16 files changed, 122 insertions, 102 deletions

diff --git a/net/batman-adv/soft-interface.c b/net/batman-adv/soft-interface.c
index aceeabc2ca86..f9cc95728989 100644
--- a/net/batman-adv/soft-interface.c
+++ b/net/batman-adv/soft-interface.c
@@ -566,7 +566,7 @@ static int interface_tx(struct sk_buff *skb, struct net_device *soft_iface)
         struct orig_node *orig_node = NULL;
         int data_len = skb->len, ret;
         short vid = -1;
-        bool do_bcast = false;
+        bool do_bcast;
 
         if (atomic_read(&bat_priv->mesh_state) != MESH_ACTIVE)
                 goto dropped;
@@ -600,15 +600,15 @@ static int interface_tx(struct sk_buff *skb, struct net_device *soft_iface)
 
         orig_node = transtable_search(bat_priv, ethhdr->h_source,
                                       ethhdr->h_dest);
-        if (is_multicast_ether_addr(ethhdr->h_dest) ||
-                                (orig_node && orig_node->gw_flags)) {
+        do_bcast = is_multicast_ether_addr(ethhdr->h_dest);
+        if (do_bcast || (orig_node && orig_node->gw_flags)) {
                 ret = gw_is_target(bat_priv, skb, orig_node);
 
                 if (ret < 0)
                         goto dropped;
 
-                if (ret == 0)
-                        do_bcast = true;
+                if (ret)
+                        do_bcast = false;
         }
 
         /* ethernet packet should be broadcasted */
diff --git a/net/bridge/br_device.c b/net/bridge/br_device.c
index 28325d15773b..feb77ea7b58e 100644
--- a/net/bridge/br_device.c
+++ b/net/bridge/br_device.c
@@ -91,7 +91,6 @@ static int br_dev_open(struct net_device *dev)
 {
         struct net_bridge *br = netdev_priv(dev);
 
-        netif_carrier_off(dev);
         netdev_update_features(dev);
         netif_start_queue(dev);
         br_stp_enable_bridge(br);
@@ -108,8 +107,6 @@ static int br_dev_stop(struct net_device *dev)
 {
         struct net_bridge *br = netdev_priv(dev);
 
-        netif_carrier_off(dev);
-
         br_stp_disable_bridge(br);
         br_multicast_stop(br);
 
diff --git a/net/can/bcm.c b/net/can/bcm.c
index d6c8ae5b2e6a..c84963d2dee6 100644
--- a/net/can/bcm.c
+++ b/net/can/bcm.c
@@ -344,6 +344,18 @@ static void bcm_send_to_user(struct bcm_op *op, struct bcm_msg_head *head,
         }
 }
 
+static void bcm_tx_start_timer(struct bcm_op *op)
+{
+        if (op->kt_ival1.tv64 && op->count)
+                hrtimer_start(&op->timer,
+                              ktime_add(ktime_get(), op->kt_ival1),
+                              HRTIMER_MODE_ABS);
+        else if (op->kt_ival2.tv64)
+                hrtimer_start(&op->timer,
+                              ktime_add(ktime_get(), op->kt_ival2),
+                              HRTIMER_MODE_ABS);
+}
+
 static void bcm_tx_timeout_tsklet(unsigned long data)
 {
         struct bcm_op *op = (struct bcm_op *)data;
@@ -365,26 +377,12 @@ static void bcm_tx_timeout_tsklet(unsigned long data)
 
                         bcm_send_to_user(op, &msg_head, NULL, 0);
                 }
-        }
-
-        if (op->kt_ival1.tv64 && (op->count > 0)) {
-
-                /* send (next) frame */
                 bcm_can_tx(op);
-                hrtimer_start(&op->timer,
-                              ktime_add(ktime_get(), op->kt_ival1),
-                              HRTIMER_MODE_ABS);
 
-        } else {
-                if (op->kt_ival2.tv64) {
+        } else if (op->kt_ival2.tv64)
+                bcm_can_tx(op);
 
