40 files changed, 232 insertions, 304 deletions
diff --git a/net/9p/trans_virtio.c b/net/9p/trans_virtio.c
index 0117b9fb8480..de7a9f532edc 100644
--- a/net/9p/trans_virtio.c
+++ b/net/9p/trans_virtio.c
@@ -110,7 +110,7 @@ static struct p9_req_t *p9_lookup_tag(struct virtio_chan *c, u16 tag)
                }
                for (count = old_max; count < c->max_tag; count++) {
                        c->reqs[count].status = REQ_STATUS_IDLE;
-                        c->reqs[count].wq = kmalloc(sizeof(wait_queue_t),
+                        c->reqs[count].wq = kmalloc(sizeof(wait_queue_head_t),
                                                                GFP_ATOMIC);
                        if (!c->reqs[count].wq) {
                                printk(KERN_ERR "Couldn't grow tag array\n");
@@ -183,8 +183,7 @@ pack_sg_list(struct scatterlist *sg, int start, int limit, char *data,
                sg_set_buf(&sg[index++], data, s);
                count -= s;
                data += s;
-                if (index > limit)
+                BUG_ON(index > limit);
-                        BUG();
        }
        return index-start;
diff --git a/net/ax25/ax25_out.c b/net/ax25/ax25_out.c
index 92b517af7260..bf706f83a5c9 100644
--- a/net/ax25/ax25_out.c
+++ b/net/ax25/ax25_out.c
@@ -117,6 +117,12 @@ void ax25_output(ax25_cb *ax25, int paclen, struct sk_buff *skb)
        unsigned char *p;
        int frontlen, len, fragno, ka9qfrag, first = 1;
+        if (paclen < 16) {
+                WARN_ON_ONCE(1);
+                kfree_skb(skb);
+                return;
+        }
        if ((skb->len - 1) > paclen) {
                if (*skb->data == AX25_P_TEXT) {
                        skb_pull(skb, 1); /* skip PID */
@@ -251,8 +257,6 @@ void ax25_kick(ax25_cb *ax25)
        if (start == end)
                return;
-        ax25->vs = start;
        /*
         * Transmit data until either we're out of data to send or
         * the window is full. Send a poll on the final I frame if
@@ -261,8 +265,13 @@ void ax25_kick(ax25_cb *ax25)
        /*
         * Dequeue the frame and copy it.
+         * Check for race with ax25_clear_queues().
         */
        skb  = skb_dequeue(&ax25->write_queue);
+        if (!skb)
+                return;
+        ax25->vs = start;
        do {
                if ((skbn = skb_clone(skb, GFP_ATOMIC)) == NULL) {
diff --git a/net/bluetooth/hci_conn.c b/net/bluetooth/hci_conn.c
index 5fc7be206f62..f8880261da0e 100644
--- a/net/bluetooth/hci_conn.c
+++ b/net/bluetooth/hci_conn.c
@@ -260,7 +260,6 @@ int hci_conn_del(struct hci_conn *conn)
        tasklet_enable(&hdev->tx_task);
        skb_queue_purge(&conn->data_q);
        hci_conn_del_sysfs(conn);
-        hci_dev_put(hdev);
        return 0;
 }
diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c
index 372b0d3b75a8..930b58e7149a 100644
--- a/net/bluetooth/hci_core.c
+++ b/net/bluetooth/hci_core.c
@@ -24,6 +24,7 @@
 /* Bluetooth HCI core. */
+#include <linux/jiffies.h>
 #include <linux/module.h>
 #include <linux/kmod.h>
@@ -1321,7 +1322,7 @@ static inline void hci_sched_acl(struct hci_dev *hdev)
        if (!test_bit(HCI_RAW, &hdev->flags)) {
                /* ACL tx timeout must be longer than maximum
                 * link supervision timeout (40.9 seconds) */
-                if (!hdev->acl_cnt && (jiffies - hdev->acl_last_tx) > (HZ * 45))
+                if (!hdev->acl_cnt && time_after(jiffies, hdev->acl_last_tx + HZ * 45))
                        hci_acl_tx_to(hdev);
        }
@@ -1543,7 +1544,7 @@ static void hci_cmd_task(unsigned long arg)
        BT_DBG("%s cmd %d", hdev->name, atomic_read(&hdev->cmd_cnt));
-        if (!atomic_read(&hdev->cmd_cnt) && (jiffies - hdev->cmd_last_tx) > HZ) {
+        if (!atomic_read(&hdev->cmd_cnt) && time_after(jiffies, hdev->cmd_last_tx + HZ)) {
                BT_ERR("%s command tx timeout", hdev->name);
                atomic_set(&hdev->cmd_cnt, 1);
        }
diff --git a/net/bluetooth/hci_sysfs.c b/net/bluetooth/hci_sysfs.c
index e13cf5ef144c..84360c117d4e 100644
--- a/net/bluetooth/hci_sysfs.c
+++ b/net/bluetooth/hci_sysfs.c
@@ -320,28 +320,34 @@ void hci_conn_add_sysfs(struct hci_conn *conn)
        queue_work(btaddconn, &conn->work);
 }
+/*
+ * The rfcomm tty device will possibly retain even when conn
+ * is down, and sysfs doesn't support move zombie device,
+ * so we should move the device before conn device is destroyed.
+ */
 static int __match_tty(struct device *dev, void *data)
 {
-        /* The rfcomm tty device will possibly retain even when conn
+        return !strncmp(dev->bus_id, "rfcomm", 6);
-         * is down, and sysfs doesn't support move zombie device,
-         * so we should move the device before conn device is destroyed.
