14 files changed, 92 insertions, 75 deletions

diff --git a/net/bridge/br_multicast.c b/net/bridge/br_multicast.c
index 995cbe0ac0b2..a5f4e5769809 100644
--- a/net/bridge/br_multicast.c
+++ b/net/bridge/br_multicast.c
@@ -1501,6 +1501,8 @@ static int br_multicast_ipv6_rcv(struct net_bridge *br,
 
         __skb_pull(skb2, offset);
         skb_reset_transport_header(skb2);
+        skb_postpull_rcsum(skb2, skb_network_header(skb2),
+                           skb_network_header_len(skb2));
 
         icmp6_type = icmp6_hdr(skb2)->icmp6_type;
 
@@ -1770,7 +1772,7 @@ int br_multicast_toggle(struct net_bridge *br, unsigned long val)
         int err = 0;
         struct net_bridge_mdb_htable *mdb;
 
-        spin_lock(&br->multicast_lock);
+        spin_lock_bh(&br->multicast_lock);
         if (br->multicast_disabled == !val)
                 goto unlock;
 
@@ -1806,7 +1808,7 @@ rollback:
         }
 
 unlock:
-        spin_unlock(&br->multicast_lock);
+        spin_unlock_bh(&br->multicast_lock);
 
         return err;
 }
diff --git a/net/ipv4/ah4.c b/net/ipv4/ah4.c
index c1f4154552fc..36d14406261e 100644
--- a/net/ipv4/ah4.c
+++ b/net/ipv4/ah4.c
@@ -136,8 +136,6 @@ static void ah_output_done(struct crypto_async_request *base, int err)
                 memcpy(top_iph+1, iph+1, top_iph->ihl*4 - sizeof(struct iphdr));
         }
 
-        err = ah->nexthdr;
-
         kfree(AH_SKB_CB(skb)->tmp);
         xfrm_output_resume(skb, err);
 }
@@ -264,12 +262,12 @@ static void ah_input_done(struct crypto_async_request *base, int err)
         if (err)
                 goto out;
 
+        err = ah->nexthdr;
+
         skb->network_header += ah_hlen;
         memcpy(skb_network_header(skb), work_iph, ihl);
         __skb_pull(skb, ah_hlen + ihl);
         skb_set_transport_header(skb, -ihl);
-
-        err = ah->nexthdr;
 out:
         kfree(AH_SKB_CB(skb)->tmp);
         xfrm_input_resume(skb, err);
@@ -371,8 +369,6 @@ static int ah_input(struct xfrm_state *x, struct sk_buff *skb)
                 if (err == -EINPROGRESS)
                         goto out;
 
-                if (err == -EBUSY)
-                        err = NET_XMIT_DROP;
                 goto out_free;
         }
 
diff --git a/net/ipv4/inet_diag.c b/net/ipv4/inet_diag.c
index f5e2bdaef949..68e8ac514383 100644
--- a/net/ipv4/inet_diag.c
+++ b/net/ipv4/inet_diag.c
@@ -133,8 +133,8 @@ static int inet_csk_diag_fill(struct sock *sk,
                                &np->rcv_saddr);
                 ipv6_addr_copy((struct in6_addr *)r->id.idiag_dst,
                                &np->daddr);
-                if (ext & (1 << (INET_DIAG_TOS - 1)))
-                        RTA_PUT_U8(skb, INET_DIAG_TOS, np->tclass);
+                if (ext & (1 << (INET_DIAG_TCLASS - 1)))
+                        RTA_PUT_U8(skb, INET_DIAG_TCLASS, np->tclass);
         }
 #endif
 