-                        /* send (next) frame */
-                        bcm_can_tx(op);
-                        hrtimer_start(&op->timer,
-                                      ktime_add(ktime_get(), op->kt_ival2),
-                                      HRTIMER_MODE_ABS);
-                }
-        }
+        bcm_tx_start_timer(op);
 }
 
 /*
@@ -964,23 +962,20 @@ static int bcm_tx_setup(struct bcm_msg_head *msg_head, struct msghdr *msg,
                         hrtimer_cancel(&op->timer);
         }
 
-        if ((op->flags & STARTTIMER) &&
-            ((op->kt_ival1.tv64 && op->count) || op->kt_ival2.tv64)) {
-
+        if (op->flags & STARTTIMER) {
+                hrtimer_cancel(&op->timer);
                 /* spec: send can_frame when starting timer */
                 op->flags |= TX_ANNOUNCE;
-
-                if (op->kt_ival1.tv64 && (op->count > 0)) {
-                        /* op->count-- is done in bcm_tx_timeout_handler */
-                        hrtimer_start(&op->timer, op->kt_ival1,
-                                      HRTIMER_MODE_REL);
-                } else
-                        hrtimer_start(&op->timer, op->kt_ival2,
-                                      HRTIMER_MODE_REL);
         }
 
-        if (op->flags & TX_ANNOUNCE)
+        if (op->flags & TX_ANNOUNCE) {
                 bcm_can_tx(op);
+                if (op->count)
+                        op->count--;
+        }
+
+        if (op->flags & STARTTIMER)
+                bcm_tx_start_timer(op);
 
         return msg_head->nframes * CFSIZ + MHSIZ;
 }
diff --git a/net/ceph/ceph_common.c b/net/ceph/ceph_common.c
index 132963abc266..2883ea01e680 100644
--- a/net/ceph/ceph_common.c
+++ b/net/ceph/ceph_common.c
@@ -232,6 +232,7 @@ void ceph_destroy_options(struct ceph_options *opt)
                 ceph_crypto_key_destroy(opt->key);
                 kfree(opt->key);
         }
+        kfree(opt->mon_addr);
         kfree(opt);
 }
 EXPORT_SYMBOL(ceph_destroy_options);
diff --git a/net/ceph/messenger.c b/net/ceph/messenger.c
index c340e2e0765b..9918e9eb276e 100644
--- a/net/ceph/messenger.c
+++ b/net/ceph/messenger.c
@@ -2307,6 +2307,7 @@ struct ceph_msg *ceph_msg_new(int type, int front_len, gfp_t flags)
         m->front_max = front_len;
         m->front_is_vmalloc = false;
         m->more_to_follow = false;
+        m->ack_stamp = 0;
         m->pool = NULL;
 
         /* middle */
diff --git a/net/ceph/osd_client.c b/net/ceph/osd_client.c
index 16836a7df7a6..88ad8a2501b5 100644
--- a/net/ceph/osd_client.c
+++ b/net/ceph/osd_client.c
@@ -217,6 +217,7 @@ struct ceph_osd_request *ceph_osdc_alloc_request(struct ceph_osd_client *osdc,
         INIT_LIST_HEAD(&req->r_unsafe_item);
         INIT_LIST_HEAD(&req->r_linger_item);
         INIT_LIST_HEAD(&req->r_linger_osd);
+        INIT_LIST_HEAD(&req->r_req_lru_item);
         req->r_flags = flags;
 
         WARN_ON((flags & (CEPH_OSD_FLAG_READ|CEPH_OSD_FLAG_WRITE)) == 0);
@@ -816,13 +817,10 @@ static void __register_request(struct ceph_osd_client *osdc,
 {
         req->r_tid = ++osdc->last_tid;
         req->r_request->hdr.tid = cpu_to_le64(req->r_tid);
-        INIT_LIST_HEAD(&req->r_req_lru_item);
-
         dout("__register_request %p tid %lld\n", req, req->r_tid);
         __insert_request(osdc, req);
         ceph_osdc_get_request(req);
         osdc->num_requests++;
-
         if (osdc->num_requests == 1) {
                 dout(" first request, scheduling timeout\n");
                 __schedule_osd_timeout(osdc);
diff --git a/net/ceph/osdmap.c b/net/ceph/osdmap.c
index e97c3588c3ec..fd863fe76934 100644
--- a/net/ceph/osdmap.c
+++ b/net/ceph/osdmap.c
@@ -339,6 +339,7 @@ static int __insert_pg_mapping(struct ceph_pg_mapping *new,
         struct ceph_pg_mapping *pg = NULL;
         int c;
 
