22 files changed, 175 insertions, 116 deletions
diff --git a/net/ax25/af_ax25.c b/net/ax25/af_ax25.c
index 0906c194a413..9d9a6a3edbd5 100644
--- a/net/ax25/af_ax25.c
+++ b/net/ax25/af_ax25.c
@@ -2011,16 +2011,17 @@ static void __exit ax25_exit(void)
        proc_net_remove(&init_net, "ax25_route");
        proc_net_remove(&init_net, "ax25");
        proc_net_remove(&init_net, "ax25_calls");
-        ax25_rt_free();
-        ax25_uid_free();
-        ax25_dev_free();
-        ax25_unregister_sysctl();
        unregister_netdevice_notifier(&ax25_dev_notifier);
+        ax25_unregister_sysctl();
        dev_remove_pack(&ax25_packet_type);
        sock_unregister(PF_AX25);
        proto_unregister(&ax25_proto);
+        ax25_rt_free();
+        ax25_uid_free();
+        ax25_dev_free();
 }
 module_exit(ax25_exit);
diff --git a/net/caif/chnl_net.c b/net/caif/chnl_net.c
index 20618dd3088b..d09340e1523f 100644
--- a/net/caif/chnl_net.c
+++ b/net/caif/chnl_net.c
@@ -103,6 +103,7 @@ static int chnl_recv_cb(struct cflayer *layr, struct cfpkt *pkt)
                skb->protocol = htons(ETH_P_IPV6);
                break;
        default:
+                kfree_skb(skb);
                priv->netdev->stats.rx_errors++;
                return -EINVAL;
        }
@@ -220,14 +221,16 @@ static int chnl_net_start_xmit(struct sk_buff *skb, struct net_device *dev)
        if (skb->len > priv->netdev->mtu) {
                pr_warn("Size of skb exceeded MTU\n");
+                kfree_skb(skb);
                dev->stats.tx_errors++;
-                return -ENOSPC;
+                return NETDEV_TX_OK;
        }
        if (!priv->flowenabled) {
                pr_debug("dropping packets flow off\n");
+                kfree_skb(skb);
                dev->stats.tx_dropped++;
-                return NETDEV_TX_BUSY;
+                return NETDEV_TX_OK;
        }
        if (priv->conn_req.protocol == CAIFPROTO_DATAGRAM_LOOP)
@@ -242,7 +245,7 @@ static int chnl_net_start_xmit(struct sk_buff *skb, struct net_device *dev)
        result = priv->chnl.dn->transmit(priv->chnl.dn, pkt);
        if (result) {
                dev->stats.tx_dropped++;
-                return result;
+                return NETDEV_TX_OK;
        }
        /* Update statistics. */
diff --git a/net/core/dev.c b/net/core/dev.c
index c25d453b2803..9bb8f87c4cda 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -1409,14 +1409,34 @@ EXPORT_SYMBOL(register_netdevice_notifier);
 *      register_netdevice_notifier(). The notifier is unlinked into the
 *      kernel structures and may then be reused. A negative errno code
 *      is returned on a failure.
+ *
+ *      After unregistering unregister and down device events are synthesized
+ *      for all devices on the device list to the removed notifier to remove
+ *      the need for special case cleanup code.
