55 files changed, 244 insertions, 225 deletions

diff --git a/net/8021q/vlanproc.c b/net/8021q/vlanproc.c
index a0ec47925597..146cfb0e9882 100644
--- a/net/8021q/vlanproc.c
+++ b/net/8021q/vlanproc.c
@@ -161,11 +161,10 @@ int __init vlan_proc_init(void)
         if (!proc_vlan_dir)
                 goto err;
 
-        proc_vlan_conf = create_proc_entry(name_conf, S_IFREG|S_IRUSR|S_IWUSR,
-                                           proc_vlan_dir);
+        proc_vlan_conf = proc_create(name_conf, S_IFREG|S_IRUSR|S_IWUSR,
+                                     proc_vlan_dir, &vlan_fops);
         if (!proc_vlan_conf)
                 goto err;
-        proc_vlan_conf->proc_fops = &vlan_fops;
         return 0;
 
 err:
@@ -182,13 +181,11 @@ int vlan_proc_add_dev(struct net_device *vlandev)
 {
         struct vlan_dev_info *dev_info = vlan_dev_info(vlandev);
 
-        dev_info->dent = create_proc_entry(vlandev->name,
-                                           S_IFREG|S_IRUSR|S_IWUSR,
-                                           proc_vlan_dir);
+        dev_info->dent = proc_create(vlandev->name, S_IFREG|S_IRUSR|S_IWUSR,
+                                     proc_vlan_dir, &vlandev_fops);
         if (!dev_info->dent)
                 return -ENOBUFS;
 
-        dev_info->dent->proc_fops = &vlandev_fops;
         dev_info->dent->data = vlandev;
         return 0;
 }
diff --git a/net/appletalk/atalk_proc.c b/net/appletalk/atalk_proc.c
index 8e8dcfd532db..162199a2d74f 100644
--- a/net/appletalk/atalk_proc.c
+++ b/net/appletalk/atalk_proc.c
@@ -283,25 +283,24 @@ int __init atalk_proc_init(void)
                 goto out;
         atalk_proc_dir->owner = THIS_MODULE;
 
-        p = create_proc_entry("interface", S_IRUGO, atalk_proc_dir);
+        p = proc_create("interface", S_IRUGO, atalk_proc_dir,
+                        &atalk_seq_interface_fops);
         if (!p)
                 goto out_interface;
-        p->proc_fops = &atalk_seq_interface_fops;
 
-        p = create_proc_entry("route", S_IRUGO, atalk_proc_dir);
+        p = proc_create("route", S_IRUGO, atalk_proc_dir,
+                        &atalk_seq_route_fops);
         if (!p)
                 goto out_route;
-        p->proc_fops = &atalk_seq_route_fops;
 
-        p = create_proc_entry("socket", S_IRUGO, atalk_proc_dir);
+        p = proc_create("socket", S_IRUGO, atalk_proc_dir,
+                        &atalk_seq_socket_fops);
         if (!p)
                 goto out_socket;
-        p->proc_fops = &atalk_seq_socket_fops;
 
-        p = create_proc_entry("arp", S_IRUGO, atalk_proc_dir);
+        p = proc_create("arp", S_IRUGO, atalk_proc_dir, &atalk_seq_arp_fops);
         if (!p)
                 goto out_arp;
-        p->proc_fops = &atalk_seq_arp_fops;
 
         rc = 0;
 out:
diff --git a/net/atm/br2684.c b/net/atm/br2684.c
index 574d9a964176..1b228065e745 100644
--- a/net/atm/br2684.c
+++ b/net/atm/br2684.c
@@ -742,9 +742,9 @@ static int __init br2684_init(void)
 {
 #ifdef CONFIG_PROC_FS
         struct proc_dir_entry *p;
-        if ((p = create_proc_entry("br2684", 0, atm_proc_root)) == NULL)
+        p = proc_create("br2684", 0, atm_proc_root, &br2684_proc_ops);
+        if (p == NULL)
                 return -ENOMEM;
-        p->proc_fops = &br2684_proc_ops;
 #endif
         register_atm_ioctl(&br2684_ioctl_ops);
         return 0;
diff --git a/net/atm/clip.c b/net/atm/clip.c
index 86b885ec1cbd..d30167c0b48e 100644
--- a/net/atm/clip.c
+++ b/net/atm/clip.c
@@ -962,9 +962,7 @@ static int __init atm_clip_init(void)
         {
                 struct proc_dir_entry *p;
 
-                p = create_proc_entry("arp", S_IRUGO, atm_proc_root);
-                if (p)
-                        p->proc_fops = &arp_seq_fops;
+                p = proc_create("arp", S_IRUGO, atm_proc_root, &arp_seq_fops);
         }
 #endif
 
diff --git a/net/atm/lec.c b/net/atm/lec.c
index 1a8c4c6c0cd0..0e450d12f035 100644
--- a/net/atm/lec.c
+++ b/net/atm/lec.c
@@ -1249,9 +1249,7 @@ static int __init lane_module_init(void)
 #ifdef CONFIG_PROC_FS
         struct proc_dir_entry *p;
 
-        p = create_proc_entry("lec", S_IRUGO, atm_proc_root);
-        if (p)
-                p->proc_fops = &lec_seq_fops;
+        p = proc_create("lec", S_IRUGO, atm_proc_root, &lec_seq_fops);
 #endif
 
         register_atm_ioctl(&lane_ioctl_ops);
diff --git a/net/atm/mpoa_proc.c b/net/atm/mpoa_proc.c
index 91f3ffc90dbd..4990541ef5da 100644
--- a/net/atm/mpoa_proc.c
+++ b/net/atm/mpoa_proc.c
@@ -276,12 +276,11 @@ int mpc_proc_init(void)
 {
         struct proc_dir_entry *p;
 
-        p = create_proc_entry(STAT_FILE_NAME, 0, atm_proc_root);
+        p = proc_create(STAT_FILE_NAME, 0, atm_proc_root, &mpc_file_operations);
         if (!p) {
                 printk(KERN_ERR "Unable to initialize /proc/atm/%s\n", STAT_FILE_NAME);
                 return -ENOMEM;
         }
-        p->proc_fops = &mpc_file_operations;
         p->owner = THIS_MODULE;
         return 0;
 }
diff --git a/net/atm/proc.c b/net/atm/proc.c
index 49125110bb8b..e9693aed7ef8 100644
--- a/net/atm/proc.c
+++ b/net/atm/proc.c
@@ -435,11 +435,11 @@ int atm_proc_dev_register(struct atm_dev *dev)
                 goto err_out;
         sprintf(dev->proc_name,"%s:%d",dev->type, dev->number);
 
-        dev->proc_entry = create_proc_entry(dev->proc_name, 0, atm_proc_root);
+        dev->proc_entry = proc_create(dev->proc_name, 0, atm_proc_root,
+                                      &proc_atm_dev_ops);
         if (!dev->proc_entry)
                 goto err_free_name;
         dev->proc_entry->data = dev;
-        dev->proc_entry->proc_fops = &proc_atm_dev_ops;
         dev->proc_entry->owner = THIS_MODULE;
         return 0;
 err_free_name:
@@ -492,10 +492,10 @@ int __init atm_proc_init(void)
         for (e = atm_proc_ents; e->name; e++) {
                 struct proc_dir_entry *dirent;
 
-                dirent = create_proc_entry(e->name, S_IRUGO, atm_proc_root);
+                dirent = proc_create(e->name, S_IRUGO,
+                                     atm_proc_root, e->proc_fops);
                 if (!dirent)
                         goto err_out_remove;
-                dirent->proc_fops = e->proc_fops;
                 dirent->owner = THIS_MODULE;
                 e->dirent = dirent;
         }
diff --git a/net/bluetooth/l2cap.c b/net/bluetooth/l2cap.c
index a8811c0a0cea..34f8bf98bc05 100644
--- a/net/bluetooth/l2cap.c
+++ b/net/bluetooth/l2cap.c
@@ -417,6 +417,9 @@ static void l2cap_conn_del(struct hci_conn *hcon, int err)
                 l2cap_sock_kill(sk);
         }
 
+        if (conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_SENT)
+                del_timer_sync(&conn->info_timer);
+
         hcon->l2cap_data = NULL;
         kfree(conn);
 }
diff --git a/net/core/neighbour.c b/net/core/neighbour.c
index 2328acbd16cd..d9a02b2cc289 100644
--- a/net/core/neighbour.c
+++ b/net/core/neighbour.c
@@ -839,7 +839,7 @@ static void neigh_timer_handler(unsigned long arg)
                 struct sk_buff *skb = skb_peek(&neigh->arp_queue);
                 /* keep skb alive even if arp_queue overflows */
                 if (skb)
-                        skb_get(skb);
+                        skb = skb_copy(skb, GFP_ATOMIC);
                 write_unlock(&neigh->lock);
                 neigh->ops->solicit(neigh, skb);
                 atomic_inc(&neigh->probes);
@@ -1389,10 +1389,10 @@ void neigh_table_init_no_netlink(struct neigh_table *tbl)
                 panic("cannot create neighbour cache statistics");
 