-         * Due to the only child device of hci_conn dev is rfcomm
-         * tty_dev, here just return 1
-         */
-        return 1;
 }
 static void del_conn(struct work_struct *work)
 {
-        struct device *dev;
        struct hci_conn *conn = container_of(work, struct hci_conn, work);
+        struct hci_dev *hdev = conn->hdev;
+        while (1) {
+                struct device *dev;
-        while (dev = device_find_child(&conn->dev, NULL, __match_tty)) {
+                dev = device_find_child(&conn->dev, NULL, __match_tty);
+                if (!dev)
+                        break;
                device_move(dev, NULL);
                put_device(dev);
        }
        device_del(&conn->dev);
        put_device(&conn->dev);
+        hci_dev_put(hdev);
 }
 void hci_conn_del_sysfs(struct hci_conn *conn)
diff --git a/net/bridge/netfilter/ebt_dnat.c b/net/bridge/netfilter/ebt_dnat.c
index e700cbf634c2..ca64c1cc1b47 100644
--- a/net/bridge/netfilter/ebt_dnat.c
+++ b/net/bridge/netfilter/ebt_dnat.c
@@ -20,8 +20,8 @@ static int ebt_target_dnat(struct sk_buff *skb, unsigned int hooknr,
 {
        const struct ebt_nat_info *info = data;
-        if (skb_make_writable(skb, 0))
+        if (!skb_make_writable(skb, 0))
-                return NF_DROP;
+                return EBT_DROP;
        memcpy(eth_hdr(skb)->h_dest, info->mac, ETH_ALEN);
        return info->target;
diff --git a/net/bridge/netfilter/ebt_redirect.c b/net/bridge/netfilter/ebt_redirect.c
index bfdf2fb60b1f..b8afe850cf1e 100644
--- a/net/bridge/netfilter/ebt_redirect.c
+++ b/net/bridge/netfilter/ebt_redirect.c
@@ -21,8 +21,8 @@ static int ebt_target_redirect(struct sk_buff *skb, unsigned int hooknr,
 {
        const struct ebt_redirect_info *info = data;
-        if (skb_make_writable(skb, 0))
+        if (!skb_make_writable(skb, 0))
-                return NF_DROP;
+                return EBT_DROP;
        if (hooknr != NF_BR_BROUTING)
                memcpy(eth_hdr(skb)->h_dest,
diff --git a/net/bridge/netfilter/ebt_snat.c b/net/bridge/netfilter/ebt_snat.c
index e252dabbb143..5425333dda03 100644
--- a/net/bridge/netfilter/ebt_snat.c
+++ b/net/bridge/netfilter/ebt_snat.c
@@ -22,8 +22,8 @@ static int ebt_target_snat(struct sk_buff *skb, unsigned int hooknr,
 {
        const struct ebt_nat_info *info = data;
-        if (skb_make_writable(skb, 0))
+        if (!skb_make_writable(skb, 0))
-                return NF_DROP;
+                return EBT_DROP;
        memcpy(eth_hdr(skb)->h_source, info->mac, ETH_ALEN);
        if (!(info->target & NAT_ARP_BIT) &&
diff --git a/net/core/dev.c b/net/core/dev.c
index 908f07c3bd7d..fcdf03cf3b3f 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -2900,7 +2900,7 @@ int __dev_addr_add(struct dev_addr_list **list, int *count,
                }
        }
-        da = kmalloc(sizeof(*da), GFP_ATOMIC);
+        da = kzalloc(sizeof(*da), GFP_ATOMIC);
        if (da == NULL)
                return -ENOMEM;
        memcpy(da->da_addr, addr, alen);
diff --git a/net/core/neighbour.c b/net/core/neighbour.c
index 7bb6a9a1256d..2328acbd16cd 100644
--- a/net/core/neighbour.c
+++ b/net/core/neighbour.c
@@ -358,11 +358,12 @@ struct neighbour *neigh_lookup(struct neigh_table *tbl, const void *pkey,
 {
        struct neighbour *n;
        int key_len = tbl->key_len;
-        u32 hash_val = tbl->hash(pkey, dev);
+        u32 hash_val;
        NEIGH_CACHE_STAT_INC(tbl, lookups);
        read_lock_bh(&tbl->lock);
+        hash_val = tbl->hash(pkey, dev);
        for (n = tbl->hash_buckets[hash_val & tbl->hash_mask]; n; n = n->next) {
                if (dev == n->dev && !memcmp(n->primary_key, pkey, key_len)) {
                        neigh_hold(n);
@@ -379,11 +380,12 @@ struct neighbour *neigh_lookup_nodev(struct neigh_table *tbl, struct net *net,
 {
        struct neighbour *n;
        int key_len = tbl->key_len;
-        u32 hash_val = tbl->hash(pkey, NULL);
+        u32 hash_val;
        NEIGH_CACHE_STAT_INC(tbl, lookups);
        read_lock_bh(&tbl->lock);
+        hash_val = tbl->hash(pkey, NULL);
        for (n = tbl->hash_buckets[hash_val & tbl->hash_mask]; n; n = n->next) {
                if (!memcmp(n->primary_key, pkey, key_len) &&
                    (net == n->dev->nd_net)) {
@@ -507,6 +509,7 @@ struct pneigh_entry * pneigh_lookup(struct neigh_table *tbl,
        if (tbl->pconstructor && tbl->pconstructor(n)) {
                if (dev)
                        dev_put(dev);
+                release_net(net);
                kfree(n);
                n = NULL;
                goto out;
@@ -834,12 +837,18 @@ static void neigh_timer_handler(unsigned long arg)
        }
        if (neigh->nud_state & (NUD_INCOMPLETE | NUD_PROBE)) {
                struct sk_buff *skb = skb_peek(&neigh->arp_queue);
+                /* keep skb alive even if arp_queue overflows */
+                if (skb)
+                        skb_get(skb);
+                write_unlock(&neigh->lock);
                neigh->ops->solicit(neigh, skb);
                atomic_inc(&neigh->probes);
-        }
+                if (skb)
+                        kfree_skb(skb);
+        } else {
 out:
-        write_unlock(&neigh->lock);
+                write_unlock(&neigh->lock);
+        }
        if (notify)
                neigh_update_notify(neigh);
diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
index ecb02afd52dc..2bd9c5f7627d 100644
--- a/net/core/rtnetlink.c
+++ b/net/core/rtnetlink.c
@@ -504,7 +504,7 @@ int rtnl_put_cacheinfo(struct sk_buff *skb, struct dst_entry *dst, u32 id,
 EXPORT_SYMBOL_GPL(rtnl_put_cacheinfo);
-static int set_operstate(struct net_device *dev, unsigned char transition, bool send_notification)
+static void set_operstate(struct net_device *dev, unsigned char transition)
 {
        unsigned char operstate = dev->operstate;
@@ -527,12 +527,8 @@ static int set_operstate(struct net_device *dev, unsigned char transition, bool
                write_lock_bh(&dev_base_lock);
                dev->operstate = operstate;
                write_unlock_bh(&dev_base_lock);
+                netdev_state_change(dev);
-                if (send_notification)
+        }
-                        netdev_state_change(dev);
-                return 1;
-        } else
-                return 0;
 }
 static void copy_rtnl_link_stats(struct rtnl_link_stats *a,
@@ -693,10 +689,12 @@ const struct nla_policy ifla_policy[IFLA_MAX+1] = {
        [IFLA_BROADCAST]        = { .type = NLA_BINARY, .len = MAX_ADDR_LEN },
        [IFLA_MAP]              = { .len = sizeof(struct rtnl_link_ifmap) },
        [IFLA_MTU]              = { .type = NLA_U32 },
+        [IFLA_LINK]             = { .type = NLA_U32 },
        [IFLA_TXQLEN]           = { .type = NLA_U32 },
        [IFLA_WEIGHT]           = { .type = NLA_U32 },
        [IFLA_OPERSTATE]        = { .type = NLA_U8 },
        [IFLA_LINKMODE]         = { .type = NLA_U8 },
+        [IFLA_LINKINFO]         = { .type = NLA_NESTED },
        [IFLA_NET_NS_PID]       = { .type = NLA_U32 },
 };
@@ -724,6 +722,21 @@ static struct net *get_net_ns_by_pid(pid_t pid)
        return net;
 }
