36 files changed, 647 insertions, 311 deletions

diff --git a/net/bluetooth/bnep/core.c b/net/bluetooth/bnep/core.c
index f10b41fb05a0..5868597534e5 100644
--- a/net/bluetooth/bnep/core.c
+++ b/net/bluetooth/bnep/core.c
@@ -648,6 +648,7 @@ int bnep_del_connection(struct bnep_conndel_req *req)
 
 static void __bnep_copy_ci(struct bnep_conninfo *ci, struct bnep_session *s)
 {
+        memset(ci, 0, sizeof(*ci));
         memcpy(ci->dst, s->eh.h_source, ETH_ALEN);
         strcpy(ci->device, s->dev->name);
         ci->flags = s->flags;
diff --git a/net/bluetooth/cmtp/core.c b/net/bluetooth/cmtp/core.c
index ec0a1347f933..8e5f292529ac 100644
--- a/net/bluetooth/cmtp/core.c
+++ b/net/bluetooth/cmtp/core.c
@@ -78,6 +78,7 @@ static void __cmtp_unlink_session(struct cmtp_session *session)
 
 static void __cmtp_copy_session(struct cmtp_session *session, struct cmtp_conninfo *ci)
 {
+        memset(ci, 0, sizeof(*ci));
         bacpy(&ci->bdaddr, &session->bdaddr);
 
         ci->flags = session->flags;
diff --git a/net/bluetooth/hci_conn.c b/net/bluetooth/hci_conn.c
index 0b1e460fe440..6b90a4191734 100644
--- a/net/bluetooth/hci_conn.c
+++ b/net/bluetooth/hci_conn.c
@@ -39,7 +39,7 @@
 #include <net/sock.h>
 
 #include <asm/system.h>
-#include <asm/uaccess.h>
+#include <linux/uaccess.h>
 #include <asm/unaligned.h>
 
 #include <net/bluetooth/bluetooth.h>
@@ -66,7 +66,8 @@ void hci_acl_connect(struct hci_conn *conn)
         bacpy(&cp.bdaddr, &conn->dst);
         cp.pscan_rep_mode = 0x02;
 
-        if ((ie = hci_inquiry_cache_lookup(hdev, &conn->dst))) {
+        ie = hci_inquiry_cache_lookup(hdev, &conn->dst);
+        if (ie) {
                 if (inquiry_entry_age(ie) <= INQUIRY_ENTRY_AGE_MAX) {
                         cp.pscan_rep_mode = ie->data.pscan_rep_mode;
                         cp.pscan_mode     = ie->data.pscan_mode;
@@ -368,8 +369,10 @@ struct hci_conn *hci_connect(struct hci_dev *hdev, int type, bdaddr_t *dst, __u8
 
         BT_DBG("%s dst %s", hdev->name, batostr(dst));
 
-        if (!(acl = hci_conn_hash_lookup_ba(hdev, ACL_LINK, dst))) {
-                if (!(acl = hci_conn_add(hdev, ACL_LINK, dst)))
+        acl = hci_conn_hash_lookup_ba(hdev, ACL_LINK, dst);
+        if (!acl) {
+                acl = hci_conn_add(hdev, ACL_LINK, dst);
+                if (!acl)
                         return NULL;
         }
 
@@ -389,8 +392,10 @@ struct hci_conn *hci_connect(struct hci_dev *hdev, int type, bdaddr_t *dst, __u8
         if (type == ACL_LINK)
                 return acl;
 
-        if (!(sco = hci_conn_hash_lookup_ba(hdev, type, dst))) {
-                if (!(sco = hci_conn_add(hdev, type, dst))) {
+        sco = hci_conn_hash_lookup_ba(hdev, type, dst);
+        if (!sco) {
+                sco = hci_conn_add(hdev, type, dst);
+                if (!sco) {
                         hci_conn_put(acl);
                         return NULL;
                 }
@@ -647,10 +652,12 @@ int hci_get_conn_list(void __user *arg)
 
         size = sizeof(req) + req.conn_num * sizeof(*ci);
 
-        if (!(cl = kmalloc(size, GFP_KERNEL)))
+        cl = kmalloc(size, GFP_KERNEL);
+        if (!cl)
                 return -ENOMEM;
 
-        if (!(hdev = hci_dev_get(req.dev_id))) {
+        hdev = hci_dev_get(req.dev_id);
+        if (!hdev) {
                 kfree(cl);
                 return -ENODEV;
         }
diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c
index bc2a052e518b..51c61f75a797 100644
--- a/net/bluetooth/hci_core.c
+++ b/net/bluetooth/hci_core.c
@@ -44,7 +44,7 @@
 #include <net/sock.h>
 
 #include <asm/system.h>
-#include <asm/uaccess.h>
+#include <linux/uaccess.h>
 #include <asm/unaligned.h>
 
 #include <net/bluetooth/bluetooth.h>
@@ -349,20 +349,23 @@ struct inquiry_entry *hci_inquiry_cache_lookup(struct hci_dev *hdev, bdaddr_t *b
 void hci_inquiry_cache_update(struct hci_dev *hdev, struct inquiry_data *data)
 {
         struct inquiry_cache *cache = &hdev->inq_cache;
-        struct inquiry_entry *e;
+        struct inquiry_entry *ie;
 
         BT_DBG("cache %p, %s", cache, batostr(&data->bdaddr));
 
-        if (!(e = hci_inquiry_cache_lookup(hdev, &data->bdaddr))) {
+        ie = hci_inquiry_cache_lookup(hdev, &data->bdaddr);
+        if (!ie) {
                 /* Entry not in the cache. Add new one. */
-                if (!(e = kzalloc(sizeof(struct inquiry_entry), GFP_ATOMIC)))
+                ie = kzalloc(sizeof(struct inquiry_entry), GFP_ATOMIC);
+                if (!ie)
                         return;
-                e->next     = cache->list;
-                cache->list = e;
+
+                ie->next = cache->list;
+                cache->list = ie;
         }
 
-        memcpy(&e->data, data, sizeof(*data));
-        e->timestamp = jiffies;
+        memcpy(&ie->data, data, sizeof(*data));
+        ie->timestamp = jiffies;
         cache->timestamp = jiffies;
 }
 
@@ -422,16 +425,20 @@ int hci_inquiry(void __user *arg)
 
         hci_dev_lock_bh(hdev);
         if (inquiry_cache_age(hdev) > INQUIRY_CACHE_AGE_MAX ||
-                                        inquiry_cache_empty(hdev) ||
-                                        ir.flags & IREQ_CACHE_FLUSH) {
+                                inquiry_cache_empty(hdev) ||
+                                ir.flags & IREQ_CACHE_FLUSH) {
                 inquiry_cache_flush(hdev);
                 do_inquiry = 1;
         }
         hci_dev_unlock_bh(hdev);
 
         timeo = ir.length * msecs_to_jiffies(2000);
-        if (do_inquiry && (err = hci_request(hdev, hci_inq_req, (unsigned long)&ir, timeo)) < 0)
-                goto done;
+
+        if (do_inquiry) {
+                err = hci_request(hdev, hci_inq_req, (unsigned long)&ir, timeo);
+                if (err < 0)
+                        goto done;
+        }
 
         /* for unlimited number of responses we will use buffer with 255 entries */
         max_rsp = (ir.num_rsp == 0) ? 255 : ir.num_rsp;
@@ -439,7 +446,8 @@ int hci_inquiry(void __user *arg)
         /* cache_dump can't sleep. Therefore we allocate temp buffer and then
          * copy it to the user space.
          */
-        if (!(buf = kmalloc(sizeof(struct inquiry_info) * max_rsp, GFP_KERNEL))) {
+        buf = kmalloc(sizeof(struct inquiry_info) *max_rsp, GFP_KERNEL);
+        if (!buf) {
                 err = -ENOMEM;
                 goto done;
         }
@@ -611,7 +619,8 @@ int hci_dev_close(__u16 dev)
         struct hci_dev *hdev;
         int err;
 
-        if (!(hdev = hci_dev_get(dev)))
+        hdev = hci_dev_get(dev);
+        if (!hdev)
                 return -ENODEV;
         err = hci_dev_do_close(hdev);
         hci_dev_put(hdev);
@@ -623,7 +632,8 @@ int hci_dev_reset(__u16 dev)
         struct hci_dev *hdev;
         int ret = 0;
 
-        if (!(hdev = hci_dev_get(dev)))
+        hdev = hci_dev_get(dev);
+        if (!hdev)
                 return -ENODEV;
 
         hci_req_lock(hdev);
@@ -663,7 +673,8 @@ int hci_dev_reset_stat(__u16 dev)
         struct hci_dev *hdev;
         int ret = 0;
 
-        if (!(hdev = hci_dev_get(dev)))
+        hdev = hci_dev_get(dev);
+        if (!hdev)
                 return -ENODEV;
 
         memset(&hdev->stat, 0, sizeof(struct hci_dev_stats));
@@ -682,7 +693,8 @@ int hci_dev_cmd(unsigned int cmd, void __user *arg)
         if (copy_from_user(&dr, arg, sizeof(dr)))
                 return -EFAULT;
 
-        if (!(hdev = hci_dev_get(dr.dev_id)))
+        hdev = hci_dev_get(dr.dev_id);
+        if (!hdev)
                 return -ENODEV;
 
         switch (cmd) {
@@ -763,7 +775,8 @@ int hci_get_dev_list(void __user *arg)
 
         size = sizeof(*dl) + dev_num * sizeof(*dr);
 
-        if (!(dl = kzalloc(size, GFP_KERNEL)))
+        dl = kzalloc(size, GFP_KERNEL);
+        if (!dl)
                 return -ENOMEM;
 
         dr = dl->dev_req;
@@ -797,7 +810,8 @@ int hci_get_dev_info(void __user *arg)
         if (copy_from_user(&di, arg, sizeof(di)))
                 return -EFAULT;
 
-        if (!(hdev = hci_dev_get(di.dev_id)))
+        hdev = hci_dev_get(di.dev_id);
+        if (!hdev)
                 return -ENODEV;
 
         strcpy(di.name, hdev->name);
@@ -905,7 +919,7 @@ int hci_register_dev(struct hci_dev *hdev)
         hdev->sniff_max_interval = 800;
         hdev->sniff_min_interval = 80;
 
-        tasklet_init(&hdev->cmd_task, hci_cmd_task,(unsigned long) hdev);
+        tasklet_init(&hdev->cmd_task, hci_cmd_task, (unsigned long) hdev);
         tasklet_init(&hdev->rx_task, hci_rx_task, (unsigned long) hdev);
         tasklet_init(&hdev->tx_task, hci_tx_task, (unsigned long) hdev);
 
@@ -1368,7 +1382,8 @@ void hci_send_acl(struct hci_conn *conn, struct sk_buff *skb, __u16 flags)
         bt_cb(skb)->pkt_type = HCI_ACLDATA_PKT;
         hci_add_acl_hdr(skb, conn->handle, flags | ACL_START);
 
-        if (!(list = skb_shinfo(skb)->frag_list)) {
+        list = skb_shinfo(skb)->frag_list;
+        if (!list) {
                 /* Non fragmented */
                 BT_DBG("%s nonfrag skb %p len %d", hdev->name, skb, skb->len);
 
@@ -1609,7 +1624,8 @@ static inline void hci_acldata_packet(struct hci_dev *hdev, struct sk_buff *skb)
                 hci_conn_enter_active_mode(conn);
 
                 /* Send to upper protocol */
-                if ((hp = hci_proto[HCI_PROTO_L2CAP]) && hp->recv_acldata) {
+                hp = hci_proto[HCI_PROTO_L2CAP];
+                if (hp && hp->recv_acldata) {
                         hp->recv_acldata(conn, skb, flags);
                         return;
                 }
@@ -1644,7 +1660,8 @@ static inline void hci_scodata_packet(struct hci_dev *hdev, struct sk_buff *skb)
                 register struct hci_proto *hp;
 
                 /* Send to upper protocol */
-                if ((hp = hci_proto[HCI_PROTO_SCO]) && hp->recv_scodata) {
+                hp = hci_proto[HCI_PROTO_SCO];
+                if (hp && hp->recv_scodata) {
                         hp->recv_scodata(conn, skb);
                         return;
                 }
@@ -1727,7 +1744,8 @@ static void hci_cmd_task(unsigned long arg)
         if (atomic_read(&hdev->cmd_cnt) && (skb = skb_dequeue(&hdev->cmd_q))) {
                 kfree_skb(hdev->sent_cmd);
 
-                if ((hdev->sent_cmd = skb_clone(skb, GFP_ATOMIC))) {
+                hdev->sent_cmd = skb_clone(skb, GFP_ATOMIC);
+                if (hdev->sent_cmd) {
                         atomic_dec(&hdev->cmd_cnt);
                         hci_send_frame(skb);
                         hdev->cmd_last_tx = jiffies;
diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c
index 84093b0000b9..8923b36a67a2 100644
--- a/net/bluetooth/hci_event.c
+++ b/net/bluetooth/hci_event.c
@@ -39,7 +39,7 @@
 #include <net/sock.h>
 
 #include <asm/system.h>
-#include <asm/uaccess.h>
+#include <linux/uaccess.h>
 #include <asm/unaligned.h>
 
 #include <net/bluetooth/bluetooth.h>
@@ -677,9 +677,50 @@ static void hci_cs_set_conn_encrypt(struct hci_dev *hdev, __u8 status)
         hci_dev_unlock(hdev);
 }
 