 */
 int unregister_netdevice_notifier(struct notifier_block *nb)
 {
+        struct net_device *dev;
+        struct net *net;
        int err;
        rtnl_lock();
        err = raw_notifier_chain_unregister(&netdev_chain, nb);
+        if (err)
+                goto unlock;
+        for_each_net(net) {
+                for_each_netdev(net, dev) {
+                        if (dev->flags & IFF_UP) {
+                                nb->notifier_call(nb, NETDEV_GOING_DOWN, dev);
+                                nb->notifier_call(nb, NETDEV_DOWN, dev);
+                        }
+                        nb->notifier_call(nb, NETDEV_UNREGISTER, dev);
+                        nb->notifier_call(nb, NETDEV_UNREGISTER_BATCH, dev);
+                }
+        }
+unlock:
        rtnl_unlock();
        return err;
 }
diff --git a/net/core/drop_monitor.c b/net/core/drop_monitor.c
index 7f36b38e060f..5c3c81a609e5 100644
--- a/net/core/drop_monitor.c
+++ b/net/core/drop_monitor.c
@@ -150,6 +150,7 @@ static void trace_drop_common(struct sk_buff *skb, void *location)
        for (i = 0; i < msg->entries; i++) {
                if (!memcmp(&location, msg->points[i].pc, sizeof(void *))) {
                        msg->points[i].count++;
+                        atomic_inc(&data->dm_hit_count);
                        goto out;
                }
        }
diff --git a/net/core/net_namespace.c b/net/core/net_namespace.c
index 0e950fda9a0a..31a5ae51a45c 100644
--- a/net/core/net_namespace.c
+++ b/net/core/net_namespace.c
@@ -83,21 +83,29 @@ assign:
 static int ops_init(const struct pernet_operations *ops, struct net *net)
 {
-        int err;
+        int err = -ENOMEM;
+        void *data = NULL;
        if (ops->id && ops->size) {
-                void *data = kzalloc(ops->size, GFP_KERNEL);
+                data = kzalloc(ops->size, GFP_KERNEL);
                if (!data)
-                        return -ENOMEM;
+                        goto out;
                err = net_assign_generic(net, *ops->id, data);
-                if (err) {
+                if (err)
-                        kfree(data);
+                        goto cleanup;
-                        return err;
-                }
        }
+        err = 0;
        if (ops->init)
-                return ops->init(net);
+                err = ops->init(net);
-        return 0;
+        if (!err)
+                return 0;
+cleanup:
+        kfree(data);
+out:
+        return err;
 }
 static void ops_free(const struct pernet_operations *ops, struct net *net)
@@ -448,12 +456,7 @@ static void __unregister_pernet_operations(struct pernet_operations *ops)
 static int __register_pernet_operations(struct list_head *list,
                                        struct pernet_operations *ops)
 {
-        int err = 0;
+        return ops_init(ops, &init_net);
-        err = ops_init(ops, &init_net);
-        if (err)
-                ops_free(ops, &init_net);
-        return err;
-        
 }
 static void __unregister_pernet_operations(struct pernet_operations *ops)
diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
index 9944c1d9a218..3ff364065376 100644
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -335,6 +335,7 @@ static void tcp_grow_window(struct sock *sk, const struct sk_buff *skb)
                        incr = __tcp_grow_window(sk, skb);
                if (incr) {
+                        incr = max_t(int, incr, 2 * skb->len);
                        tp->rcv_ssthresh = min(tp->rcv_ssthresh + incr,
                                               tp->window_clamp);
                        inet_csk(sk)->icsk_ack.quick |= 1;
diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
index 376b2cfbb685..7ac6423117ad 100644
--- a/net/ipv4/tcp_output.c
+++ b/net/ipv4/tcp_output.c
@@ -1096,6 +1096,7 @@ static void __pskb_trim_head(struct sk_buff *skb, int len)
        eat = min_t(int, len, skb_headlen(skb));
        if (eat) {
                __skb_pull(skb, eat);
+                skb->avail_size -= eat;
                len -= eat;
                if (!len)
                        return;
diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index 6a3bb6077e19..7d5cb975cc6f 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -803,8 +803,7 @@ static void ipv6_del_addr(struct inet6_ifaddr *ifp)
                                ip6_del_rt(rt);
                                rt = NULL;
                        } else if (!(rt->rt6i_flags & RTF_EXPIRES)) {
-                                rt->dst.expires = expires;
+                                rt6_set_expires(rt, expires);
-                                rt->rt6i_flags |= RTF_EXPIRES;
                        }
                }
                dst_release(&rt->dst);
@@ -1887,11 +1886,9 @@ void addrconf_prefix_rcv(struct net_device *dev, u8 *opt, int len, bool sllao)
                                rt = NULL;
                        } else if (addrconf_finite_timeout(rt_expires)) {
                                /* not infinity */
-                                rt->dst.expires = jiffies + rt_expires;
+                                rt6_set_expires(rt, jiffies + rt_expires);
-                                rt->rt6i_flags |= RTF_EXPIRES;
                        } else {
-                                rt->rt6i_flags &= ~RTF_EXPIRES;
+                                rt6_clean_expires(rt);
-                                rt->dst.expires = 0;
                        }
                } else if (valid_lft) {
                        clock_t expires = 0;
diff --git a/net/ipv6/ip6_fib.c b/net/ipv6/ip6_fib.c
index 5b27fbcae346..93717435013e 100644
--- a/net/ipv6/ip6_fib.c
+++ b/net/ipv6/ip6_fib.c
@@ -673,11 +673,10 @@ static int fib6_add_rt2node(struct fib6_node *fn, struct rt6_info *rt,
                                            &rt->rt6i_gateway)) {
                                if (!(iter->rt6i_flags & RTF_EXPIRES))
                                        return -EEXIST;
-                                iter->dst.expires = rt->dst.expires;
+                                if (!(rt->rt6i_flags & RTF_EXPIRES))
-                                if (!(rt->rt6i_flags & RTF_EXPIRES)) {
+                                        rt6_clean_expires(iter);
-                                        iter->rt6i_flags &= ~RTF_EXPIRES;
+                                else
-                                        iter->dst.expires = 0;
+                                        rt6_set_expires(iter, rt->dst.expires);
-                                }
                                return -EEXIST;
                        }
                }
diff --git a/net/ipv6/ndisc.c b/net/ipv6/ndisc.c
index 3dcdb81ec3e8..176b469322ac 100644
--- a/net/ipv6/ndisc.c
+++ b/net/ipv6/ndisc.c
@@ -1264,8 +1264,7 @@ static void ndisc_router_discovery(struct sk_buff *skb)
        }
        if (rt)
-                rt->dst.expires = jiffies + (HZ * lifetime);
+                rt6_set_expires(rt, jiffies + (HZ * lifetime));
        if (ra_msg->icmph.icmp6_hop_limit) {
                in6_dev->cnf.hop_limit = ra_msg->icmph.icmp6_hop_limit;
                if (rt)
diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index 3992e26a6039..bc4888d902b2 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -62,7 +62,7 @@
 #include <linux/sysctl.h>
 #endif
-static struct rt6_info *ip6_rt_copy(const struct rt6_info *ort,
+static struct rt6_info *ip6_rt_copy(struct rt6_info *ort,
                                    const struct in6_addr *dest);
 static struct dst_entry *ip6_dst_check(struct dst_entry *dst, u32 cookie);
 static unsigned int      ip6_default_advmss(const struct dst_entry *dst);
@@ -285,6 +285,10 @@ static void ip6_dst_destroy(struct dst_entry *dst)
                rt->rt6i_idev = NULL;
                in6_dev_put(idev);
        }
+        if (!(rt->rt6i_flags & RTF_EXPIRES) && dst->from)
+                dst_release(dst->from);
        if (peer) {
                rt->rt6i_peer = NULL;
                inet_putpeer(peer);
@@ -329,8 +333,17 @@ static void ip6_dst_ifdown(struct dst_entry *dst, struct net_device *dev,
 static __inline__ int rt6_check_expired(const struct rt6_info *rt)
 {
-        return (rt->rt6i_flags & RTF_EXPIRES) &&