+static int validate_linkmsg(struct net_device *dev, struct nlattr *tb[])
+{
+        if (dev) {
+                if (tb[IFLA_ADDRESS] &&
+                    nla_len(tb[IFLA_ADDRESS]) < dev->addr_len)
+                        return -EINVAL;
+                if (tb[IFLA_BROADCAST] &&
+                    nla_len(tb[IFLA_BROADCAST]) < dev->addr_len)
+                        return -EINVAL;
+        }
+        return 0;
+}
 static int do_setlink(struct net_device *dev, struct ifinfomsg *ifm,
                      struct nlattr **tb, char *ifname, int modified)
 {
@@ -826,7 +839,6 @@ static int do_setlink(struct net_device *dev, struct ifinfomsg *ifm,
        if (tb[IFLA_BROADCAST]) {
                nla_memcpy(dev->broadcast, tb[IFLA_BROADCAST], dev->addr_len);
                send_addr_notify = 1;
-                modified = 1;
        }
        if (ifm->ifi_flags || ifm->ifi_change) {
@@ -839,23 +851,16 @@ static int do_setlink(struct net_device *dev, struct ifinfomsg *ifm,
                dev_change_flags(dev, flags);
        }
-        if (tb[IFLA_TXQLEN]) {
+        if (tb[IFLA_TXQLEN])
-                if (dev->tx_queue_len != nla_get_u32(tb[IFLA_TXQLEN])) {
+                dev->tx_queue_len = nla_get_u32(tb[IFLA_TXQLEN]);
-                        dev->tx_queue_len = nla_get_u32(tb[IFLA_TXQLEN]);
-                        modified = 1;
-                }
-        }
        if (tb[IFLA_OPERSTATE])
-                modified |= set_operstate(dev, nla_get_u8(tb[IFLA_OPERSTATE]), false);
+                set_operstate(dev, nla_get_u8(tb[IFLA_OPERSTATE]));
        if (tb[IFLA_LINKMODE]) {
-                if (dev->link_mode != nla_get_u8(tb[IFLA_LINKMODE])) {
+                write_lock_bh(&dev_base_lock);
-                        write_lock_bh(&dev_base_lock);
+                dev->link_mode = nla_get_u8(tb[IFLA_LINKMODE]);
-                        dev->link_mode = nla_get_u8(tb[IFLA_LINKMODE]);
+                write_unlock_bh(&dev_base_lock);
-                        write_lock_bh(&dev_base_lock);
-                        modified = 1;
-                }
        }
        err = 0;
@@ -869,10 +874,6 @@ errout:
        if (send_addr_notify)
                call_netdevice_notifiers(NETDEV_CHANGEADDR, dev);
-        if (modified)
-                netdev_state_change(dev);
        return err;
 }
@@ -908,12 +909,7 @@ static int rtnl_setlink(struct sk_buff *skb, struct nlmsghdr *nlh, void *arg)
                goto errout;
        }
-        if (tb[IFLA_ADDRESS] &&
+        if ((err = validate_linkmsg(dev, tb)) < 0)
-            nla_len(tb[IFLA_ADDRESS]) < dev->addr_len)
-                goto errout_dev;
-        if (tb[IFLA_BROADCAST] &&
-            nla_len(tb[IFLA_BROADCAST]) < dev->addr_len)
                goto errout_dev;
        err = do_setlink(dev, ifm, tb, ifname, 0);
@@ -990,7 +986,7 @@ struct net_device *rtnl_create_link(struct net *net, char *ifname,
        if (tb[IFLA_TXQLEN])
                dev->tx_queue_len = nla_get_u32(tb[IFLA_TXQLEN]);
        if (tb[IFLA_OPERSTATE])
-                set_operstate(dev, nla_get_u8(tb[IFLA_OPERSTATE]), true);
+                set_operstate(dev, nla_get_u8(tb[IFLA_OPERSTATE]));
        if (tb[IFLA_LINKMODE])
                dev->link_mode = nla_get_u8(tb[IFLA_LINKMODE]);
@@ -1034,6 +1030,9 @@ replay:
        else
                dev = NULL;
+        if ((err = validate_linkmsg(dev, tb)) < 0)
+                return err;
        if (tb[IFLA_LINKINFO]) {
                err = nla_parse_nested(linkinfo, IFLA_INFO_MAX,
                                       tb[IFLA_LINKINFO], ifla_info_policy);
diff --git a/net/ipv4/arp.c b/net/ipv4/arp.c
index c663fa5339ee..8e17f65f4002 100644
--- a/net/ipv4/arp.c
+++ b/net/ipv4/arp.c
@@ -368,6 +368,7 @@ static void arp_solicit(struct neighbour *neigh, struct sk_buff *skb)
                if (!(neigh->nud_state&NUD_VALID))
                        printk(KERN_DEBUG "trying to ucast probe in NUD_INVALID\n");
                dst_ha = neigh->ha;
+                read_lock_bh(&neigh->lock);
        } else if ((probes -= neigh->parms->app_probes) < 0) {
 #ifdef CONFIG_ARPD
                neigh_app_ns(neigh);
@@ -377,6 +378,8 @@ static void arp_solicit(struct neighbour *neigh, struct sk_buff *skb)
        arp_send(ARPOP_REQUEST, ETH_P_ARP, target, dev, saddr,
                 dst_ha, dev->dev_addr, NULL);
+        if (dst_ha)
+                read_unlock_bh(&neigh->lock);
 }
 static int arp_ignore(struct in_device *in_dev, __be32 sip, __be32 tip)
diff --git a/net/ipv4/fib_hash.c b/net/ipv4/fib_hash.c
index 76b9c684cccd..8d58d85dfac6 100644
--- a/net/ipv4/fib_hash.c
+++ b/net/ipv4/fib_hash.c
@@ -372,7 +372,8 @@ static struct fib_node *fib_find_node(struct fn_zone *fz, __be32 key)
 static int fn_hash_insert(struct fib_table *tb, struct fib_config *cfg)
 {
        struct fn_hash *table = (struct fn_hash *) tb->tb_data;
-        struct fib_node *new_f, *f;
+        struct fib_node *new_f = NULL;
+        struct fib_node *f;
        struct fib_alias *fa, *new_fa;
        struct fn_zone *fz;
        struct fib_info *fi;
@@ -496,7 +497,6 @@ static int fn_hash_insert(struct fib_table *tb, struct fib_config *cfg)
        err = -ENOBUFS;
-        new_f = NULL;
        if (!f) {
                new_f = kmem_cache_zalloc(fn_hash_kmem, GFP_KERNEL);
                if (new_f == NULL)
@@ -512,7 +512,7 @@ static int fn_hash_insert(struct fib_table *tb, struct fib_config *cfg)
        if (new_fa->fa_info != NULL) {
                new_fa = kmem_cache_alloc(fn_alias_kmem, GFP_KERNEL);
                if (new_fa == NULL)
-                        goto out_free_new_f;
+                        goto out;
        }
        new_fa->fa_info = fi;
        new_fa->fa_tos = tos;
@@ -540,9 +540,9 @@ static int fn_hash_insert(struct fib_table *tb, struct fib_config *cfg)
                  &cfg->fc_nlinfo, 0);
        return 0;
-out_free_new_f:
-        kmem_cache_free(fn_hash_kmem, new_f);
 out:
+        if (new_f)
+                kmem_cache_free(fn_hash_kmem, new_f);
        fib_release_info(fi);
        return err;
 }
diff --git a/net/ipv4/ip_gre.c b/net/ipv4/ip_gre.c
index 63f691719353..906cb1ada4c3 100644
--- a/net/ipv4/ip_gre.c
+++ b/net/ipv4/ip_gre.c
@@ -259,16 +259,8 @@ static struct ip_tunnel * ipgre_tunnel_locate(struct ip_tunnel_parm *parms, int
        if (parms->name[0])
                strlcpy(name, parms->name, IFNAMSIZ);
-        else {
+        else
-                int i;
+                sprintf(name, "gre%%d");
-                for (i=1; i<100; i++) {
-                        sprintf(name, "gre%d", i);
-                        if (__dev_get_by_name(&init_net, name) == NULL)
-                                break;
-                }
-                if (i==100)
-                        goto failed;
-        }
        dev = alloc_netdev(sizeof(*t), name, ipgre_tunnel_setup);
        if (!dev)
diff --git a/net/ipv4/ipconfig.c b/net/ipv4/ipconfig.c
index a52b5853aaa8..10013ccee8dd 100644
--- a/net/ipv4/ipconfig.c
+++ b/net/ipv4/ipconfig.c
@@ -1390,7 +1390,7 @@ static int __init ip_auto_config(void)
         * Clue in the operator.