+static int hci_outgoing_auth_needed(struct hci_dev *hdev,
+                                                struct hci_conn *conn)
+{
+        if (conn->state != BT_CONFIG || !conn->out)
+                return 0;
+
+        if (conn->sec_level == BT_SECURITY_SDP)
+                return 0;
+
+        /* Only request authentication for SSP connections or non-SSP
+         * devices with sec_level HIGH */
+        if (!(hdev->ssp_mode > 0 && conn->ssp_mode > 0) &&
+                                        conn->sec_level != BT_SECURITY_HIGH)
+                return 0;
+
+        return 1;
+}
+
 static void hci_cs_remote_name_req(struct hci_dev *hdev, __u8 status)
 {
+        struct hci_cp_remote_name_req *cp;
+        struct hci_conn *conn;
+
         BT_DBG("%s status 0x%x", hdev->name, status);
+
+        /* If successful wait for the name req complete event before
+         * checking for the need to do authentication */
+        if (!status)
+                return;
+
+        cp = hci_sent_cmd_data(hdev, HCI_OP_REMOTE_NAME_REQ);
+        if (!cp)
+                return;
+
+        hci_dev_lock(hdev);
+
+        conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
+        if (conn && hci_outgoing_auth_needed(hdev, conn)) {
+                struct hci_cp_auth_requested cp;
+                cp.handle = __cpu_to_le16(conn->handle);
+                hci_send_cmd(hdev, HCI_OP_AUTH_REQUESTED, sizeof(cp), &cp);
+        }
+
+        hci_dev_unlock(hdev);
 }
 
 static void hci_cs_read_remote_features(struct hci_dev *hdev, __u8 status)
@@ -955,12 +996,14 @@ static inline void hci_conn_request_evt(struct hci_dev *hdev, struct sk_buff *sk
 
                 hci_dev_lock(hdev);
 
-                if ((ie = hci_inquiry_cache_lookup(hdev, &ev->bdaddr)))
+                ie = hci_inquiry_cache_lookup(hdev, &ev->bdaddr);
+                if (ie)
                         memcpy(ie->data.dev_class, ev->dev_class, 3);
 
                 conn = hci_conn_hash_lookup_ba(hdev, ev->link_type, &ev->bdaddr);
                 if (!conn) {
-                        if (!(conn = hci_conn_add(hdev, ev->link_type, &ev->bdaddr))) {
+                        conn = hci_conn_add(hdev, ev->link_type, &ev->bdaddr);
+                        if (!conn) {
                                 BT_ERR("No memory for new connection");
                                 hci_dev_unlock(hdev);
                                 return;
@@ -1090,9 +1133,23 @@ static inline void hci_auth_complete_evt(struct hci_dev *hdev, struct sk_buff *s
 
 static inline void hci_remote_name_evt(struct hci_dev *hdev, struct sk_buff *skb)
 {
+        struct hci_ev_remote_name *ev = (void *) skb->data;
+        struct hci_conn *conn;
+
         BT_DBG("%s", hdev->name);
 
         hci_conn_check_pending(hdev);
+
+        hci_dev_lock(hdev);
+
+        conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
+        if (conn && hci_outgoing_auth_needed(hdev, conn)) {
+                struct hci_cp_auth_requested cp;
+                cp.handle = __cpu_to_le16(conn->handle);
+                hci_send_cmd(hdev, HCI_OP_AUTH_REQUESTED, sizeof(cp), &cp);
+        }
+
+        hci_dev_unlock(hdev);
 }
 
 static inline void hci_encrypt_change_evt(struct hci_dev *hdev, struct sk_buff *skb)
@@ -1162,33 +1219,39 @@ static inline void hci_remote_features_evt(struct hci_dev *hdev, struct sk_buff
         hci_dev_lock(hdev);
 
         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
-        if (conn) {
-                if (!ev->status)
-                        memcpy(conn->features, ev->features, 8);
+        if (!conn)
+                goto unlock;
 
-                if (conn->state == BT_CONFIG) {
-                        if (!ev->status && lmp_ssp_capable(hdev) &&
-                                                lmp_ssp_capable(conn)) {
-                                struct hci_cp_read_remote_ext_features cp;
-                                cp.handle = ev->handle;
-                                cp.page = 0x01;
-                                hci_send_cmd(hdev,
-                                        HCI_OP_READ_REMOTE_EXT_FEATURES,
-                                                        sizeof(cp), &cp);
-                        } else if (!ev->status && conn->out &&
-                                        conn->sec_level == BT_SECURITY_HIGH) {
-                                struct hci_cp_auth_requested cp;
-                                cp.handle = ev->handle;
-                                hci_send_cmd(hdev, HCI_OP_AUTH_REQUESTED,
+        if (!ev->status)
+                memcpy(conn->features, ev->features, 8);
+
+        if (conn->state != BT_CONFIG)
+                goto unlock;
+
+        if (!ev->status && lmp_ssp_capable(hdev) && lmp_ssp_capable(conn)) {
+                struct hci_cp_read_remote_ext_features cp;
+                cp.handle = ev->handle;
+                cp.page = 0x01;
+                hci_send_cmd(hdev, HCI_OP_READ_REMOTE_EXT_FEATURES,
                                                         sizeof(cp), &cp);
-                        } else {
-                                conn->state = BT_CONNECTED;
-                                hci_proto_connect_cfm(conn, ev->status);
-                                hci_conn_put(conn);
-                        }
-                }
+                goto unlock;
+        }
+
+        if (!ev->status) {
+                struct hci_cp_remote_name_req cp;
+                memset(&cp, 0, sizeof(cp));
+                bacpy(&cp.bdaddr, &conn->dst);
+                cp.pscan_rep_mode = 0x02;
+                hci_send_cmd(hdev, HCI_OP_REMOTE_NAME_REQ, sizeof(cp), &cp);
         }
 
+        if (!hci_outgoing_auth_needed(hdev, conn)) {
+                conn->state = BT_CONNECTED;
+                hci_proto_connect_cfm(conn, ev->status);
+                hci_conn_put(conn);
+        }
+
+unlock:
         hci_dev_unlock(hdev);
 }
 
@@ -1449,10 +1512,12 @@ static inline void hci_num_comp_pkts_evt(struct hci_dev *hdev, struct sk_buff *s
                         conn->sent -= count;
 
                         if (conn->type == ACL_LINK) {
-                                if ((hdev->acl_cnt += count) > hdev->acl_pkts)
+                                hdev->acl_cnt += count;
+                                if (hdev->acl_cnt > hdev->acl_pkts)
                                         hdev->acl_cnt = hdev->acl_pkts;
                         } else {
-                                if ((hdev->sco_cnt += count) > hdev->sco_pkts)
+                                hdev->sco_cnt += count;
+                                if (hdev->sco_cnt > hdev->sco_pkts)
                                         hdev->sco_cnt = hdev->sco_pkts;
                         }
                 }
@@ -1547,7 +1612,8 @@ static inline void hci_clock_offset_evt(struct hci_dev *hdev, struct sk_buff *sk
         if (conn && !ev->status) {
                 struct inquiry_entry *ie;
 
-                if ((ie = hci_inquiry_cache_lookup(hdev, &conn->dst))) {
+                ie = hci_inquiry_cache_lookup(hdev, &conn->dst);
+                if (ie) {
                         ie->data.clock_offset = ev->clock_offset;
                         ie->timestamp = jiffies;
                 }
@@ -1581,7 +1647,8 @@ static inline void hci_pscan_rep_mode_evt(struct hci_dev *hdev, struct sk_buff *
 
         hci_dev_lock(hdev);
 
-        if ((ie = hci_inquiry_cache_lookup(hdev, &ev->bdaddr))) {
+        ie = hci_inquiry_cache_lookup(hdev, &ev->bdaddr);
+        if (ie) {
                 ie->data.pscan_rep_mode = ev->pscan_rep_mode;
                 ie->timestamp = jiffies;
         }
@@ -1646,32 +1713,37 @@ static inline void hci_remote_ext_features_evt(struct hci_dev *hdev, struct sk_b
         hci_dev_lock(hdev);
 
         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
-        if (conn) {
-                if (!ev->status && ev->page == 0x01) {
-                        struct inquiry_entry *ie;
+        if (!conn)
+                goto unlock;
 
-                        if ((ie = hci_inquiry_cache_lookup(hdev, &conn->dst)))
-                                ie->data.ssp_mode = (ev->features[0] & 0x01);
+        if (!ev->status && ev->page == 0x01) {
+                struct inquiry_entry *ie;
 
-                        conn->ssp_mode = (ev->features[0] & 0x01);
-                }
+                ie = hci_inquiry_cache_lookup(hdev, &conn->dst);
+                if (ie)
+                        ie->data.ssp_mode = (ev->features[0] & 0x01);
 
-                if (conn->state == BT_CONFIG) {
-                        if (!ev->status && hdev->ssp_mode > 0 &&
-                                        conn->ssp_mode > 0 && conn->out &&
-                                        conn->sec_level != BT_SECURITY_SDP) {
-                                struct hci_cp_auth_requested cp;
-                                cp.handle = ev->handle;
-                                hci_send_cmd(hdev, HCI_OP_AUTH_REQUESTED,
-                                                        sizeof(cp), &cp);
-                        } else {
-                                conn->state = BT_CONNECTED;
-                                hci_proto_connect_cfm(conn, ev->status);
-                                hci_conn_put(conn);
-                        }
-                }
+                conn->ssp_mode = (ev->features[0] & 0x01);
         }
 
+        if (conn->state != BT_CONFIG)
+                goto unlock;
+
+        if (!ev->status) {
+                struct hci_cp_remote_name_req cp;
+                memset(&cp, 0, sizeof(cp));
+                bacpy(&cp.bdaddr, &conn->dst);
+                cp.pscan_rep_mode = 0x02;
+                hci_send_cmd(hdev, HCI_OP_REMOTE_NAME_REQ, sizeof(cp), &cp);
+        }
+
+        if (!hci_outgoing_auth_needed(hdev, conn)) {
+                conn->state = BT_CONNECTED;
+                hci_proto_connect_cfm(conn, ev->status);
+                hci_conn_put(conn);
+        }
+
+unlock:
         hci_dev_unlock(hdev);
 }
 
@@ -1821,7 +1893,8 @@ static inline void hci_remote_host_features_evt(struct hci_dev *hdev, struct sk_
 
         hci_dev_lock(hdev);
 
-        if ((ie = hci_inquiry_cache_lookup(hdev, &ev->bdaddr)))
+        ie = hci_inquiry_cache_lookup(hdev, &ev->bdaddr);
+        if (ie)
                 ie->data.ssp_mode = (ev->features[0] & 0x01);
 
         hci_dev_unlock(hdev);
diff --git a/net/bluetooth/hci_sock.c b/net/bluetooth/hci_sock.c
index 83acd164d39e..b3753bad2a55 100644
--- a/net/bluetooth/hci_sock.c
+++ b/net/bluetooth/hci_sock.c
@@ -43,7 +43,7 @@
 #include <net/sock.h>
 
 #include <asm/system.h>
-#include <asm/uaccess.h>
+#include <linux/uaccess.h>
 #include <asm/unaligned.h>
 
 #include <net/bluetooth/bluetooth.h>
@@ -125,7 +125,8 @@ void hci_send_to_sock(struct hci_dev *hdev, struct sk_buff *skb)
                                 continue;
                 }
 
-                if (!(nskb = skb_clone(skb, GFP_ATOMIC)))
+                nskb = skb_clone(skb, GFP_ATOMIC);
+                if (!nskb)
                         continue;
 
                 /* Put type byte before the data */
@@ -370,7 +371,8 @@ static int hci_sock_bind(struct socket *sock, struct sockaddr *addr, int addr_le
         }
 
         if (haddr->hci_dev != HCI_DEV_NONE) {
-                if (!(hdev = hci_dev_get(haddr->hci_dev))) {
+                hdev = hci_dev_get(haddr->hci_dev);
+                if (!hdev) {
                         err = -ENODEV;
                         goto done;
                 }
@@ -457,7 +459,8 @@ static int hci_sock_recvmsg(struct kiocb *iocb, struct socket *sock,
         if (sk->sk_state == BT_CLOSED)
                 return 0;
 
-        if (!(skb = skb_recv_datagram(sk, flags, noblock, &err)))
+        skb = skb_recv_datagram(sk, flags, noblock, &err);
+        if (!skb)
                 return err;
 
         msg->msg_namelen = 0;
@@ -499,7 +502,8 @@ static int hci_sock_sendmsg(struct kiocb *iocb, struct socket *sock,
 
         lock_sock(sk);
 
-        if (!(hdev = hci_pi(sk)->hdev)) {
+        hdev = hci_pi(sk)->hdev;
+        if (!hdev) {
                 err = -EBADFD;
                 goto done;
         }
@@ -509,7 +513,8 @@ static int hci_sock_sendmsg(struct kiocb *iocb, struct socket *sock,
                 goto done;
         }
 
-        if (!(skb = bt_skb_send_alloc(sk, len, msg->msg_flags & MSG_DONTWAIT, &err)))
+        skb = bt_skb_send_alloc(sk, len, msg->msg_flags & MSG_DONTWAIT, &err);
+        if (!skb)
                 goto done;
 
         if (memcpy_fromiovec(skb_put(skb, len), msg->msg_iov, len)) {
diff --git a/net/bluetooth/hidp/core.c b/net/bluetooth/hidp/core.c
index c0ee8b3928ed..29544c21f4b5 100644
--- a/net/bluetooth/hidp/core.c
+++ b/net/bluetooth/hidp/core.c
@@ -107,6 +107,7 @@ static void __hidp_unlink_session(struct hidp_session *session)
 
 static void __hidp_copy_session(struct hidp_session *session, struct hidp_conninfo *ci)
 {
+        memset(ci, 0, sizeof(*ci));
         bacpy(&ci->bdaddr, &session->bdaddr);
 
         ci->flags = session->flags;
@@ -115,7 +116,6 @@ static void __hidp_copy_session(struct hidp_session *session, struct hidp_connin
         ci->vendor  = 0x0000;
         ci->product = 0x0000;
         ci->version = 0x0000;
-        memset(ci->name, 0, 128);
 
         if (session->input) {
                 ci->vendor  = session->input->id.vendor;
diff --git a/net/bluetooth/l2cap.c b/net/bluetooth/l2cap.c
index cd8f6ea03841..c12eccfdfe01 100644
--- a/net/bluetooth/l2cap.c
+++ b/net/bluetooth/l2cap.c
@@ -57,7 +57,7 @@
 
 #define VERSION "2.15"
 