 #ifdef CONFIG_PROC_FS
-        tbl->pde = create_proc_entry(tbl->id, 0, init_net.proc_net_stat);
+        tbl->pde = proc_create(tbl->id, 0, init_net.proc_net_stat,
+                               &neigh_stat_seq_fops);
         if (!tbl->pde)
                 panic("cannot create neighbour proc dir entry");
-        tbl->pde->proc_fops = &neigh_stat_seq_fops;
         tbl->pde->data = tbl;
 #endif
 
diff --git a/net/core/netpoll.c b/net/core/netpoll.c
index 6faa128a4c8e..4b7e756181c9 100644
--- a/net/core/netpoll.c
+++ b/net/core/netpoll.c
@@ -39,6 +39,8 @@ static struct sk_buff_head skb_pool;
 static atomic_t trapped;
 
 #define USEC_PER_POLL   50
+#define NETPOLL_RX_ENABLED  1
+#define NETPOLL_RX_DROP     2
 
 #define MAX_SKB_SIZE \
                 (MAX_UDP_CHUNK + sizeof(struct udphdr) + \
@@ -126,11 +128,13 @@ static int poll_one_napi(struct netpoll_info *npinfo,
         if (!test_bit(NAPI_STATE_SCHED, &napi->state))
                 return budget;
 
+        npinfo->rx_flags |= NETPOLL_RX_DROP;
         atomic_inc(&trapped);
 
         work = napi->poll(napi, budget);
 
         atomic_dec(&trapped);
+        npinfo->rx_flags &= ~NETPOLL_RX_DROP;
 
         return budget - work;
 }
@@ -472,7 +476,7 @@ int __netpoll_rx(struct sk_buff *skb)
         if (skb->dev->type != ARPHRD_ETHER)
                 goto out;
 
-        /* if receive ARP during middle of NAPI poll, then queue */
+        /* check if netpoll clients need ARP */
         if (skb->protocol == htons(ETH_P_ARP) &&
             atomic_read(&trapped)) {
                 skb_queue_tail(&npi->arp_tx, skb);
@@ -534,9 +538,6 @@ int __netpoll_rx(struct sk_buff *skb)
         return 1;
 
 out:
-        /* If packet received while already in poll then just
-         * silently drop.
-         */
         if (atomic_read(&trapped)) {
                 kfree_skb(skb);
                 return 1;
@@ -675,6 +676,7 @@ int netpoll_setup(struct netpoll *np)
                         goto release;
                 }
 
+                npinfo->rx_flags = 0;
                 npinfo->rx_np = NULL;
 
                 spin_lock_init(&npinfo->rx_lock);
@@ -756,6 +758,7 @@ int netpoll_setup(struct netpoll *np)
 
         if (np->rx_hook) {
                 spin_lock_irqsave(&npinfo->rx_lock, flags);
+                npinfo->rx_flags |= NETPOLL_RX_ENABLED;
                 npinfo->rx_np = np;
                 spin_unlock_irqrestore(&npinfo->rx_lock, flags);
         }
@@ -797,6 +800,7 @@ void netpoll_cleanup(struct netpoll *np)
                         if (npinfo->rx_np == np) {
                                 spin_lock_irqsave(&npinfo->rx_lock, flags);
                                 npinfo->rx_np = NULL;
+                                npinfo->rx_flags &= ~NETPOLL_RX_ENABLED;
                                 spin_unlock_irqrestore(&npinfo->rx_lock, flags);
                         }
 
diff --git a/net/core/pktgen.c b/net/core/pktgen.c
index bfcdfaebca5c..20e63b302ba6 100644
--- a/net/core/pktgen.c
+++ b/net/core/pktgen.c
@@ -3570,14 +3570,14 @@ static int pktgen_add_device(struct pktgen_thread *t, const char *ifname)
         if (err)
                 goto out1;
 
-        pkt_dev->entry = create_proc_entry(ifname, 0600, pg_proc_dir);
+        pkt_dev->entry = proc_create(ifname, 0600,
+                                     pg_proc_dir, &pktgen_if_fops);
         if (!pkt_dev->entry) {
                 printk(KERN_ERR "pktgen: cannot create %s/%s procfs entry.\n",
                        PG_PROC_DIR, ifname);
                 err = -EINVAL;
                 goto out2;
         }
-        pkt_dev->entry->proc_fops = &pktgen_if_fops;
         pkt_dev->entry->data = pkt_dev;
 #ifdef CONFIG_XFRM
         pkt_dev->ipsmode = XFRM_MODE_TRANSPORT;
@@ -3628,7 +3628,7 @@ static int __init pktgen_create_thread(int cpu)
         kthread_bind(p, cpu);
         t->tsk = p;
 
-        pe = create_proc_entry(t->tsk->comm, 0600, pg_proc_dir);
+        pe = proc_create(t->tsk->comm, 0600, pg_proc_dir, &pktgen_thread_fops);
         if (!pe) {
                 printk(KERN_ERR "pktgen: cannot create %s/%s procfs entry.\n",
                        PG_PROC_DIR, t->tsk->comm);
@@ -3638,7 +3638,6 @@ static int __init pktgen_create_thread(int cpu)
                 return -EINVAL;
         }
 
-        pe->proc_fops = &pktgen_thread_fops;
         pe->data = t;
 
         wake_up_process(p);
@@ -3709,7 +3708,7 @@ static int __init pg_init(void)
                 return -ENODEV;
         pg_proc_dir->owner = THIS_MODULE;
 
-        pe = create_proc_entry(PGCTRL, 0600, pg_proc_dir);
+        pe = proc_create(PGCTRL, 0600, pg_proc_dir, &pktgen_fops);
         if (pe == NULL) {
                 printk(KERN_ERR "pktgen: ERROR: cannot create %s "
                        "procfs entry.\n", PGCTRL);
@@ -3717,7 +3716,6 @@ static int __init pg_init(void)
                 return -EINVAL;
         }
 
-        pe->proc_fops = &pktgen_fops;
         pe->data = NULL;
 
         /* Register us to receive netdevice events */
diff --git a/net/ipv4/Kconfig b/net/ipv4/Kconfig
index 19880b086e71..9c7e5ffb223d 100644
--- a/net/ipv4/Kconfig
+++ b/net/ipv4/Kconfig
@@ -343,7 +343,7 @@ config INET_ESP
         tristate "IP: ESP transformation"
         select XFRM
         select CRYPTO
-        select CRYPTO_AEAD
+        select CRYPTO_AUTHENC
         select CRYPTO_HMAC
         select CRYPTO_MD5
         select CRYPTO_CBC
diff --git a/net/ipv4/devinet.c b/net/ipv4/devinet.c
index f282b26f63eb..87490f7bb0f7 100644
--- a/net/ipv4/devinet.c
+++ b/net/ipv4/devinet.c
@@ -752,6 +752,7 @@ int devinet_ioctl(unsigned int cmd, void __user *arg)
                         inet_del_ifa(in_dev, ifap, 0);
                         ifa->ifa_broadcast = 0;
                         ifa->ifa_anycast = 0;
+                        ifa->ifa_scope = 0;
                 }
 
                 ifa->ifa_address = ifa->ifa_local = sin->sin_addr.s_addr;
diff --git a/net/ipv4/ip_gre.c b/net/ipv4/ip_gre.c
index 906cb1ada4c3..e7821ba7a9a0 100644
--- a/net/ipv4/ip_gre.c
+++ b/net/ipv4/ip_gre.c
@@ -266,20 +266,24 @@ static struct ip_tunnel * ipgre_tunnel_locate(struct ip_tunnel_parm *parms, int
         if (!dev)
           return NULL;
 
+        if (strchr(name, '%')) {
+                if (dev_alloc_name(dev, name) < 0)
+                        goto failed_free;
+        }
+
         dev->init = ipgre_tunnel_init;
         nt = netdev_priv(dev);
         nt->parms = *parms;
 
-        if (register_netdevice(dev) < 0) {
-                free_netdev(dev);
-                goto failed;
-        }
+        if (register_netdevice(dev) < 0)
+                goto failed_free;
 
         dev_hold(dev);
         ipgre_tunnel_link(nt);
         return nt;
 