diff --git a/net/ipv4/ip_options.c b/net/ipv4/ip_options.c
index ec93335901dd..05d20cca9d66 100644
--- a/net/ipv4/ip_options.c
+++ b/net/ipv4/ip_options.c
@@ -640,6 +640,7 @@ int ip_options_rcv_srr(struct sk_buff *skb)
         }
         if (srrptr <= srrspace) {
                 opt->srr_is_hit = 1;
+                iph->daddr = nexthop;
                 opt->is_changed = 1;
         }
         return 0;
diff --git a/net/ipv4/ping.c b/net/ipv4/ping.c
index a06f73fdb3c0..43d4c3b22369 100644
--- a/net/ipv4/ping.c
+++ b/net/ipv4/ping.c
@@ -339,7 +339,6 @@ void ping_err(struct sk_buff *skb, u32 info)
         sk = ping_v4_lookup(net, iph->daddr, iph->saddr,
                             ntohs(icmph->un.echo.id), skb->dev->ifindex);
         if (sk == NULL) {
-                ICMP_INC_STATS_BH(net, ICMP_MIB_INERRORS);
                 pr_debug("no socket, dropping\n");
                 return; /* No socket for error */
         }
@@ -679,7 +678,6 @@ static int ping_queue_rcv_skb(struct sock *sk, struct sk_buff *skb)
         pr_debug("ping_queue_rcv_skb(sk=%p,sk->num=%d,skb=%p)\n",
                 inet_sk(sk), inet_sk(sk)->inet_num, skb);
         if (sock_queue_rcv_skb(sk, skb) < 0) {
-                ICMP_INC_STATS_BH(sock_net(sk), ICMP_MIB_INERRORS);
                 kfree_skb(skb);
                 pr_debug("ping_queue_rcv_skb -> failed\n");
                 return -1;
diff --git a/net/ipv4/route.c b/net/ipv4/route.c
index 511f4a75149c..0c74da8a0473 100644
--- a/net/ipv4/route.c
+++ b/net/ipv4/route.c
@@ -1304,16 +1304,42 @@ static void rt_del(unsigned hash, struct rtable *rt)
         spin_unlock_bh(rt_hash_lock_addr(hash));
 }
 
+static int check_peer_redir(struct dst_entry *dst, struct inet_peer *peer)
+{
+        struct rtable *rt = (struct rtable *) dst;
+        __be32 orig_gw = rt->rt_gateway;
+        struct neighbour *n, *old_n;
+
+        dst_confirm(&rt->dst);
+
+        rt->rt_gateway = peer->redirect_learned.a4;
+
+        n = ipv4_neigh_lookup(&rt->dst, &rt->rt_gateway);
+        if (IS_ERR(n))
+                return PTR_ERR(n);
+        old_n = xchg(&rt->dst._neighbour, n);
+        if (old_n)
+                neigh_release(old_n);
+        if (!n || !(n->nud_state & NUD_VALID)) {
+                if (n)
+                        neigh_event_send(n, NULL);
+                rt->rt_gateway = orig_gw;
+                return -EAGAIN;
+        } else {
+                rt->rt_flags |= RTCF_REDIRECTED;
+                call_netevent_notifiers(NETEVENT_NEIGH_UPDATE, n);
+        }
+        return 0;
+}
+
 /* called in rcu_read_lock() section */
 void ip_rt_redirect(__be32 old_gw, __be32 daddr, __be32 new_gw,
                     __be32 saddr, struct net_device *dev)
 {
         int s, i;
         struct in_device *in_dev = __in_dev_get_rcu(dev);
-        struct rtable *rt;
         __be32 skeys[2] = { saddr, 0 };
         int    ikeys[2] = { dev->ifindex, 0 };
-        struct flowi4 fl4;
         struct inet_peer *peer;
         struct net *net;
 
@@ -1336,33 +1362,42 @@ void ip_rt_redirect(__be32 old_gw, __be32 daddr, __be32 new_gw,
                         goto reject_redirect;
         }
 
