* Sort the rates. This is optimized for the most common case (i.e.
-         * almost-sorted CCK+OFDM rates). Kind of bubble-sort with reversed
-         * mapping too. */
-        for (i = 0; i < sband->n_bitrates; i++) {
-                rinfo[i].index = i;
-                rinfo[i].rev_index = i;
-                if (RC_PID_FAST_START)
-                        rinfo[i].diff = 0;
-                else
-                        rinfo[i].diff = i * pinfo->norm_offset;
-        }
-        for (i = 1; i < sband->n_bitrates; i++) {
-                s = 0;
-                for (j = 0; j < sband->n_bitrates - i; j++)
-                        if (unlikely(sband->bitrates[rinfo[j].index].bitrate >
-                                     sband->bitrates[rinfo[j + 1].index].bitrate)) {
-                                tmp = rinfo[j].index;
-                                rinfo[j].index = rinfo[j + 1].index;
-                                rinfo[j + 1].index = tmp;
-                                rinfo[rinfo[j].index].rev_index = j;
-                                rinfo[rinfo[j + 1].index].rev_index = j + 1;
-                                s = 1;
-                        }
-                if (!s)
-                        break;
-        }
-
 #ifdef CONFIG_MAC80211_DEBUGFS
         de = &pinfo->dentries;
         de->target = debugfs_create_u32("target_pf", S_IRUSR | S_IWUSR,
diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c
index 3fb04a86444d..63656266d567 100644
--- a/net/mac80211/tx.c
+++ b/net/mac80211/tx.c
@@ -772,7 +772,7 @@ ieee80211_tx_h_fragment(struct ieee80211_tx_data *tx)
         hdrlen = ieee80211_hdrlen(hdr->frame_control);
 
         /* internal error, why is TX_FRAGMENTED set? */
-        if (WARN_ON(skb->len <= frag_threshold))
+        if (WARN_ON(skb->len + FCS_LEN <= frag_threshold))
                 return TX_DROP;
 
         /*
diff --git a/net/netfilter/Kconfig b/net/netfilter/Kconfig
index 2329c5f50551..cb3ad741ebf8 100644
--- a/net/netfilter/Kconfig
+++ b/net/netfilter/Kconfig
@@ -275,6 +275,8 @@ config NF_CT_NETLINK
         help
           This option enables support for a netlink-based userspace interface
 
+endif # NF_CONNTRACK
+
 # transparent proxy support
 config NETFILTER_TPROXY
         tristate "Transparent proxying support (EXPERIMENTAL)"
@@ -290,8 +292,6 @@ config NETFILTER_TPROXY
 
           To compile it as a module, choose M here.  If unsure, say N.
 
-endif # NF_CONNTRACK
-
 config NETFILTER_XTABLES
         tristate "Netfilter Xtables support (required for ip_tables)"
         default m if NETFILTER_ADVANCED=n
@@ -837,6 +837,7 @@ config NETFILTER_XT_MATCH_SOCKET
         depends on NETFILTER_TPROXY
         depends on NETFILTER_XTABLES
         depends on NETFILTER_ADVANCED
+        depends on !NF_CONNTRACK || NF_CONNTRACK
         select NF_DEFRAG_IPV4
         help
           This option adds a `socket' match, which can be used to match
diff --git a/net/netfilter/ipvs/ip_vs_conn.c b/net/netfilter/ipvs/ip_vs_conn.c
index 60aba45023ff..77bfdfeb966e 100644
--- a/net/netfilter/ipvs/ip_vs_conn.c
+++ b/net/netfilter/ipvs/ip_vs_conn.c
@@ -260,7 +260,10 @@ struct ip_vs_conn *ip_vs_ct_in_get
         list_for_each_entry(cp, &ip_vs_conn_tab[hash], c_list) {
                 if (cp->af == af &&
                     ip_vs_addr_equal(af, s_addr, &cp->caddr) &&
-                    ip_vs_addr_equal(af, d_addr, &cp->vaddr) &&
+                    /* protocol should only be IPPROTO_IP if
+                     * d_addr is a fwmark */
+                    ip_vs_addr_equal(protocol == IPPROTO_IP ? AF_UNSPEC : af,
+                                     d_addr, &cp->vaddr) &&
                     s_port == cp->cport && d_port == cp->vport &&
                     cp->flags & IP_VS_CONN_F_TEMPLATE &&
                     protocol == cp->protocol) {
@@ -698,7 +701,9 @@ ip_vs_conn_new(int af, int proto, const union nf_inet_addr *caddr, __be16 cport,
         cp->cport          = cport;
         ip_vs_addr_copy(af, &cp->vaddr, vaddr);
         cp->vport          = vport;
-        ip_vs_addr_copy(af, &cp->daddr, daddr);
+        /* proto should only be IPPROTO_IP if d_addr is a fwmark */
+        ip_vs_addr_copy(proto == IPPROTO_IP ? AF_UNSPEC : af,
+                        &cp->daddr, daddr);
         cp->dport          = dport;
         cp->flags          = flags;
         spin_lock_init(&cp->lock);
diff --git a/net/netfilter/ipvs/ip_vs_core.c b/net/netfilter/ipvs/ip_vs_core.c
index cb3e031335eb..8dddb17a947a 100644
--- a/net/netfilter/ipvs/ip_vs_core.c
+++ b/net/netfilter/ipvs/ip_vs_core.c
@@ -278,7 +278,7 @@ ip_vs_sched_persist(struct ip_vs_service *svc,
                  */
                 if (svc->fwmark) {
                         union nf_inet_addr fwmark = {
-                                .all = { 0, 0, 0, htonl(svc->fwmark) }
+                                .ip = htonl(svc->fwmark)
                         };
 