+        struct rt6_info *ort = NULL;
-                time_after(jiffies, rt->dst.expires);
+        if (rt->rt6i_flags & RTF_EXPIRES) {
+                if (time_after(jiffies, rt->dst.expires))
+                        return 1;
+        } else if (rt->dst.from) {
+                ort = (struct rt6_info *) rt->dst.from;
+                return (ort->rt6i_flags & RTF_EXPIRES) &&
+                        time_after(jiffies, ort->dst.expires);
+        }
+        return 0;
 }
 static inline int rt6_need_strict(const struct in6_addr *daddr)
@@ -620,12 +633,11 @@ int rt6_route_rcv(struct net_device *dev, u8 *opt, int len,
                                 (rt->rt6i_flags & ~RTF_PREF_MASK) | RTF_PREF(pref);
        if (rt) {
-                if (!addrconf_finite_timeout(lifetime)) {
+                if (!addrconf_finite_timeout(lifetime))
-                        rt->rt6i_flags &= ~RTF_EXPIRES;
+                        rt6_clean_expires(rt);
-                } else {
+                else
-                        rt->dst.expires = jiffies + HZ * lifetime;
+                        rt6_set_expires(rt, jiffies + HZ * lifetime);
-                        rt->rt6i_flags |= RTF_EXPIRES;
-                }
                dst_release(&rt->dst);
        }
        return 0;
@@ -730,7 +742,7 @@ int ip6_ins_rt(struct rt6_info *rt)
        return __ip6_ins_rt(rt, &info);
 }
-static struct rt6_info *rt6_alloc_cow(const struct rt6_info *ort,
+static struct rt6_info *rt6_alloc_cow(struct rt6_info *ort,
                                      const struct in6_addr *daddr,
                                      const struct in6_addr *saddr)
 {
@@ -954,10 +966,10 @@ struct dst_entry *ip6_blackhole_route(struct net *net, struct dst_entry *dst_ori
                rt->rt6i_idev = ort->rt6i_idev;
                if (rt->rt6i_idev)
                        in6_dev_hold(rt->rt6i_idev);
-                rt->dst.expires = 0;
                rt->rt6i_gateway = ort->rt6i_gateway;
-                rt->rt6i_flags = ort->rt6i_flags & ~RTF_EXPIRES;
+                rt->rt6i_flags = ort->rt6i_flags;
+                rt6_clean_expires(rt);
                rt->rt6i_metric = 0;
                memcpy(&rt->rt6i_dst, &ort->rt6i_dst, sizeof(struct rt6key));
@@ -1019,10 +1031,9 @@ static void ip6_link_failure(struct sk_buff *skb)
        rt = (struct rt6_info *) skb_dst(skb);
        if (rt) {
-                if (rt->rt6i_flags & RTF_CACHE) {
+                if (rt->rt6i_flags & RTF_CACHE)
-                        dst_set_expires(&rt->dst, 0);
+                        rt6_update_expires(rt, 0);
-                        rt->rt6i_flags |= RTF_EXPIRES;
+                else if (rt->rt6i_node && (rt->rt6i_flags & RTF_DEFAULT))
-                } else if (rt->rt6i_node && (rt->rt6i_flags & RTF_DEFAULT))
                        rt->rt6i_node->fn_sernum = -1;
        }
 }
@@ -1289,9 +1300,12 @@ int ip6_route_add(struct fib6_config *cfg)
        }
        rt->dst.obsolete = -1;
-        rt->dst.expires = (cfg->fc_flags & RTF_EXPIRES) ?
-                                jiffies + clock_t_to_jiffies(cfg->fc_expires) :
+        if (cfg->fc_flags & RTF_EXPIRES)
-                                0;
+                rt6_set_expires(rt, jiffies +
+                                clock_t_to_jiffies(cfg->fc_expires));
+        else
+                rt6_clean_expires(rt);
        if (cfg->fc_protocol == RTPROT_UNSPEC)
                cfg->fc_protocol = RTPROT_BOOT;
@@ -1736,8 +1750,8 @@ again:
                        features |= RTAX_FEATURE_ALLFRAG;
                        dst_metric_set(&rt->dst, RTAX_FEATURES, features);
                }
-                dst_set_expires(&rt->dst, net->ipv6.sysctl.ip6_rt_mtu_expires);
+                rt6_update_expires(rt, net->ipv6.sysctl.ip6_rt_mtu_expires);
-                rt->rt6i_flags |= RTF_MODIFIED|RTF_EXPIRES;
+                rt->rt6i_flags |= RTF_MODIFIED;
                goto out;
        }
@@ -1765,9 +1779,8 @@ again:
                 * which is 10 mins. After 10 mins the decreased pmtu is expired
                 * and detecting PMTU increase will be automatically happened.