+        dout("__insert_pg_mapping %llx %p\n", *(u64 *)&new->pgid, new);
         while (*p) {
                 parent = *p;
                 pg = rb_entry(parent, struct ceph_pg_mapping, node);
@@ -366,16 +367,33 @@ static struct ceph_pg_mapping *__lookup_pg_mapping(struct rb_root *root,
         while (n) {
                 pg = rb_entry(n, struct ceph_pg_mapping, node);
                 c = pgid_cmp(pgid, pg->pgid);
-                if (c < 0)
+                if (c < 0) {
                         n = n->rb_left;
-                else if (c > 0)
+                } else if (c > 0) {
                         n = n->rb_right;
-                else
+                } else {
+                        dout("__lookup_pg_mapping %llx got %p\n",
+                             *(u64 *)&pgid, pg);
                         return pg;
+                }
         }
         return NULL;
 }
 
+static int __remove_pg_mapping(struct rb_root *root, struct ceph_pg pgid)
+{
+        struct ceph_pg_mapping *pg = __lookup_pg_mapping(root, pgid);
+
+        if (pg) {
+                dout("__remove_pg_mapping %llx %p\n", *(u64 *)&pgid, pg);
+                rb_erase(&pg->node, root);
+                kfree(pg);
+                return 0;
+        }
+        dout("__remove_pg_mapping %llx dne\n", *(u64 *)&pgid);
+        return -ENOENT;
+}
+
 /*
  * rbtree of pg pool info
  */
@@ -711,7 +729,6 @@ struct ceph_osdmap *osdmap_apply_incremental(void **p, void *end,
         void *start = *p;
         int err = -EINVAL;
         u16 version;
-        struct rb_node *rbp;
 
         ceph_decode_16_safe(p, end, version, bad);
         if (version > CEPH_OSDMAP_INC_VERSION) {
@@ -861,7 +878,6 @@ struct ceph_osdmap *osdmap_apply_incremental(void **p, void *end,
         }
 
         /* new_pg_temp */
-        rbp = rb_first(&map->pg_temp);
         ceph_decode_32_safe(p, end, len, bad);
         while (len--) {
                 struct ceph_pg_mapping *pg;
@@ -872,18 +888,6 @@ struct ceph_osdmap *osdmap_apply_incremental(void **p, void *end,
                 ceph_decode_copy(p, &pgid, sizeof(pgid));
                 pglen = ceph_decode_32(p);
 
-                /* remove any? */
-                while (rbp && pgid_cmp(rb_entry(rbp, struct ceph_pg_mapping,
-                                                node)->pgid, pgid) <= 0) {
-                        struct ceph_pg_mapping *cur =
-                                rb_entry(rbp, struct ceph_pg_mapping, node);
-
-                        rbp = rb_next(rbp);
-                        dout(" removed pg_temp %llx\n", *(u64 *)&cur->pgid);
-                        rb_erase(&cur->node, &map->pg_temp);
-                        kfree(cur);
-                }
-
                 if (pglen) {
                         /* insert */
                         ceph_decode_need(p, end, pglen*sizeof(u32), bad);
@@ -903,17 +907,11 @@ struct ceph_osdmap *osdmap_apply_incremental(void **p, void *end,
                         }
                         dout(" added pg_temp %llx len %d\n", *(u64 *)&pgid,
                              pglen);
+                } else {
+                        /* remove */
+                        __remove_pg_mapping(&map->pg_temp, pgid);
                 }
         }
-        while (rbp) {
-                struct ceph_pg_mapping *cur =
-                        rb_entry(rbp, struct ceph_pg_mapping, node);
-
-                rbp = rb_next(rbp);
-                dout(" removed pg_temp %llx\n", *(u64 *)&cur->pgid);
-                rb_erase(&cur->node, &map->pg_temp);
-                kfree(cur);
-        }
 