                         ct = ip_vs_ct_in_get(svc->af, IPPROTO_IP, &snet, 0,
@@ -306,7 +306,7 @@ ip_vs_sched_persist(struct ip_vs_service *svc,
                          */
                         if (svc->fwmark) {
                                 union nf_inet_addr fwmark = {
-                                        .all = { 0, 0, 0, htonl(svc->fwmark) }
+                                        .ip = htonl(svc->fwmark)
                                 };
 
                                 ct = ip_vs_conn_new(svc->af, IPPROTO_IP,
diff --git a/net/netfilter/nf_conntrack_netlink.c b/net/netfilter/nf_conntrack_netlink.c
index f13fc57e1ecb..c523f0b8cee5 100644
--- a/net/netfilter/nf_conntrack_netlink.c
+++ b/net/netfilter/nf_conntrack_netlink.c
@@ -1186,28 +1186,6 @@ ctnetlink_change_conntrack(struct nf_conn *ct, struct nlattr *cda[])
         return 0;
 }
 
-static inline void
-ctnetlink_event_report(struct nf_conn *ct, u32 pid, int report)
-{
-        unsigned int events = 0;
-
-        if (test_bit(IPS_EXPECTED_BIT, &ct->status))
-                events |= IPCT_RELATED;
-        else
-                events |= IPCT_NEW;
-
-        nf_conntrack_event_report(IPCT_STATUS |
-                                  IPCT_HELPER |
-                                  IPCT_REFRESH |
-                                  IPCT_PROTOINFO |
-                                  IPCT_NATSEQADJ |
-                                  IPCT_MARK |
-                                  events,
-                                  ct,
-                                  pid,
-                                  report);
-}
-
 static struct nf_conn *
 ctnetlink_create_conntrack(struct nlattr *cda[],
                            struct nf_conntrack_tuple *otuple,
@@ -1373,6 +1351,7 @@ ctnetlink_new_conntrack(struct sock *ctnl, struct sk_buff *skb,
                 err = -ENOENT;
                 if (nlh->nlmsg_flags & NLM_F_CREATE) {
                         struct nf_conn *ct;
+                        enum ip_conntrack_events events;
 