-        memset(&fl4, 0, sizeof(fl4));
-        fl4.daddr = daddr;
         for (s = 0; s < 2; s++) {
                 for (i = 0; i < 2; i++) {
-                        fl4.flowi4_oif = ikeys[i];
-                        fl4.saddr = skeys[s];
-                        rt = __ip_route_output_key(net, &fl4);
-                        if (IS_ERR(rt))
-                                continue;
-
-                        if (rt->dst.error || rt->dst.dev != dev ||
-                            rt->rt_gateway != old_gw) {
-                                ip_rt_put(rt);
-                                continue;
-                        }
+                        unsigned int hash;
+                        struct rtable __rcu **rthp;
+                        struct rtable *rt;
+
+                        hash = rt_hash(daddr, skeys[s], ikeys[i], rt_genid(net));
+
+                        rthp = &rt_hash_table[hash].chain;
+
+                        while ((rt = rcu_dereference(*rthp)) != NULL) {
+                                rthp = &rt->dst.rt_next;
+
+                                if (rt->rt_key_dst != daddr ||
+                                    rt->rt_key_src != skeys[s] ||
+                                    rt->rt_oif != ikeys[i] ||
+                                    rt_is_input_route(rt) ||
+                                    rt_is_expired(rt) ||
+                                    !net_eq(dev_net(rt->dst.dev), net) ||
+                                    rt->dst.error ||
+                                    rt->dst.dev != dev ||
+                                    rt->rt_gateway != old_gw)
+                                        continue;
 
-                        if (!rt->peer)
-                                rt_bind_peer(rt, rt->rt_dst, 1);
+                                if (!rt->peer)
+                                        rt_bind_peer(rt, rt->rt_dst, 1);
 
-                        peer = rt->peer;
-                        if (peer) {
-                                peer->redirect_learned.a4 = new_gw;
-                                atomic_inc(&__rt_peer_genid);
+                                peer = rt->peer;
+                                if (peer) {
+                                        if (peer->redirect_learned.a4 != new_gw) {
+                                                peer->redirect_learned.a4 = new_gw;
+                                                atomic_inc(&__rt_peer_genid);
+                                        }
+                                        check_peer_redir(&rt->dst, peer);
+                                }
                         }
-
-                        ip_rt_put(rt);
-                        return;
                 }
         }
         return;
@@ -1649,33 +1684,6 @@ static void ip_rt_update_pmtu(struct dst_entry *dst, u32 mtu)
         }
 }
 
-static int check_peer_redir(struct dst_entry *dst, struct inet_peer *peer)
-{
-        struct rtable *rt = (struct rtable *) dst;
-        __be32 orig_gw = rt->rt_gateway;
-        struct neighbour *n, *old_n;
-
-        dst_confirm(&rt->dst);
-
-        rt->rt_gateway = peer->redirect_learned.a4;
-
-        n = ipv4_neigh_lookup(&rt->dst, &rt->rt_gateway);
-        if (IS_ERR(n))
-                return PTR_ERR(n);
-        old_n = xchg(&rt->dst._neighbour, n);
-        if (old_n)
-                neigh_release(old_n);
-        if (!n || !(n->nud_state & NUD_VALID)) {
-                if (n)
-                        neigh_event_send(n, NULL);
-                rt->rt_gateway = orig_gw;
-                return -EAGAIN;
-        } else {
-                rt->rt_flags |= RTCF_REDIRECTED;
-                call_netevent_notifiers(NETEVENT_NEIGH_UPDATE, n);
-        }
-        return 0;
-}
 
 static struct dst_entry *ipv4_dst_check(struct dst_entry *dst, u32 cookie)
 {
diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
index a7443159c400..a9db4b1a2215 100644
--- a/net/ipv4/tcp_ipv4.c
+++ b/net/ipv4/tcp_ipv4.c
@@ -1510,6 +1510,7 @@ exit:
         NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_LISTENDROPS);
         return NULL;
 put_and_exit:
+        tcp_clear_xmit_timers(newsk);
         bh_unlock_sock(newsk);
         sock_put(newsk);
         goto exit;
diff --git a/net/ipv6/ah6.c b/net/ipv6/ah6.c
index 2195ae651923..4c0f894d0843 100644
--- a/net/ipv6/ah6.c
+++ b/net/ipv6/ah6.c
@@ -324,8 +324,6 @@ static void ah6_output_done(struct crypto_async_request *base, int err)
 #endif
         }
 