-failed:
+failed_free:
+        free_netdev(dev);
         return NULL;
 }
 
diff --git a/net/ipv4/ipcomp.c b/net/ipv4/ipcomp.c
index ae1f45fc23b9..58b60b2fb011 100644
--- a/net/ipv4/ipcomp.c
+++ b/net/ipv4/ipcomp.c
@@ -108,8 +108,11 @@ static int ipcomp_compress(struct xfrm_state *x, struct sk_buff *skb)
         const int cpu = get_cpu();
         u8 *scratch = *per_cpu_ptr(ipcomp_scratches, cpu);
         struct crypto_comp *tfm = *per_cpu_ptr(ipcd->tfms, cpu);
-        int err = crypto_comp_compress(tfm, start, plen, scratch, &dlen);
+        int err;
 
+        local_bh_disable();
+        err = crypto_comp_compress(tfm, start, plen, scratch, &dlen);
+        local_bh_enable();
         if (err)
                 goto out;
 
diff --git a/net/ipv4/ipconfig.c b/net/ipv4/ipconfig.c
index 10013ccee8dd..5dd938579eeb 100644
--- a/net/ipv4/ipconfig.c
+++ b/net/ipv4/ipconfig.c
@@ -753,9 +753,9 @@ static void __init ic_bootp_send_if(struct ic_device *d, unsigned long jiffies_d
                 printk("Unknown ARP type 0x%04x for device %s\n", dev->type, dev->name);
                 b->htype = dev->type; /* can cause undefined behavior */
         }
+
+        /* server_ip and your_ip address are both already zero per RFC2131 */
         b->hlen = dev->addr_len;
-        b->your_ip = NONE;
-        b->server_ip = NONE;
         memcpy(b->hw_addr, dev->dev_addr, dev->addr_len);
         b->secs = htons(jiffies_diff / HZ);
         b->xid = d->xid;
diff --git a/net/ipv4/ipip.c b/net/ipv4/ipip.c
index e77e3b855834..dbaed69de06a 100644
--- a/net/ipv4/ipip.c
+++ b/net/ipv4/ipip.c
@@ -228,20 +228,24 @@ static struct ip_tunnel * ipip_tunnel_locate(struct ip_tunnel_parm *parms, int c
         if (dev == NULL)
                 return NULL;
 
+        if (strchr(name, '%')) {
+                if (dev_alloc_name(dev, name) < 0)
+                        goto failed_free;
+        }
+
         nt = netdev_priv(dev);
         dev->init = ipip_tunnel_init;
         nt->parms = *parms;
 
-        if (register_netdevice(dev) < 0) {
-                free_netdev(dev);
-                goto failed;
-        }
+        if (register_netdevice(dev) < 0)
+                goto failed_free;
 
         dev_hold(dev);
         ipip_tunnel_link(nt);
         return nt;
 
-failed:
+failed_free:
+        free_netdev(dev);
         return NULL;
 }
 
diff --git a/net/ipv4/route.c b/net/ipv4/route.c
index 525787b52b72..7b5e8e1d94be 100644
--- a/net/ipv4/route.c
+++ b/net/ipv4/route.c
@@ -542,12 +542,11 @@ static __init int ip_rt_proc_init(struct net *net)
         if (!pde)
                 goto err1;
 
-        pde = create_proc_entry("rt_cache", S_IRUGO, net->proc_net_stat);
+        pde = proc_create("rt_cache", S_IRUGO,
+                          net->proc_net_stat, &rt_cpu_seq_fops);
         if (!pde)
                 goto err2;
 
-        pde->proc_fops = &rt_cpu_seq_fops;
-
 #ifdef CONFIG_NET_CLS_ROUTE
         pde = create_proc_read_entry("rt_acct", 0, net->proc_net,
                         ip_rt_acct_read, NULL);
diff --git a/net/ipv4/tcp_bic.c b/net/ipv4/tcp_bic.c
index 5212ed9b0c98..7eb7636db0d0 100644
--- a/net/ipv4/tcp_bic.c
+++ b/net/ipv4/tcp_bic.c
@@ -1,12 +1,13 @@
 /*
  * Binary Increase Congestion control for TCP
- *
+ * Home page:
+ *      http://netsrv.csc.ncsu.edu/twiki/bin/view/Main/BIC
  * This is from the implementation of BICTCP in
  * Lison-Xu, Kahaled Harfoush, and Injong Rhee.
  *  "Binary Increase Congestion Control for Fast, Long Distance
  *  Networks" in InfoComm 2004
  * Available from:
- *  http://www.csc.ncsu.edu/faculty/rhee/export/bitcp.pdf
+ *  http://netsrv.csc.ncsu.edu/export/bitcp.pdf
  *
  * Unless BIC is enabled and congestion window is large
  * this behaves the same as the original Reno.
diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
index 19c449f62672..7facdb0f6960 100644
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -1367,7 +1367,7 @@ static struct sk_buff *tcp_sacktag_walk(struct sk_buff *skb, struct sock *sk,
  * a normal way
  */
 static struct sk_buff *tcp_sacktag_skip(struct sk_buff *skb, struct sock *sk,
-                                        u32 skip_to_seq)
+                                        u32 skip_to_seq, int *fack_count)
 {
         tcp_for_write_queue_from(skb, sk) {
                 if (skb == tcp_send_head(sk))
@@ -1375,6 +1375,8 @@ static struct sk_buff *tcp_sacktag_skip(struct sk_buff *skb, struct sock *sk,
 
                 if (!before(TCP_SKB_CB(skb)->end_seq, skip_to_seq))
                         break;
+
+                *fack_count += tcp_skb_pcount(skb);
         }
         return skb;
 }
@@ -1390,7 +1392,7 @@ static struct sk_buff *tcp_maybe_skipping_dsack(struct sk_buff *skb,
                 return skb;
 
         if (before(next_dup->start_seq, skip_to_seq)) {
-                skb = tcp_sacktag_skip(skb, sk, next_dup->start_seq);
+                skb = tcp_sacktag_skip(skb, sk, next_dup->start_seq, fack_count);
                 tcp_sacktag_walk(skb, sk, NULL,
                                  next_dup->start_seq, next_dup->end_seq,
                                  1, fack_count, reord, flag);
@@ -1537,7 +1539,8 @@ tcp_sacktag_write_queue(struct sock *sk, struct sk_buff *ack_skb,
 
                         /* Head todo? */
                         if (before(start_seq, cache->start_seq)) {
-                                skb = tcp_sacktag_skip(skb, sk, start_seq);
+                                skb = tcp_sacktag_skip(skb, sk, start_seq,
+                                                       &fack_count);
                                 skb = tcp_sacktag_walk(skb, sk, next_dup,
                                                        start_seq,
                                                        cache->start_seq,
@@ -1565,7 +1568,8 @@ tcp_sacktag_write_queue(struct sock *sk, struct sk_buff *ack_skb,
                                 goto walk;
                         }
 
-                        skb = tcp_sacktag_skip(skb, sk, cache->end_seq);
+                        skb = tcp_sacktag_skip(skb, sk, cache->end_seq,
+                                               &fack_count);
                         /* Check overlap against next cached too (past this one already) */
                         cache++;
                         continue;
@@ -1577,7 +1581,7 @@ tcp_sacktag_write_queue(struct sock *sk, struct sk_buff *ack_skb,
                                 break;
                         fack_count = tp->fackets_out;
                 }
-                skb = tcp_sacktag_skip(skb, sk, start_seq);
+                skb = tcp_sacktag_skip(skb, sk, start_seq, &fack_count);
 
 walk:
                 skb = tcp_sacktag_walk(skb, sk, next_dup, start_seq, end_seq,
diff --git a/net/ipv6/Kconfig b/net/ipv6/Kconfig
index 3ffb0323668c..58219dfffef8 100644
--- a/net/ipv6/Kconfig
+++ b/net/ipv6/Kconfig
@@ -85,7 +85,7 @@ config INET6_ESP
         depends on IPV6
         select XFRM
         select CRYPTO
-        select CRYPTO_AEAD
+        select CRYPTO_AUTHENC
         select CRYPTO_HMAC
         select CRYPTO_MD5
         select CRYPTO_CBC
diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index e40213db9e4c..101e0e70ba27 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -1557,6 +1557,7 @@ addrconf_prefix_route(struct in6_addr *pfx, int plen, struct net_device *dev,
                 .fc_expires = expires,
                 .fc_dst_len = plen,
                 .fc_flags = RTF_UP | flags,
+                .fc_nlinfo.nl_net = &init_net,
         };
 
         ipv6_addr_copy(&cfg.fc_dst, pfx);
@@ -1583,6 +1584,7 @@ static void addrconf_add_mroute(struct net_device *dev)
                 .fc_ifindex = dev->ifindex,
                 .fc_dst_len = 8,
                 .fc_flags = RTF_UP,
+                .fc_nlinfo.nl_net = &init_net,
         };
 
         ipv6_addr_set(&cfg.fc_dst, htonl(0xFF000000), 0, 0, 0);
@@ -1599,6 +1601,7 @@ static void sit_route_add(struct net_device *dev)
                 .fc_ifindex = dev->ifindex,
                 .fc_dst_len = 96,
                 .fc_flags = RTF_UP | RTF_NONEXTHOP,
+                .fc_nlinfo.nl_net = &init_net,
         };
 