-static int disable_ertm = 0;
+static int disable_ertm;
 
 static u32 l2cap_feat_mask = L2CAP_FEAT_FIXED_CHAN;
 static u8 l2cap_fixed_chan[8] = { 0x02, };
@@ -83,6 +83,18 @@ static struct sk_buff *l2cap_build_cmd(struct l2cap_conn *conn,
 static int l2cap_ertm_data_rcv(struct sock *sk, struct sk_buff *skb);
 
 /* ---- L2CAP timers ---- */
+static void l2cap_sock_set_timer(struct sock *sk, long timeout)
+{
+        BT_DBG("sk %p state %d timeout %ld", sk, sk->sk_state, timeout);
+        sk_reset_timer(sk, &sk->sk_timer, jiffies + timeout);
+}
+
+static void l2cap_sock_clear_timer(struct sock *sk)
+{
+        BT_DBG("sock %p state %d", sk, sk->sk_state);
+        sk_stop_timer(sk, &sk->sk_timer);
+}
+
 static void l2cap_sock_timeout(unsigned long arg)
 {
         struct sock *sk = (struct sock *) arg;
@@ -92,6 +104,14 @@ static void l2cap_sock_timeout(unsigned long arg)
 
         bh_lock_sock(sk);
 
+        if (sock_owned_by_user(sk)) {
+                /* sk is owned by user. Try again later */
+                l2cap_sock_set_timer(sk, HZ / 5);
+                bh_unlock_sock(sk);
+                sock_put(sk);
+                return;
+        }
+
         if (sk->sk_state == BT_CONNECTED || sk->sk_state == BT_CONFIG)
                 reason = ECONNREFUSED;
         else if (sk->sk_state == BT_CONNECT &&
@@ -108,18 +128,6 @@ static void l2cap_sock_timeout(unsigned long arg)
         sock_put(sk);
 }
 
-static void l2cap_sock_set_timer(struct sock *sk, long timeout)
-{
-        BT_DBG("sk %p state %d timeout %ld", sk, sk->sk_state, timeout);
-        sk_reset_timer(sk, &sk->sk_timer, jiffies + timeout);
-}
-
-static void l2cap_sock_clear_timer(struct sock *sk)
-{
-        BT_DBG("sock %p state %d", sk, sk->sk_state);
-        sk_stop_timer(sk, &sk->sk_timer);
-}
-
 /* ---- L2CAP channels ---- */
 static struct sock *__l2cap_get_chan_by_dcid(struct l2cap_chan_list *l, u16 cid)
 {
@@ -743,11 +751,13 @@ found:
 /* Find socket with psm and source bdaddr.
  * Returns closest match.
  */
-static struct sock *__l2cap_get_sock_by_psm(int state, __le16 psm, bdaddr_t *src)
+static struct sock *l2cap_get_sock_by_psm(int state, __le16 psm, bdaddr_t *src)
 {
         struct sock *sk = NULL, *sk1 = NULL;
         struct hlist_node *node;
 
+        read_lock(&l2cap_sk_list.lock);
+
         sk_for_each(sk, node, &l2cap_sk_list.head) {
                 if (state && sk->sk_state != state)
                         continue;
@@ -762,20 +772,10 @@ static struct sock *__l2cap_get_sock_by_psm(int state, __le16 psm, bdaddr_t *src
                                 sk1 = sk;
                 }
         }
-        return node ? sk : sk1;
-}
 
-/* Find socket with given address (psm, src).
- * Returns locked socket */
-static inline struct sock *l2cap_get_sock_by_psm(int state, __le16 psm, bdaddr_t *src)
-{
-        struct sock *s;
-        read_lock(&l2cap_sk_list.lock);
-        s = __l2cap_get_sock_by_psm(state, psm, src);
-        if (s)
-                bh_lock_sock(s);
         read_unlock(&l2cap_sk_list.lock);
-        return s;
+
+        return node ? sk : sk1;
 }
 
 static void l2cap_sock_destruct(struct sock *sk)
@@ -2926,6 +2926,8 @@ static inline int l2cap_connect_req(struct l2cap_conn *conn, struct l2cap_cmd_hd
                 goto sendresp;
         }
 
+        bh_lock_sock(parent);
+
         /* Check if the ACL is secure enough (if not SDP) */
         if (psm != cpu_to_le16(0x0001) &&
                                 !hci_conn_check_link_mode(conn->hcon)) {
@@ -3078,6 +3080,14 @@ static inline int l2cap_connect_rsp(struct l2cap_conn *conn, struct l2cap_cmd_hd
                 break;
 
         default:
+                /* don't delete l2cap channel if sk is owned by user */
+                if (sock_owned_by_user(sk)) {
+                        sk->sk_state = BT_DISCONN;
+                        l2cap_sock_clear_timer(sk);
+                        l2cap_sock_set_timer(sk, HZ / 5);
+                        break;
+                }
+
                 l2cap_chan_del(sk, ECONNREFUSED);
                 break;
         }
@@ -3283,6 +3293,15 @@ static inline int l2cap_disconnect_req(struct l2cap_conn *conn, struct l2cap_cmd
 
         sk->sk_shutdown = SHUTDOWN_MASK;
 
+        /* don't delete l2cap channel if sk is owned by user */
+        if (sock_owned_by_user(sk)) {
+                sk->sk_state = BT_DISCONN;
+                l2cap_sock_clear_timer(sk);
+                l2cap_sock_set_timer(sk, HZ / 5);
+                bh_unlock_sock(sk);
+                return 0;
+        }
+
         l2cap_chan_del(sk, ECONNRESET);
         bh_unlock_sock(sk);
 
@@ -3305,6 +3324,15 @@ static inline int l2cap_disconnect_rsp(struct l2cap_conn *conn, struct l2cap_cmd
         if (!sk)
                 return 0;
 
+        /* don't delete l2cap channel if sk is owned by user */
+        if (sock_owned_by_user(sk)) {
+                sk->sk_state = BT_DISCONN;
+                l2cap_sock_clear_timer(sk);
+                l2cap_sock_set_timer(sk, HZ / 5);
+                bh_unlock_sock(sk);
+                return 0;
+        }
+
         l2cap_chan_del(sk, 0);
         bh_unlock_sock(sk);
 
@@ -4134,11 +4162,10 @@ static inline void l2cap_data_channel_rrframe(struct sock *sk, u16 rx_control)
                         __mod_retrans_timer();
 
                 pi->conn_state &= ~L2CAP_CONN_REMOTE_BUSY;
-                if (pi->conn_state & L2CAP_CONN_SREJ_SENT) {
+                if (pi->conn_state & L2CAP_CONN_SREJ_SENT)
                         l2cap_send_ack(pi);
-                } else {
+                else
                         l2cap_ertm_send(sk);
-                }
         }
 }
 
@@ -4430,6 +4457,8 @@ static inline int l2cap_conless_channel(struct l2cap_conn *conn, __le16 psm, str
         if (!sk)
                 goto drop;
 
+        bh_lock_sock(sk);
+
         BT_DBG("sk %p, len %d", sk, skb->len);
 
         if (sk->sk_state != BT_BOUND && sk->sk_state != BT_CONNECTED)
@@ -4841,8 +4870,10 @@ static int __init l2cap_init(void)
                 return err;
 
         _busy_wq = create_singlethread_workqueue("l2cap");
-        if (!_busy_wq)
-                goto error;
+        if (!_busy_wq) {
+                proto_unregister(&l2cap_proto);
+                return -ENOMEM;
+        }
 
         err = bt_sock_register(BTPROTO_L2CAP, &l2cap_sock_family_ops);
         if (err < 0) {
@@ -4870,6 +4901,7 @@ static int __init l2cap_init(void)
         return 0;
 
 error:
+        destroy_workqueue(_busy_wq);
         proto_unregister(&l2cap_proto);
         return err;
 }
diff --git a/net/bluetooth/rfcomm/core.c b/net/bluetooth/rfcomm/core.c
index fa642aa652bd..c1e2bbafb549 100644
--- a/net/bluetooth/rfcomm/core.c
+++ b/net/bluetooth/rfcomm/core.c
@@ -41,7 +41,7 @@
 #include <linux/slab.h>
 
 #include <net/sock.h>
-#include <asm/uaccess.h>
+#include <linux/uaccess.h>
 #include <asm/unaligned.h>
 
 #include <net/bluetooth/bluetooth.h>
@@ -51,10 +51,10 @@
 
 #define VERSION "1.11"
 
-static int disable_cfc = 0;
+static int disable_cfc;
+static int l2cap_ertm;
 static int channel_mtu = -1;
 static unsigned int l2cap_mtu = RFCOMM_MAX_L2CAP_MTU;
-static int l2cap_ertm = 0;
 
 static struct task_struct *rfcomm_thread;
 
@@ -1901,7 +1901,7 @@ static inline void rfcomm_check_connection(struct rfcomm_session *s)
 
         BT_DBG("%p state %ld", s, s->state);
 
-        switch(sk->sk_state) {
+        switch (sk->sk_state) {
         case BT_CONNECTED:
                 s->state = BT_CONNECT;
 
diff --git a/net/bluetooth/rfcomm/sock.c b/net/bluetooth/rfcomm/sock.c
index aec505f934df..66cc1f0c3df8 100644
--- a/net/bluetooth/rfcomm/sock.c
+++ b/net/bluetooth/rfcomm/sock.c
@@ -45,7 +45,7 @@
 #include <net/sock.h>
 
 #include <asm/system.h>
-#include <asm/uaccess.h>
+#include <linux/uaccess.h>
 
 #include <net/bluetooth/bluetooth.h>
 #include <net/bluetooth/hci_core.h>
@@ -140,11 +140,13 @@ static struct sock *__rfcomm_get_sock_by_addr(u8 channel, bdaddr_t *src)
 /* Find socket with channel and source bdaddr.
  * Returns closest match.
  */
-static struct sock *__rfcomm_get_sock_by_channel(int state, u8 channel, bdaddr_t *src)
+static struct sock *rfcomm_get_sock_by_channel(int state, u8 channel, bdaddr_t *src)
 {
         struct sock *sk = NULL, *sk1 = NULL;
         struct hlist_node *node;
 
+        read_lock(&rfcomm_sk_list.lock);
+
         sk_for_each(sk, node, &rfcomm_sk_list.head) {
                 if (state && sk->sk_state != state)
                         continue;
@@ -159,19 +161,10 @@ static struct sock *__rfcomm_get_sock_by_channel(int state, u8 channel, bdaddr_t
                                 sk1 = sk;
                 }
         }
-        return node ? sk : sk1;
-}
 
-/* Find socket with given address (channel, src).
- * Returns locked socket */
-static inline struct sock *rfcomm_get_sock_by_channel(int state, u8 channel, bdaddr_t *src)
-{
-        struct sock *s;
-        read_lock(&rfcomm_sk_list.lock);
-        s = __rfcomm_get_sock_by_channel(state, channel, src);
-        if (s) bh_lock_sock(s);
         read_unlock(&rfcomm_sk_list.lock);
-        return s;
+
+        return node ? sk : sk1;
 }
 
 static void rfcomm_sock_destruct(struct sock *sk)
@@ -895,7 +888,8 @@ static int rfcomm_sock_shutdown(struct socket *sock, int how)
 
         BT_DBG("sock %p, sk %p", sock, sk);
 
-        if (!sk) return 0;
+        if (!sk)
+                return 0;
 
         lock_sock(sk);
         if (!sk->sk_shutdown) {
@@ -945,6 +939,8 @@ int rfcomm_connect_ind(struct rfcomm_session *s, u8 channel, struct rfcomm_dlc *
         if (!parent)
                 return 0;
 
+        bh_lock_sock(parent);
+
         /* Check for backlog size */
         if (sk_acceptq_is_full(parent)) {
                 BT_DBG("backlog full %d", parent->sk_ack_backlog);
diff --git a/net/bluetooth/rfcomm/tty.c b/net/bluetooth/rfcomm/tty.c
index a9b81f5dacd1..2575c2db6404 100644
--- a/net/bluetooth/rfcomm/tty.c
+++ b/net/bluetooth/rfcomm/tty.c
@@ -58,9 +58,9 @@ struct rfcomm_dev {
 
         bdaddr_t                src;
         bdaddr_t                dst;
-        u8                      channel;
+        u8                      channel;
 
-        uint                    modem_status;
+        uint                    modem_status;
 
         struct rfcomm_dlc       *dlc;
         struct tty_struct       *tty;
@@ -69,7 +69,7 @@ struct rfcomm_dev {
 
         struct device           *tty_dev;
 
-        atomic_t                wmem_alloc;
+        atomic_t                wmem_alloc;
 
         struct sk_buff_head     pending;
 };
@@ -431,7 +431,8 @@ static int rfcomm_release_dev(void __user *arg)
 
         BT_DBG("dev_id %d flags 0x%x", req.dev_id, req.flags);
 
-        if (!(dev = rfcomm_dev_get(req.dev_id)))
+        dev = rfcomm_dev_get(req.dev_id);
+        if (!dev)
                 return -ENODEV;
 
         if (dev->flags != NOCAP_FLAGS && !capable(CAP_NET_ADMIN)) {
@@ -470,7 +471,8 @@ static int rfcomm_get_dev_list(void __user *arg)
 
         size = sizeof(*dl) + dev_num * sizeof(*di);
 
-        if (!(dl = kmalloc(size, GFP_KERNEL)))
+        dl = kmalloc(size, GFP_KERNEL);
+        if (!dl)
                 return -ENOMEM;
 
         di = dl->dev_info;
@@ -513,7 +515,8 @@ static int rfcomm_get_dev_info(void __user *arg)
         if (copy_from_user(&di, arg, sizeof(di)))
                 return -EFAULT;
 
-        if (!(dev = rfcomm_dev_get(di.id)))
+        dev = rfcomm_dev_get(di.id);
+        if (!dev)
                 return -ENODEV;
 
         di.flags   = dev->flags;
@@ -561,7 +564,8 @@ static void rfcomm_dev_data_ready(struct rfcomm_dlc *dlc, struct sk_buff *skb)
                 return;
         }
 