         */
        printk("IP-Config: Complete:");
-        printk("\n      device=%s", ic_dev->name);
+        printk("\n     device=%s", ic_dev->name);
        printk(", addr=%u.%u.%u.%u", NIPQUAD(ic_myaddr));
        printk(", mask=%u.%u.%u.%u", NIPQUAD(ic_netmask));
        printk(", gw=%u.%u.%u.%u", NIPQUAD(ic_gateway));
diff --git a/net/ipv4/ipip.c b/net/ipv4/ipip.c
index da281581692c..e77e3b855834 100644
--- a/net/ipv4/ipip.c
+++ b/net/ipv4/ipip.c
@@ -221,16 +221,8 @@ static struct ip_tunnel * ipip_tunnel_locate(struct ip_tunnel_parm *parms, int c
        if (parms->name[0])
                strlcpy(name, parms->name, IFNAMSIZ);
-        else {
+        else
-                int i;
+                sprintf(name, "tunl%%d");
-                for (i=1; i<100; i++) {
-                        sprintf(name, "tunl%d", i);
-                        if (__dev_get_by_name(&init_net, name) == NULL)
-                                break;
-                }
-                if (i==100)
-                        goto failed;
-        }
        dev = alloc_netdev(sizeof(*t), name, ipip_tunnel_setup);
        if (dev == NULL)
diff --git a/net/ipv4/netfilter/arpt_mangle.c b/net/ipv4/netfilter/arpt_mangle.c
index 45fa4e20094a..3f4222b0a803 100644
--- a/net/ipv4/netfilter/arpt_mangle.c
+++ b/net/ipv4/netfilter/arpt_mangle.c
@@ -19,7 +19,7 @@ target(struct sk_buff *skb,
        unsigned char *arpptr;
        int pln, hln;
-        if (skb_make_writable(skb, skb->len))
+        if (!skb_make_writable(skb, skb->len))
                return NF_DROP;
        arp = arp_hdr(skb);
diff --git a/net/ipv4/netfilter/ip_queue.c b/net/ipv4/netfilter/ip_queue.c
index 6bda1102851b..fe05da41d6ba 100644
--- a/net/ipv4/netfilter/ip_queue.c
+++ b/net/ipv4/netfilter/ip_queue.c
@@ -283,8 +283,8 @@ static int
 ipq_mangle_ipv4(ipq_verdict_msg_t *v, struct nf_queue_entry *e)
 {
        int diff;
-        int err;
        struct iphdr *user_iph = (struct iphdr *)v->payload;
+        struct sk_buff *nskb;
        if (v->data_len < sizeof(*user_iph))
                return 0;
@@ -296,14 +296,16 @@ ipq_mangle_ipv4(ipq_verdict_msg_t *v, struct nf_queue_entry *e)
                if (v->data_len > 0xFFFF)
                        return -EINVAL;
                if (diff > skb_tailroom(e->skb)) {
-                        err = pskb_expand_head(e->skb, 0,
+                        nskb = skb_copy_expand(e->skb, 0,
                                               diff - skb_tailroom(e->skb),
                                               GFP_ATOMIC);
-                        if (err) {
+                        if (!nskb) {
                                printk(KERN_WARNING "ip_queue: error "
-                                      "in mangle, dropping packet: %d\n", -err);
+                                      "in mangle, dropping packet\n");
-                                return err;
+                                return -ENOMEM;
                        }
+                        kfree_skb(e->skb);
+                        e->skb = nskb;
                }
                skb_put(e->skb, diff);
        }
diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
index 63414ea427c5..00156bf421ca 100644
--- a/net/ipv4/tcp_ipv4.c
+++ b/net/ipv4/tcp_ipv4.c
@@ -719,7 +719,7 @@ static void tcp_v4_reqsk_send_ack(struct sk_buff *skb,
 }
 /*
- *      Send a SYN-ACK after having received an ACK.
+ *      Send a SYN-ACK after having received a SYN.
 *      This still operates on a request_sock only, not on a big
 *      socket.
 */
diff --git a/net/ipv6/af_inet6.c b/net/ipv6/af_inet6.c
index bddac0e8780f..f0aa97738746 100644
--- a/net/ipv6/af_inet6.c
+++ b/net/ipv6/af_inet6.c
@@ -752,14 +752,6 @@ static int __init inet6_init(void)
        BUILD_BUG_ON(sizeof(struct inet6_skb_parm) > sizeof(dummy_skb->cb));
-#ifdef MODULE
-#if 0 /* FIXME --RR */
-        if (!mod_member_present(&__this_module, can_unload))
-          return -EINVAL;
-        __this_module.can_unload = &ipv6_unload;
-#endif
-#endif
        err = proto_register(&tcpv6_prot, 1);
        if (err)
                goto out;
diff --git a/net/ipv6/ip6_fib.c b/net/ipv6/ip6_fib.c
index f93407cf6515..bab72b6f1444 100644
--- a/net/ipv6/ip6_fib.c
+++ b/net/ipv6/ip6_fib.c
@@ -1151,7 +1151,7 @@ static void fib6_del_route(struct fib6_node *fn, struct rt6_info **rtp,
                        fn = fn->parent;
                }
                /* No more references are possible at this point. */
-                if (atomic_read(&rt->rt6i_ref) != 1) BUG();
+                BUG_ON(atomic_read(&rt->rt6i_ref) != 1);
        }
        inet6_rt_notify(RTM_DELROUTE, rt, info);
diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c
index 9031e521c1df..2a124e9a1b2d 100644
--- a/net/ipv6/ip6_tunnel.c
+++ b/net/ipv6/ip6_tunnel.c
@@ -229,18 +229,11 @@ static struct ip6_tnl *ip6_tnl_create(struct ip6_tnl_parm *p)
        char name[IFNAMSIZ];
        int err;
-        if (p->name[0]) {
+        if (p->name[0])
                strlcpy(name, p->name, IFNAMSIZ);
-        } else {
+        else
-                int i;
+                sprintf(name, "ip6tnl%%d");
-                for (i = 1; i < IP6_TNL_MAX; i++) {
-                        sprintf(name, "ip6tnl%d", i);
-                        if (__dev_get_by_name(&init_net, name) == NULL)
-                                break;
-                }
-                if (i == IP6_TNL_MAX)
-                        goto failed;
-        }
        dev = alloc_netdev(sizeof (*t), name, ip6_tnl_dev_setup);
        if (dev == NULL)
                goto failed;
@@ -550,6 +543,7 @@ ip4ip6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
                        ip_rt_put(rt);
                        goto out;
                }
+                skb2->dst = (struct dst_entry *)rt;
        } else {
                ip_rt_put(rt);
                if (ip_route_input(skb2, eiph->daddr, eiph->saddr, eiph->tos,
diff --git a/net/ipv6/netfilter/ip6_queue.c b/net/ipv6/netfilter/ip6_queue.c
index e869916b05f1..cc2f9afcf808 100644
--- a/net/ipv6/netfilter/ip6_queue.c
+++ b/net/ipv6/netfilter/ip6_queue.c
@@ -285,8 +285,8 @@ static int
 ipq_mangle_ipv6(ipq_verdict_msg_t *v, struct nf_queue_entry *e)
 {
        int diff;
-        int err;
        struct ipv6hdr *user_iph = (struct ipv6hdr *)v->payload;
+        struct sk_buff *nskb;
        if (v->data_len < sizeof(*user_iph))
                return 0;
@@ -298,14 +298,16 @@ ipq_mangle_ipv6(ipq_verdict_msg_t *v, struct nf_queue_entry *e)
                if (v->data_len > 0xFFFF)
                        return -EINVAL;
                if (diff > skb_tailroom(e->skb)) {
-                        err = pskb_expand_head(e->skb, 0,
+                        nskb = skb_copy_expand(e->skb, 0,
                                               diff - skb_tailroom(e->skb),
                                               GFP_ATOMIC);
-                        if (err) {
+                        if (!nskb) {
                                printk(KERN_WARNING "ip6_queue: OOM "
                                      "in mangle, dropping packet\n");
-                                return err;
+                                return -ENOMEM;
                        }
+                        kfree_skb(e->skb);
+                        e->skb = nskb;
                }
                skb_put(e->skb, diff);