         /* prefix length - 96 bits "::d.d.d.d" */
diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c
index 2a124e9a1b2d..78f438880923 100644
--- a/net/ipv6/ip6_tunnel.c
+++ b/net/ipv6/ip6_tunnel.c
@@ -238,17 +238,24 @@ static struct ip6_tnl *ip6_tnl_create(struct ip6_tnl_parm *p)
         if (dev == NULL)
                 goto failed;
 
+        if (strchr(name, '%')) {
+                if (dev_alloc_name(dev, name) < 0)
+                        goto failed_free;
+        }
+
         t = netdev_priv(dev);
         dev->init = ip6_tnl_dev_init;
         t->parms = *p;
 
-        if ((err = register_netdevice(dev)) < 0) {
-                free_netdev(dev);
-                goto failed;
-        }
+        if ((err = register_netdevice(dev)) < 0)
+                goto failed_free;
+
         dev_hold(dev);
         ip6_tnl_link(t);
         return t;
+
+failed_free:
+        free_netdev(dev);
 failed:
         return NULL;
 }
diff --git a/net/ipv6/ipcomp6.c b/net/ipv6/ipcomp6.c
index b90039593a7f..e3dcfa2f436b 100644
--- a/net/ipv6/ipcomp6.c
+++ b/net/ipv6/ipcomp6.c
@@ -146,7 +146,9 @@ static int ipcomp6_output(struct xfrm_state *x, struct sk_buff *skb)
         scratch = *per_cpu_ptr(ipcomp6_scratches, cpu);
         tfm = *per_cpu_ptr(ipcd->tfms, cpu);
 
+        local_bh_disable();
         err = crypto_comp_compress(tfm, start, plen, scratch, &dlen);
+        local_bh_enable();
         if (err || (dlen + sizeof(*ipch)) >= plen) {
                 put_cpu();
                 goto out_ok;
diff --git a/net/ipv6/proc.c b/net/ipv6/proc.c
index 35e502a72495..199ef379e501 100644
--- a/net/ipv6/proc.c
+++ b/net/ipv6/proc.c
@@ -217,12 +217,12 @@ int snmp6_register_dev(struct inet6_dev *idev)
         if (!proc_net_devsnmp6)
                 return -ENOENT;
 
-        p = create_proc_entry(idev->dev->name, S_IRUGO, proc_net_devsnmp6);
+        p = proc_create(idev->dev->name, S_IRUGO,
+                        proc_net_devsnmp6, &snmp6_seq_fops);
         if (!p)
                 return -ENOMEM;
 
         p->data = idev;
-        p->proc_fops = &snmp6_seq_fops;
 
         idev->stats.proc_dir_entry = p;
         return 0;
diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index 6e7b56ef4449..e8b241cb60bc 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -1719,6 +1719,8 @@ static void rtmsg_to_fib6_config(struct in6_rtmsg *rtmsg,
         cfg->fc_src_len = rtmsg->rtmsg_src_len;
         cfg->fc_flags = rtmsg->rtmsg_flags;
 
+        cfg->fc_nlinfo.nl_net = &init_net;
+
         ipv6_addr_copy(&cfg->fc_dst, &rtmsg->rtmsg_dst);
         ipv6_addr_copy(&cfg->fc_src, &rtmsg->rtmsg_src);
         ipv6_addr_copy(&cfg->fc_gateway, &rtmsg->rtmsg_gateway);
diff --git a/net/ipv6/sit.c b/net/ipv6/sit.c
index dde7801abeff..1656c003b989 100644
--- a/net/ipv6/sit.c
+++ b/net/ipv6/sit.c
@@ -171,6 +171,11 @@ static struct ip_tunnel * ipip6_tunnel_locate(struct ip_tunnel_parm *parms, int
         if (dev == NULL)
                 return NULL;
 
+        if (strchr(name, '%')) {
+                if (dev_alloc_name(dev, name) < 0)
+                        goto failed_free;
+        }
+
         nt = netdev_priv(dev);
         dev->init = ipip6_tunnel_init;
         nt->parms = *parms;
@@ -178,16 +183,16 @@ static struct ip_tunnel * ipip6_tunnel_locate(struct ip_tunnel_parm *parms, int
         if (parms->i_flags & SIT_ISATAP)
                 dev->priv_flags |= IFF_ISATAP;
 
-        if (register_netdevice(dev) < 0) {
-                free_netdev(dev);
-                goto failed;
-        }
+        if (register_netdevice(dev) < 0)
+                goto failed_free;
 
         dev_hold(dev);
 
         ipip6_tunnel_link(nt);
         return nt;
 
+failed_free:
+        free_netdev(dev);
 failed:
         return NULL;
 }
diff --git a/net/ipv6/sysctl_net_ipv6.c b/net/ipv6/sysctl_net_ipv6.c
index 408691b777c2..d6d3e68086f8 100644
--- a/net/ipv6/sysctl_net_ipv6.c
+++ b/net/ipv6/sysctl_net_ipv6.c
@@ -102,9 +102,6 @@ static int ipv6_sysctl_net_init(struct net *net)
         net->ipv6.sysctl.table = register_net_sysctl_table(net, net_ipv6_ctl_path,
                                                            ipv6_table);
         if (!net->ipv6.sysctl.table)
-                return -ENOMEM;
-
-        if (!net->ipv6.sysctl.table)
                 goto out_ipv6_icmp_table;
 
         err = 0;
diff --git a/net/ipx/ipx_proc.c b/net/ipx/ipx_proc.c
index d483a00dc427..5ed97ad0e2e3 100644
--- a/net/ipx/ipx_proc.c
+++ b/net/ipx/ipx_proc.c
@@ -358,22 +358,19 @@ int __init ipx_proc_init(void)
 
         if (!ipx_proc_dir)
                 goto out;
-        p = create_proc_entry("interface", S_IRUGO, ipx_proc_dir);
+        p = proc_create("interface", S_IRUGO,
+                        ipx_proc_dir, &ipx_seq_interface_fops);
         if (!p)
                 goto out_interface;
 
-        p->proc_fops = &ipx_seq_interface_fops;
-        p = create_proc_entry("route", S_IRUGO, ipx_proc_dir);
+        p = proc_create("route", S_IRUGO, ipx_proc_dir, &ipx_seq_route_fops);
         if (!p)
                 goto out_route;
 
-        p->proc_fops = &ipx_seq_route_fops;
-        p = create_proc_entry("socket", S_IRUGO, ipx_proc_dir);
+        p = proc_create("socket", S_IRUGO, ipx_proc_dir, &ipx_seq_socket_fops);
         if (!p)
                 goto out_socket;
 
-        p->proc_fops = &ipx_seq_socket_fops;
-
         rc = 0;
 out:
         return rc;
diff --git a/net/irda/ircomm/ircomm_core.c b/net/irda/ircomm/ircomm_core.c
index b825399fc160..6eef1f2a7553 100644
--- a/net/irda/ircomm/ircomm_core.c
+++ b/net/irda/ircomm/ircomm_core.c
@@ -76,9 +76,11 @@ static int __init ircomm_init(void)
 
 #ifdef CONFIG_PROC_FS
         { struct proc_dir_entry *ent;
-        ent = create_proc_entry("ircomm", 0, proc_irda);
-        if (ent)
-                ent->proc_fops = &ircomm_proc_fops;
+        ent = proc_create("ircomm", 0, proc_irda, &ircomm_proc_fops);
+        if (!ent) {
+                printk(KERN_ERR "ircomm_init: can't create /proc entry!\n");
+                return -ENODEV;
+        }
         }
 #endif /* CONFIG_PROC_FS */
 
diff --git a/net/irda/irlan/irlan_common.c b/net/irda/irlan/irlan_common.c
index a4b56e25a917..1eb4bbcb1c9e 100644
--- a/net/irda/irlan/irlan_common.c
+++ b/net/irda/irlan/irlan_common.c
@@ -128,13 +128,11 @@ static int __init irlan_init(void)
 