                 */
-                dst_set_expires(&nrt->dst, net->ipv6.sysctl.ip6_rt_mtu_expires);
+                rt6_update_expires(nrt, net->ipv6.sysctl.ip6_rt_mtu_expires);
-                nrt->rt6i_flags |= RTF_DYNAMIC|RTF_EXPIRES;
+                nrt->rt6i_flags |= RTF_DYNAMIC;
                ip6_ins_rt(nrt);
        }
 out:
@@ -1799,7 +1812,7 @@ void rt6_pmtu_discovery(const struct in6_addr *daddr, const struct in6_addr *sad
 *      Misc support functions
 */
-static struct rt6_info *ip6_rt_copy(const struct rt6_info *ort,
+static struct rt6_info *ip6_rt_copy(struct rt6_info *ort,
                                    const struct in6_addr *dest)
 {
        struct net *net = dev_net(ort->dst.dev);
@@ -1819,10 +1832,14 @@ static struct rt6_info *ip6_rt_copy(const struct rt6_info *ort,
                if (rt->rt6i_idev)
                        in6_dev_hold(rt->rt6i_idev);
                rt->dst.lastuse = jiffies;
-                rt->dst.expires = 0;
                rt->rt6i_gateway = ort->rt6i_gateway;
-                rt->rt6i_flags = ort->rt6i_flags & ~RTF_EXPIRES;
+                rt->rt6i_flags = ort->rt6i_flags;
+                if ((ort->rt6i_flags & (RTF_DEFAULT | RTF_ADDRCONF)) ==
+                    (RTF_DEFAULT | RTF_ADDRCONF))
+                        rt6_set_from(rt, ort);
+                else
+                        rt6_clean_expires(rt);
                rt->rt6i_metric = 0;
 #ifdef CONFIG_IPV6_SUBTREES
diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
index 86cfe6005f40..98256cf72f9d 100644
--- a/net/ipv6/tcp_ipv6.c
+++ b/net/ipv6/tcp_ipv6.c
@@ -1383,6 +1383,10 @@ static struct sock * tcp_v6_syn_recv_sock(struct sock *sk, struct sk_buff *skb,
        tcp_mtup_init(newsk);
        tcp_sync_mss(newsk, dst_mtu(dst));
        newtp->advmss = dst_metric_advmss(dst);
+        if (tcp_sk(sk)->rx_opt.user_mss &&
+            tcp_sk(sk)->rx_opt.user_mss < newtp->advmss)
+                newtp->advmss = tcp_sk(sk)->rx_opt.user_mss;
        tcp_initialize_rcv_mss(newsk);
        if (tcp_rsk(req)->snt_synack)
                tcp_valid_rtt_meas(newsk,
diff --git a/net/key/af_key.c b/net/key/af_key.c
index 11dbb2255ccb..7e5d927b576f 100644
--- a/net/key/af_key.c
+++ b/net/key/af_key.c
@@ -3480,7 +3480,7 @@ static int pfkey_send_migrate(const struct xfrm_selector *sel, u8 dir, u8 type,
        /* Addresses to be used by KM for negotiation, if ext is available */
        if (k != NULL && (set_sadb_kmaddress(skb, k) < 0))
-                return -EINVAL;
+                goto err;
        /* selector src */
        set_sadb_address(skb, sasize_sel, SADB_EXT_ADDRESS_SRC, sel);
diff --git a/net/l2tp/l2tp_ip.c b/net/l2tp/l2tp_ip.c
index 55670ec3cd0f..585d93ecee2d 100644
--- a/net/l2tp/l2tp_ip.c
+++ b/net/l2tp/l2tp_ip.c
@@ -232,7 +232,7 @@ static void l2tp_ip_close(struct sock *sk, long timeout)
 {
        write_lock_bh(&l2tp_ip_lock);
        hlist_del_init(&sk->sk_bind_node);
-        hlist_del_init(&sk->sk_node);
+        sk_del_node_init(sk);
        write_unlock_bh(&l2tp_ip_lock);
        sk_common_release(sk);
 }
@@ -271,7 +271,8 @@ static int l2tp_ip_bind(struct sock *sk, struct sockaddr *uaddr, int addr_len)
            chk_addr_ret != RTN_MULTICAST && chk_addr_ret != RTN_BROADCAST)
                goto out;
-        inet->inet_rcv_saddr = inet->inet_saddr = addr->l2tp_addr.s_addr;
+        if (addr->l2tp_addr.s_addr)
+                inet->inet_rcv_saddr = inet->inet_saddr = addr->l2tp_addr.s_addr;
        if (chk_addr_ret == RTN_MULTICAST || chk_addr_ret == RTN_BROADCAST)
                inet->inet_saddr = 0;  /* Use device */
        sk_dst_reset(sk);
diff --git a/net/mac80211/ibss.c b/net/mac80211/ibss.c
index 33fd8d9f714e..cef7c29214a8 100644
--- a/net/mac80211/ibss.c
+++ b/net/mac80211/ibss.c
@@ -457,8 +457,8 @@ static void ieee80211_rx_bss_info(struct ieee80211_sub_if_data *sdata,
                         * fall back to HT20 if we don't use or use