         /* ignore the rest */
         *p = end;
@@ -1046,10 +1044,25 @@ static int *calc_pg_raw(struct ceph_osdmap *osdmap, struct ceph_pg pgid,
         struct ceph_pg_mapping *pg;
         struct ceph_pg_pool_info *pool;
         int ruleno;
-        unsigned poolid, ps, pps;
+        unsigned poolid, ps, pps, t;
         int preferred;
 
+        poolid = le32_to_cpu(pgid.pool);
+        ps = le16_to_cpu(pgid.ps);
+        preferred = (s16)le16_to_cpu(pgid.preferred);
+
+        pool = __lookup_pg_pool(&osdmap->pg_pools, poolid);
+        if (!pool)
+                return NULL;
+
         /* pg_temp? */
+        if (preferred >= 0)
+                t = ceph_stable_mod(ps, le32_to_cpu(pool->v.lpg_num),
+                                    pool->lpgp_num_mask);
+        else
+                t = ceph_stable_mod(ps, le32_to_cpu(pool->v.pg_num),
+                                    pool->pgp_num_mask);
+        pgid.ps = cpu_to_le16(t);
         pg = __lookup_pg_mapping(&osdmap->pg_temp, pgid);
         if (pg) {
                 *num = pg->len;
@@ -1057,18 +1070,6 @@ static int *calc_pg_raw(struct ceph_osdmap *osdmap, struct ceph_pg pgid,
         }
 
         /* crush */
-        poolid = le32_to_cpu(pgid.pool);
-        ps = le16_to_cpu(pgid.ps);
-        preferred = (s16)le16_to_cpu(pgid.preferred);
-
-        /* don't forcefeed bad device ids to crush */
-        if (preferred >= osdmap->max_osd ||
-            preferred >= osdmap->crush->max_devices)
-                preferred = -1;
-
-        pool = __lookup_pg_pool(&osdmap->pg_pools, poolid);
-        if (!pool)
-                return NULL;
         ruleno = crush_find_rule(osdmap->crush, pool->v.crush_ruleset,
                                  pool->v.type, pool->v.size);
         if (ruleno < 0) {
@@ -1078,6 +1079,11 @@ static int *calc_pg_raw(struct ceph_osdmap *osdmap, struct ceph_pg pgid,
                 return NULL;
         }
 
+        /* don't forcefeed bad device ids to crush */
+        if (preferred >= osdmap->max_osd ||
+            preferred >= osdmap->crush->max_devices)
+                preferred = -1;
+
         if (preferred >= 0)
                 pps = ceph_stable_mod(ps,
                                       le32_to_cpu(pool->v.lpgp_num),
diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
index 143221ebeb7a..81cae641c9a9 100644
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -1398,9 +1398,7 @@ static int tcp_shifted_skb(struct sock *sk, struct sk_buff *skb,
 
         BUG_ON(!pcount);
 
-        /* Tweak before seqno plays */
-        if (!tcp_is_fack(tp) && tcp_is_sack(tp) && tp->lost_skb_hint &&
-            !before(TCP_SKB_CB(tp->lost_skb_hint)->seq, TCP_SKB_CB(skb)->seq))
+        if (skb == tp->lost_skb_hint)
                 tp->lost_cnt_hint += pcount;
 