 #ifdef CONFIG_PROC_FS
         { struct proc_dir_entry *proc;
-        proc = create_proc_entry("irlan", 0, proc_irda);
+        proc = proc_create("irlan", 0, proc_irda, &irlan_fops);
         if (!proc) {
                 printk(KERN_ERR "irlan_init: can't create /proc entry!\n");
                 return -ENODEV;
         }
-
-        proc->proc_fops = &irlan_fops;
         }
 #endif /* CONFIG_PROC_FS */
 
diff --git a/net/irda/irproc.c b/net/irda/irproc.c
index cae24fbda966..88e80a312732 100644
--- a/net/irda/irproc.c
+++ b/net/irda/irproc.c
@@ -72,11 +72,9 @@ void __init irda_proc_register(void)
                 return;
         proc_irda->owner = THIS_MODULE;
 
-        for (i=0; i<ARRAY_SIZE(irda_dirs); i++) {
-                d = create_proc_entry(irda_dirs[i].name, 0, proc_irda);
-                if (d)
-                        d->proc_fops = irda_dirs[i].fops;
-        }
+        for (i = 0; i < ARRAY_SIZE(irda_dirs); i++)
+                d = proc_create(irda_dirs[i].name, 0, proc_irda,
+                                irda_dirs[i].fops);
 }
 
 /*
diff --git a/net/iucv/iucv.c b/net/iucv/iucv.c
index 2753b0c448f3..d764f4c1b7e4 100644
--- a/net/iucv/iucv.c
+++ b/net/iucv/iucv.c
@@ -621,7 +621,6 @@ static int iucv_sever_pathid(u16 pathid, u8 userdata[16])
         return iucv_call_b2f0(IUCV_SEVER, parm);
 }
 
-#ifdef CONFIG_SMP
 /**
  * __iucv_cleanup_queue
  * @dummy: unused dummy argument
@@ -632,7 +631,6 @@ static int iucv_sever_pathid(u16 pathid, u8 userdata[16])
 static void __iucv_cleanup_queue(void *dummy)
 {
 }
-#endif
 
 /**
  * iucv_cleanup_queue
diff --git a/net/key/af_key.c b/net/key/af_key.c
index 1c853927810a..8b5f486ac80f 100644
--- a/net/key/af_key.c
+++ b/net/key/af_key.c
@@ -3807,17 +3807,16 @@ static int pfkey_init_proc(void)
 {
         struct proc_dir_entry *e;
 
-        e = create_proc_entry("pfkey", 0, init_net.proc_net);
+        e = proc_net_fops_create(&init_net, "pfkey", 0, &pfkey_proc_ops);
         if (e == NULL)
                 return -ENOMEM;
 
-        e->proc_fops = &pfkey_proc_ops;
         return 0;
 }
 
 static void pfkey_exit_proc(void)
 {
-        remove_proc_entry("net/pfkey", NULL);
+        proc_net_remove(&init_net, "pfkey");
 }
 #else
 static inline int pfkey_init_proc(void)
diff --git a/net/llc/llc_proc.c b/net/llc/llc_proc.c
index cb34bc0518e8..48212c0a961c 100644
--- a/net/llc/llc_proc.c
+++ b/net/llc/llc_proc.c
@@ -239,18 +239,14 @@ int __init llc_proc_init(void)
                 goto out;
         llc_proc_dir->owner = THIS_MODULE;
 
-        p = create_proc_entry("socket", S_IRUGO, llc_proc_dir);
+        p = proc_create("socket", S_IRUGO, llc_proc_dir, &llc_seq_socket_fops);
         if (!p)
                 goto out_socket;
 
-        p->proc_fops = &llc_seq_socket_fops;
-
-        p = create_proc_entry("core", S_IRUGO, llc_proc_dir);
+        p = proc_create("core", S_IRUGO, llc_proc_dir, &llc_seq_core_fops);
         if (!p)
                 goto out_core;
 
-        p->proc_fops = &llc_seq_core_fops;
-
         rc = 0;
 out:
         return rc;
diff --git a/net/mac80211/ieee80211_sta.c b/net/mac80211/ieee80211_sta.c
index 2019b4f0528d..9aeed5320228 100644
--- a/net/mac80211/ieee80211_sta.c
+++ b/net/mac80211/ieee80211_sta.c
@@ -1116,9 +1116,10 @@ static void ieee80211_sta_process_addba_request(struct net_device *dev,
         /* prepare reordering buffer */
         tid_agg_rx->reorder_buf =
                 kmalloc(buf_size * sizeof(struct sk_buf *), GFP_ATOMIC);
-        if ((!tid_agg_rx->reorder_buf) && net_ratelimit()) {
-                printk(KERN_ERR "can not allocate reordering buffer "
-                                                "to tid %d\n", tid);
+        if (!tid_agg_rx->reorder_buf) {
+                if (net_ratelimit())
+                        printk(KERN_ERR "can not allocate reordering buffer "
+                               "to tid %d\n", tid);
                 goto end;
         }
         memset(tid_agg_rx->reorder_buf, 0,
diff --git a/net/mac80211/rc80211_pid_algo.c b/net/mac80211/rc80211_pid_algo.c
index c339571632b2..3b77410588e7 100644
--- a/net/mac80211/rc80211_pid_algo.c
+++ b/net/mac80211/rc80211_pid_algo.c
@@ -2,7 +2,7 @@
  * Copyright 2002-2005, Instant802 Networks, Inc.
  * Copyright 2005, Devicescape Software, Inc.
  * Copyright 2007, Mattias Nissler <mattias.nissler@gmx.de>
- * Copyright 2007, Stefano Brivio <stefano.brivio@polimi.it>
+ * Copyright 2007-2008, Stefano Brivio <stefano.brivio@polimi.it>
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License version 2 as
@@ -63,72 +63,66 @@
  * RC_PID_ARITH_SHIFT.
  */
 
-
-/* Shift the adjustment so that we won't switch to a lower rate if it exhibited
- * a worse failed frames behaviour and we'll choose the highest rate whose
- * failed frames behaviour is not worse than the one of the original rate
- * target. While at it, check that the adjustment is within the ranges. Then,
- * provide the new rate index. */
-static int rate_control_pid_shift_adjust(struct rc_pid_rateinfo *r,
-                                         int adj, int cur, int l)
-{
-        int i, j, k, tmp;
-
-        j = r[cur].rev_index;
-        i = j + adj;
-
-        if (i < 0)
-                return r[0].index;
-        if (i >= l - 1)
-                return r[l - 1].index;
-
-        tmp = i;
-
-        if (adj < 0) {
-                for (k = j; k >= i; k--)
-                        if (r[k].diff <= r[j].diff)
-                                tmp = k;
-        } else {
-                for (k = i + 1; k + i < l; k++)
-                        if (r[k].diff <= r[i].diff)
-                                tmp = k;
-        }
-
-        return r[tmp].index;
-}
-
+/* Adjust the rate while ensuring that we won't switch to a lower rate if it
+ * exhibited a worse failed frames behaviour and we'll choose the highest rate
+ * whose failed frames behaviour is not worse than the one of the original rate
+ * target. While at it, check that the new rate is valid. */
 static void rate_control_pid_adjust_rate(struct ieee80211_local *local,
                                          struct sta_info *sta, int adj,
                                          struct rc_pid_rateinfo *rinfo)
 {
         struct ieee80211_sub_if_data *sdata;
         struct ieee80211_hw_mode *mode;
-        int newidx;
-        int maxrate;
-        int back = (adj > 0) ? 1 : -1;
+        int cur_sorted, new_sorted, probe, tmp, n_bitrates;
+        int cur = sta->txrate;
 
         sdata = IEEE80211_DEV_TO_SUB_IF(sta->dev);
 
         mode = local->oper_hw_mode;
-        maxrate = sdata->bss ? sdata->bss->max_ratectrl_rateidx : -1;
+        n_bitrates = mode->num_rates;
 
-        newidx = rate_control_pid_shift_adjust(rinfo, adj, sta->txrate,
-                                               mode->num_rates);
+        /* Map passed arguments to sorted values. */
+        cur_sorted = rinfo[cur].rev_index;
+        new_sorted = cur_sorted + adj;
 
-        while (newidx != sta->txrate) {
-                if (rate_supported(sta, mode, newidx) &&
-                    (maxrate < 0 || newidx <= maxrate)) {
-                        sta->txrate = newidx;
-                        break;
-                }
+        /* Check limits. */
+        if (new_sorted < 0)
+                new_sorted = rinfo[0].rev_index;
+        else if (new_sorted >= n_bitrates)
+                new_sorted = rinfo[n_bitrates - 1].rev_index;
 