-        err = ah->nexthdr;
-
         kfree(AH_SKB_CB(skb)->tmp);
         xfrm_output_resume(skb, err);
 }
@@ -466,12 +464,12 @@ static void ah6_input_done(struct crypto_async_request *base, int err)
         if (err)
                 goto out;
 
+        err = ah->nexthdr;
+
         skb->network_header += ah_hlen;
         memcpy(skb_network_header(skb), work_iph, hdr_len);
         __skb_pull(skb, ah_hlen + hdr_len);
         skb_set_transport_header(skb, -hdr_len);
-
-        err = ah->nexthdr;
 out:
         kfree(AH_SKB_CB(skb)->tmp);
         xfrm_input_resume(skb, err);
@@ -583,8 +581,6 @@ static int ah6_input(struct xfrm_state *x, struct sk_buff *skb)
                 if (err == -EINPROGRESS)
                         goto out;
 
-                if (err == -EBUSY)
-                        err = NET_XMIT_DROP;
                 goto out_free;
         }
 
diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c
index f36ca1397513..83f0e31c5fbd 100644
--- a/net/ipv6/ip6_tunnel.c
+++ b/net/ipv6/ip6_tunnel.c
@@ -289,6 +289,8 @@ static struct ip6_tnl *ip6_tnl_create(struct net *net, struct ip6_tnl_parm *p)
         if ((err = register_netdevice(dev)) < 0)
                 goto failed_free;
 
+        strcpy(t->parms.name, dev->name);
+
         dev_hold(dev);
         ip6_tnl_link(ip6n, t);
         return t;
@@ -1407,7 +1409,6 @@ ip6_tnl_dev_init_gen(struct net_device *dev)
         struct ip6_tnl *t = netdev_priv(dev);
 
         t->dev = dev;
-        strcpy(t->parms.name, dev->name);
         dev->tstats = alloc_percpu(struct pcpu_tstats);
         if (!dev->tstats)
                 return -ENOMEM;
@@ -1487,6 +1488,7 @@ static void __net_exit ip6_tnl_destroy_tunnels(struct ip6_tnl_net *ip6n)
 static int __net_init ip6_tnl_init_net(struct net *net)
 {
         struct ip6_tnl_net *ip6n = net_generic(net, ip6_tnl_net_id);
+        struct ip6_tnl *t = NULL;
         int err;
 
         ip6n->tnls[0] = ip6n->tnls_wc;
@@ -1507,6 +1509,10 @@ static int __net_init ip6_tnl_init_net(struct net *net)
         err = register_netdev(ip6n->fb_tnl_dev);
         if (err < 0)
                 goto err_register;
+
+        t = netdev_priv(ip6n->fb_tnl_dev);
+
+        strcpy(t->parms.name, ip6n->fb_tnl_dev->name);
         return 0;
 
 err_register:
diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
index 341e18344679..f9ec15b3fe09 100644
--- a/net/mac80211/mlme.c
+++ b/net/mac80211/mlme.c
@@ -2296,6 +2296,7 @@ void ieee80211_sta_quiesce(struct ieee80211_sub_if_data *sdata)
 
         cancel_work_sync(&ifmgd->request_smps_work);
 
+        cancel_work_sync(&ifmgd->monitor_work);
         cancel_work_sync(&ifmgd->beacon_connection_loss_work);
         if (del_timer_sync(&ifmgd->timer))
                 set_bit(TMR_RUNNING_TIMER, &ifmgd->timers_running);
@@ -2304,7 +2305,6 @@ void ieee80211_sta_quiesce(struct ieee80211_sub_if_data *sdata)
         if (del_timer_sync(&ifmgd->chswitch_timer))
                 set_bit(TMR_RUNNING_CHANSW, &ifmgd->timers_running);
 