                         ct = ctnetlink_create_conntrack(cda, &otuple,
                                                         &rtuple, u3);
@@ -1383,9 +1362,18 @@ ctnetlink_new_conntrack(struct sock *ctnl, struct sk_buff *skb,
                         err = 0;
                         nf_conntrack_get(&ct->ct_general);
                         spin_unlock_bh(&nf_conntrack_lock);
-                        ctnetlink_event_report(ct,
-                                               NETLINK_CB(skb).pid,
-                                               nlmsg_report(nlh));
+                        if (test_bit(IPS_EXPECTED_BIT, &ct->status))
+                                events = IPCT_RELATED;
+                        else
+                                events = IPCT_NEW;
+
+                        nf_conntrack_event_report(IPCT_STATUS |
+                                                  IPCT_HELPER |
+                                                  IPCT_PROTOINFO |
+                                                  IPCT_NATSEQADJ |
+                                                  IPCT_MARK | events,
+                                                  ct, NETLINK_CB(skb).pid,
+                                                  nlmsg_report(nlh));
                         nf_ct_put(ct);
                 } else
                         spin_unlock_bh(&nf_conntrack_lock);
@@ -1404,9 +1392,13 @@ ctnetlink_new_conntrack(struct sock *ctnl, struct sk_buff *skb,
                 if (err == 0) {
                         nf_conntrack_get(&ct->ct_general);
                         spin_unlock_bh(&nf_conntrack_lock);
-                        ctnetlink_event_report(ct,
-                                               NETLINK_CB(skb).pid,
-                                               nlmsg_report(nlh));
+                        nf_conntrack_event_report(IPCT_STATUS |
+                                                  IPCT_HELPER |
+                                                  IPCT_PROTOINFO |
+                                                  IPCT_NATSEQADJ |
+                                                  IPCT_MARK,
+                                                  ct, NETLINK_CB(skb).pid,
+                                                  nlmsg_report(nlh));
                         nf_ct_put(ct);
                 } else
                         spin_unlock_bh(&nf_conntrack_lock);
diff --git a/net/netfilter/nf_conntrack_proto_dccp.c b/net/netfilter/nf_conntrack_proto_dccp.c
index 50dac8dbe7d8..8e757dd53396 100644
--- a/net/netfilter/nf_conntrack_proto_dccp.c
+++ b/net/netfilter/nf_conntrack_proto_dccp.c
@@ -633,6 +633,8 @@ static int dccp_to_nlattr(struct sk_buff *skb, struct nlattr *nla,
         if (!nest_parms)
                 goto nla_put_failure;
         NLA_PUT_U8(skb, CTA_PROTOINFO_DCCP_STATE, ct->proto.dccp.state);
+        NLA_PUT_U8(skb, CTA_PROTOINFO_DCCP_ROLE,
+                   ct->proto.dccp.role[IP_CT_DIR_ORIGINAL]);
         nla_nest_end(skb, nest_parms);
         read_unlock_bh(&dccp_lock);
         return 0;
@@ -644,6 +646,7 @@ nla_put_failure:
 
 static const struct nla_policy dccp_nla_policy[CTA_PROTOINFO_DCCP_MAX + 1] = {
         [CTA_PROTOINFO_DCCP_STATE]      = { .type = NLA_U8 },
+        [CTA_PROTOINFO_DCCP_ROLE]       = { .type = NLA_U8 },
 };
 
 static int nlattr_to_dccp(struct nlattr *cda[], struct nf_conn *ct)
@@ -661,11 +664,21 @@ static int nlattr_to_dccp(struct nlattr *cda[], struct nf_conn *ct)
                 return err;
 
         if (!tb[CTA_PROTOINFO_DCCP_STATE] ||
-            nla_get_u8(tb[CTA_PROTOINFO_DCCP_STATE]) >= CT_DCCP_IGNORE)
+            !tb[CTA_PROTOINFO_DCCP_ROLE] ||
+            nla_get_u8(tb[CTA_PROTOINFO_DCCP_ROLE]) > CT_DCCP_ROLE_MAX ||
+            nla_get_u8(tb[CTA_PROTOINFO_DCCP_STATE]) >= CT_DCCP_IGNORE) {
                 return -EINVAL;
+        }
 
         write_lock_bh(&dccp_lock);
         ct->proto.dccp.state = nla_get_u8(tb[CTA_PROTOINFO_DCCP_STATE]);
+        if (nla_get_u8(tb[CTA_PROTOINFO_DCCP_ROLE]) == CT_DCCP_ROLE_CLIENT) {
+                ct->proto.dccp.role[IP_CT_DIR_ORIGINAL] = CT_DCCP_ROLE_CLIENT;
+                ct->proto.dccp.role[IP_CT_DIR_REPLY] = CT_DCCP_ROLE_SERVER;
+        } else {
+                ct->proto.dccp.role[IP_CT_DIR_ORIGINAL] = CT_DCCP_ROLE_SERVER;
+                ct->proto.dccp.role[IP_CT_DIR_REPLY] = CT_DCCP_ROLE_CLIENT;
+        }
         write_unlock_bh(&dccp_lock);
         return 0;
 }
@@ -777,6 +790,7 @@ static struct nf_conntrack_l4proto dccp_proto6 __read_mostly = {
         .print_conntrack        = dccp_print_conntrack,
 #if defined(CONFIG_NF_CT_NETLINK) || defined(CONFIG_NF_CT_NETLINK_MODULE)
         .to_nlattr              = dccp_to_nlattr,
+        .nlattr_size            = dccp_nlattr_size,
         .from_nlattr            = nlattr_to_dccp,
         .tuple_to_nlattr        = nf_ct_port_tuple_to_nlattr,
         .nlattr_tuple_size      = nf_ct_port_nlattr_tuple_size,
diff --git a/net/netfilter/nf_conntrack_proto_udplite.c b/net/netfilter/nf_conntrack_proto_udplite.c
index 4614696c1b88..0badedc542d3 100644
--- a/net/netfilter/nf_conntrack_proto_udplite.c
+++ b/net/netfilter/nf_conntrack_proto_udplite.c
@@ -204,6 +204,7 @@ static struct nf_conntrack_l4proto nf_conntrack_l4proto_udplite6 __read_mostly =
         .error                  = udplite_error,
 #if defined(CONFIG_NF_CT_NETLINK) || defined(CONFIG_NF_CT_NETLINK_MODULE)
         .tuple_to_nlattr        = nf_ct_port_tuple_to_nlattr,
+        .nlattr_tuple_size      = nf_ct_port_nlattr_tuple_size,
         .nlattr_to_tuple        = nf_ct_port_nlattr_to_tuple,
         .nla_policy             = nf_ct_port_nla_policy,
 #endif
diff --git a/net/netfilter/x_tables.c b/net/netfilter/x_tables.c
index 509a95621f9f..150e5cf62f85 100644
--- a/net/netfilter/x_tables.c
+++ b/net/netfilter/x_tables.c
@@ -625,20 +625,6 @@ void xt_free_table_info(struct xt_table_info *info)
 }
 EXPORT_SYMBOL(xt_free_table_info);
 