-                newidx += back;
+        tmp = new_sorted;
+
+        if (adj < 0) {
+                /* Ensure that the rate decrease isn't disadvantageous. */
+                for (probe = cur_sorted; probe >= new_sorted; probe--)
+                        if (rinfo[probe].diff <= rinfo[cur_sorted].diff &&
+                            rate_supported(sta, mode, rinfo[probe].index))
+                                tmp = probe;
+        } else {
+                /* Look for rate increase with zero (or below) cost. */
+                for (probe = new_sorted + 1; probe < n_bitrates; probe++)
+                        if (rinfo[probe].diff <= rinfo[new_sorted].diff &&
+                            rate_supported(sta, mode, rinfo[probe].index))
+                                tmp = probe;
         }
 
+        /* Fit the rate found to the nearest supported rate. */
+        do {
+                if (rate_supported(sta, mode, rinfo[tmp].index)) {
+                        sta->txrate = rinfo[tmp].index;
+                        break;
+                }
+                if (adj < 0)
+                        tmp--;
+                else
+                        tmp++;
+        } while (tmp < n_bitrates && tmp >= 0);
+
 #ifdef CONFIG_MAC80211_DEBUGFS
         rate_control_pid_event_rate_change(
                 &((struct rc_pid_sta_info *)sta->rate_ctrl_priv)->events,
-                newidx, mode->rates[newidx].rate);
+                cur, mode->rates[cur].rate);
 #endif
 }
 
diff --git a/net/netfilter/nf_conntrack_core.c b/net/netfilter/nf_conntrack_core.c
index 327e847d2702..b77eb56a87e3 100644
--- a/net/netfilter/nf_conntrack_core.c
+++ b/net/netfilter/nf_conntrack_core.c
@@ -256,13 +256,19 @@ __nf_conntrack_find(const struct nf_conntrack_tuple *tuple)
         struct hlist_node *n;
         unsigned int hash = hash_conntrack(tuple);
 
+        /* Disable BHs the entire time since we normally need to disable them
+         * at least once for the stats anyway.
+         */
+        local_bh_disable();
         hlist_for_each_entry_rcu(h, n, &nf_conntrack_hash[hash], hnode) {
                 if (nf_ct_tuple_equal(tuple, &h->tuple)) {
                         NF_CT_STAT_INC(found);
+                        local_bh_enable();
                         return h;
                 }
                 NF_CT_STAT_INC(searched);
         }
+        local_bh_enable();
 
         return NULL;
 }
@@ -400,17 +406,20 @@ nf_conntrack_tuple_taken(const struct nf_conntrack_tuple *tuple,
         struct hlist_node *n;
         unsigned int hash = hash_conntrack(tuple);
 
-        rcu_read_lock();
+        /* Disable BHs the entire time since we need to disable them at
+         * least once for the stats anyway.
+         */
+        rcu_read_lock_bh();
         hlist_for_each_entry_rcu(h, n, &nf_conntrack_hash[hash], hnode) {
                 if (nf_ct_tuplehash_to_ctrack(h) != ignored_conntrack &&
                     nf_ct_tuple_equal(tuple, &h->tuple)) {
                         NF_CT_STAT_INC(found);
-                        rcu_read_unlock();
+                        rcu_read_unlock_bh();
                         return 1;
                 }
                 NF_CT_STAT_INC(searched);
         }
-        rcu_read_unlock();
+        rcu_read_unlock_bh();
 
         return 0;
 }
diff --git a/net/netfilter/xt_conntrack.c b/net/netfilter/xt_conntrack.c
index 85330856a29c..0c50b2894055 100644
--- a/net/netfilter/xt_conntrack.c
+++ b/net/netfilter/xt_conntrack.c
@@ -122,7 +122,7 @@ conntrack_addrcmp(const union nf_inet_addr *kaddr,
                   const union nf_inet_addr *umask, unsigned int l3proto)
 {
         if (l3proto == AF_INET)
-                return (kaddr->ip & umask->ip) == uaddr->ip;
+                return ((kaddr->ip ^ uaddr->ip) & umask->ip) == 0;
         else if (l3proto == AF_INET6)
                 return ipv6_masked_addr_cmp(&kaddr->in6, &umask->in6,
                        &uaddr->in6) == 0;
@@ -231,7 +231,7 @@ conntrack_mt(const struct sk_buff *skb, const struct net_device *in,
                         if (test_bit(IPS_DST_NAT_BIT, &ct->status))
                                 statebit |= XT_CONNTRACK_STATE_DNAT;
                 }
-                if ((info->state_mask & statebit) ^
+                if (!!(info->state_mask & statebit) ^
                     !(info->invert_flags & XT_CONNTRACK_STATE))
                         return false;
         }
diff --git a/net/sctp/auth.c b/net/sctp/auth.c
index 8bb79f281774..675a5c3e68a6 100644
--- a/net/sctp/auth.c
+++ b/net/sctp/auth.c
@@ -838,11 +838,11 @@ int sctp_auth_set_key(struct sctp_endpoint *ep,
         }
 
         /* Create a new key data based on the info passed in */
-        key = sctp_auth_create_key(auth_key->sca_keylen, GFP_KERNEL);
+        key = sctp_auth_create_key(auth_key->sca_keylength, GFP_KERNEL);
         if (!key)
                 goto nomem;
 
-        memcpy(key->data, &auth_key->sca_key[0], auth_key->sca_keylen);
+        memcpy(key->data, &auth_key->sca_key[0], auth_key->sca_keylength);
 
         /* If we are replacing, remove the old keys data from the
          * key id.  If we are adding new key id, add it to the
diff --git a/net/sctp/ipv6.c b/net/sctp/ipv6.c
index 4d7ec961ae1d..87f940587d5f 100644
--- a/net/sctp/ipv6.c
+++ b/net/sctp/ipv6.c
@@ -966,7 +966,7 @@ static struct inet6_protocol sctpv6_protocol = {
         .flags        = INET6_PROTO_NOPOLICY | INET6_PROTO_FINAL,
 };
 
-static struct sctp_af sctp_ipv6_specific = {
+static struct sctp_af sctp_af_inet6 = {
         .sa_family         = AF_INET6,
         .sctp_xmit         = sctp_v6_xmit,
         .setsockopt        = ipv6_setsockopt,
@@ -998,7 +998,7 @@ static struct sctp_af sctp_ipv6_specific = {
 #endif
 };
 
-static struct sctp_pf sctp_pf_inet6_specific = {
+static struct sctp_pf sctp_pf_inet6 = {
         .event_msgname = sctp_inet6_event_msgname,
         .skb_msgname   = sctp_inet6_skb_msgname,
         .af_supported  = sctp_inet6_af_supported,
@@ -1008,7 +1008,7 @@ static struct sctp_pf sctp_pf_inet6_specific = {
         .supported_addrs = sctp_inet6_supported_addrs,
         .create_accept_sk = sctp_v6_create_accept_sk,
         .addr_v4map    = sctp_v6_addr_v4map,
-        .af            = &sctp_ipv6_specific,
+        .af            = &sctp_af_inet6,
 };
 
 /* Initialize IPv6 support and register with socket layer.  */
@@ -1017,10 +1017,10 @@ int sctp_v6_init(void)
         int rc;
 
         /* Register the SCTP specific PF_INET6 functions. */
-        sctp_register_pf(&sctp_pf_inet6_specific, PF_INET6);
+        sctp_register_pf(&sctp_pf_inet6, PF_INET6);
 
         /* Register the SCTP specific AF_INET6 functions. */
-        sctp_register_af(&sctp_ipv6_specific);
+        sctp_register_af(&sctp_af_inet6);
 
         rc = proto_register(&sctpv6_prot, 1);
         if (rc)
@@ -1051,7 +1051,7 @@ void sctp_v6_exit(void)
         inet6_unregister_protosw(&sctpv6_seqpacket_protosw);
         inet6_unregister_protosw(&sctpv6_stream_protosw);
         proto_unregister(&sctpv6_prot);
-        list_del(&sctp_ipv6_specific.list);
+        list_del(&sctp_af_inet6.list);
 }
 
 /* Unregister with inet6 layer. */
diff --git a/net/sctp/objcnt.c b/net/sctp/objcnt.c
index 14e294e37626..cfeb07ea1b04 100644
--- a/net/sctp/objcnt.c
+++ b/net/sctp/objcnt.c
@@ -132,12 +132,11 @@ void sctp_dbg_objcnt_init(void)
 {
         struct proc_dir_entry *ent;
 
-        ent = create_proc_entry("sctp_dbg_objcnt", 0, proc_net_sctp);
+        ent = proc_create("sctp_dbg_objcnt", 0,
+                          proc_net_sctp, &sctp_objcnt_ops);
         if (!ent)
                 printk(KERN_WARNING
                         "sctp_dbg_objcnt: Unable to create /proc entry.\n");
-        else
-                ent->proc_fops = &sctp_objcnt_ops;
 }
 