-        if (!(tty = dev->tty) || !skb_queue_empty(&dev->pending)) {
+        tty = dev->tty;
+        if (!tty || !skb_queue_empty(&dev->pending)) {
                 skb_queue_tail(&dev->pending, skb);
                 return;
         }
@@ -796,7 +800,8 @@ static int rfcomm_tty_write(struct tty_struct *tty, const unsigned char *buf, in
 
                 memcpy(skb_put(skb, size), buf + sent, size);
 
-                if ((err = rfcomm_dlc_send(dlc, skb)) < 0) {
+                err = rfcomm_dlc_send(dlc, skb);
+                if (err < 0) {
                         kfree_skb(skb);
                         break;
                 }
@@ -892,7 +897,7 @@ static void rfcomm_tty_set_termios(struct tty_struct *tty, struct ktermios *old)
 
         /* Parity on/off and when on, odd/even */
         if (((old->c_cflag & PARENB) != (new->c_cflag & PARENB)) ||
-                        ((old->c_cflag & PARODD) != (new->c_cflag & PARODD)) ) {
+                        ((old->c_cflag & PARODD) != (new->c_cflag & PARODD))) {
                 changes |= RFCOMM_RPN_PM_PARITY;
                 BT_DBG("Parity change detected.");
         }
@@ -937,11 +942,10 @@ static void rfcomm_tty_set_termios(struct tty_struct *tty, struct ktermios *old)
         /* POSIX does not support 1.5 stop bits and RFCOMM does not
          * support 2 stop bits. So a request for 2 stop bits gets
          * translated to 1.5 stop bits */
-        if (new->c_cflag & CSTOPB) {
+        if (new->c_cflag & CSTOPB)
                 stop_bits = RFCOMM_RPN_STOP_15;
-        } else {
+        else
                 stop_bits = RFCOMM_RPN_STOP_1;
-        }
 
         /* Handle number of data bits [5-8] */
         if ((old->c_cflag & CSIZE) != (new->c_cflag & CSIZE))
diff --git a/net/bluetooth/sco.c b/net/bluetooth/sco.c
index 66b9e5c0523a..960c6d1637da 100644
--- a/net/bluetooth/sco.c
+++ b/net/bluetooth/sco.c
@@ -44,7 +44,7 @@
 #include <net/sock.h>
 
 #include <asm/system.h>
-#include <asm/uaccess.h>
+#include <linux/uaccess.h>
 
 #include <net/bluetooth/bluetooth.h>
 #include <net/bluetooth/hci_core.h>
@@ -52,7 +52,7 @@
 
 #define VERSION "0.6"
 
-static int disable_esco = 0;
+static int disable_esco;
 
 static const struct proto_ops sco_sock_ops;
 
@@ -138,16 +138,17 @@ static inline struct sock *sco_chan_get(struct sco_conn *conn)
 
 static int sco_conn_del(struct hci_conn *hcon, int err)
 {
-        struct sco_conn *conn;
+        struct sco_conn *conn = hcon->sco_data;
         struct sock *sk;
 
-        if (!(conn = hcon->sco_data))
+        if (!conn)
                 return 0;
 
         BT_DBG("hcon %p conn %p, err %d", hcon, conn, err);
 
         /* Kill socket */
-        if ((sk = sco_chan_get(conn))) {
+        sk = sco_chan_get(conn);
+        if (sk) {
                 bh_lock_sock(sk);
                 sco_sock_clear_timer(sk);
                 sco_chan_del(sk, err);
@@ -185,7 +186,8 @@ static int sco_connect(struct sock *sk)
 
         BT_DBG("%s -> %s", batostr(src), batostr(dst));
 
-        if (!(hdev = hci_get_route(dst, src)))
+        hdev = hci_get_route(dst, src);
+        if (!hdev)
                 return -EHOSTUNREACH;
 
         hci_dev_lock_bh(hdev);
@@ -510,7 +512,8 @@ static int sco_sock_connect(struct socket *sock, struct sockaddr *addr, int alen
         /* Set destination address and psm */
         bacpy(&bt_sk(sk)->dst, &sa->sco_bdaddr);
 
-        if ((err = sco_connect(sk)))
+        err = sco_connect(sk);
+        if (err)
                 goto done;
 
         err = bt_sock_wait_state(sk, BT_CONNECTED,
@@ -828,13 +831,14 @@ static void sco_chan_del(struct sock *sk, int err)
 
 static void sco_conn_ready(struct sco_conn *conn)
 {
-        struct sock *parent, *sk;
+        struct sock *parent;
+        struct sock *sk = conn->sk;
 
         BT_DBG("conn %p", conn);
 
         sco_conn_lock(conn);
 
-        if ((sk = conn->sk)) {
+        if (sk) {
                 sco_sock_clear_timer(sk);
                 bh_lock_sock(sk);
                 sk->sk_state = BT_CONNECTED;
diff --git a/net/bridge/br_device.c b/net/bridge/br_device.c
index 17cb0b633576..556443566e9c 100644
--- a/net/bridge/br_device.c
+++ b/net/bridge/br_device.c
@@ -141,7 +141,7 @@ static int br_change_mtu(struct net_device *dev, int new_mtu)
 
 #ifdef CONFIG_BRIDGE_NETFILTER
         /* remember the MTU in the rtable for PMTU */
-        br->fake_rtable.dst.metrics[RTAX_MTU - 1] = new_mtu;
+        dst_metric_set(&br->fake_rtable.dst, RTAX_MTU, new_mtu);
 #endif
 
         return 0;
diff --git a/net/bridge/br_netfilter.c b/net/bridge/br_netfilter.c
index 6e1392093911..16f5c333596a 100644
--- a/net/bridge/br_netfilter.c
+++ b/net/bridge/br_netfilter.c
@@ -124,7 +124,7 @@ void br_netfilter_rtable_init(struct net_bridge *br)
         atomic_set(&rt->dst.__refcnt, 1);
         rt->dst.dev = br->dev;
         rt->dst.path = &rt->dst;
-        rt->dst.metrics[RTAX_MTU - 1] = 1500;
+        dst_metric_set(&rt->dst, RTAX_MTU, 1500);
         rt->dst.flags   = DST_NOXFRM;
         rt->dst.ops = &fake_dst_ops;
 }
diff --git a/net/core/filter.c b/net/core/filter.c
index e193e29d4671..e8a6ac411ffb 100644
--- a/net/core/filter.c
+++ b/net/core/filter.c
@@ -88,7 +88,7 @@ enum {
 };
 
 /* No hurry in this branch */
-static void *__load_pointer(const struct sk_buff *skb, int k)
+static void *__load_pointer(const struct sk_buff *skb, int k, unsigned int size)
 {
         u8 *ptr = NULL;
 
@@ -97,7 +97,7 @@ static void *__load_pointer(const struct sk_buff *skb, int k)
         else if (k >= SKF_LL_OFF)
                 ptr = skb_mac_header(skb) + k - SKF_LL_OFF;
 
-        if (ptr >= skb->head && ptr < skb_tail_pointer(skb))
+        if (ptr >= skb->head && ptr + size <= skb_tail_pointer(skb))
                 return ptr;
         return NULL;
 }
@@ -110,7 +110,7 @@ static inline void *load_pointer(const struct sk_buff *skb, int k,
         else {
                 if (k >= SKF_AD_OFF)
                         return NULL;
-                return __load_pointer(skb, k);
+                return __load_pointer(skb, k, size);
         }
 }
 
diff --git a/net/core/sock.c b/net/core/sock.c
index fb6080111461..bcdb6ff6e621 100644
--- a/net/core/sock.c
+++ b/net/core/sock.c
@@ -992,17 +992,18 @@ static inline void sock_lock_init(struct sock *sk)
 /*
  * Copy all fields from osk to nsk but nsk->sk_refcnt must not change yet,
  * even temporarly, because of RCU lookups. sk_node should also be left as is.
+ * We must not copy fields between sk_dontcopy_begin and sk_dontcopy_end
  */
 static void sock_copy(struct sock *nsk, const struct sock *osk)
 {
 #ifdef CONFIG_SECURITY_NETWORK
         void *sptr = nsk->sk_security;
 #endif
-        BUILD_BUG_ON(offsetof(struct sock, sk_copy_start) !=
-                     sizeof(osk->sk_node) + sizeof(osk->sk_refcnt) +
-                     sizeof(osk->sk_tx_queue_mapping));
-        memcpy(&nsk->sk_copy_start, &osk->sk_copy_start,
-               osk->sk_prot->obj_size - offsetof(struct sock, sk_copy_start));
+        memcpy(nsk, osk, offsetof(struct sock, sk_dontcopy_begin));
+
+        memcpy(&nsk->sk_dontcopy_end, &osk->sk_dontcopy_end,
+               osk->sk_prot->obj_size - offsetof(struct sock, sk_dontcopy_end));
+
 #ifdef CONFIG_SECURITY_NETWORK
         nsk->sk_security = sptr;
         security_sk_clone(osk, nsk);
diff --git a/net/decnet/dn_route.c b/net/decnet/dn_route.c
index 8280e43c8861..e2e926841fe6 100644
--- a/net/decnet/dn_route.c
+++ b/net/decnet/dn_route.c
@@ -240,13 +240,13 @@ static void dn_dst_update_pmtu(struct dst_entry *dst, u32 mtu)
 
         if (dst_metric(dst, RTAX_MTU) > mtu && mtu >= min_mtu) {
                 if (!(dst_metric_locked(dst, RTAX_MTU))) {
-                        dst->metrics[RTAX_MTU-1] = mtu;
+                        dst_metric_set(dst, RTAX_MTU, mtu);
                         dst_set_expires(dst, dn_rt_mtu_expires);
                 }
                 if (!(dst_metric_locked(dst, RTAX_ADVMSS))) {
                         u32 mss = mtu - DN_MAX_NSP_DATA_HEADER;
                         if (dst_metric(dst, RTAX_ADVMSS) > mss)
-                                dst->metrics[RTAX_ADVMSS-1] = mss;
+                                dst_metric_set(dst, RTAX_ADVMSS, mss);
                 }
         }
 }
@@ -806,8 +806,7 @@ static int dn_rt_set_next_hop(struct dn_route *rt, struct dn_fib_res *res)
                 if (DN_FIB_RES_GW(*res) &&
                     DN_FIB_RES_NH(*res).nh_scope == RT_SCOPE_LINK)
                         rt->rt_gateway = DN_FIB_RES_GW(*res);
-                memcpy(rt->dst.metrics, fi->fib_metrics,
-                       sizeof(rt->dst.metrics));
+                dst_import_metrics(&rt->dst, fi->fib_metrics);
         }
         rt->rt_type = res->type;
 
@@ -820,11 +819,11 @@ static int dn_rt_set_next_hop(struct dn_route *rt, struct dn_fib_res *res)
 
         if (dst_metric(&rt->dst, RTAX_MTU) == 0 ||
             dst_metric(&rt->dst, RTAX_MTU) > rt->dst.dev->mtu)
-                rt->dst.metrics[RTAX_MTU-1] = rt->dst.dev->mtu;
+                dst_metric_set(&rt->dst, RTAX_MTU, rt->dst.dev->mtu);
         mss = dn_mss_from_pmtu(dev, dst_mtu(&rt->dst));
         if (dst_metric(&rt->dst, RTAX_ADVMSS) == 0 ||
             dst_metric(&rt->dst, RTAX_ADVMSS) > mss)
-                rt->dst.metrics[RTAX_ADVMSS-1] = mss;
+                dst_metric_set(&rt->dst, RTAX_ADVMSS, mss);
         return 0;
 }
 
@@ -1502,7 +1501,7 @@ static int dn_rt_fill_info(struct sk_buff *skb, u32 pid, u32 seq,
         RTA_PUT(skb, RTA_PREFSRC, 2, &rt->rt_local_src);
         if (rt->rt_daddr != rt->rt_gateway)
                 RTA_PUT(skb, RTA_GATEWAY, 2, &rt->rt_gateway);
-        if (rtnetlink_put_metrics(skb, rt->dst.metrics) < 0)
+        if (rtnetlink_put_metrics(skb, dst_metrics_ptr(&rt->dst)) < 0)
                 goto rtattr_failure;
         expires = rt->dst.expires ? rt->dst.expires - jiffies : 0;
         if (rtnl_put_cacheinfo(skb, &rt->dst, 0, 0, 0, expires,
diff --git a/net/ipv4/inet_connection_sock.c b/net/ipv4/inet_connection_sock.c
index 06f5f8f482f0..25e318153f14 100644
--- a/net/ipv4/inet_connection_sock.c
+++ b/net/ipv4/inet_connection_sock.c
@@ -55,7 +55,6 @@ EXPORT_SYMBOL(inet_get_local_port_range);
 int inet_csk_bind_conflict(const struct sock *sk,
                            const struct inet_bind_bucket *tb)
 {
-        const __be32 sk_rcv_saddr = inet_rcv_saddr(sk);
         struct sock *sk2;
         struct hlist_node *node;
         int reuse = sk->sk_reuse;
@@ -75,9 +74,9 @@ int inet_csk_bind_conflict(const struct sock *sk,
                      sk->sk_bound_dev_if == sk2->sk_bound_dev_if)) {
                         if (!reuse || !sk2->sk_reuse ||
                             sk2->sk_state == TCP_LISTEN) {
-                                const __be32 sk2_rcv_saddr = inet_rcv_saddr(sk2);
-                                if (!sk2_rcv_saddr || !sk_rcv_saddr ||
-                                    sk2_rcv_saddr == sk_rcv_saddr)
+                                const __be32 sk2_rcv_saddr = sk_rcv_saddr(sk2);
+                                if (!sk2_rcv_saddr || !sk_rcv_saddr(sk) ||
+                                    sk2_rcv_saddr == sk_rcv_saddr(sk))
                                         break;
                         }
                 }
diff --git a/net/ipv4/ip_gre.c b/net/ipv4/ip_gre.c
index 258c98d5fa79..ff4e7a4e33ed 100644
--- a/net/ipv4/ip_gre.c
+++ b/net/ipv4/ip_gre.c
@@ -818,7 +818,7 @@ static netdev_tx_t ipgre_tunnel_xmit(struct sk_buff *skb, struct net_device *dev
                              !ipv4_is_multicast(tunnel->parms.iph.daddr)) ||
                             rt6->rt6i_dst.plen == 128) {
                                 rt6->rt6i_flags |= RTF_MODIFIED;
-                                skb_dst(skb)->metrics[RTAX_MTU-1] = mtu;
+                                dst_metric_set(skb_dst(skb), RTAX_MTU, mtu);
                         }
                 }
 