-void xt_table_entry_swap_rcu(struct xt_table_info *oldinfo,
-                             struct xt_table_info *newinfo)
-{
-        unsigned int cpu;
-
-        for_each_possible_cpu(cpu) {
-                void *p = oldinfo->entries[cpu];
-                rcu_assign_pointer(oldinfo->entries[cpu], newinfo->entries[cpu]);
-                newinfo->entries[cpu] = p;
-        }
-
-}
-EXPORT_SYMBOL_GPL(xt_table_entry_swap_rcu);
-
 /* Find table by name, grabs mutex & ref.  Returns ERR_PTR() on error. */
 struct xt_table *xt_find_table_lock(struct net *net, u_int8_t af,
                                     const char *name)
@@ -676,32 +662,43 @@ void xt_compat_unlock(u_int8_t af)
 EXPORT_SYMBOL_GPL(xt_compat_unlock);
 #endif
 
+DEFINE_PER_CPU(struct xt_info_lock, xt_info_locks);
+EXPORT_PER_CPU_SYMBOL_GPL(xt_info_locks);
+
+
 struct xt_table_info *
 xt_replace_table(struct xt_table *table,
               unsigned int num_counters,
               struct xt_table_info *newinfo,
               int *error)
 {
-        struct xt_table_info *oldinfo, *private;
+        struct xt_table_info *private;
 
         /* Do the substitution. */
-        mutex_lock(&table->lock);
+        local_bh_disable();
         private = table->private;
+
         /* Check inside lock: is the old number correct? */
         if (num_counters != private->number) {
                 duprintf("num_counters != table->private->number (%u/%u)\n",
                          num_counters, private->number);
-                mutex_unlock(&table->lock);
+                local_bh_enable();
                 *error = -EAGAIN;
                 return NULL;
         }
-        oldinfo = private;
-        rcu_assign_pointer(table->private, newinfo);
-        newinfo->initial_entries = oldinfo->initial_entries;
-        mutex_unlock(&table->lock);
 
-        synchronize_net();
-        return oldinfo;
+        table->private = newinfo;
+        newinfo->initial_entries = private->initial_entries;
+
+        /*
+         * Even though table entries have now been swapped, other CPU's
+         * may still be using the old entries. This is okay, because
+         * resynchronization happens because of the locking done
+         * during the get_counters() routine.
+         */
+        local_bh_enable();
+
+        return private;
 }
 EXPORT_SYMBOL_GPL(xt_replace_table);
 
@@ -734,7 +731,6 @@ struct xt_table *xt_register_table(struct net *net, struct xt_table *table,
 
         /* Simplifies replace_table code. */
         table->private = bootstrap;
-        mutex_init(&table->lock);
 
         if (!xt_replace_table(table, 0, newinfo, &ret))
                 goto unlock;
@@ -1147,7 +1143,14 @@ static struct pernet_operations xt_net_ops = {
 
 static int __init xt_init(void)
 {
-        int i, rv;
+        unsigned int i;
+        int rv;
+
+        for_each_possible_cpu(i) {
+                struct xt_info_lock *lock = &per_cpu(xt_info_locks, i);
+                spin_lock_init(&lock->lock);
+                lock->readers = 0;
+        }
 
         xt = kmalloc(sizeof(struct xt_af) * NFPROTO_NUMPROTO, GFP_KERNEL);
         if (!xt)
diff --git a/net/netfilter/xt_cluster.c b/net/netfilter/xt_cluster.c
index 6c4847662b85..69a639f35403 100644
--- a/net/netfilter/xt_cluster.c
+++ b/net/netfilter/xt_cluster.c
@@ -135,7 +135,13 @@ static bool xt_cluster_mt_checkentry(const struct xt_mtchk_param *par)
 {
         struct xt_cluster_match_info *info = par->matchinfo;
 