         TCP_SKB_CB(prev)->end_seq += shifted;
diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
index dd3fad9fb633..48da7cc41e23 100644
--- a/net/ipv4/tcp_ipv4.c
+++ b/net/ipv4/tcp_ipv4.c
@@ -927,18 +927,21 @@ int tcp_v4_md5_do_add(struct sock *sk, __be32 addr,
                         }
                         sk_nocaps_add(sk, NETIF_F_GSO_MASK);
                 }
-                if (tcp_alloc_md5sig_pool(sk) == NULL) {
+
+                md5sig = tp->md5sig_info;
+                if (md5sig->entries4 == 0 &&
+                    tcp_alloc_md5sig_pool(sk) == NULL) {
                         kfree(newkey);
                         return -ENOMEM;
                 }
-                md5sig = tp->md5sig_info;
 
                 if (md5sig->alloced4 == md5sig->entries4) {
                         keys = kmalloc((sizeof(*keys) *
                                         (md5sig->entries4 + 1)), GFP_ATOMIC);
                         if (!keys) {
                                 kfree(newkey);
-                                tcp_free_md5sig_pool();
+                                if (md5sig->entries4 == 0)
+                                        tcp_free_md5sig_pool();
                                 return -ENOMEM;
                         }
 
@@ -982,6 +985,7 @@ int tcp_v4_md5_do_del(struct sock *sk, __be32 addr)
                                 kfree(tp->md5sig_info->keys4);
                                 tp->md5sig_info->keys4 = NULL;
                                 tp->md5sig_info->alloced4 = 0;
+                                tcp_free_md5sig_pool();
                         } else if (tp->md5sig_info->entries4 != i) {
                                 /* Need to do some manipulation */
                                 memmove(&tp->md5sig_info->keys4[i],
@@ -989,7 +993,6 @@ int tcp_v4_md5_do_del(struct sock *sk, __be32 addr)
                                         (tp->md5sig_info->entries4 - i) *
                                          sizeof(struct tcp4_md5sig_key));
                         }
-                        tcp_free_md5sig_pool();
                         return 0;
                 }
         }
diff --git a/net/ipv6/ip6mr.c b/net/ipv6/ip6mr.c
index 705c82886281..def0538e2413 100644
--- a/net/ipv6/ip6mr.c
+++ b/net/ipv6/ip6mr.c
@@ -696,8 +696,10 @@ static netdev_tx_t reg_vif_xmit(struct sk_buff *skb,
         int err;
 
         err = ip6mr_fib_lookup(net, &fl6, &mrt);
-        if (err < 0)
+        if (err < 0) {
+                kfree_skb(skb);
                 return err;
+        }
 
         read_lock(&mrt_lock);
         dev->stats.tx_bytes += skb->len;
@@ -2052,8 +2054,10 @@ int ip6_mr_input(struct sk_buff *skb)
         int err;
 
         err = ip6mr_fib_lookup(net, &fl6, &mrt);
-        if (err < 0)
+        if (err < 0) {
+                kfree_skb(skb);
                 return err;
+        }
 
         read_lock(&mrt_lock);
         cache = ip6mr_cache_find(mrt,
diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index 1250f9020670..fb545edef6ea 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -244,7 +244,9 @@ static inline struct rt6_info *ip6_dst_alloc(struct dst_ops *ops,
 {
         struct rt6_info *rt = dst_alloc(ops, dev, 0, 0, flags);
 
-        memset(&rt->rt6i_table, 0, sizeof(*rt) - sizeof(struct dst_entry));
+        if (rt != NULL)
+                memset(&rt->rt6i_table, 0,
+                        sizeof(*rt) - sizeof(struct dst_entry));
 
         return rt;
 }
diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
index 00797d857667..5357902c7978 100644
--- a/net/ipv6/tcp_ipv6.c
+++ b/net/ipv6/tcp_ipv6.c
@@ -591,7 +591,8 @@ static int tcp_v6_md5_do_add(struct sock *sk, const struct in6_addr *peer,
                         }
                         sk_nocaps_add(sk, NETIF_F_GSO_MASK);
                 }
-                if (tcp_alloc_md5sig_pool(sk) == NULL) {
+                if (tp->md5sig_info->entries6 == 0 &&
+                        tcp_alloc_md5sig_pool(sk) == NULL) {
                         kfree(newkey);
                         return -ENOMEM;
                 }
@@ -600,8 +601,9 @@ static int tcp_v6_md5_do_add(struct sock *sk, const struct in6_addr *peer,
                                        (tp->md5sig_info->entries6 + 1)), GFP_ATOMIC);
 