diff --git a/net/ipv4/route.c b/net/ipv4/route.c
index 3843c2dfde82..26ac396eaa5e 100644
--- a/net/ipv4/route.c
+++ b/net/ipv4/route.c
@@ -1686,11 +1686,14 @@ unsigned short ip_rt_frag_needed(struct net *net, struct iphdr *iph,
                                         if (mtu < dst_mtu(&rth->dst)) {
                                                 dst_confirm(&rth->dst);
                                                 if (mtu < ip_rt_min_pmtu) {
+                                                        u32 lock = dst_metric(&rth->dst,
+                                                                              RTAX_LOCK);
                                                         mtu = ip_rt_min_pmtu;
-                                                        rth->dst.metrics[RTAX_LOCK-1] |=
-                                                                (1 << RTAX_MTU);
+                                                        lock |= (1 << RTAX_MTU);
+                                                        dst_metric_set(&rth->dst, RTAX_LOCK,
+                                                                       lock);
                                                 }
-                                                rth->dst.metrics[RTAX_MTU-1] = mtu;
+                                                dst_metric_set(&rth->dst, RTAX_MTU, mtu);
                                                 dst_set_expires(&rth->dst,
                                                         ip_rt_mtu_expires);
                                         }
@@ -1708,10 +1711,11 @@ static void ip_rt_update_pmtu(struct dst_entry *dst, u32 mtu)
         if (dst_mtu(dst) > mtu && mtu >= 68 &&
             !(dst_metric_locked(dst, RTAX_MTU))) {
                 if (mtu < ip_rt_min_pmtu) {
+                        u32 lock = dst_metric(dst, RTAX_LOCK);
                         mtu = ip_rt_min_pmtu;
-                        dst->metrics[RTAX_LOCK-1] |= (1 << RTAX_MTU);
+                        dst_metric_set(dst, RTAX_LOCK, lock | (1 << RTAX_MTU));
                 }
-                dst->metrics[RTAX_MTU-1] = mtu;
+                dst_metric_set(dst, RTAX_MTU, mtu);
                 dst_set_expires(dst, ip_rt_mtu_expires);
                 call_netevent_notifiers(NETEVENT_PMTU_UPDATE, dst);
         }
@@ -1796,36 +1800,37 @@ static void set_class_tag(struct rtable *rt, u32 tag)
 
 static void rt_set_nexthop(struct rtable *rt, struct fib_result *res, u32 itag)
 {
+        struct dst_entry *dst = &rt->dst;
         struct fib_info *fi = res->fi;
 
         if (fi) {
                 if (FIB_RES_GW(*res) &&
                     FIB_RES_NH(*res).nh_scope == RT_SCOPE_LINK)
                         rt->rt_gateway = FIB_RES_GW(*res);
-                memcpy(rt->dst.metrics, fi->fib_metrics,
-                       sizeof(rt->dst.metrics));
+                dst_import_metrics(dst, fi->fib_metrics);
                 if (fi->fib_mtu == 0) {
-                        rt->dst.metrics[RTAX_MTU-1] = rt->dst.dev->mtu;
-                        if (dst_metric_locked(&rt->dst, RTAX_MTU) &&
+                        dst_metric_set(dst, RTAX_MTU, dst->dev->mtu);
+                        if (dst_metric_locked(dst, RTAX_MTU) &&
                             rt->rt_gateway != rt->rt_dst &&
-                            rt->dst.dev->mtu > 576)
-                                rt->dst.metrics[RTAX_MTU-1] = 576;
+                            dst->dev->mtu > 576)
+                                dst_metric_set(dst, RTAX_MTU, 576);
                 }
 #ifdef CONFIG_NET_CLS_ROUTE
-                rt->dst.tclassid = FIB_RES_NH(*res).nh_tclassid;
+                dst->tclassid = FIB_RES_NH(*res).nh_tclassid;
 #endif
         } else
-                rt->dst.metrics[RTAX_MTU-1]= rt->dst.dev->mtu;
-
-        if (dst_metric(&rt->dst, RTAX_HOPLIMIT) == 0)
-                rt->dst.metrics[RTAX_HOPLIMIT-1] = sysctl_ip_default_ttl;
-        if (dst_mtu(&rt->dst) > IP_MAX_MTU)
-                rt->dst.metrics[RTAX_MTU-1] = IP_MAX_MTU;
-        if (dst_metric(&rt->dst, RTAX_ADVMSS) == 0)
-                rt->dst.metrics[RTAX_ADVMSS-1] = max_t(unsigned int, rt->dst.dev->mtu - 40,
-                                       ip_rt_min_advmss);
-        if (dst_metric(&rt->dst, RTAX_ADVMSS) > 65535 - 40)
-                rt->dst.metrics[RTAX_ADVMSS-1] = 65535 - 40;
+                dst_metric_set(dst, RTAX_MTU, dst->dev->mtu);
+
+        if (dst_metric(dst, RTAX_HOPLIMIT) == 0)
+                dst_metric_set(dst, RTAX_HOPLIMIT, sysctl_ip_default_ttl);
+        if (dst_mtu(dst) > IP_MAX_MTU)
+                dst_metric_set(dst, RTAX_MTU, IP_MAX_MTU);
+        if (dst_metric(dst, RTAX_ADVMSS) == 0)
+                dst_metric_set(dst, RTAX_ADVMSS,
+                               max_t(unsigned int, dst->dev->mtu - 40,
+                                     ip_rt_min_advmss));
+        if (dst_metric(dst, RTAX_ADVMSS) > 65535 - 40)
+                dst_metric_set(dst, RTAX_ADVMSS, 65535 - 40);
 
 #ifdef CONFIG_NET_CLS_ROUTE
 #ifdef CONFIG_IP_MULTIPLE_TABLES
@@ -2720,7 +2725,7 @@ static int ipv4_dst_blackhole(struct net *net, struct rtable **rp, struct flowi
                 new->__use = 1;
                 new->input = dst_discard;
                 new->output = dst_discard;
-                memcpy(new->metrics, ort->dst.metrics, RTAX_MAX*sizeof(u32));
+                dst_copy_metrics(new, &ort->dst);
 
                 new->dev = ort->dst.dev;
                 if (new->dev)
@@ -2827,7 +2832,7 @@ static int rt_fill_info(struct net *net,
         if (rt->rt_dst != rt->rt_gateway)
                 NLA_PUT_BE32(skb, RTA_GATEWAY, rt->rt_gateway);
 
-        if (rtnetlink_put_metrics(skb, rt->dst.metrics) < 0)
+        if (rtnetlink_put_metrics(skb, dst_metrics_ptr(&rt->dst)) < 0)
                 goto nla_put_failure;
 
         if (rt->fl.mark)
diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
index 6d8ab1c4efc3..824e8c8a17ad 100644
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -734,7 +734,7 @@ void tcp_update_metrics(struct sock *sk)
                          * Reset our results.
                          */
                         if (!(dst_metric_locked(dst, RTAX_RTT)))
-                                dst->metrics[RTAX_RTT - 1] = 0;
+                                dst_metric_set(dst, RTAX_RTT, 0);
                         return;
                 }
 
@@ -776,34 +776,38 @@ void tcp_update_metrics(struct sock *sk)
                         if (dst_metric(dst, RTAX_SSTHRESH) &&
                             !dst_metric_locked(dst, RTAX_SSTHRESH) &&
                             (tp->snd_cwnd >> 1) > dst_metric(dst, RTAX_SSTHRESH))
-                                dst->metrics[RTAX_SSTHRESH-1] = tp->snd_cwnd >> 1;
+                                dst_metric_set(dst, RTAX_SSTHRESH, tp->snd_cwnd >> 1);
                         if (!dst_metric_locked(dst, RTAX_CWND) &&
                             tp->snd_cwnd > dst_metric(dst, RTAX_CWND))
-                                dst->metrics[RTAX_CWND - 1] = tp->snd_cwnd;
+                                dst_metric_set(dst, RTAX_CWND, tp->snd_cwnd);
                 } else if (tp->snd_cwnd > tp->snd_ssthresh &&
                            icsk->icsk_ca_state == TCP_CA_Open) {
                         /* Cong. avoidance phase, cwnd is reliable. */
                         if (!dst_metric_locked(dst, RTAX_SSTHRESH))
-                                dst->metrics[RTAX_SSTHRESH-1] =
-                                        max(tp->snd_cwnd >> 1, tp->snd_ssthresh);
+                                dst_metric_set(dst, RTAX_SSTHRESH,
+                                               max(tp->snd_cwnd >> 1, tp->snd_ssthresh));
                         if (!dst_metric_locked(dst, RTAX_CWND))
-                                dst->metrics[RTAX_CWND-1] = (dst_metric(dst, RTAX_CWND) + tp->snd_cwnd) >> 1;
+                                dst_metric_set(dst, RTAX_CWND,
+                                               (dst_metric(dst, RTAX_CWND) +
+                                                tp->snd_cwnd) >> 1);
                 } else {
                         /* Else slow start did not finish, cwnd is non-sense,
                            ssthresh may be also invalid.
                          */
                         if (!dst_metric_locked(dst, RTAX_CWND))
-                                dst->metrics[RTAX_CWND-1] = (dst_metric(dst, RTAX_CWND) + tp->snd_ssthresh) >> 1;
+                                dst_metric_set(dst, RTAX_CWND,
+                                               (dst_metric(dst, RTAX_CWND) +
+                                                tp->snd_ssthresh) >> 1);
                         if (dst_metric(dst, RTAX_SSTHRESH) &&
                             !dst_metric_locked(dst, RTAX_SSTHRESH) &&
                             tp->snd_ssthresh > dst_metric(dst, RTAX_SSTHRESH))
-                                dst->metrics[RTAX_SSTHRESH-1] = tp->snd_ssthresh;
+                                dst_metric_set(dst, RTAX_SSTHRESH, tp->snd_ssthresh);
                 }
 
                 if (!dst_metric_locked(dst, RTAX_REORDERING)) {
                         if (dst_metric(dst, RTAX_REORDERING) < tp->reordering &&
                             tp->reordering != sysctl_tcp_reordering)
-                                dst->metrics[RTAX_REORDERING-1] = tp->reordering;
+                                dst_metric_set(dst, RTAX_REORDERING, tp->reordering);
                 }
         }
 }
diff --git a/net/ipv6/ndisc.c b/net/ipv6/ndisc.c
index e18f84130203..2342545a5ee9 100644
--- a/net/ipv6/ndisc.c
+++ b/net/ipv6/ndisc.c
@@ -1259,7 +1259,8 @@ static void ndisc_router_discovery(struct sk_buff *skb)
         if (ra_msg->icmph.icmp6_hop_limit) {
                 in6_dev->cnf.hop_limit = ra_msg->icmph.icmp6_hop_limit;
                 if (rt)
-                        rt->dst.metrics[RTAX_HOPLIMIT-1] = ra_msg->icmph.icmp6_hop_limit;
+                        dst_metric_set(&rt->dst, RTAX_HOPLIMIT,
+                                       ra_msg->icmph.icmp6_hop_limit);
         }
 
 skip_defrtr:
@@ -1377,7 +1378,7 @@ skip_linkparms:
                         in6_dev->cnf.mtu6 = mtu;
 
                         if (rt)
-                                rt->dst.metrics[RTAX_MTU-1] = mtu;
+                                dst_metric_set(&rt->dst, RTAX_MTU, mtu);
 
                         rt6_mtu_change(skb->dev, mtu);
                 }
diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index 026caef0326c..4aed0812b512 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -129,7 +129,6 @@ static struct rt6_info ip6_null_entry_template = {
                 .__use          = 1,
                 .obsolete       = -1,
                 .error          = -ENETUNREACH,
-                .metrics        = { [RTAX_HOPLIMIT - 1] = 255, },
                 .input          = ip6_pkt_discard,
                 .output         = ip6_pkt_discard_out,
         },
@@ -150,7 +149,6 @@ static struct rt6_info ip6_prohibit_entry_template = {
                 .__use          = 1,
                 .obsolete       = -1,
                 .error          = -EACCES,
-                .metrics        = { [RTAX_HOPLIMIT - 1] = 255, },
                 .input          = ip6_pkt_prohibit,
                 .output         = ip6_pkt_prohibit_out,
         },
@@ -166,7 +164,6 @@ static struct rt6_info ip6_blk_hole_entry_template = {
                 .__use          = 1,
                 .obsolete       = -1,
                 .error          = -EINVAL,
-                .metrics        = { [RTAX_HOPLIMIT - 1] = 255, },
                 .input          = dst_discard,
                 .output         = dst_discard,
         },
@@ -844,7 +841,7 @@ int ip6_dst_blackhole(struct sock *sk, struct dst_entry **dstp, struct flowi *fl
                 new->input = dst_discard;
                 new->output = dst_discard;
 