-        if (info->node_mask >= (1 << info->total_nodes)) {
+        if (info->total_nodes > XT_CLUSTER_NODES_MAX) {
+                printk(KERN_ERR "xt_cluster: you have exceeded the maximum "
+                                "number of cluster nodes (%u > %u)\n",
+                                info->total_nodes, XT_CLUSTER_NODES_MAX);
+                return false;
+        }
+        if (info->node_mask >= (1ULL << info->total_nodes)) {
                 printk(KERN_ERR "xt_cluster: this node mask cannot be "
                                 "higher than the total number of nodes\n");
                 return false;
diff --git a/net/netfilter/xt_recent.c b/net/netfilter/xt_recent.c
index 791e030ea903..eb0ceb846527 100644
--- a/net/netfilter/xt_recent.c
+++ b/net/netfilter/xt_recent.c
@@ -474,7 +474,7 @@ static ssize_t recent_old_proc_write(struct file *file,
         struct recent_table *t = pde->data;
         struct recent_entry *e;
         char buf[sizeof("+255.255.255.255")], *c = buf;
-        __be32 addr;
+        union nf_inet_addr addr = {};
         int add;
 
         if (size > sizeof(buf))
@@ -506,14 +506,13 @@ static ssize_t recent_old_proc_write(struct file *file,
                 add = 1;
                 break;
         }
-        addr = in_aton(c);
+        addr.ip = in_aton(c);
 
         spin_lock_bh(&recent_lock);
-        e = recent_entry_lookup(t, (const void *)&addr, NFPROTO_IPV4, 0);
+        e = recent_entry_lookup(t, &addr, NFPROTO_IPV4, 0);
         if (e == NULL) {
                 if (add)
-                        recent_entry_init(t, (const void *)&addr,
-                                          NFPROTO_IPV4, 0);
+                        recent_entry_init(t, &addr, NFPROTO_IPV4, 0);
         } else {
                 if (add)
                         recent_entry_update(t, e);
diff --git a/net/sched/cls_api.c b/net/sched/cls_api.c
index 173fcc4b050d..0759f32e9dca 100644
--- a/net/sched/cls_api.c
+++ b/net/sched/cls_api.c
@@ -254,7 +254,7 @@ replay:
                 }
                 tp->ops = tp_ops;
                 tp->protocol = protocol;
-                tp->prio = nprio ? : tcf_auto_prio(*back);
+                tp->prio = nprio ? : TC_H_MAJ(tcf_auto_prio(*back));
                 tp->q = q;
                 tp->classify = tp_ops->classify;
                 tp->classid = parent;
diff --git a/net/sched/sch_fifo.c b/net/sched/sch_fifo.c
index 92cfc9d7e3b9..69188e8358b4 100644
--- a/net/sched/sch_fifo.c
+++ b/net/sched/sch_fifo.c
@@ -51,7 +51,7 @@ static int fifo_init(struct Qdisc *sch, struct nlattr *opt)
                 u32 limit = qdisc_dev(sch)->tx_queue_len ? : 1;
 
                 if (sch->ops == &bfifo_qdisc_ops)
-                        limit *= qdisc_dev(sch)->mtu;
+                        limit *= psched_mtu(qdisc_dev(sch));
 