                         if (!keys) {
-                                tcp_free_md5sig_pool();
                                 kfree(newkey);
+                                if (tp->md5sig_info->entries6 == 0)
+                                        tcp_free_md5sig_pool();
                                 return -ENOMEM;
                         }
 
@@ -647,6 +649,7 @@ static int tcp_v6_md5_do_del(struct sock *sk, const struct in6_addr *peer)
                                 kfree(tp->md5sig_info->keys6);
                                 tp->md5sig_info->keys6 = NULL;
                                 tp->md5sig_info->alloced6 = 0;
+                                tcp_free_md5sig_pool();
                         } else {
                                 /* shrink the database */
                                 if (tp->md5sig_info->entries6 != i)
@@ -655,7 +658,6 @@ static int tcp_v6_md5_do_del(struct sock *sk, const struct in6_addr *peer)
                                                 (tp->md5sig_info->entries6 - i)
                                                 * sizeof (tp->md5sig_info->keys6[0]));
                         }
-                        tcp_free_md5sig_pool();
                         return 0;
                 }
         }
@@ -1383,6 +1385,8 @@ static struct sock * tcp_v6_syn_recv_sock(struct sock *sk, struct sk_buff *skb,
                 newtp->af_specific = &tcp_sock_ipv6_mapped_specific;
 #endif
 
+                newnp->ipv6_ac_list = NULL;
+                newnp->ipv6_fl_list = NULL;
                 newnp->pktoptions  = NULL;
                 newnp->opt         = NULL;
                 newnp->mcast_oif   = inet6_iif(skb);
@@ -1447,6 +1451,7 @@ static struct sock * tcp_v6_syn_recv_sock(struct sock *sk, struct sk_buff *skb,
            First: no IPv4 options.
          */
         newinet->inet_opt = NULL;
+        newnp->ipv6_ac_list = NULL;
         newnp->ipv6_fl_list = NULL;
 
         /* Clone RX bits */
diff --git a/net/netfilter/ipvs/ip_vs_ctl.c b/net/netfilter/ipvs/ip_vs_ctl.c
index 2b771dc708a3..5290ac353a5e 100644
--- a/net/netfilter/ipvs/ip_vs_ctl.c
+++ b/net/netfilter/ipvs/ip_vs_ctl.c
@@ -3679,7 +3679,7 @@ int __net_init ip_vs_control_net_init(struct net *net)
         int idx;
         struct netns_ipvs *ipvs = net_ipvs(net);
 
-        ipvs->rs_lock = __RW_LOCK_UNLOCKED(ipvs->rs_lock);
+        rwlock_init(&ipvs->rs_lock);
 
         /* Initialize rs_table */
         for (idx = 0; idx < IP_VS_RTAB_SIZE; idx++)
diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
index 25e68f56b4ba..dac91abf4c0f 100644
--- a/net/packet/af_packet.c
+++ b/net/packet/af_packet.c
@@ -1720,7 +1720,10 @@ static int packet_rcv(struct sk_buff *skb, struct net_device *dev,
         return 0;
 
 drop_n_acct:
-        po->stats.tp_drops = atomic_inc_return(&sk->sk_drops);
+        spin_lock(&sk->sk_receive_queue.lock);
+        po->stats.tp_drops++;
+        atomic_inc(&sk->sk_drops);
+        spin_unlock(&sk->sk_receive_queue.lock);
 
 drop_n_restore:
         if (skb_head != skb->data && skb_shared(skb)) {
diff --git a/net/rds/iw_rdma.c b/net/rds/iw_rdma.c
index 8b77edbab272..4e1de171866c 100644
--- a/net/rds/iw_rdma.c
+++ b/net/rds/iw_rdma.c
@@ -84,7 +84,8 @@ static int rds_iw_map_fastreg(struct rds_iw_mr_pool *pool,
 static void rds_iw_free_fastreg(struct rds_iw_mr_pool *pool, struct rds_iw_mr *ibmr);
 static unsigned int rds_iw_unmap_fastreg_list(struct rds_iw_mr_pool *pool,
                         struct list_head *unmap_list,
-                        struct list_head *kill_list);
+                        struct list_head *kill_list,
+                        int *unpinned);
 static void rds_iw_destroy_fastreg(struct rds_iw_mr_pool *pool, struct rds_iw_mr *ibmr);
 