-                memcpy(new->metrics, ort->dst.metrics, RTAX_MAX*sizeof(u32));
+                dst_copy_metrics(new, &ort->dst);
                 new->dev = ort->dst.dev;
                 if (new->dev)
                         dev_hold(new->dev);
@@ -928,10 +925,12 @@ static void ip6_rt_update_pmtu(struct dst_entry *dst, u32 mtu)
         if (mtu < dst_mtu(dst) && rt6->rt6i_dst.plen == 128) {
                 rt6->rt6i_flags |= RTF_MODIFIED;
                 if (mtu < IPV6_MIN_MTU) {
+                        u32 features = dst_metric(dst, RTAX_FEATURES);
                         mtu = IPV6_MIN_MTU;
-                        dst->metrics[RTAX_FEATURES-1] |= RTAX_FEATURE_ALLFRAG;
+                        features |= RTAX_FEATURE_ALLFRAG;
+                        dst_metric_set(dst, RTAX_FEATURES, features);
                 }
-                dst->metrics[RTAX_MTU-1] = mtu;
+                dst_metric_set(dst, RTAX_MTU, mtu);
                 call_netevent_notifiers(NETEVENT_PMTU_UPDATE, dst);
         }
 }
@@ -989,9 +988,9 @@ struct dst_entry *icmp6_dst_alloc(struct net_device *dev,
         rt->rt6i_idev     = idev;
         rt->rt6i_nexthop  = neigh;
         atomic_set(&rt->dst.__refcnt, 1);
-        rt->dst.metrics[RTAX_HOPLIMIT-1] = 255;
-        rt->dst.metrics[RTAX_MTU-1] = ipv6_get_mtu(rt->rt6i_dev);
-        rt->dst.metrics[RTAX_ADVMSS-1] = ipv6_advmss(net, dst_mtu(&rt->dst));
+        dst_metric_set(&rt->dst, RTAX_HOPLIMIT, 255);
+        dst_metric_set(&rt->dst, RTAX_MTU, ipv6_get_mtu(rt->rt6i_dev));
+        dst_metric_set(&rt->dst, RTAX_ADVMSS, ipv6_advmss(net, dst_mtu(&rt->dst)));
         rt->dst.output  = ip6_output;
 
 #if 0   /* there's no chance to use these for ndisc */
@@ -1305,17 +1304,17 @@ install_route:
                                         goto out;
                                 }
 
-                                rt->dst.metrics[type - 1] = nla_get_u32(nla);
+                                dst_metric_set(&rt->dst, type, nla_get_u32(nla));
                         }
                 }
         }
 
         if (dst_metric(&rt->dst, RTAX_HOPLIMIT) == 0)
-                rt->dst.metrics[RTAX_HOPLIMIT-1] = -1;
+                dst_metric_set(&rt->dst, RTAX_HOPLIMIT, -1);
         if (!dst_mtu(&rt->dst))
-                rt->dst.metrics[RTAX_MTU-1] = ipv6_get_mtu(dev);
+                dst_metric_set(&rt->dst, RTAX_MTU, ipv6_get_mtu(dev));
         if (!dst_metric(&rt->dst, RTAX_ADVMSS))
-                rt->dst.metrics[RTAX_ADVMSS-1] = ipv6_advmss(net, dst_mtu(&rt->dst));
+                dst_metric_set(&rt->dst, RTAX_ADVMSS, ipv6_advmss(net, dst_mtu(&rt->dst)));
         rt->dst.dev = dev;
         rt->rt6i_idev = idev;
         rt->rt6i_table = table;
@@ -1541,9 +1540,9 @@ void rt6_redirect(struct in6_addr *dest, struct in6_addr *src,
         ipv6_addr_copy(&nrt->rt6i_gateway, (struct in6_addr*)neigh->primary_key);
         nrt->rt6i_nexthop = neigh_clone(neigh);
         /* Reset pmtu, it may be better */
-        nrt->dst.metrics[RTAX_MTU-1] = ipv6_get_mtu(neigh->dev);
-        nrt->dst.metrics[RTAX_ADVMSS-1] = ipv6_advmss(dev_net(neigh->dev),
-                                                        dst_mtu(&nrt->dst));
+        dst_metric_set(&nrt->dst, RTAX_MTU, ipv6_get_mtu(neigh->dev));
+        dst_metric_set(&nrt->dst, RTAX_ADVMSS, ipv6_advmss(dev_net(neigh->dev),
+                                                           dst_mtu(&nrt->dst)));
 
         if (ip6_ins_rt(nrt))
                 goto out;
@@ -1602,9 +1601,12 @@ static void rt6_do_pmtu_disc(struct in6_addr *daddr, struct in6_addr *saddr,
            would return automatically.
          */
         if (rt->rt6i_flags & RTF_CACHE) {
-                rt->dst.metrics[RTAX_MTU-1] = pmtu;
-                if (allfrag)
-                        rt->dst.metrics[RTAX_FEATURES-1] |= RTAX_FEATURE_ALLFRAG;
+                dst_metric_set(&rt->dst, RTAX_MTU, pmtu);
+                if (allfrag) {
+                        u32 features = dst_metric(&rt->dst, RTAX_FEATURES);
+                        features |= RTAX_FEATURE_ALLFRAG;
+                        dst_metric_set(&rt->dst, RTAX_FEATURES, features);
+                }
                 dst_set_expires(&rt->dst, net->ipv6.sysctl.ip6_rt_mtu_expires);
                 rt->rt6i_flags |= RTF_MODIFIED|RTF_EXPIRES;
                 goto out;
@@ -1621,9 +1623,12 @@ static void rt6_do_pmtu_disc(struct in6_addr *daddr, struct in6_addr *saddr,
                 nrt = rt6_alloc_clone(rt, daddr);
 
         if (nrt) {
-                nrt->dst.metrics[RTAX_MTU-1] = pmtu;
-                if (allfrag)
-                        nrt->dst.metrics[RTAX_FEATURES-1] |= RTAX_FEATURE_ALLFRAG;
+                dst_metric_set(&nrt->dst, RTAX_MTU, pmtu);
+                if (allfrag) {
+                        u32 features = dst_metric(&nrt->dst, RTAX_FEATURES);
+                        features |= RTAX_FEATURE_ALLFRAG;
+                        dst_metric_set(&nrt->dst, RTAX_FEATURES, features);
+                }
 
                 /* According to RFC 1981, detecting PMTU increase shouldn't be
                  * happened within 5 mins, the recommended timer is 10 mins.
@@ -1674,7 +1679,7 @@ static struct rt6_info * ip6_rt_copy(struct rt6_info *ort)
                 rt->dst.input = ort->dst.input;
                 rt->dst.output = ort->dst.output;
 
-                memcpy(rt->dst.metrics, ort->dst.metrics, RTAX_MAX*sizeof(u32));
+                dst_copy_metrics(&rt->dst, &ort->dst);
                 rt->dst.error = ort->dst.error;
                 rt->dst.dev = ort->dst.dev;
                 if (rt->dst.dev)
@@ -1966,9 +1971,9 @@ struct rt6_info *addrconf_dst_alloc(struct inet6_dev *idev,
         rt->dst.output = ip6_output;
         rt->rt6i_dev = net->loopback_dev;
         rt->rt6i_idev = idev;
-        rt->dst.metrics[RTAX_MTU-1] = ipv6_get_mtu(rt->rt6i_dev);
-        rt->dst.metrics[RTAX_ADVMSS-1] = ipv6_advmss(net, dst_mtu(&rt->dst));
-        rt->dst.metrics[RTAX_HOPLIMIT-1] = -1;
+        dst_metric_set(&rt->dst, RTAX_MTU, ipv6_get_mtu(rt->rt6i_dev));
+        dst_metric_set(&rt->dst, RTAX_ADVMSS, ipv6_advmss(net, dst_mtu(&rt->dst)));
+        dst_metric_set(&rt->dst, RTAX_HOPLIMIT, -1);
         rt->dst.obsolete = -1;
 
         rt->rt6i_flags = RTF_UP | RTF_NONEXTHOP;
@@ -2068,8 +2073,8 @@ static int rt6_mtu_change_route(struct rt6_info *rt, void *p_arg)
             (dst_mtu(&rt->dst) >= arg->mtu ||
              (dst_mtu(&rt->dst) < arg->mtu &&
               dst_mtu(&rt->dst) == idev->cnf.mtu6))) {
-                rt->dst.metrics[RTAX_MTU-1] = arg->mtu;
-                rt->dst.metrics[RTAX_ADVMSS-1] = ipv6_advmss(net, arg->mtu);
+                dst_metric_set(&rt->dst, RTAX_MTU, arg->mtu);
+                dst_metric_set(&rt->dst, RTAX_ADVMSS, ipv6_advmss(net, arg->mtu));
         }
         return 0;
 }
@@ -2295,7 +2300,7 @@ static int rt6_fill_node(struct net *net,
                         NLA_PUT(skb, RTA_PREFSRC, 16, &saddr_buf);
         }
 
-        if (rtnetlink_put_metrics(skb, rt->dst.metrics) < 0)
+        if (rtnetlink_put_metrics(skb, dst_metrics_ptr(&rt->dst)) < 0)
                 goto nla_put_failure;
 
         if (rt->dst.neighbour)
@@ -2686,6 +2691,7 @@ static int __net_init ip6_route_net_init(struct net *net)
         net->ipv6.ip6_null_entry->dst.path =
                 (struct dst_entry *)net->ipv6.ip6_null_entry;
         net->ipv6.ip6_null_entry->dst.ops = &net->ipv6.ip6_dst_ops;
+        dst_metric_set(&net->ipv6.ip6_null_entry->dst, RTAX_HOPLIMIT, 255);
 
 #ifdef CONFIG_IPV6_MULTIPLE_TABLES
         net->ipv6.ip6_prohibit_entry = kmemdup(&ip6_prohibit_entry_template,
@@ -2696,6 +2702,7 @@ static int __net_init ip6_route_net_init(struct net *net)
         net->ipv6.ip6_prohibit_entry->dst.path =
                 (struct dst_entry *)net->ipv6.ip6_prohibit_entry;
         net->ipv6.ip6_prohibit_entry->dst.ops = &net->ipv6.ip6_dst_ops;
+        dst_metric_set(&net->ipv6.ip6_prohibit_entry->dst, RTAX_HOPLIMIT, 255);
 
         net->ipv6.ip6_blk_hole_entry = kmemdup(&ip6_blk_hole_entry_template,
                                                sizeof(*net->ipv6.ip6_blk_hole_entry),
@@ -2705,6 +2712,7 @@ static int __net_init ip6_route_net_init(struct net *net)
         net->ipv6.ip6_blk_hole_entry->dst.path =
                 (struct dst_entry *)net->ipv6.ip6_blk_hole_entry;
         net->ipv6.ip6_blk_hole_entry->dst.ops = &net->ipv6.ip6_dst_ops;
+        dst_metric_set(&net->ipv6.ip6_blk_hole_entry->dst, RTAX_HOPLIMIT, 255);
 #endif
 
         net->ipv6.sysctl.flush_delay = 0;
diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c
index b541a4e009fb..7aad12770867 100644
--- a/net/ipv6/udp.c
+++ b/net/ipv6/udp.c
@@ -54,8 +54,8 @@ int ipv6_rcv_saddr_equal(const struct sock *sk, const struct sock *sk2)
 {
         const struct in6_addr *sk_rcv_saddr6 = &inet6_sk(sk)->rcv_saddr;
         const struct in6_addr *sk2_rcv_saddr6 = inet6_rcv_saddr(sk2);
-        __be32 sk1_rcv_saddr = inet_sk(sk)->inet_rcv_saddr;
-        __be32 sk2_rcv_saddr = inet_rcv_saddr(sk2);
+        __be32 sk1_rcv_saddr = sk_rcv_saddr(sk);
+        __be32 sk2_rcv_saddr = sk_rcv_saddr(sk2);
         int sk_ipv6only = ipv6_only_sock(sk);
         int sk2_ipv6only = inet_v6_ipv6only(sk2);
         int addr_type = ipv6_addr_type(sk_rcv_saddr6);
diff --git a/net/mac80211/agg-rx.c b/net/mac80211/agg-rx.c
index 720b7a84af59..f138b195d657 100644
--- a/net/mac80211/agg-rx.c
+++ b/net/mac80211/agg-rx.c
@@ -129,9 +129,7 @@ static void sta_rx_agg_reorder_timer_expired(unsigned long data)
                         timer_to_tid[0]);
 
         rcu_read_lock();
-        spin_lock(&sta->lock);
         ieee80211_release_reorder_timeout(sta, *ptid);
-        spin_unlock(&sta->lock);
         rcu_read_unlock();
 }
 
@@ -256,7 +254,7 @@ void ieee80211_process_addba_request(struct ieee80211_local *local,
         }
 
         /* prepare A-MPDU MLME for Rx aggregation */
-        tid_agg_rx = kmalloc(sizeof(struct tid_ampdu_rx), GFP_ATOMIC);
+        tid_agg_rx = kmalloc(sizeof(struct tid_ampdu_rx), GFP_KERNEL);
         if (!tid_agg_rx) {
 #ifdef CONFIG_MAC80211_HT_DEBUG
                 if (net_ratelimit())
@@ -280,9 +278,9 @@ void ieee80211_process_addba_request(struct ieee80211_local *local,
 
         /* prepare reordering buffer */
         tid_agg_rx->reorder_buf =
-                kcalloc(buf_size, sizeof(struct sk_buff *), GFP_ATOMIC);
+                kcalloc(buf_size, sizeof(struct sk_buff *), GFP_KERNEL);
         tid_agg_rx->reorder_time =
-                kcalloc(buf_size, sizeof(unsigned long), GFP_ATOMIC);
+                kcalloc(buf_size, sizeof(unsigned long), GFP_KERNEL);
         if (!tid_agg_rx->reorder_buf || !tid_agg_rx->reorder_time) {
 #ifdef CONFIG_MAC80211_HT_DEBUG
                 if (net_ratelimit())
diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c
index 0c544074479e..db134b500caa 100644
--- a/net/mac80211/cfg.c
+++ b/net/mac80211/cfg.c
@@ -1551,27 +1551,54 @@ static int ieee80211_cancel_remain_on_channel(struct wiphy *wiphy,
         return ieee80211_wk_cancel_remain_on_channel(sdata, cookie);
 }
 