-        cancel_work_sync(&ifmgd->monitor_work);
         /* these will just be re-established on connection */
         del_timer_sync(&ifmgd->conn_mon_timer);
         del_timer_sync(&ifmgd->bcn_mon_timer);
diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
index 4eafbfd891d5..d1a8869fe05d 100644
--- a/net/mac80211/rx.c
+++ b/net/mac80211/rx.c
@@ -141,8 +141,9 @@ ieee80211_add_rx_radiotap_header(struct ieee80211_local *local,
         pos++;
 
         /* IEEE80211_RADIOTAP_RATE */
-        if (status->flag & RX_FLAG_HT) {
+        if (!rate || status->flag & RX_FLAG_HT) {
                 /*
+                 * Without rate information don't add it. If we have,
                  * MCS information is a separate field in radiotap,
                  * added below. The byte here is needed as padding
                  * for the channel though, so initialise it to 0.
@@ -163,12 +164,14 @@ ieee80211_add_rx_radiotap_header(struct ieee80211_local *local,
         else if (status->flag & RX_FLAG_HT)
                 put_unaligned_le16(IEEE80211_CHAN_DYN | IEEE80211_CHAN_2GHZ,
                                    pos);
-        else if (rate->flags & IEEE80211_RATE_ERP_G)
+        else if (rate && rate->flags & IEEE80211_RATE_ERP_G)
                 put_unaligned_le16(IEEE80211_CHAN_OFDM | IEEE80211_CHAN_2GHZ,
                                    pos);
-        else
+        else if (rate)
                 put_unaligned_le16(IEEE80211_CHAN_CCK | IEEE80211_CHAN_2GHZ,
                                    pos);
+        else
+                put_unaligned_le16(IEEE80211_CHAN_2GHZ, pos);
         pos += 2;
 
         /* IEEE80211_RADIOTAP_DBM_ANTSIGNAL */
diff --git a/net/mac80211/util.c b/net/mac80211/util.c
index 7683cb83fe46..3a00814699f0 100644
--- a/net/mac80211/util.c
+++ b/net/mac80211/util.c
@@ -866,6 +866,8 @@ struct sk_buff *ieee80211_build_probe_req(struct ieee80211_sub_if_data *sdata,
         skb = ieee80211_probereq_get(&local->hw, &sdata->vif,
                                      ssid, ssid_len,
                                      buf, buf_len);
+        if (!skb)
+                goto out;
 
         if (dst) {
                 mgmt = (struct ieee80211_mgmt *) skb->data;
@@ -874,6 +876,8 @@ struct sk_buff *ieee80211_build_probe_req(struct ieee80211_sub_if_data *sdata,
         }
 
         IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_INTFL_DONT_ENCRYPT;
+
+ out:
         kfree(buf);
 
         return skb;
diff --git a/net/rds/Kconfig b/net/rds/Kconfig
index 4cf6dc7910e4..ec753b3ae72a 100644
--- a/net/rds/Kconfig
+++ b/net/rds/Kconfig
@@ -9,7 +9,6 @@ config RDS
 
 config RDS_RDMA
         tristate "RDS over Infiniband and iWARP"
-        select LLIST
         depends on RDS && INFINIBAND && INFINIBAND_ADDR_TRANS
         ---help---
           Allow RDS to use Infiniband and iWARP as a transport.
diff --git a/net/wireless/reg.c b/net/wireless/reg.c
index 6acba9d18cc8..e71f5a66574e 100644
--- a/net/wireless/reg.c
+++ b/net/wireless/reg.c
@@ -2265,6 +2265,9 @@ void /* __init_or_exit */ regulatory_exit(void)
 
         kfree(last_request);
 
+        last_request = NULL;
+        dev_set_uevent_suppress(&reg_pdev->dev, true);
+
         platform_device_unregister(reg_pdev);
 
         spin_lock_bh(&reg_pending_beacons_lock);