                         * the other extension channel
                         */
-                        if ((channel_type == NL80211_CHAN_HT40MINUS ||
+                        if (!(channel_type == NL80211_CHAN_HT40MINUS ||
-                             channel_type == NL80211_CHAN_HT40PLUS) &&
+                              channel_type == NL80211_CHAN_HT40PLUS) ||
                            channel_type != sdata->u.ibss.channel_type)
                                sta_ht_cap_new.cap &=
                                        ~IEEE80211_HT_CAP_SUP_WIDTH_20_40;
diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
index bcfe8c77c839..d64e285400aa 100644
--- a/net/mac80211/rx.c
+++ b/net/mac80211/rx.c
@@ -103,7 +103,7 @@ static void
 ieee80211_add_rx_radiotap_header(struct ieee80211_local *local,
                                 struct sk_buff *skb,
                                 struct ieee80211_rate *rate,
-                                 int rtap_len)
+                                 int rtap_len, bool has_fcs)
 {
        struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
        struct ieee80211_radiotap_header *rthdr;
@@ -134,7 +134,7 @@ ieee80211_add_rx_radiotap_header(struct ieee80211_local *local,
        }
        /* IEEE80211_RADIOTAP_FLAGS */
-        if (local->hw.flags & IEEE80211_HW_RX_INCLUDES_FCS)
+        if (has_fcs && (local->hw.flags & IEEE80211_HW_RX_INCLUDES_FCS))
                *pos |= IEEE80211_RADIOTAP_F_FCS;
        if (status->flag & (RX_FLAG_FAILED_FCS_CRC | RX_FLAG_FAILED_PLCP_CRC))
                *pos |= IEEE80211_RADIOTAP_F_BADFCS;
@@ -294,7 +294,8 @@ ieee80211_rx_monitor(struct ieee80211_local *local, struct sk_buff *origskb,
        }
        /* prepend radiotap information */
-        ieee80211_add_rx_radiotap_header(local, skb, rate, needed_headroom);
+        ieee80211_add_rx_radiotap_header(local, skb, rate, needed_headroom,
+                                         true);
        skb_reset_mac_header(skb);
        skb->ip_summed = CHECKSUM_UNNECESSARY;
@@ -2571,7 +2572,8 @@ static void ieee80211_rx_cooked_monitor(struct ieee80211_rx_data *rx,
                goto out_free_skb;
        /* prepend radiotap information */
-        ieee80211_add_rx_radiotap_header(local, skb, rate, needed_headroom);
+        ieee80211_add_rx_radiotap_header(local, skb, rate, needed_headroom,
+                                         false);
        skb_set_mac_header(skb, 0);
        skb->ip_summed = CHECKSUM_UNNECESSARY;
diff --git a/net/phonet/pn_dev.c b/net/phonet/pn_dev.c
index 9b9a85ecc4c7..bf5cf69c820a 100644
--- a/net/phonet/pn_dev.c
+++ b/net/phonet/pn_dev.c
@@ -331,23 +331,6 @@ static int __net_init phonet_init_net(struct net *net)
 static void __net_exit phonet_exit_net(struct net *net)
 {
-        struct phonet_net *pnn = phonet_pernet(net);
-        struct net_device *dev;
-        unsigned i;
-        rtnl_lock();
-        for_each_netdev(net, dev)
-                phonet_device_destroy(dev);
-        for (i = 0; i < 64; i++) {
-                dev = pnn->routes.table[i];
-                if (dev) {
-                        rtm_phonet_notify(RTM_DELROUTE, dev, i);
-                        dev_put(dev);
-                }
-        }
-        rtnl_unlock();
        proc_net_remove(net, "phonet");
 }
@@ -361,7 +344,7 @@ static struct pernet_operations phonet_net_ops = {
 /* Initialize Phonet devices list */
 int __init phonet_device_init(void)
 {
-        int err = register_pernet_device(&phonet_net_ops);
+        int err = register_pernet_subsys(&phonet_net_ops);
        if (err)
                return err;
@@ -377,7 +360,7 @@ void phonet_device_exit(void)
 {
        rtnl_unregister_all(PF_PHONET);
        unregister_netdevice_notifier(&phonet_device_notifier);
-        unregister_pernet_device(&phonet_net_ops);
+        unregister_pernet_subsys(&phonet_net_ops);
        proc_net_remove(&init_net, "pnresource");