 /* Cleanup the objcount entry in the proc filesystem.  */
diff --git a/net/sctp/proc.c b/net/sctp/proc.c
index 69bb5a63fd8b..973f1dbc2ec3 100644
--- a/net/sctp/proc.c
+++ b/net/sctp/proc.c
@@ -108,12 +108,10 @@ int __init sctp_snmp_proc_init(void)
 {
         struct proc_dir_entry *p;
 
-        p = create_proc_entry("snmp", S_IRUGO, proc_net_sctp);
+        p = proc_create("snmp", S_IRUGO, proc_net_sctp, &sctp_snmp_seq_fops);
         if (!p)
                 return -ENOMEM;
 
-        p->proc_fops = &sctp_snmp_seq_fops;
-
         return 0;
 }
 
@@ -258,12 +256,10 @@ int __init sctp_eps_proc_init(void)
 {
         struct proc_dir_entry *p;
 
-        p = create_proc_entry("eps", S_IRUGO, proc_net_sctp);
+        p = proc_create("eps", S_IRUGO, proc_net_sctp, &sctp_eps_seq_fops);
         if (!p)
                 return -ENOMEM;
 
-        p->proc_fops = &sctp_eps_seq_fops;
-
         return 0;
 }
 
@@ -369,12 +365,11 @@ int __init sctp_assocs_proc_init(void)
 {
         struct proc_dir_entry *p;
 
-        p = create_proc_entry("assocs", S_IRUGO, proc_net_sctp);
+        p = proc_create("assocs", S_IRUGO, proc_net_sctp,
+                        &sctp_assocs_seq_fops);
         if (!p)
                 return -ENOMEM;
 
-        p->proc_fops = &sctp_assocs_seq_fops;
-
         return 0;
 }
 
diff --git a/net/sctp/protocol.c b/net/sctp/protocol.c
index 22a16571499c..688546dccd82 100644
--- a/net/sctp/protocol.c
+++ b/net/sctp/protocol.c
@@ -832,7 +832,7 @@ static inline int sctp_v4_xmit(struct sk_buff *skb,
         return ip_queue_xmit(skb, ipfragok);
 }
 
-static struct sctp_af sctp_ipv4_specific;
+static struct sctp_af sctp_af_inet;
 
 static struct sctp_pf sctp_pf_inet = {
         .event_msgname = sctp_inet_event_msgname,
@@ -844,7 +844,7 @@ static struct sctp_pf sctp_pf_inet = {
         .supported_addrs = sctp_inet_supported_addrs,
         .create_accept_sk = sctp_v4_create_accept_sk,
         .addr_v4map     = sctp_v4_addr_v4map,
-        .af            = &sctp_ipv4_specific,
+        .af            = &sctp_af_inet
 };
 
 /* Notifier for inetaddr addition/deletion events.  */
@@ -906,7 +906,7 @@ static struct net_protocol sctp_protocol = {
 };
 
 /* IPv4 address related functions.  */
-static struct sctp_af sctp_ipv4_specific = {
+static struct sctp_af sctp_af_inet = {
         .sa_family         = AF_INET,
         .sctp_xmit         = sctp_v4_xmit,
         .setsockopt        = ip_setsockopt,
@@ -1192,7 +1192,7 @@ SCTP_STATIC __init int sctp_init(void)
         sctp_sysctl_register();
 
         INIT_LIST_HEAD(&sctp_address_families);
-        sctp_register_af(&sctp_ipv4_specific);
+        sctp_register_af(&sctp_af_inet);
 
         status = proto_register(&sctp_prot, 1);
         if (status)
@@ -1249,7 +1249,7 @@ err_v6_init:
         proto_unregister(&sctp_prot);
 err_proto_register:
         sctp_sysctl_unregister();
-        list_del(&sctp_ipv4_specific.list);
+        list_del(&sctp_af_inet.list);
         free_pages((unsigned long)sctp_port_hashtable,
                    get_order(sctp_port_hashsize *
                              sizeof(struct sctp_bind_hashbucket)));
@@ -1299,7 +1299,7 @@ SCTP_STATIC __exit void sctp_exit(void)
         inet_unregister_protosw(&sctp_seqpacket_protosw);
 
         sctp_sysctl_unregister();
-        list_del(&sctp_ipv4_specific.list);
+        list_del(&sctp_af_inet.list);
 
         free_pages((unsigned long)sctp_assoc_hashtable,
                    get_order(sctp_assoc_hashsize *
diff --git a/net/sctp/socket.c b/net/sctp/socket.c
index 44797ad88a05..939892691a26 100644
--- a/net/sctp/socket.c
+++ b/net/sctp/socket.c
@@ -1964,7 +1964,7 @@ static int sctp_setsockopt_disable_fragments(struct sock *sk,
 static int sctp_setsockopt_events(struct sock *sk, char __user *optval,
                                         int optlen)
 {
-        if (optlen != sizeof(struct sctp_event_subscribe))
+        if (optlen > sizeof(struct sctp_event_subscribe))
                 return -EINVAL;
         if (copy_from_user(&sctp_sk(sk)->subscribe, optval, optlen))
                 return -EFAULT;
@@ -5070,6 +5070,7 @@ static int sctp_getsockopt_peer_auth_chunks(struct sock *sk, int len,
         struct sctp_authchunks val;
         struct sctp_association *asoc;
         struct sctp_chunks_param *ch;
+        u32    num_chunks;
         char __user *to;
 
         if (len <= sizeof(struct sctp_authchunks))
@@ -5086,12 +5087,15 @@ static int sctp_getsockopt_peer_auth_chunks(struct sock *sk, int len,
         ch = asoc->peer.peer_chunks;
 
         /* See if the user provided enough room for all the data */
-        if (len < ntohs(ch->param_hdr.length))
+        num_chunks = ntohs(ch->param_hdr.length) - sizeof(sctp_paramhdr_t);
+        if (len < num_chunks)
                 return -EINVAL;
 
-        len = ntohs(ch->param_hdr.length);
+        len = num_chunks;
         if (put_user(len, optlen))
                 return -EFAULT;
+        if (put_user(num_chunks, &p->gauth_number_of_chunks))
+                return -EFAULT;
         if (copy_to_user(to, ch->chunks, len))
                 return -EFAULT;
 
@@ -5105,6 +5109,7 @@ static int sctp_getsockopt_local_auth_chunks(struct sock *sk, int len,
         struct sctp_authchunks val;
         struct sctp_association *asoc;
         struct sctp_chunks_param *ch;
+        u32    num_chunks;
         char __user *to;
 
         if (len <= sizeof(struct sctp_authchunks))
@@ -5123,12 +5128,15 @@ static int sctp_getsockopt_local_auth_chunks(struct sock *sk, int len,
         else
                 ch = sctp_sk(sk)->ep->auth_chunk_list;
 
-        if (len < ntohs(ch->param_hdr.length))
+        num_chunks = ntohs(ch->param_hdr.length) - sizeof(sctp_paramhdr_t);
+        if (len < num_chunks)
                 return -EINVAL;
 
-        len = ntohs(ch->param_hdr.length);
+        len = num_chunks;
         if (put_user(len, optlen))
                 return -EFAULT;
+        if (put_user(num_chunks, &p->gauth_number_of_chunks))
+                return -EFAULT;
         if (copy_to_user(to, ch->chunks, len))
                 return -EFAULT;
 
diff --git a/net/sctp/ulpevent.c b/net/sctp/ulpevent.c
index e27b11f18b7f..b43f1f110f87 100644
--- a/net/sctp/ulpevent.c
+++ b/net/sctp/ulpevent.c
@@ -206,7 +206,7 @@ struct sctp_ulpevent  *sctp_ulpevent_make_assoc_change(
          * This field is the total length of the notification data, including
          * the notification header.
          */
-        sac->sac_length = sizeof(struct sctp_assoc_change);
+        sac->sac_length = skb->len;
 
         /* Socket Extensions for SCTP
          * 5.3.1.1 SCTP_ASSOC_CHANGE
diff --git a/net/sunrpc/cache.c b/net/sunrpc/cache.c
index 636c8e04e0be..b5f2786251b9 100644
--- a/net/sunrpc/cache.c
+++ b/net/sunrpc/cache.c
@@ -316,31 +316,29 @@ static int create_cache_proc_entries(struct cache_detail *cd)
         cd->proc_ent->owner = cd->owner;
         cd->channel_ent = cd->content_ent = NULL;
 