                 q->limit = limit;
         } else {
diff --git a/net/sunrpc/xprt.c b/net/sunrpc/xprt.c
index a0bfe53f1621..06ca058572f2 100644
--- a/net/sunrpc/xprt.c
+++ b/net/sunrpc/xprt.c
@@ -672,10 +672,8 @@ xprt_init_autodisconnect(unsigned long data)
         if (test_and_set_bit(XPRT_LOCKED, &xprt->state))
                 goto out_abort;
         spin_unlock(&xprt->transport_lock);
-        if (xprt_connecting(xprt))
-                xprt_release_write(xprt, NULL);
-        else
-                queue_work(rpciod_workqueue, &xprt->task_cleanup);
+        set_bit(XPRT_CONNECTION_CLOSE, &xprt->state);
+        queue_work(rpciod_workqueue, &xprt->task_cleanup);
         return;
 out_abort:
         spin_unlock(&xprt->transport_lock);
diff --git a/net/sunrpc/xprtrdma/svc_rdma_recvfrom.c b/net/sunrpc/xprtrdma/svc_rdma_recvfrom.c
index 629a28764da9..42a6f9f20285 100644
--- a/net/sunrpc/xprtrdma/svc_rdma_recvfrom.c
+++ b/net/sunrpc/xprtrdma/svc_rdma_recvfrom.c
@@ -265,7 +265,7 @@ static int fast_reg_read_chunks(struct svcxprt_rdma *xprt,
                 frmr->page_list->page_list[page_no] =
                         ib_dma_map_single(xprt->sc_cm_id->device,
                                           page_address(rqstp->rq_arg.pages[page_no]),
-                                          PAGE_SIZE, DMA_TO_DEVICE);
+                                          PAGE_SIZE, DMA_FROM_DEVICE);
                 if (ib_dma_mapping_error(xprt->sc_cm_id->device,
                                          frmr->page_list->page_list[page_no]))
                         goto fatal_err;
diff --git a/net/sunrpc/xprtrdma/svc_rdma_sendto.c b/net/sunrpc/xprtrdma/svc_rdma_sendto.c
index 6c26a675435a..8b510c5e8777 100644
--- a/net/sunrpc/xprtrdma/svc_rdma_sendto.c
+++ b/net/sunrpc/xprtrdma/svc_rdma_sendto.c
@@ -183,6 +183,7 @@ static int fast_reg_xdr(struct svcxprt_rdma *xprt,
 
  fatal_err:
         printk("svcrdma: Error fast registering memory for xprt %p\n", xprt);
+        vec->frmr = NULL;
         svc_rdma_put_frmr(xprt, frmr);
         return -EIO;
 }
@@ -516,6 +517,7 @@ static int send_reply(struct svcxprt_rdma *rdma,
                        "svcrdma: could not post a receive buffer, err=%d."
                        "Closing transport %p.\n", ret, rdma);
                 set_bit(XPT_CLOSE, &rdma->sc_xprt.xpt_flags);
+                svc_rdma_put_frmr(rdma, vec->frmr);
                 svc_rdma_put_context(ctxt, 0);
                 return -ENOTCONN;
         }
@@ -606,6 +608,7 @@ static int send_reply(struct svcxprt_rdma *rdma,
         return 0;
 
  err:
+        svc_rdma_unmap_dma(ctxt);
         svc_rdma_put_frmr(rdma, vec->frmr);
         svc_rdma_put_context(ctxt, 1);
         return -EIO;
diff --git a/net/sunrpc/xprtrdma/svc_rdma_transport.c b/net/sunrpc/xprtrdma/svc_rdma_transport.c
index 3d810e7df3fb..4b0c2fa15e0b 100644
--- a/net/sunrpc/xprtrdma/svc_rdma_transport.c
+++ b/net/sunrpc/xprtrdma/svc_rdma_transport.c
@@ -520,8 +520,9 @@ int svc_rdma_post_recv(struct svcxprt_rdma *xprt)
         svc_xprt_get(&xprt->sc_xprt);
         ret = ib_post_recv(xprt->sc_qp, &recv_wr, &bad_recv_wr);
         if (ret) {
-                svc_xprt_put(&xprt->sc_xprt);
+                svc_rdma_unmap_dma(ctxt);
                 svc_rdma_put_context(ctxt, 1);
+                svc_xprt_put(&xprt->sc_xprt);
         }
         return ret;
 
diff --git a/net/sunrpc/xprtsock.c b/net/sunrpc/xprtsock.c
index d40ff50887aa..e18596146013 100644
--- a/net/sunrpc/xprtsock.c
+++ b/net/sunrpc/xprtsock.c
@@ -807,6 +807,9 @@ static void xs_reset_transport(struct sock_xprt *transport)
  *
  * This is used when all requests are complete; ie, no DRC state remains
  * on the server we want to save.
+ *
+ * The caller _must_ be holding XPRT_LOCKED in order to avoid issues with
+ * xs_reset_transport() zeroing the socket from underneath a writer.
  */
 static void xs_close(struct rpc_xprt *xprt)
 {
@@ -824,6 +827,14 @@ static void xs_close(struct rpc_xprt *xprt)
         xprt_disconnect_done(xprt);
 }
 