 }
diff --git a/net/sched/sch_gred.c b/net/sched/sch_gred.c
index 0b15236be7b6..8179494c269a 100644
--- a/net/sched/sch_gred.c
+++ b/net/sched/sch_gred.c
@@ -565,11 +565,8 @@ static int gred_dump(struct Qdisc *sch, struct sk_buff *skb)
                opt.packets     = q->packetsin;
                opt.bytesin     = q->bytesin;
-                if (gred_wred_mode(table)) {
+                if (gred_wred_mode(table))
-                        q->vars.qidlestart =
+                        gred_load_wred_set(table, q);
-                                table->tab[table->def]->vars.qidlestart;
-                        q->vars.qavg = table->tab[table->def]->vars.qavg;
-                }
                opt.qave = red_calc_qavg(&q->parms, &q->vars, q->vars.qavg);
diff --git a/net/sunrpc/clnt.c b/net/sunrpc/clnt.c
index 67972462a543..adf2990acebf 100644
--- a/net/sunrpc/clnt.c
+++ b/net/sunrpc/clnt.c
@@ -176,16 +176,22 @@ rpc_setup_pipedir(struct rpc_clnt *clnt, const char *dir_name)
        return 0;
 }
-static int __rpc_pipefs_event(struct rpc_clnt *clnt, unsigned long event,
+static inline int rpc_clnt_skip_event(struct rpc_clnt *clnt, unsigned long event)
-                                struct super_block *sb)
+{
+        if (((event == RPC_PIPEFS_MOUNT) && clnt->cl_dentry) ||
+            ((event == RPC_PIPEFS_UMOUNT) && !clnt->cl_dentry))
+                return 1;
+        return 0;
+}
+static int __rpc_clnt_handle_event(struct rpc_clnt *clnt, unsigned long event,
+                                   struct super_block *sb)
 {
        struct dentry *dentry;
        int err = 0;
        switch (event) {
        case RPC_PIPEFS_MOUNT:
-                if (clnt->cl_program->pipe_dir_name == NULL)
-                        break;
                dentry = rpc_setup_pipedir_sb(sb, clnt,
                                              clnt->cl_program->pipe_dir_name);
                BUG_ON(dentry == NULL);
@@ -208,6 +214,20 @@ static int __rpc_pipefs_event(struct rpc_clnt *clnt, unsigned long event,
        return err;
 }
+static int __rpc_pipefs_event(struct rpc_clnt *clnt, unsigned long event,
+                                struct super_block *sb)
+{
+        int error = 0;
+        for (;; clnt = clnt->cl_parent) {
+                if (!rpc_clnt_skip_event(clnt, event))
+                        error = __rpc_clnt_handle_event(clnt, event, sb);
+                if (error || clnt == clnt->cl_parent)
+                        break;
+        }
+        return error;
+}
 static struct rpc_clnt *rpc_get_client_for_event(struct net *net, int event)
 {
        struct sunrpc_net *sn = net_generic(net, sunrpc_net_id);
@@ -215,10 +235,12 @@ static struct rpc_clnt *rpc_get_client_for_event(struct net *net, int event)
        spin_lock(&sn->rpc_client_lock);
        list_for_each_entry(clnt, &sn->all_clients, cl_clients) {
-                if (((event == RPC_PIPEFS_MOUNT) && clnt->cl_dentry) ||
+                if (clnt->cl_program->pipe_dir_name == NULL)
-                    ((event == RPC_PIPEFS_UMOUNT) && !clnt->cl_dentry))
+                        break;
+                if (rpc_clnt_skip_event(clnt, event))
+                        continue;
+                if (atomic_inc_not_zero(&clnt->cl_count) == 0)
                        continue;
-                atomic_inc(&clnt->cl_count);
                spin_unlock(&sn->rpc_client_lock);
                return clnt;
        }
@@ -257,6 +279,14 @@ void rpc_clients_notifier_unregister(void)
        return rpc_pipefs_notifier_unregister(&rpc_clients_block);
 }
+static void rpc_clnt_set_nodename(struct rpc_clnt *clnt, const char *nodename)
+{
+        clnt->cl_nodelen = strlen(nodename);
+        if (clnt->cl_nodelen > UNX_MAXNODENAME)
+                clnt->cl_nodelen = UNX_MAXNODENAME;
+        memcpy(clnt->cl_nodename, nodename, clnt->cl_nodelen);
+}
 static struct rpc_clnt * rpc_new_client(const struct rpc_create_args *args, struct rpc_xprt *xprt)