        }
diff --git a/net/ipv6/sit.c b/net/ipv6/sit.c
index e77239d02bf5..dde7801abeff 100644
--- a/net/ipv6/sit.c
+++ b/net/ipv6/sit.c
@@ -164,16 +164,8 @@ static struct ip_tunnel * ipip6_tunnel_locate(struct ip_tunnel_parm *parms, int
        if (parms->name[0])
                strlcpy(name, parms->name, IFNAMSIZ);
-        else {
+        else
-                int i;
+                sprintf(name, "sit%%d");
-                for (i=1; i<100; i++) {
-                        sprintf(name, "sit%d", i);
-                        if (__dev_get_by_name(&init_net, name) == NULL)
-                                break;
-                }
-                if (i==100)
-                        goto failed;
-        }
        dev = alloc_netdev(sizeof(*t), name, ipip6_tunnel_setup);
        if (dev == NULL)
diff --git a/net/mac80211/ieee80211.c b/net/mac80211/ieee80211.c
index 67b7c75c430d..28bcdf9fc3df 100644
--- a/net/mac80211/ieee80211.c
+++ b/net/mac80211/ieee80211.c
@@ -165,6 +165,7 @@ static int ieee80211_open(struct net_device *dev)
        struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
        struct ieee80211_if_init_conf conf;
        int res;
+        bool need_hw_reconfig = 0;
        sdata = IEEE80211_DEV_TO_SUB_IF(dev);
@@ -218,7 +219,7 @@ static int ieee80211_open(struct net_device *dev)
                        res = local->ops->start(local_to_hw(local));
                if (res)
                        return res;
-                ieee80211_hw_config(local);
+                need_hw_reconfig = 1;
                ieee80211_led_radio(local, local->hw.conf.radio_enabled);
        }
@@ -282,6 +283,8 @@ static int ieee80211_open(struct net_device *dev)
                atomic_inc(&local->iff_promiscs);
        local->open_count++;
+        if (need_hw_reconfig)
+                ieee80211_hw_config(local);
        netif_start_queue(dev);
diff --git a/net/netfilter/nfnetlink_queue.c b/net/netfilter/nfnetlink_queue.c
index a48b20fe9cd6..0043d3a9f87e 100644
--- a/net/netfilter/nfnetlink_queue.c
+++ b/net/netfilter/nfnetlink_queue.c
@@ -443,8 +443,8 @@ err_out:
 static int
 nfqnl_mangle(void *data, int data_len, struct nf_queue_entry *e)
 {
+        struct sk_buff *nskb;
        int diff;
-        int err;
        diff = data_len - e->skb->len;
        if (diff < 0) {
@@ -454,14 +454,16 @@ nfqnl_mangle(void *data, int data_len, struct nf_queue_entry *e)
                if (data_len > 0xFFFF)
                        return -EINVAL;
                if (diff > skb_tailroom(e->skb)) {
-                        err = pskb_expand_head(e->skb, 0,
+                        nskb = skb_copy_expand(e->skb, 0,
                                               diff - skb_tailroom(e->skb),
                                               GFP_ATOMIC);
-                        if (err) {
+                        if (!nskb) {
                                printk(KERN_WARNING "nf_queue: OOM "
                                      "in mangle, dropping packet\n");
-                                return err;
+                                return -ENOMEM;
                        }
+                        kfree_skb(e->skb);
+                        e->skb = nskb;
                }
                skb_put(e->skb, diff);
        }
diff --git a/net/netfilter/xt_hashlimit.c b/net/netfilter/xt_hashlimit.c
index 744c7f2ab0b1..5418ce59ac3a 100644
--- a/net/netfilter/xt_hashlimit.c
+++ b/net/netfilter/xt_hashlimit.c
@@ -774,9 +774,6 @@ hashlimit_mt_check(const char *tablename, const void *inf,
                return false;
        }
        mutex_unlock(&hlimit_mutex);
-        /* Ugly hack: For SMP, we only want to use one set */
-        info->master = info;
        return true;
 }
diff --git a/net/netfilter/xt_iprange.c b/net/netfilter/xt_iprange.c
index 4f984dc60319..500528d60cd7 100644
--- a/net/netfilter/xt_iprange.c
+++ b/net/netfilter/xt_iprange.c
@@ -102,7 +102,7 @@ iprange_ipv6_sub(const struct in6_addr *a, const struct in6_addr *b)
        int r;
        for (i = 0; i < 4; ++i) {
-                r = (__force u32)a->s6_addr32[i] - (__force u32)b->s6_addr32[i];
+                r = ntohl(a->s6_addr32[i]) - ntohl(b->s6_addr32[i]);
                if (r != 0)
                        return r;
        }
diff --git a/net/netfilter/xt_u32.c b/net/netfilter/xt_u32.c
index 9b8ed390a8e0..627e0f336d54 100644
--- a/net/netfilter/xt_u32.c
+++ b/net/netfilter/xt_u32.c
@@ -26,7 +26,6 @@ static bool u32_match_it(const struct xt_u32 *data,
        u_int32_t pos;
        u_int32_t val;
        u_int32_t at;
-        int ret;
        /*
         * Small example: "0 >> 28 == 4 && 8 & 0xFF0000 >> 16 = 6, 17"
@@ -40,8 +39,8 @@ static bool u32_match_it(const struct xt_u32 *data,
                if (skb->len < 4 || pos > skb->len - 4)
                        return false;
-                ret   = skb_copy_bits(skb, pos, &n, sizeof(n));
+                if (skb_copy_bits(skb, pos, &n, sizeof(n)) < 0)
-                BUG_ON(ret < 0);
+                        BUG();
                val   = ntohl(n);
                nnums = ct->nnums;
@@ -67,9 +66,9 @@ static bool u32_match_it(const struct xt_u32 *data,
                                    pos > skb->len - at - 4)
                                        return false;
-                                ret = skb_copy_bits(skb, at + pos, &n,
+                                if (skb_copy_bits(skb, at + pos, &n,
-                                                    sizeof(n));
+                                                    sizeof(n)) < 0)
-                                BUG_ON(ret < 0);
+                                        BUG();
                                val = ntohl(n);
                                break;
                        }
diff --git a/net/netlabel/netlabel_cipso_v4.c b/net/netlabel/netlabel_cipso_v4.c
index c7ad64d664ad..fdc14a0d21af 100644
--- a/net/netlabel/netlabel_cipso_v4.c
+++ b/net/netlabel/netlabel_cipso_v4.c
@@ -718,36 +718,35 @@ static int netlbl_cipsov4_remove(struct sk_buff *skb, struct genl_info *info)
 * NetLabel Generic NETLINK Command Definitions
 */
-static struct genl_ops netlbl_cipsov4_genl_c_add = {
+static struct genl_ops netlbl_cipsov4_ops[] = {
+        {
        .cmd = NLBL_CIPSOV4_C_ADD,
        .flags = GENL_ADMIN_PERM,
        .policy = netlbl_cipsov4_genl_policy,
        .doit = netlbl_cipsov4_add,
        .dumpit = NULL,
-};
+        },
+        {
-static struct genl_ops netlbl_cipsov4_genl_c_remove = {
        .cmd = NLBL_CIPSOV4_C_REMOVE,
        .flags = GENL_ADMIN_PERM,
        .policy = netlbl_cipsov4_genl_policy,
        .doit = netlbl_cipsov4_remove,
        .dumpit = NULL,
-};
+        },
+        {
-static struct genl_ops netlbl_cipsov4_genl_c_list = {
        .cmd = NLBL_CIPSOV4_C_LIST,
        .flags = 0,
        .policy = netlbl_cipsov4_genl_policy,
        .doit = netlbl_cipsov4_list,
        .dumpit = NULL,
-};
+        },
+        {
-static struct genl_ops netlbl_cipsov4_genl_c_listall = {
        .cmd = NLBL_CIPSOV4_C_LISTALL,
        .flags = 0,
        .policy = netlbl_cipsov4_genl_policy,
        .doit = NULL,
        .dumpit = netlbl_cipsov4_listall,
+        },
 };
 /*
@@ -762,30 +761,20 @@ static struct genl_ops netlbl_cipsov4_genl_c_listall = {
 * mechanism.  Returns zero on success, negative values on failure.