+static void xs_tcp_close(struct rpc_xprt *xprt)
+{
+        if (test_and_clear_bit(XPRT_CONNECTION_CLOSE, &xprt->state))
+                xs_close(xprt);
+        else
+                xs_tcp_shutdown(xprt);
+}
+
 /**
  * xs_destroy - prepare to shutdown a transport
  * @xprt: doomed transport
@@ -1772,6 +1783,15 @@ static void xs_tcp_setup_socket(struct rpc_xprt *xprt,
                         xprt, -status, xprt_connected(xprt),
                         sock->sk->sk_state);
         switch (status) {
+        default:
+                printk("%s: connect returned unhandled error %d\n",
+                        __func__, status);
+        case -EADDRNOTAVAIL:
+                /* We're probably in TIME_WAIT. Get rid of existing socket,
+                 * and retry
+                 */
+                set_bit(XPRT_CONNECTION_CLOSE, &xprt->state);
+                xprt_force_disconnect(xprt);
         case -ECONNREFUSED:
         case -ECONNRESET:
         case -ENETUNREACH:
@@ -1782,10 +1802,6 @@ static void xs_tcp_setup_socket(struct rpc_xprt *xprt,
                 xprt_clear_connecting(xprt);
                 return;
         }
-        /* get rid of existing socket, and retry */
-        xs_tcp_shutdown(xprt);
-        printk("%s: connect returned unhandled error %d\n",
-                        __func__, status);
 out_eagain:
         status = -EAGAIN;
 out:
@@ -1994,7 +2010,7 @@ static struct rpc_xprt_ops xs_tcp_ops = {
         .buf_free               = rpc_free,
         .send_request           = xs_tcp_send_request,
         .set_retrans_timeout    = xprt_set_retrans_timeout_def,
-        .close                  = xs_tcp_shutdown,
+        .close                  = xs_tcp_close,
         .destroy                = xs_destroy,
         .print_stats            = xs_tcp_print_stats,
 };
diff --git a/net/wimax/op-msg.c b/net/wimax/op-msg.c
index 5d149c1b5f0d..9ad4d893a566 100644
--- a/net/wimax/op-msg.c
+++ b/net/wimax/op-msg.c
@@ -149,7 +149,8 @@ struct sk_buff *wimax_msg_alloc(struct wimax_dev *wimax_dev,
         }
         result = nla_put(skb, WIMAX_GNL_MSG_DATA, size, msg);
         if (result < 0) {
-                dev_err(dev, "no memory to add payload in attribute\n");
+                dev_err(dev, "no memory to add payload (msg %p size %zu) in "
+                        "attribute: %d\n", msg, size, result);
                 goto error_nla_put;
         }
         genlmsg_end(skb, genl_msg);
@@ -299,10 +300,10 @@ int wimax_msg(struct wimax_dev *wimax_dev, const char *pipe_name,
         struct sk_buff *skb;
 
         skb = wimax_msg_alloc(wimax_dev, pipe_name, buf, size, gfp_flags);
-        if (skb == NULL)
-                goto error_msg_new;
-        result = wimax_msg_send(wimax_dev, skb);
-error_msg_new:
+        if (IS_ERR(skb))
+                result = PTR_ERR(skb);
+        else
+                result = wimax_msg_send(wimax_dev, skb);
         return result;
 }
 EXPORT_SYMBOL_GPL(wimax_msg);
diff --git a/net/wimax/stack.c b/net/wimax/stack.c
index a0ee76b52510..933e1422b09f 100644
--- a/net/wimax/stack.c
+++ b/net/wimax/stack.c
@@ -338,8 +338,21 @@ out:
  */
 void wimax_state_change(struct wimax_dev *wimax_dev, enum wimax_st new_state)
 {
+        /*
+         * A driver cannot take the wimax_dev out of the
+         * __WIMAX_ST_NULL state unless by calling wimax_dev_add(). If
+         * the wimax_dev's state is still NULL, we ignore any request
+         * to change its state because it means it hasn't been yet
+         * registered.
+         *
+         * There is no need to complain about it, as routines that
+         * call this might be shared from different code paths that
+         * are called before or after wimax_dev_add() has done its
+         * job.
+         */
         mutex_lock(&wimax_dev->mutex);
-        __wimax_state_change(wimax_dev, new_state);
+        if (wimax_dev->state > __WIMAX_ST_NULL)
+                __wimax_state_change(wimax_dev, new_state);
         mutex_unlock(&wimax_dev->mutex);
         return;
 }
@@ -376,7 +389,7 @@ EXPORT_SYMBOL_GPL(wimax_state_get);
 void wimax_dev_init(struct wimax_dev *wimax_dev)
 {
         INIT_LIST_HEAD(&wimax_dev->id_table_node);
-        __wimax_state_set(wimax_dev, WIMAX_ST_UNINITIALIZED);
+        __wimax_state_set(wimax_dev, __WIMAX_ST_NULL);
         mutex_init(&wimax_dev->mutex);
         mutex_init(&wimax_dev->mutex_reset);
 }
diff --git a/net/wireless/reg.c b/net/wireless/reg.c
index 6c1993d99902..08265ca15785 100644
--- a/net/wireless/reg.c
+++ b/net/wireless/reg.c
@@ -907,6 +907,7 @@ EXPORT_SYMBOL(freq_reg_info);
 int freq_reg_info(struct wiphy *wiphy, u32 center_freq, u32 *bandwidth,
                          const struct ieee80211_reg_rule **reg_rule)
 {
+        assert_cfg80211_lock();
         return freq_reg_info_regd(wiphy, center_freq,
                 bandwidth, reg_rule, NULL);
 }
@@ -1133,7 +1134,8 @@ static bool reg_is_world_roaming(struct wiphy *wiphy)
         if (is_world_regdom(cfg80211_regdomain->alpha2) ||
             (wiphy->regd && is_world_regdom(wiphy->regd->alpha2)))
                 return true;
-        if (last_request->initiator != NL80211_REGDOM_SET_BY_COUNTRY_IE &&
+        if (last_request &&
+            last_request->initiator != NL80211_REGDOM_SET_BY_COUNTRY_IE &&
             wiphy->custom_regulatory)
                 return true;
         return false;
@@ -1142,6 +1144,12 @@ static bool reg_is_world_roaming(struct wiphy *wiphy)
 /* Reap the advantages of previously found beacons */
 static void reg_process_beacons(struct wiphy *wiphy)
 {
+        /*
+         * Means we are just firing up cfg80211, so no beacons would
+         * have been processed yet.
+         */
+        if (!last_request)
+                return;
         if (!reg_is_world_roaming(wiphy))
                 return;
         wiphy_update_beacon_reg(wiphy);
@@ -1176,6 +1184,8 @@ static void handle_channel_custom(struct wiphy *wiphy,
         struct ieee80211_supported_band *sband;
         struct ieee80211_channel *chan;
 