+static enum work_done_result
+ieee80211_offchan_tx_done(struct ieee80211_work *wk, struct sk_buff *skb)
+{
+        /*
+         * Use the data embedded in the work struct for reporting
+         * here so if the driver mangled the SKB before dropping
+         * it (which is the only way we really should get here)
+         * then we don't report mangled data.
+         *
+         * If there was no wait time, then by the time we get here
+         * the driver will likely not have reported the status yet,
+         * so in that case userspace will have to deal with it.
+         */
+
+        if (wk->offchan_tx.wait && wk->offchan_tx.frame)
+                cfg80211_mgmt_tx_status(wk->sdata->dev,
+                                        (unsigned long) wk->offchan_tx.frame,
+                                        wk->ie, wk->ie_len, false, GFP_KERNEL);
+
+        return WORK_DONE_DESTROY;
+}
+
 static int ieee80211_mgmt_tx(struct wiphy *wiphy, struct net_device *dev,
-                             struct ieee80211_channel *chan,
+                             struct ieee80211_channel *chan, bool offchan,
                              enum nl80211_channel_type channel_type,
-                             bool channel_type_valid,
+                             bool channel_type_valid, unsigned int wait,
                              const u8 *buf, size_t len, u64 *cookie)
 {
         struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
         struct ieee80211_local *local = sdata->local;
         struct sk_buff *skb;
         struct sta_info *sta;
+        struct ieee80211_work *wk;
         const struct ieee80211_mgmt *mgmt = (void *)buf;
         u32 flags = IEEE80211_TX_INTFL_NL80211_FRAME_TX |
                     IEEE80211_TX_CTL_REQ_TX_STATUS;
+        bool is_offchan = false;
 
         /* Check that we are on the requested channel for transmission */
         if (chan != local->tmp_channel &&
             chan != local->oper_channel)
-                return -EBUSY;
+                is_offchan = true;
         if (channel_type_valid &&
             (channel_type != local->tmp_channel_type &&
              channel_type != local->_oper_channel_type))
+                is_offchan = true;
+
+        if (is_offchan && !offchan)
                 return -EBUSY;
 
         switch (sdata->vif.type) {
@@ -1605,12 +1632,70 @@ static int ieee80211_mgmt_tx(struct wiphy *wiphy, struct net_device *dev,
         IEEE80211_SKB_CB(skb)->flags = flags;
 
         skb->dev = sdata->dev;
-        ieee80211_tx_skb(sdata, skb);
 
         *cookie = (unsigned long) skb;
+
+        /*
+         * Can transmit right away if the channel was the
+         * right one and there's no wait involved... If a
+         * wait is involved, we might otherwise not be on
+         * the right channel for long enough!
+         */
+        if (!is_offchan && !wait && !sdata->vif.bss_conf.idle) {
+                ieee80211_tx_skb(sdata, skb);
+                return 0;
+        }
+
+        wk = kzalloc(sizeof(*wk) + len, GFP_KERNEL);
+        if (!wk) {
+                kfree_skb(skb);
+                return -ENOMEM;
+        }
+
+        wk->type = IEEE80211_WORK_OFFCHANNEL_TX;
+        wk->chan = chan;
+        wk->sdata = sdata;
+        wk->done = ieee80211_offchan_tx_done;
+        wk->offchan_tx.frame = skb;
+        wk->offchan_tx.wait = wait;
+        wk->ie_len = len;
+        memcpy(wk->ie, buf, len);
+
+        ieee80211_add_work(wk);
         return 0;
 }
 
+static int ieee80211_mgmt_tx_cancel_wait(struct wiphy *wiphy,
+                                         struct net_device *dev,
+                                         u64 cookie)
+{
+        struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
+        struct ieee80211_local *local = sdata->local;
+        struct ieee80211_work *wk;
+        int ret = -ENOENT;
+
+        mutex_lock(&local->mtx);
+        list_for_each_entry(wk, &local->work_list, list) {
+                if (wk->sdata != sdata)
+                        continue;
+
+                if (wk->type != IEEE80211_WORK_OFFCHANNEL_TX)
+                        continue;
+
+                if (cookie != (unsigned long) wk->offchan_tx.frame)
+                        continue;
+
+                wk->timeout = jiffies;
+
+                ieee80211_queue_work(&local->hw, &local->work_work);
+                ret = 0;
+                break;
+        }
+        mutex_unlock(&local->mtx);
+
+        return ret;
+}
+
 static void ieee80211_mgmt_frame_register(struct wiphy *wiphy,
                                           struct net_device *dev,
                                           u16 frame_type, bool reg)
@@ -1695,6 +1780,7 @@ struct cfg80211_ops mac80211_config_ops = {
         .remain_on_channel = ieee80211_remain_on_channel,
         .cancel_remain_on_channel = ieee80211_cancel_remain_on_channel,
         .mgmt_tx = ieee80211_mgmt_tx,
+        .mgmt_tx_cancel_wait = ieee80211_mgmt_tx_cancel_wait,
         .set_cqm_rssi_config = ieee80211_set_cqm_rssi_config,
         .mgmt_frame_register = ieee80211_mgmt_frame_register,
         .set_antenna = ieee80211_set_antenna,
diff --git a/net/mac80211/debugfs_sta.c b/net/mac80211/debugfs_sta.c
index f0fce37f4069..8bb5af85f469 100644
--- a/net/mac80211/debugfs_sta.c
+++ b/net/mac80211/debugfs_sta.c
@@ -112,34 +112,35 @@ static ssize_t sta_agg_status_read(struct file *file, char __user *userbuf,
         char buf[71 + STA_TID_NUM * 40], *p = buf;
         int i;
         struct sta_info *sta = file->private_data;
+        struct tid_ampdu_rx *tid_rx;
+        struct tid_ampdu_tx *tid_tx;
+
+        rcu_read_lock();
 
-        spin_lock_bh(&sta->lock);
         p += scnprintf(p, sizeof(buf) + buf - p, "next dialog_token: %#02x\n",
                         sta->ampdu_mlme.dialog_token_allocator + 1);
         p += scnprintf(p, sizeof(buf) + buf - p,
                        "TID\t\tRX active\tDTKN\tSSN\t\tTX\tDTKN\tpending\n");
+
         for (i = 0; i < STA_TID_NUM; i++) {
+                tid_rx = rcu_dereference(sta->ampdu_mlme.tid_rx[i]);
+                tid_tx = rcu_dereference(sta->ampdu_mlme.tid_tx[i]);
+
                 p += scnprintf(p, sizeof(buf) + buf - p, "%02d", i);
-                p += scnprintf(p, sizeof(buf) + buf - p, "\t\t%x",
-                                !!sta->ampdu_mlme.tid_rx[i]);
+                p += scnprintf(p, sizeof(buf) + buf - p, "\t\t%x", !!tid_rx);
                 p += scnprintf(p, sizeof(buf) + buf - p, "\t%#.2x",
-                                sta->ampdu_mlme.tid_rx[i] ?
-                                sta->ampdu_mlme.tid_rx[i]->dialog_token : 0);
+                                tid_rx ? tid_rx->dialog_token : 0);
                 p += scnprintf(p, sizeof(buf) + buf - p, "\t%#.3x",
-                                sta->ampdu_mlme.tid_rx[i] ?
-                                sta->ampdu_mlme.tid_rx[i]->ssn : 0);
+                                tid_rx ? tid_rx->ssn : 0);
 
-                p += scnprintf(p, sizeof(buf) + buf - p, "\t\t%x",
-                                !!sta->ampdu_mlme.tid_tx[i]);
+                p += scnprintf(p, sizeof(buf) + buf - p, "\t\t%x", !!tid_tx);
                 p += scnprintf(p, sizeof(buf) + buf - p, "\t%#.2x",
-                                sta->ampdu_mlme.tid_tx[i] ?
-                                sta->ampdu_mlme.tid_tx[i]->dialog_token : 0);
+                                tid_tx ? tid_tx->dialog_token : 0);
                 p += scnprintf(p, sizeof(buf) + buf - p, "\t%03d",
-                                sta->ampdu_mlme.tid_tx[i] ?
-                                skb_queue_len(&sta->ampdu_mlme.tid_tx[i]->pending) : 0);
+                                tid_tx ? skb_queue_len(&tid_tx->pending) : 0);
                 p += scnprintf(p, sizeof(buf) + buf - p, "\n");
         }
-        spin_unlock_bh(&sta->lock);
+        rcu_read_unlock();
 
         return simple_read_from_buffer(userbuf, count, ppos, buf, p - buf);
 }
diff --git a/net/mac80211/ieee80211_i.h b/net/mac80211/ieee80211_i.h
index 5bc0745368fe..66b0b52b828d 100644
--- a/net/mac80211/ieee80211_i.h
+++ b/net/mac80211/ieee80211_i.h
@@ -260,6 +260,7 @@ enum ieee80211_work_type {
         IEEE80211_WORK_ASSOC_BEACON_WAIT,
         IEEE80211_WORK_ASSOC,
         IEEE80211_WORK_REMAIN_ON_CHANNEL,
+        IEEE80211_WORK_OFFCHANNEL_TX,
 };
 
 /**
@@ -320,6 +321,10 @@ struct ieee80211_work {
                 struct {
                         u32 duration;
                 } remain;
+                struct {
+                        struct sk_buff *frame;
+                        u32 wait;
+                } offchan_tx;
         };
 
         int ie_len;
diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
index 55337709de41..6289525c0998 100644
--- a/net/mac80211/rx.c
+++ b/net/mac80211/rx.c
@@ -538,6 +538,8 @@ static void ieee80211_release_reorder_frame(struct ieee80211_hw *hw,
 {
         struct sk_buff *skb = tid_agg_rx->reorder_buf[index];
 
+        lockdep_assert_held(&tid_agg_rx->reorder_lock);
+
         if (!skb)
                 goto no_frame;
 
@@ -557,6 +559,8 @@ static void ieee80211_release_reorder_frames(struct ieee80211_hw *hw,
 {
         int index;
 
+        lockdep_assert_held(&tid_agg_rx->reorder_lock);
+
         while (seq_less(tid_agg_rx->head_seq_num, head_seq_num)) {
                 index = seq_sub(tid_agg_rx->head_seq_num, tid_agg_rx->ssn) %
                                                         tid_agg_rx->buf_size;
@@ -581,6 +585,8 @@ static void ieee80211_sta_reorder_release(struct ieee80211_hw *hw,
 {
         int index, j;
 
+        lockdep_assert_held(&tid_agg_rx->reorder_lock);
+
         /* release the buffer until next missing frame */
         index = seq_sub(tid_agg_rx->head_seq_num, tid_agg_rx->ssn) %
                                                 tid_agg_rx->buf_size;
@@ -683,10 +689,11 @@ static bool ieee80211_sta_manage_reorder_buf(struct ieee80211_hw *hw,
         int index;
         bool ret = true;
 
+        spin_lock(&tid_agg_rx->reorder_lock);
+
         buf_size = tid_agg_rx->buf_size;
         head_seq_num = tid_agg_rx->head_seq_num;
 
-        spin_lock(&tid_agg_rx->reorder_lock);
         /* frame with out of date sequence number */
         if (seq_less(mpdu_seq_num, head_seq_num)) {
                 dev_kfree_skb(skb);
@@ -1870,9 +1877,8 @@ ieee80211_rx_h_data(struct ieee80211_rx_data *rx)
         dev->stats.rx_packets++;
         dev->stats.rx_bytes += rx->skb->len;
 
-        if (ieee80211_is_data(hdr->frame_control) &&
-            !is_multicast_ether_addr(hdr->addr1) &&
-            local->hw.conf.dynamic_ps_timeout > 0 && local->ps_sdata) {
+        if (local->ps_sdata && local->hw.conf.dynamic_ps_timeout > 0 &&
+            !is_multicast_ether_addr(((struct ethhdr *)rx->skb->data)->h_dest)) {
                         mod_timer(&local->dynamic_ps_timer, jiffies +
                          msecs_to_jiffies(local->hw.conf.dynamic_ps_timeout));
         }
@@ -1921,9 +1927,12 @@ ieee80211_rx_h_ctrl(struct ieee80211_rx_data *rx, struct sk_buff_head *frames)
                         mod_timer(&tid_agg_rx->session_timer,
                                   TU_TO_EXP_TIME(tid_agg_rx->timeout));
 
+                spin_lock(&tid_agg_rx->reorder_lock);
                 /* release stored frames up to start of BAR */
                 ieee80211_release_reorder_frames(hw, tid_agg_rx, start_seq_num,
                                                  frames);
+                spin_unlock(&tid_agg_rx->reorder_lock);
+
                 kfree_skb(skb);
                 return RX_QUEUED;
         }
@@ -2519,9 +2528,8 @@ static void ieee80211_invoke_rx_handlers(struct ieee80211_rx_data *rx)
 }
 