 *
 */
-int netlbl_cipsov4_genl_init(void)
+int __init netlbl_cipsov4_genl_init(void)
 {
-        int ret_val;
+        int ret_val, i;
        ret_val = genl_register_family(&netlbl_cipsov4_gnl_family);
        if (ret_val != 0)
                return ret_val;
-        ret_val = genl_register_ops(&netlbl_cipsov4_gnl_family,
+        for (i = 0; i < ARRAY_SIZE(netlbl_cipsov4_ops); i++) {
-                                    &netlbl_cipsov4_genl_c_add);
+                ret_val = genl_register_ops(&netlbl_cipsov4_gnl_family,
-        if (ret_val != 0)
+                                &netlbl_cipsov4_ops[i]);
-                return ret_val;
+                if (ret_val != 0)
-        ret_val = genl_register_ops(&netlbl_cipsov4_gnl_family,
+                        return ret_val;
-                                    &netlbl_cipsov4_genl_c_remove);
+        }
-        if (ret_val != 0)
-                return ret_val;
-        ret_val = genl_register_ops(&netlbl_cipsov4_gnl_family,
-                                    &netlbl_cipsov4_genl_c_list);
-        if (ret_val != 0)
-                return ret_val;
-        ret_val = genl_register_ops(&netlbl_cipsov4_gnl_family,
-                                    &netlbl_cipsov4_genl_c_listall);
-        if (ret_val != 0)
-                return ret_val;
        return 0;
 }
diff --git a/net/netlabel/netlabel_domainhash.c b/net/netlabel/netlabel_domainhash.c
index fd462313471c..02c2f7c0b255 100644
--- a/net/netlabel/netlabel_domainhash.c
+++ b/net/netlabel/netlabel_domainhash.c
@@ -171,7 +171,7 @@ static struct netlbl_dom_map *netlbl_domhsh_search_def(const char *domain)
 * values on error.
 *
 */
-int netlbl_domhsh_init(u32 size)
+int __init netlbl_domhsh_init(u32 size)
 {
        u32 iter;
        struct netlbl_domhsh_tbl *hsh_tbl;
diff --git a/net/netlabel/netlabel_mgmt.c b/net/netlabel/netlabel_mgmt.c
index e2258dc3c845..22c191267808 100644
--- a/net/netlabel/netlabel_mgmt.c
+++ b/net/netlabel/netlabel_mgmt.c
@@ -517,68 +517,63 @@ version_failure:
 * NetLabel Generic NETLINK Command Definitions
 */
-static struct genl_ops netlbl_mgmt_genl_c_add = {
+static struct genl_ops netlbl_mgmt_genl_ops[] = {
+        {
        .cmd = NLBL_MGMT_C_ADD,
        .flags = GENL_ADMIN_PERM,
        .policy = netlbl_mgmt_genl_policy,
        .doit = netlbl_mgmt_add,
        .dumpit = NULL,
-};
+        },
+        {
-static struct genl_ops netlbl_mgmt_genl_c_remove = {
        .cmd = NLBL_MGMT_C_REMOVE,
        .flags = GENL_ADMIN_PERM,
        .policy = netlbl_mgmt_genl_policy,
        .doit = netlbl_mgmt_remove,
        .dumpit = NULL,
-};
+        },
+        {
-static struct genl_ops netlbl_mgmt_genl_c_listall = {
        .cmd = NLBL_MGMT_C_LISTALL,
        .flags = 0,
        .policy = netlbl_mgmt_genl_policy,
        .doit = NULL,
        .dumpit = netlbl_mgmt_listall,
-};
+        },
+        {
-static struct genl_ops netlbl_mgmt_genl_c_adddef = {
        .cmd = NLBL_MGMT_C_ADDDEF,
        .flags = GENL_ADMIN_PERM,
        .policy = netlbl_mgmt_genl_policy,
        .doit = netlbl_mgmt_adddef,
        .dumpit = NULL,
-};
+        },
+        {
-static struct genl_ops netlbl_mgmt_genl_c_removedef = {
        .cmd = NLBL_MGMT_C_REMOVEDEF,
        .flags = GENL_ADMIN_PERM,
        .policy = netlbl_mgmt_genl_policy,
        .doit = netlbl_mgmt_removedef,
        .dumpit = NULL,
-};
+        },
+        {
-static struct genl_ops netlbl_mgmt_genl_c_listdef = {
        .cmd = NLBL_MGMT_C_LISTDEF,
        .flags = 0,
        .policy = netlbl_mgmt_genl_policy,
        .doit = netlbl_mgmt_listdef,
        .dumpit = NULL,
-};
+        },
+        {
-static struct genl_ops netlbl_mgmt_genl_c_protocols = {
        .cmd = NLBL_MGMT_C_PROTOCOLS,
        .flags = 0,
        .policy = netlbl_mgmt_genl_policy,
        .doit = NULL,
        .dumpit = netlbl_mgmt_protocols,
-};
+        },
+        {
-static struct genl_ops netlbl_mgmt_genl_c_version = {
        .cmd = NLBL_MGMT_C_VERSION,
        .flags = 0,
        .policy = netlbl_mgmt_genl_policy,
        .doit = netlbl_mgmt_version,
        .dumpit = NULL,
+        },
 };
 /*
@@ -593,46 +588,20 @@ static struct genl_ops netlbl_mgmt_genl_c_version = {
 * mechanism.  Returns zero on success, negative values on failure.