+        assert_cfg80211_lock();
+
         sband = wiphy->bands[band];
         BUG_ON(chan_idx >= sband->n_channels);
         chan = &sband->channels[chan_idx];
@@ -1214,10 +1224,13 @@ void wiphy_apply_custom_regulatory(struct wiphy *wiphy,
                                    const struct ieee80211_regdomain *regd)
 {
         enum ieee80211_band band;
+
+        mutex_lock(&cfg80211_mutex);
         for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
                 if (wiphy->bands[band])
                         handle_band_custom(wiphy, band, regd);
         }
+        mutex_unlock(&cfg80211_mutex);
 }
 EXPORT_SYMBOL(wiphy_apply_custom_regulatory);
 
@@ -1423,7 +1436,7 @@ new_request:
         return call_crda(last_request->alpha2);
 }
 
-/* This currently only processes user and driver regulatory hints */
+/* This processes *all* regulatory hints */
 static void reg_process_hint(struct regulatory_request *reg_request)
 {
         int r = 0;
diff --git a/net/wireless/scan.c b/net/wireless/scan.c
index 2ae65b39b529..1f260c40b6ca 100644
--- a/net/wireless/scan.c
+++ b/net/wireless/scan.c
@@ -395,6 +395,7 @@ cfg80211_bss_update(struct cfg80211_registered_device *dev,
                                         memcpy(ies, res->pub.information_elements, ielen);
                                         found->ies_allocated = true;
                                         found->pub.information_elements = ies;
+                                        found->pub.len_information_elements = ielen;
                                 }
                         }
                 }
diff --git a/net/xfrm/xfrm_state.c b/net/xfrm/xfrm_state.c
index 82271720d970..5f1f86565f16 100644
--- a/net/xfrm/xfrm_state.c
+++ b/net/xfrm/xfrm_state.c
@@ -794,7 +794,7 @@ xfrm_state_find(xfrm_address_t *daddr, xfrm_address_t *saddr,
 {
         static xfrm_address_t saddr_wildcard = { };
         struct net *net = xp_net(pol);
-        unsigned int h;
+        unsigned int h, h_wildcard;
         struct hlist_node *entry;
         struct xfrm_state *x, *x0, *to_put;
         int acquire_in_progress = 0;
@@ -819,8 +819,8 @@ xfrm_state_find(xfrm_address_t *daddr, xfrm_address_t *saddr,
         if (best)
                 goto found;
 
-        h = xfrm_dst_hash(net, daddr, &saddr_wildcard, tmpl->reqid, family);
-        hlist_for_each_entry(x, entry, net->xfrm.state_bydst+h, bydst) {
+        h_wildcard = xfrm_dst_hash(net, daddr, &saddr_wildcard, tmpl->reqid, family);
+        hlist_for_each_entry(x, entry, net->xfrm.state_bydst+h_wildcard, bydst) {
                 if (x->props.family == family &&
                     x->props.reqid == tmpl->reqid &&
                     !(x->props.flags & XFRM_STATE_WILDRECV) &&