 /*
- * This function makes calls into the RX path. Therefore the
- * caller must hold the sta_info->lock and everything has to
- * be under rcu_read_lock protection as well.
+ * This function makes calls into the RX path, therefore
+ * it has to be invoked under RCU read lock.
  */
 void ieee80211_release_reorder_timeout(struct sta_info *sta, int tid)
 {
diff --git a/net/mac80211/sta_info.h b/net/mac80211/sta_info.h
index b562d9b6a702..05f11302443b 100644
--- a/net/mac80211/sta_info.h
+++ b/net/mac80211/sta_info.h
@@ -81,13 +81,14 @@ enum ieee80211_sta_info_flags {
  * @stop_initiator: initiator of a session stop
  * @tx_stop: TX DelBA frame when stopping
  *
- * This structure is protected by RCU and the per-station
- * spinlock. Assignments to the array holding it must hold
- * the spinlock, only the TX path can access it under RCU
- * lock-free if, and only if, the state has  the flag
- * %HT_AGG_STATE_OPERATIONAL set. Otherwise, the TX path
- * must also acquire the spinlock and re-check the state,
- * see comments in the tx code touching it.
+ * This structure's lifetime is managed by RCU, assignments to
+ * the array holding it must hold the aggregation mutex.
+ *
+ * The TX path can access it under RCU lock-free if, and
+ * only if, the state has the flag %HT_AGG_STATE_OPERATIONAL
+ * set. Otherwise, the TX path must also acquire the spinlock
+ * and re-check the state, see comments in the tx code
+ * touching it.
  */
 struct tid_ampdu_tx {
         struct rcu_head rcu_head;
@@ -115,15 +116,13 @@ struct tid_ampdu_tx {
  * @rcu_head: RCU head used for freeing this struct
  * @reorder_lock: serializes access to reorder buffer, see below.
  *
- * This structure is protected by RCU and the per-station
- * spinlock. Assignments to the array holding it must hold
- * the spinlock.
+ * This structure's lifetime is managed by RCU, assignments to
+ * the array holding it must hold the aggregation mutex.
  *
- * The @reorder_lock is used to protect the variables and
- * arrays such as @reorder_buf, @reorder_time, @head_seq_num,
- * @stored_mpdu_num and @reorder_time from being corrupted by
- * concurrent access of the RX path and the expired frame
- * release timer.
+ * The @reorder_lock is used to protect the members of this
+ * struct, except for @timeout, @buf_size and @dialog_token,
+ * which are constant across the lifetime of the struct (the
+ * dialog token being used only for debugging).
  */
 struct tid_ampdu_rx {
         struct rcu_head rcu_head;
diff --git a/net/mac80211/status.c b/net/mac80211/status.c
index bed7e32ed908..4958710a7d92 100644
--- a/net/mac80211/status.c
+++ b/net/mac80211/status.c
@@ -321,10 +321,23 @@ void ieee80211_tx_status(struct ieee80211_hw *hw, struct sk_buff *skb)
                                         msecs_to_jiffies(10));
         }
 
-        if (info->flags & IEEE80211_TX_INTFL_NL80211_FRAME_TX)
+        if (info->flags & IEEE80211_TX_INTFL_NL80211_FRAME_TX) {
+                struct ieee80211_work *wk;
+
+                rcu_read_lock();
+                list_for_each_entry_rcu(wk, &local->work_list, list) {
+                        if (wk->type != IEEE80211_WORK_OFFCHANNEL_TX)
+                                continue;
+                        if (wk->offchan_tx.frame != skb)
+                                continue;
+                        wk->offchan_tx.frame = NULL;
+                        break;
+                }
+                rcu_read_unlock();
                 cfg80211_mgmt_tx_status(
                         skb->dev, (unsigned long) skb, skb->data, skb->len,
                         !!(info->flags & IEEE80211_TX_STAT_ACK), GFP_ATOMIC);
+        }
 
         /* this was a transmitted frame, but now we want to reuse it */
         skb_orphan(skb);
diff --git a/net/mac80211/work.c b/net/mac80211/work.c
index ae344d1ba056..2b5c3f267198 100644
--- a/net/mac80211/work.c
+++ b/net/mac80211/work.c
@@ -561,6 +561,25 @@ ieee80211_remain_on_channel_timeout(struct ieee80211_work *wk)
 }
 
 static enum work_action __must_check
+ieee80211_offchannel_tx(struct ieee80211_work *wk)
+{
+        if (!wk->started) {
+                wk->timeout = jiffies + msecs_to_jiffies(wk->offchan_tx.wait);
+
+                /*
+                 * After this, offchan_tx.frame remains but now is no
+                 * longer a valid pointer -- we still need it as the
+                 * cookie for canceling this work.
+                 */
+                ieee80211_tx_skb(wk->sdata, wk->offchan_tx.frame);
+
+                return WORK_ACT_NONE;
+        }
+
+        return WORK_ACT_TIMEOUT;
+}
+
+static enum work_action __must_check
 ieee80211_assoc_beacon_wait(struct ieee80211_work *wk)
 {
         if (wk->started)
@@ -955,6 +974,9 @@ static void ieee80211_work_work(struct work_struct *work)
                 case IEEE80211_WORK_REMAIN_ON_CHANNEL:
                         rma = ieee80211_remain_on_channel_timeout(wk);
                         break;
+                case IEEE80211_WORK_OFFCHANNEL_TX:
+                        rma = ieee80211_offchannel_tx(wk);
+                        break;
                 case IEEE80211_WORK_ASSOC_BEACON_WAIT:
                         rma = ieee80211_assoc_beacon_wait(wk);
                         break;
diff --git a/net/wireless/core.h b/net/wireless/core.h
index 6583cca0e2ee..ee80ad8dc655 100644
--- a/net/wireless/core.h
+++ b/net/wireless/core.h
@@ -341,9 +341,9 @@ void cfg80211_mlme_unregister_socket(struct wireless_dev *wdev, u32 nlpid);
 void cfg80211_mlme_purge_registrations(struct wireless_dev *wdev);
 int cfg80211_mlme_mgmt_tx(struct cfg80211_registered_device *rdev,
                           struct net_device *dev,
-                          struct ieee80211_channel *chan,
+                          struct ieee80211_channel *chan, bool offchan,
                           enum nl80211_channel_type channel_type,
-                          bool channel_type_valid,
+                          bool channel_type_valid, unsigned int wait,
                           const u8 *buf, size_t len, u64 *cookie);
 
 /* SME */
diff --git a/net/wireless/mlme.c b/net/wireless/mlme.c
index 6980a0c315b2..d7680f2a4c5b 100644
--- a/net/wireless/mlme.c
+++ b/net/wireless/mlme.c
@@ -864,9 +864,9 @@ void cfg80211_mlme_purge_registrations(struct wireless_dev *wdev)
 
 int cfg80211_mlme_mgmt_tx(struct cfg80211_registered_device *rdev,
                           struct net_device *dev,
-                          struct ieee80211_channel *chan,
+                          struct ieee80211_channel *chan, bool offchan,
                           enum nl80211_channel_type channel_type,
-                          bool channel_type_valid,
+                          bool channel_type_valid, unsigned int wait,
                           const u8 *buf, size_t len, u64 *cookie)
 {
         struct wireless_dev *wdev = dev->ieee80211_ptr;
@@ -946,8 +946,9 @@ int cfg80211_mlme_mgmt_tx(struct cfg80211_registered_device *rdev,
                 return -EINVAL;
 
         /* Transmit the Action frame as requested by user space */
-        return rdev->ops->mgmt_tx(&rdev->wiphy, dev, chan, channel_type,
-                                  channel_type_valid, buf, len, cookie);
+        return rdev->ops->mgmt_tx(&rdev->wiphy, dev, chan, offchan,
+                                  channel_type, channel_type_valid,
+                                  wait, buf, len, cookie);
 }
 
 bool cfg80211_rx_mgmt(struct net_device *dev, int freq, const u8 *buf,
diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
index 67ff7e92cb99..960be4e650f0 100644
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -163,16 +163,13 @@ static const struct nla_policy nl80211_policy[NL80211_ATTR_MAX+1] = {
         [NL80211_ATTR_CQM] = { .type = NLA_NESTED, },
         [NL80211_ATTR_LOCAL_STATE_CHANGE] = { .type = NLA_FLAG },
         [NL80211_ATTR_AP_ISOLATE] = { .type = NLA_U8 },
-
         [NL80211_ATTR_WIPHY_TX_POWER_SETTING] = { .type = NLA_U32 },
         [NL80211_ATTR_WIPHY_TX_POWER_LEVEL] = { .type = NLA_U32 },
-
         [NL80211_ATTR_FRAME_TYPE] = { .type = NLA_U16 },
-
         [NL80211_ATTR_WIPHY_ANTENNA_TX] = { .type = NLA_U32 },
         [NL80211_ATTR_WIPHY_ANTENNA_RX] = { .type = NLA_U32 },
-
         [NL80211_ATTR_MCAST_RATE] = { .type = NLA_U32 },
+        [NL80211_ATTR_OFFCHANNEL_TX_OK] = { .type = NLA_FLAG },
 };
 
 /* policy for the key attributes */
@@ -677,6 +674,7 @@ static int nl80211_send_wiphy(struct sk_buff *msg, u32 pid, u32 seq, int flags,
         CMD(remain_on_channel, REMAIN_ON_CHANNEL);
         CMD(set_bitrate_mask, SET_TX_BITRATE_MASK);
         CMD(mgmt_tx, FRAME);
+        CMD(mgmt_tx_cancel_wait, FRAME_WAIT_CANCEL);
         if (dev->wiphy.flags & WIPHY_FLAG_NETNS_OK) {
                 i++;
                 NLA_PUT_U32(msg, i, NL80211_CMD_SET_WIPHY_NETNS);
@@ -698,6 +696,10 @@ static int nl80211_send_wiphy(struct sk_buff *msg, u32 pid, u32 seq, int flags,
 
         nla_nest_end(msg, nl_cmds);
 
+        /* for now at least assume all drivers have it */
+        if (dev->ops->mgmt_tx)
+                NLA_PUT_FLAG(msg, NL80211_ATTR_OFFCHANNEL_TX_OK);
+
         if (mgmt_stypes) {
                 u16 stypes;
                 struct nlattr *nl_ftypes, *nl_ifs;
@@ -4244,6 +4246,8 @@ static int nl80211_tx_mgmt(struct sk_buff *skb, struct genl_info *info)
         void *hdr;
         u64 cookie;
         struct sk_buff *msg;
+        unsigned int wait = 0;
+        bool offchan;
 
         if (!info->attrs[NL80211_ATTR_FRAME] ||
             !info->attrs[NL80211_ATTR_WIPHY_FREQ])
@@ -4260,6 +4264,12 @@ static int nl80211_tx_mgmt(struct sk_buff *skb, struct genl_info *info)
             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
                 return -EOPNOTSUPP;
 
+        if (info->attrs[NL80211_ATTR_DURATION]) {
+                if (!rdev->ops->mgmt_tx_cancel_wait)
+                        return -EINVAL;
+                wait = nla_get_u32(info->attrs[NL80211_ATTR_DURATION]);
+        }
+
         if (info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]) {
                 channel_type = nla_get_u32(
                         info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]);
@@ -4271,6 +4281,8 @@ static int nl80211_tx_mgmt(struct sk_buff *skb, struct genl_info *info)
                 channel_type_valid = true;
         }
 
+        offchan = info->attrs[NL80211_ATTR_OFFCHANNEL_TX_OK];
+
         freq = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]);
         chan = rdev_freq_to_chan(rdev, freq, channel_type);
         if (chan == NULL)
@@ -4287,8 +4299,8 @@ static int nl80211_tx_mgmt(struct sk_buff *skb, struct genl_info *info)
                 err = PTR_ERR(hdr);
                 goto free_msg;
         }
-        err = cfg80211_mlme_mgmt_tx(rdev, dev, chan, channel_type,
-                                    channel_type_valid,
+        err = cfg80211_mlme_mgmt_tx(rdev, dev, chan, offchan, channel_type,
+                                    channel_type_valid, wait,
                                     nla_data(info->attrs[NL80211_ATTR_FRAME]),
                                     nla_len(info->attrs[NL80211_ATTR_FRAME]),
                                     &cookie);
@@ -4307,6 +4319,31 @@ static int nl80211_tx_mgmt(struct sk_buff *skb, struct genl_info *info)
         return err;
 }
 
+static int nl80211_tx_mgmt_cancel_wait(struct sk_buff *skb, struct genl_info *info)
+{
+        struct cfg80211_registered_device *rdev = info->user_ptr[0];
+        struct net_device *dev = info->user_ptr[1];
+        u64 cookie;
+
+        if (!info->attrs[NL80211_ATTR_COOKIE])
+                return -EINVAL;
+
+        if (!rdev->ops->mgmt_tx_cancel_wait)
+                return -EOPNOTSUPP;
+
+        if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
+            dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC &&
+            dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT &&
+            dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
+            dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP_VLAN &&
+            dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
+                return -EOPNOTSUPP;
+
+        cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]);
+
+        return rdev->ops->mgmt_tx_cancel_wait(&rdev->wiphy, dev, cookie);
+}
+
 static int nl80211_set_power_save(struct sk_buff *skb, struct genl_info *info)
 {
         struct cfg80211_registered_device *rdev = info->user_ptr[0];
@@ -4880,6 +4917,14 @@ static struct genl_ops nl80211_ops[] = {
                                   NL80211_FLAG_NEED_RTNL,
         },
         {
+                .cmd = NL80211_CMD_FRAME_WAIT_CANCEL,
+                .doit = nl80211_tx_mgmt_cancel_wait,
+                .policy = nl80211_policy,
+                .flags = GENL_ADMIN_PERM,
+                .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
+                                  NL80211_FLAG_NEED_RTNL,
+        },
+        {
                 .cmd = NL80211_CMD_SET_POWER_SAVE,
                 .doit = nl80211_set_power_save,
                 .policy = nl80211_policy,
diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c
index 044e77898512..6e50ccd8c532 100644
--- a/net/xfrm/xfrm_policy.c
+++ b/net/xfrm/xfrm_policy.c
@@ -1433,7 +1433,7 @@ static struct dst_entry *xfrm_bundle_create(struct xfrm_policy *policy,
                 }
 
                 xdst->route = dst;
-                memcpy(&dst1->metrics, &dst->metrics, sizeof(dst->metrics));
+                dst_copy_metrics(dst1, dst);
 
                 if (xfrm[i]->props.mode != XFRM_MODE_TRANSPORT) {
                         family = xfrm[i]->props.family;
@@ -2271,7 +2271,7 @@ static void xfrm_init_pmtu(struct dst_entry *dst)
                 if (pmtu > route_mtu_cached)
                         pmtu = route_mtu_cached;
 
-                dst->metrics[RTAX_MTU-1] = pmtu;
+                dst_metric_set(dst, RTAX_MTU, pmtu);
         } while ((dst = dst->next));
 }
 
@@ -2349,7 +2349,7 @@ static int xfrm_bundle_ok(struct xfrm_policy *pol, struct xfrm_dst *first,
                 mtu = xfrm_state_mtu(dst->xfrm, mtu);
                 if (mtu > last->route_mtu_cached)
                         mtu = last->route_mtu_cached;
-                dst->metrics[RTAX_MTU-1] = mtu;
+                dst_metric_set(dst, RTAX_MTU, mtu);
 
                 if (last == first)
                         break;