 *
 */
-int netlbl_mgmt_genl_init(void)
+int __init netlbl_mgmt_genl_init(void)
 {
-        int ret_val;
+        int ret_val, i;
        ret_val = genl_register_family(&netlbl_mgmt_gnl_family);
        if (ret_val != 0)
                return ret_val;
-        ret_val = genl_register_ops(&netlbl_mgmt_gnl_family,
+        for (i = 0; i < ARRAY_SIZE(netlbl_mgmt_genl_ops); i++) {
-                                    &netlbl_mgmt_genl_c_add);
+                ret_val = genl_register_ops(&netlbl_mgmt_gnl_family,
-        if (ret_val != 0)
+                                &netlbl_mgmt_genl_ops[i]);
-                return ret_val;
+                if (ret_val != 0)
-        ret_val = genl_register_ops(&netlbl_mgmt_gnl_family,
+                        return ret_val;
-                                    &netlbl_mgmt_genl_c_remove);
+        }
-        if (ret_val != 0)
-                return ret_val;
-        ret_val = genl_register_ops(&netlbl_mgmt_gnl_family,
-                                    &netlbl_mgmt_genl_c_listall);
-        if (ret_val != 0)
-                return ret_val;
-        ret_val = genl_register_ops(&netlbl_mgmt_gnl_family,
-                                    &netlbl_mgmt_genl_c_adddef);
-        if (ret_val != 0)
-                return ret_val;
-        ret_val = genl_register_ops(&netlbl_mgmt_gnl_family,
-                                    &netlbl_mgmt_genl_c_removedef);
-        if (ret_val != 0)
-                return ret_val;
-        ret_val = genl_register_ops(&netlbl_mgmt_gnl_family,
-                                    &netlbl_mgmt_genl_c_listdef);
-        if (ret_val != 0)
-                return ret_val;
-        ret_val = genl_register_ops(&netlbl_mgmt_gnl_family,
-                                    &netlbl_mgmt_genl_c_protocols);
-        if (ret_val != 0)
-                return ret_val;
-        ret_val = genl_register_ops(&netlbl_mgmt_gnl_family,
-                                    &netlbl_mgmt_genl_c_version);
-        if (ret_val != 0)
-                return ret_val;
        return 0;
 }
diff --git a/net/netlabel/netlabel_unlabeled.c b/net/netlabel/netlabel_unlabeled.c
index 3e745b72fded..4478f2f6079d 100644
--- a/net/netlabel/netlabel_unlabeled.c
+++ b/net/netlabel/netlabel_unlabeled.c
@@ -1553,68 +1553,63 @@ unlabel_staticlistdef_return:
 * NetLabel Generic NETLINK Command Definitions
 */
-static struct genl_ops netlbl_unlabel_genl_c_staticadd = {
+static struct genl_ops netlbl_unlabel_genl_ops[] = {
+        {
        .cmd = NLBL_UNLABEL_C_STATICADD,
        .flags = GENL_ADMIN_PERM,
        .policy = netlbl_unlabel_genl_policy,
        .doit = netlbl_unlabel_staticadd,
        .dumpit = NULL,
-};
+        },
+        {
-static struct genl_ops netlbl_unlabel_genl_c_staticremove = {
        .cmd = NLBL_UNLABEL_C_STATICREMOVE,
        .flags = GENL_ADMIN_PERM,
        .policy = netlbl_unlabel_genl_policy,
        .doit = netlbl_unlabel_staticremove,
        .dumpit = NULL,
-};
+        },
+        {
-static struct genl_ops netlbl_unlabel_genl_c_staticlist = {
        .cmd = NLBL_UNLABEL_C_STATICLIST,
        .flags = 0,
        .policy = netlbl_unlabel_genl_policy,
        .doit = NULL,
        .dumpit = netlbl_unlabel_staticlist,
-};
+        },
+        {
-static struct genl_ops netlbl_unlabel_genl_c_staticadddef = {
        .cmd = NLBL_UNLABEL_C_STATICADDDEF,
        .flags = GENL_ADMIN_PERM,
        .policy = netlbl_unlabel_genl_policy,
        .doit = netlbl_unlabel_staticadddef,
        .dumpit = NULL,
-};
+        },
+        {
-static struct genl_ops netlbl_unlabel_genl_c_staticremovedef = {
        .cmd = NLBL_UNLABEL_C_STATICREMOVEDEF,
        .flags = GENL_ADMIN_PERM,
        .policy = netlbl_unlabel_genl_policy,
        .doit = netlbl_unlabel_staticremovedef,
        .dumpit = NULL,
-};
+        },
+        {
-static struct genl_ops netlbl_unlabel_genl_c_staticlistdef = {
        .cmd = NLBL_UNLABEL_C_STATICLISTDEF,
        .flags = 0,
        .policy = netlbl_unlabel_genl_policy,
        .doit = NULL,
        .dumpit = netlbl_unlabel_staticlistdef,
-};
+        },
+        {
-static struct genl_ops netlbl_unlabel_genl_c_accept = {
        .cmd = NLBL_UNLABEL_C_ACCEPT,
        .flags = GENL_ADMIN_PERM,
        .policy = netlbl_unlabel_genl_policy,
        .doit = netlbl_unlabel_accept,
        .dumpit = NULL,
-};
+        },
+        {
-static struct genl_ops netlbl_unlabel_genl_c_list = {
        .cmd = NLBL_UNLABEL_C_LIST,
        .flags = 0,
        .policy = netlbl_unlabel_genl_policy,
        .doit = netlbl_unlabel_list,
        .dumpit = NULL,
+        },
 };
 /*
@@ -1629,53 +1624,20 @@ static struct genl_ops netlbl_unlabel_genl_c_list = {
 * mechanism.  Returns zero on success, negative values on failure.
 *
 */
-int netlbl_unlabel_genl_init(void)
+int __init netlbl_unlabel_genl_init(void)
 {
-        int ret_val;
+        int ret_val, i;
        ret_val = genl_register_family(&netlbl_unlabel_gnl_family);
        if (ret_val != 0)
                return ret_val;
-        ret_val = genl_register_ops(&netlbl_unlabel_gnl_family,
+        for (i = 0; i < ARRAY_SIZE(netlbl_unlabel_genl_ops); i++) {
-                                    &netlbl_unlabel_genl_c_staticadd);
+                ret_val = genl_register_ops(&netlbl_unlabel_gnl_family,
-        if (ret_val != 0)
+                                &netlbl_unlabel_genl_ops[i]);
-                return ret_val;
+                if (ret_val != 0)
+                        return ret_val;
-        ret_val = genl_register_ops(&netlbl_unlabel_gnl_family,
+        }
-                                    &netlbl_unlabel_genl_c_staticremove);
-        if (ret_val != 0)
-                return ret_val;
-        ret_val = genl_register_ops(&netlbl_unlabel_gnl_family,
-                                    &netlbl_unlabel_genl_c_staticlist);
-        if (ret_val != 0)
-                return ret_val;
-        ret_val = genl_register_ops(&netlbl_unlabel_gnl_family,
-                                    &netlbl_unlabel_genl_c_staticadddef);
-        if (ret_val != 0)
-                return ret_val;
-        ret_val = genl_register_ops(&netlbl_unlabel_gnl_family,
-                                    &netlbl_unlabel_genl_c_staticremovedef);
-        if (ret_val != 0)
-                return ret_val;
-        ret_val = genl_register_ops(&netlbl_unlabel_gnl_family,
-                                    &netlbl_unlabel_genl_c_staticlistdef);
-        if (ret_val != 0)
-                return ret_val;
-        ret_val = genl_register_ops(&netlbl_unlabel_gnl_family,
-                                    &netlbl_unlabel_genl_c_accept);
-        if (ret_val != 0)
-                return ret_val;
-        ret_val = genl_register_ops(&netlbl_unlabel_gnl_family,
-                                    &netlbl_unlabel_genl_c_list);
-        if (ret_val != 0)
-                return ret_val;
        return 0;
 }
@@ -1699,7 +1661,7 @@ static struct notifier_block netlbl_unlhsh_netdev_notifier = {
 * non-zero values on error.