 static int rds_iw_get_device(struct rds_sock *rs, struct rds_iw_device **rds_iwdev, struct rdma_cm_id **cm_id)
@@ -499,7 +500,7 @@ static int rds_iw_flush_mr_pool(struct rds_iw_mr_pool *pool, int free_all)
         LIST_HEAD(unmap_list);
         LIST_HEAD(kill_list);
         unsigned long flags;
-        unsigned int nfreed = 0, ncleaned = 0, free_goal;
+        unsigned int nfreed = 0, ncleaned = 0, unpinned = 0, free_goal;
         int ret = 0;
 
         rds_iw_stats_inc(s_iw_rdma_mr_pool_flush);
@@ -524,7 +525,8 @@ static int rds_iw_flush_mr_pool(struct rds_iw_mr_pool *pool, int free_all)
          * will be destroyed by the unmap function.
          */
         if (!list_empty(&unmap_list)) {
-                ncleaned = rds_iw_unmap_fastreg_list(pool, &unmap_list, &kill_list);
+                ncleaned = rds_iw_unmap_fastreg_list(pool, &unmap_list,
+                                                     &kill_list, &unpinned);
                 /* If we've been asked to destroy all MRs, move those
                  * that were simply cleaned to the kill list */
                 if (free_all)
@@ -548,6 +550,7 @@ static int rds_iw_flush_mr_pool(struct rds_iw_mr_pool *pool, int free_all)
                 spin_unlock_irqrestore(&pool->list_lock, flags);
         }
 
+        atomic_sub(unpinned, &pool->free_pinned);
         atomic_sub(ncleaned, &pool->dirty_count);
         atomic_sub(nfreed, &pool->item_count);
 
@@ -828,7 +831,8 @@ static void rds_iw_free_fastreg(struct rds_iw_mr_pool *pool,
 
 static unsigned int rds_iw_unmap_fastreg_list(struct rds_iw_mr_pool *pool,
                                 struct list_head *unmap_list,
-                                struct list_head *kill_list)
+                                struct list_head *kill_list,
+                                int *unpinned)
 {
         struct rds_iw_mapping *mapping, *next;
         unsigned int ncleaned = 0;
@@ -855,6 +859,7 @@ static unsigned int rds_iw_unmap_fastreg_list(struct rds_iw_mr_pool *pool,
 
                 spin_lock_irqsave(&pool->list_lock, flags);
                 list_for_each_entry_safe(mapping, next, unmap_list, m_list) {
+                        *unpinned += mapping->m_sg.len;
                         list_move(&mapping->m_list, &laundered);
                         ncleaned++;
                 }
diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c
index 94fdcc7f1030..552df27dcf53 100644
--- a/net/xfrm/xfrm_policy.c
+++ b/net/xfrm/xfrm_policy.c
@@ -1349,14 +1349,16 @@ static inline struct xfrm_dst *xfrm_alloc_dst(struct net *net, int family)
                 BUG();
         }
         xdst = dst_alloc(dst_ops, NULL, 0, 0, 0);
-        memset(&xdst->u.rt6.rt6i_table, 0, sizeof(*xdst) - sizeof(struct dst_entry));
-        xfrm_policy_put_afinfo(afinfo);
 
-        if (likely(xdst))
+        if (likely(xdst)) {
+                memset(&xdst->u.rt6.rt6i_table, 0,
+                        sizeof(*xdst) - sizeof(struct dst_entry));
                 xdst->flo.ops = &xfrm_bundle_fc_ops;
-        else
+        } else
                 xdst = ERR_PTR(-ENOBUFS);
 
+        xfrm_policy_put_afinfo(afinfo);
+
         return xdst;
 }