 {
        const struct rpc_program *program = args->program;
@@ -337,10 +367,7 @@ static struct rpc_clnt * rpc_new_client(const struct rpc_create_args *args, stru
        }
        /* save the nodename */
-        clnt->cl_nodelen = strlen(init_utsname()->nodename);
+        rpc_clnt_set_nodename(clnt, utsname()->nodename);
-        if (clnt->cl_nodelen > UNX_MAXNODENAME)
-                clnt->cl_nodelen = UNX_MAXNODENAME;
-        memcpy(clnt->cl_nodename, init_utsname()->nodename, clnt->cl_nodelen);
        rpc_register_client(clnt);
        return clnt;
@@ -499,6 +526,7 @@ rpc_clone_client(struct rpc_clnt *clnt)
        err = rpc_setup_pipedir(new, clnt->cl_program->pipe_dir_name);
        if (err != 0)
                goto out_no_path;
+        rpc_clnt_set_nodename(new, utsname()->nodename);
        if (new->cl_auth)
                atomic_inc(&new->cl_auth->au_count);
        atomic_inc(&clnt->cl_count);
diff --git a/net/sunrpc/rpc_pipe.c b/net/sunrpc/rpc_pipe.c
index 0af37fc46818..3b62cf288031 100644
--- a/net/sunrpc/rpc_pipe.c
+++ b/net/sunrpc/rpc_pipe.c
@@ -1126,19 +1126,20 @@ rpc_fill_super(struct super_block *sb, void *data, int silent)
                return -ENOMEM;
        dprintk("RPC:   sending pipefs MOUNT notification for net %p%s\n", net,
                                                                NET_NAME(net));
+        sn->pipefs_sb = sb;
        err = blocking_notifier_call_chain(&rpc_pipefs_notifier_list,
                                           RPC_PIPEFS_MOUNT,
                                           sb);
        if (err)
                goto err_depopulate;
        sb->s_fs_info = get_net(net);
-        sn->pipefs_sb = sb;
        return 0;
 err_depopulate:
        blocking_notifier_call_chain(&rpc_pipefs_notifier_list,
                                           RPC_PIPEFS_UMOUNT,
                                           sb);
+        sn->pipefs_sb = NULL;
        __rpc_depopulate(root, files, RPCAUTH_lockd, RPCAUTH_RootEOF);
        return err;
 }
diff --git a/net/sunrpc/sunrpc_syms.c b/net/sunrpc/sunrpc_syms.c
index 8adfc88e793a..3d6498af9adc 100644
--- a/net/sunrpc/sunrpc_syms.c
+++ b/net/sunrpc/sunrpc_syms.c
@@ -75,20 +75,21 @@ static struct pernet_operations sunrpc_net_ops = {
 static int __init
 init_sunrpc(void)
 {
-        int err = register_rpc_pipefs();
+        int err = rpc_init_mempool();
        if (err)
                goto out;
-        err = rpc_init_mempool();
-        if (err)
-                goto out2;
        err = rpcauth_init_module();
        if (err)
-                goto out3;
+                goto out2;
        cache_initialize();
        err = register_pernet_subsys(&sunrpc_net_ops);
        if (err)
+                goto out3;
+        err = register_rpc_pipefs();
+        if (err)
                goto out4;
 #ifdef RPC_DEBUG
        rpc_register_sysctl();
@@ -98,11 +99,11 @@ init_sunrpc(void)
        return 0;
 out4:
-        rpcauth_remove_module();
+        unregister_pernet_subsys(&sunrpc_net_ops);
 out3:
-        rpc_destroy_mempool();
+        rpcauth_remove_module();
 out2:
-        unregister_rpc_pipefs();
+        rpc_destroy_mempool();
 out:
        return err;
 }
diff --git a/net/wireless/util.c b/net/wireless/util.c
index 1b7a08df933c..957f25621617 100644
--- a/net/wireless/util.c
+++ b/net/wireless/util.c
@@ -989,7 +989,7 @@ int cfg80211_can_change_interface(struct cfg80211_registered_device *rdev,
                        if (rdev->wiphy.software_iftypes & BIT(iftype))
                                continue;
                        for (j = 0; j < c->n_limits; j++) {
-                                if (!(limits[j].types & iftype))
+                                if (!(limits[j].types & BIT(iftype)))
                                        continue;
                                if (limits[j].max < num[iftype])
                                        goto cont;