 *
 */
-int netlbl_unlabel_init(u32 size)
+int __init netlbl_unlabel_init(u32 size)
 {
        u32 iter;
        struct netlbl_unlhsh_tbl *hsh_tbl;
@@ -1803,7 +1765,7 @@ unlabel_getattr_nolabel:
 * and to send unlabeled network traffic by default.
 *
 */
-int netlbl_unlabel_defconf(void)
+int __init netlbl_unlabel_defconf(void)
 {
        int ret_val;
        struct netlbl_dom_map *entry;
diff --git a/net/netlabel/netlabel_user.c b/net/netlabel/netlabel_user.c
index 023fc8fe840d..b17d4203806e 100644
--- a/net/netlabel/netlabel_user.c
+++ b/net/netlabel/netlabel_user.c
@@ -59,7 +59,7 @@
 * non-zero on failure.
 *
 */
-int netlbl_netlink_init(void)
+int __init netlbl_netlink_init(void)
 {
        int ret_val;
diff --git a/net/rfkill/rfkill.c b/net/rfkill/rfkill.c
index 1a47f5d1be17..140a0a8c6b02 100644
--- a/net/rfkill/rfkill.c
+++ b/net/rfkill/rfkill.c
@@ -232,7 +232,7 @@ static int rfkill_suspend(struct device *dev, pm_message_t state)
        struct rfkill *rfkill = to_rfkill(dev);
        if (dev->power.power_state.event != state.event) {
-                if (state.event == PM_EVENT_SUSPEND) {
+                if (state.event & PM_EVENT_SLEEP) {
                        mutex_lock(&rfkill->mutex);
                        if (rfkill->state == RFKILL_STATE_ON)
diff --git a/net/rxrpc/ar-accept.c b/net/rxrpc/ar-accept.c
index 92a87fde8bfe..bdfb77417794 100644
--- a/net/rxrpc/ar-accept.c
+++ b/net/rxrpc/ar-accept.c
@@ -156,8 +156,7 @@ static int rxrpc_accept_incoming_call(struct rxrpc_local *local,
                                                  false);
                        spin_unlock(&call->lock);
                        notification = NULL;
-                        if (ret < 0)
+                        BUG_ON(ret < 0);
-                                BUG();
                }
                spin_unlock(&call->conn->state_lock);
diff --git a/net/rxrpc/ar-ack.c b/net/rxrpc/ar-ack.c
index 657ee69f2133..3ac1672e1070 100644
--- a/net/rxrpc/ar-ack.c
+++ b/net/rxrpc/ar-ack.c
@@ -814,8 +814,7 @@ static int rxrpc_post_message(struct rxrpc_call *call, u32 mark, u32 error,
                spin_lock_bh(&call->lock);
                ret = rxrpc_queue_rcv_skb(call, skb, true, fatal);
                spin_unlock_bh(&call->lock);
-                if (ret < 0)
+                BUG_ON(ret < 0);
-                        BUG();
        }
        return 0;
diff --git a/net/sctp/socket.c b/net/sctp/socket.c
index d47d5787e2e5..44797ad88a05 100644
--- a/net/sctp/socket.c
+++ b/net/sctp/socket.c
@@ -6488,6 +6488,7 @@ struct proto sctp_prot = {
        .memory_pressure = &sctp_memory_pressure,
        .enter_memory_pressure = sctp_enter_memory_pressure,
        .memory_allocated = &sctp_memory_allocated,
+        .sockets_allocated = &sctp_sockets_allocated,
        REF_PROTO_INUSE(sctp)
 };
@@ -6521,6 +6522,7 @@ struct proto sctpv6_prot = {
        .memory_pressure = &sctp_memory_pressure,
        .enter_memory_pressure = sctp_enter_memory_pressure,
        .memory_allocated = &sctp_memory_allocated,
+        .sockets_allocated = &sctp_sockets_allocated,
        REF_PROTO_INUSE(sctpv6)
 };
 #endif /* defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE) */
diff --git a/net/sunrpc/svcsock.c b/net/sunrpc/svcsock.c
index 1d3e5fcc2cc4..c475977de05a 100644
--- a/net/sunrpc/svcsock.c
+++ b/net/sunrpc/svcsock.c
@@ -175,7 +175,7 @@ static int svc_sendto(struct svc_rqst *rqstp, struct xdr_buf *xdr)
        size_t          base = xdr->page_base;
        unsigned int    pglen = xdr->page_len;
        unsigned int    flags = MSG_MORE;
-        char            buf[RPC_MAX_ADDRBUFLEN];
+        RPC_IFDEBUG(char buf[RPC_MAX_ADDRBUFLEN]);
        slen = xdr->len;
@@ -716,7 +716,7 @@ static struct svc_xprt *svc_tcp_accept(struct svc_xprt *xprt)
        struct socket   *newsock;
        struct svc_sock *newsvsk;
        int             err, slen;
-        char            buf[RPC_MAX_ADDRBUFLEN];
+        RPC_IFDEBUG(char buf[RPC_MAX_ADDRBUFLEN]);
        dprintk("svc: tcp_accept %p sock %p\n", svsk, sock);
        if (!sock)
@@ -1206,10 +1206,10 @@ static struct svc_xprt *svc_create_socket(struct svc_serv *serv,
        struct socket   *sock;
        int             error;
        int             type;
-        char            buf[RPC_MAX_ADDRBUFLEN];
        struct sockaddr_storage addr;
        struct sockaddr *newsin = (struct sockaddr *)&addr;
        int             newlen;
+        RPC_IFDEBUG(char buf[RPC_MAX_ADDRBUFLEN]);
        dprintk("svc: svc_create_socket(%s, %d, %s)\n",
                        serv->sv_program->pg_name, protocol,
diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c
index 47219f98053f..9fc4c315f6cd 100644
--- a/net/xfrm/xfrm_policy.c
+++ b/net/xfrm/xfrm_policy.c
@@ -331,15 +331,31 @@ static void xfrm_dst_hash_transfer(struct hlist_head *list,
                                   struct hlist_head *ndsttable,
                                   unsigned int nhashmask)
 {
-        struct hlist_node *entry, *tmp;
+        struct hlist_node *entry, *tmp, *entry0 = NULL;
        struct xfrm_policy *pol;
+        unsigned int h0 = 0;
+redo:
        hlist_for_each_entry_safe(pol, entry, tmp, list, bydst) {
                unsigned int h;
                h = __addr_hash(&pol->selector.daddr, &pol->selector.saddr,
                                pol->family, nhashmask);
-                hlist_add_head(&pol->bydst, ndsttable+h);
+                if (!entry0) {
+                        hlist_del(entry);
+                        hlist_add_head(&pol->bydst, ndsttable+h);
+                        h0 = h;
+                } else {
+                        if (h != h0)
+                                continue;
+                        hlist_del(entry);
+                        hlist_add_after(entry0, &pol->bydst);
+                }
+                entry0 = entry;
+        }
+        if (!hlist_empty(list)) {
+                entry0 = NULL;
+                goto redo;
        }
 }