-        p = create_proc_entry("flush", S_IFREG|S_IRUSR|S_IWUSR, cd->proc_ent);
+        p = proc_create("flush", S_IFREG|S_IRUSR|S_IWUSR,
+                        cd->proc_ent, &cache_flush_operations);
         cd->flush_ent = p;
         if (p == NULL)
                 goto out_nomem;
-        p->proc_fops = &cache_flush_operations;
         p->owner = cd->owner;
         p->data = cd;
 
         if (cd->cache_request || cd->cache_parse) {
-                p = create_proc_entry("channel", S_IFREG|S_IRUSR|S_IWUSR,
-                                      cd->proc_ent);
+                p = proc_create("channel", S_IFREG|S_IRUSR|S_IWUSR,
+                                cd->proc_ent, &cache_file_operations);
                 cd->channel_ent = p;
                 if (p == NULL)
                         goto out_nomem;
-                p->proc_fops = &cache_file_operations;
                 p->owner = cd->owner;
                 p->data = cd;
         }
         if (cd->cache_show) {
-                p = create_proc_entry("content", S_IFREG|S_IRUSR|S_IWUSR,
-                                      cd->proc_ent);
+                p = proc_create("content", S_IFREG|S_IRUSR|S_IWUSR,
+                                cd->proc_ent, &content_file_operations);
                 cd->content_ent = p;
                 if (p == NULL)
                         goto out_nomem;
-                p->proc_fops = &content_file_operations;
                 p->owner = cd->owner;
                 p->data = cd;
         }
diff --git a/net/sunrpc/stats.c b/net/sunrpc/stats.c
index 5a16875f5ac8..c6061a4346c8 100644
--- a/net/sunrpc/stats.c
+++ b/net/sunrpc/stats.c
@@ -229,9 +229,8 @@ do_register(const char *name, void *data, const struct file_operations *fops)
         rpc_proc_init();
         dprintk("RPC:       registering /proc/net/rpc/%s\n", name);
 
-        ent = create_proc_entry(name, 0, proc_net_rpc);
+        ent = proc_create(name, 0, proc_net_rpc, fops);
         if (ent) {
-                ent->proc_fops = fops;
                 ent->data = data;
         }
         return ent;
diff --git a/net/sunrpc/xprtrdma/transport.c b/net/sunrpc/xprtrdma/transport.c
index 02c522c17de5..a564c1a39ec5 100644
--- a/net/sunrpc/xprtrdma/transport.c
+++ b/net/sunrpc/xprtrdma/transport.c
@@ -614,7 +614,11 @@ xprt_rdma_free(void *buffer)
                 return;
 
         req = container_of(buffer, struct rpcrdma_req, rl_xdr_buf[0]);
-        r_xprt = container_of(req->rl_buffer, struct rpcrdma_xprt, rx_buf);
+        if (req->rl_iov.length == 0) {  /* see allocate above */
+                r_xprt = container_of(((struct rpcrdma_req *) req->rl_buffer)->rl_buffer,
+                                      struct rpcrdma_xprt, rx_buf);
+        } else
+                r_xprt = container_of(req->rl_buffer, struct rpcrdma_xprt, rx_buf);
         rep = req->rl_reply;
 
         dprintk("RPC:       %s: called on 0x%p%s\n",
diff --git a/net/tipc/cluster.c b/net/tipc/cluster.c
index 95b373913aa0..4bb3404f610b 100644
--- a/net/tipc/cluster.c
+++ b/net/tipc/cluster.c
@@ -142,7 +142,7 @@ void tipc_cltr_attach_node(struct cluster *c_ptr, struct node *n_ptr)
                 max_n_num = tipc_highest_allowed_slave;
         assert(n_num > 0);
         assert(n_num <= max_n_num);
-        assert(c_ptr->nodes[n_num] == 0);
+        assert(c_ptr->nodes[n_num] == NULL);
         c_ptr->nodes[n_num] = n_ptr;
         if (n_num > c_ptr->highest_node)
                 c_ptr->highest_node = n_num;
diff --git a/net/tipc/link.c b/net/tipc/link.c
index 1b17fecee747..cefa99824c58 100644
--- a/net/tipc/link.c
+++ b/net/tipc/link.c
@@ -3251,7 +3251,7 @@ static void link_print(struct link *l_ptr, struct print_buf *buf,
                 if ((mod(msg_seqno(buf_msg(l_ptr->last_out)) -
                          msg_seqno(buf_msg(l_ptr->first_out)))
                      != (l_ptr->out_queue_size - 1))
-                    || (l_ptr->last_out->next != 0)) {
+                    || (l_ptr->last_out->next != NULL)) {
                         tipc_printf(buf, "\nSend queue inconsistency\n");
                         tipc_printf(buf, "first_out= %x ", l_ptr->first_out);
                         tipc_printf(buf, "next_out= %x ", l_ptr->next_out);
diff --git a/net/tipc/ref.c b/net/tipc/ref.c
index 6704a58c7851..c38744c96ed1 100644
--- a/net/tipc/ref.c
+++ b/net/tipc/ref.c
@@ -148,7 +148,7 @@ u32 tipc_ref_acquire(void *object, spinlock_t **lock)
                 reference = (next_plus_upper & ~index_mask) + index;
                 entry->data.reference = reference;
                 entry->object = object;
-                if (lock != 0)
+                if (lock != NULL)
                         *lock = &entry->lock;
                 spin_unlock_bh(&entry->lock);
         }
diff --git a/net/tipc/zone.c b/net/tipc/zone.c
index 114e173f11a5..3506f8563441 100644
--- a/net/tipc/zone.c
+++ b/net/tipc/zone.c
@@ -82,7 +82,7 @@ void tipc_zone_attach_cluster(struct _zone *z_ptr, struct cluster *c_ptr)
 
         assert(c_ptr->addr);
         assert(c_num <= tipc_max_clusters);
-        assert(z_ptr->clusters[c_num] == 0);
+        assert(z_ptr->clusters[c_num] == NULL);
         z_ptr->clusters[c_num] = c_ptr;
 }
 
diff --git a/net/wanrouter/wanproc.c b/net/wanrouter/wanproc.c
index f2e54c3f064e..5bebe40bf4e6 100644
--- a/net/wanrouter/wanproc.c
+++ b/net/wanrouter/wanproc.c
@@ -292,14 +292,12 @@ int __init wanrouter_proc_init(void)
         if (!proc_router)
                 goto fail;
 
-        p = create_proc_entry("config", S_IRUGO, proc_router);
+        p = proc_create("config", S_IRUGO, proc_router, &config_fops);
         if (!p)
                 goto fail_config;
-        p->proc_fops = &config_fops;
-        p = create_proc_entry("status", S_IRUGO, proc_router);
+        p = proc_create("status", S_IRUGO, proc_router, &status_fops);
         if (!p)
                 goto fail_stat;
-        p->proc_fops = &status_fops;
         return 0;
 fail_stat:
         remove_proc_entry("config", proc_router);
@@ -329,10 +327,10 @@ int wanrouter_proc_add(struct wan_device* wandev)
         if (wandev->magic != ROUTER_MAGIC)
                 return -EINVAL;
 
-        wandev->dent = create_proc_entry(wandev->name, S_IRUGO, proc_router);
+        wandev->dent = proc_create(wandev->name, S_IRUGO,
+                                   proc_router, &wandev_fops);
         if (!wandev->dent)
                 return -ENOMEM;
-        wandev->dent->proc_fops = &wandev_fops;
         wandev->dent->data      = wandev;
         return 0;
 }
diff --git a/net/x25/x25_proc.c b/net/x25/x25_proc.c
index 3f52b09bed03..1afa44d25beb 100644
--- a/net/x25/x25_proc.c
+++ b/net/x25/x25_proc.c
@@ -312,20 +312,18 @@ int __init x25_proc_init(void)
         if (!x25_proc_dir)
                 goto out;
 
-        p = create_proc_entry("route", S_IRUGO, x25_proc_dir);
+        p = proc_create("route", S_IRUGO, x25_proc_dir, &x25_seq_route_fops);
         if (!p)
                 goto out_route;
-        p->proc_fops = &x25_seq_route_fops;
 
-        p = create_proc_entry("socket", S_IRUGO, x25_proc_dir);
+        p = proc_create("socket", S_IRUGO, x25_proc_dir, &x25_seq_socket_fops);
         if (!p)
                 goto out_socket;
-        p->proc_fops = &x25_seq_socket_fops;
 
-        p = create_proc_entry("forward", S_IRUGO, x25_proc_dir);
+        p = proc_create("forward", S_IRUGO, x25_proc_dir,
+                        &x25_seq_forward_fops);
         if (!p)
                 goto out_forward;
-        p->proc_fops = &x25_seq_forward_fops;
         rc = 0;
 
 out: