32 files changed, 347 insertions, 162 deletions

diff --git a/net/atm/pppoatm.c b/net/atm/pppoatm.c
index e49bb6d948a1..e9aced0ec56b 100644
--- a/net/atm/pppoatm.c
+++ b/net/atm/pppoatm.c
@@ -260,7 +260,7 @@ static int pppoatm_devppp_ioctl(struct ppp_channel *chan, unsigned int cmd,
         return -ENOTTY;
 }
 
-static /*const*/ struct ppp_channel_ops pppoatm_ops = {
+static const struct ppp_channel_ops pppoatm_ops = {
         .start_xmit = pppoatm_send,
         .ioctl = pppoatm_devppp_ioctl,
 };
diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c
index 8303f1c9ef54..c52f091ee6de 100644
--- a/net/bluetooth/hci_core.c
+++ b/net/bluetooth/hci_core.c
@@ -924,7 +924,7 @@ int hci_register_dev(struct hci_dev *hdev)
 
         hci_conn_hash_init(hdev);
 
-        INIT_LIST_HEAD(&hdev->blacklist.list);
+        INIT_LIST_HEAD(&hdev->blacklist);
 
         memset(&hdev->stat, 0, sizeof(struct hci_dev_stats));
 
diff --git a/net/bluetooth/hci_sock.c b/net/bluetooth/hci_sock.c
index 4f170a595934..83acd164d39e 100644
--- a/net/bluetooth/hci_sock.c
+++ b/net/bluetooth/hci_sock.c
@@ -168,9 +168,8 @@ static int hci_sock_release(struct socket *sock)
 struct bdaddr_list *hci_blacklist_lookup(struct hci_dev *hdev, bdaddr_t *bdaddr)
 {
         struct list_head *p;
-        struct bdaddr_list *blacklist = &hdev->blacklist;
 
-        list_for_each(p, &blacklist->list) {
+        list_for_each(p, &hdev->blacklist) {
                 struct bdaddr_list *b;
 
                 b = list_entry(p, struct bdaddr_list, list);
@@ -202,7 +201,7 @@ static int hci_blacklist_add(struct hci_dev *hdev, void __user *arg)
 
         bacpy(&entry->bdaddr, &bdaddr);
 
-        list_add(&entry->list, &hdev->blacklist.list);
+        list_add(&entry->list, &hdev->blacklist);
 
         return 0;
 }
@@ -210,9 +209,8 @@ static int hci_blacklist_add(struct hci_dev *hdev, void __user *arg)
 int hci_blacklist_clear(struct hci_dev *hdev)
 {
         struct list_head *p, *n;
-        struct bdaddr_list *blacklist = &hdev->blacklist;
 
-        list_for_each_safe(p, n, &blacklist->list) {
+        list_for_each_safe(p, n, &hdev->blacklist) {
                 struct bdaddr_list *b;
 
                 b = list_entry(p, struct bdaddr_list, list);
diff --git a/net/bluetooth/hci_sysfs.c b/net/bluetooth/hci_sysfs.c
index ce44c47eeac1..8fb967beee80 100644
--- a/net/bluetooth/hci_sysfs.c
+++ b/net/bluetooth/hci_sysfs.c
@@ -439,12 +439,11 @@ static const struct file_operations inquiry_cache_fops = {
 static int blacklist_show(struct seq_file *f, void *p)
 {
         struct hci_dev *hdev = f->private;
-        struct bdaddr_list *blacklist = &hdev->blacklist;
         struct list_head *l;
 
         hci_dev_lock_bh(hdev);
 
-        list_for_each(l, &blacklist->list) {
+        list_for_each(l, &hdev->blacklist) {
                 struct bdaddr_list *b;
                 bdaddr_t bdaddr;
 
diff --git a/net/bluetooth/l2cap.c b/net/bluetooth/l2cap.c
index 9ba1e8eee37c..fadf26b4ed7c 100644
--- a/net/bluetooth/l2cap.c
+++ b/net/bluetooth/l2cap.c
@@ -2527,6 +2527,10 @@ done:
                 if (pi->imtu != L2CAP_DEFAULT_MTU)
                         l2cap_add_conf_opt(&ptr, L2CAP_CONF_MTU, 2, pi->imtu);
 
+                if (!(pi->conn->feat_mask & L2CAP_FEAT_ERTM) &&
+                                !(pi->conn->feat_mask & L2CAP_FEAT_STREAMING))
+                        break;
+
                 rfc.mode            = L2CAP_MODE_BASIC;
                 rfc.txwin_size      = 0;
                 rfc.max_transmit    = 0;
@@ -2534,6 +2538,8 @@ done:
                 rfc.monitor_timeout = 0;
                 rfc.max_pdu_size    = 0;
 
+                l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC, sizeof(rfc),
+                                                        (unsigned long) &rfc);
                 break;
 
         case L2CAP_MODE_ERTM:
@@ -2546,6 +2552,9 @@ done:
                 if (L2CAP_DEFAULT_MAX_PDU_SIZE > pi->conn->mtu - 10)
                         rfc.max_pdu_size = cpu_to_le16(pi->conn->mtu - 10);
 
+                l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC, sizeof(rfc),
+                                                        (unsigned long) &rfc);
+
                 if (!(pi->conn->feat_mask & L2CAP_FEAT_FCS))
                         break;
 
@@ -2566,6 +2575,9 @@ done:
                 if (L2CAP_DEFAULT_MAX_PDU_SIZE > pi->conn->mtu - 10)
                         rfc.max_pdu_size = cpu_to_le16(pi->conn->mtu - 10);
 
+                l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC, sizeof(rfc),
+                                                        (unsigned long) &rfc);
+
                 if (!(pi->conn->feat_mask & L2CAP_FEAT_FCS))
                         break;
 
@@ -2577,9 +2589,6 @@ done:
                 break;
         }
 
-        l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC, sizeof(rfc),
-                                                (unsigned long) &rfc);
-
         /* FIXME: Need actual value of the flush timeout */
         //if (flush_to != L2CAP_DEFAULT_FLUSH_TO)
         //   l2cap_add_conf_opt(&ptr, L2CAP_CONF_FLUSH_TO, 2, pi->flush_to);
@@ -2696,8 +2705,9 @@ done:
                 case L2CAP_MODE_ERTM:
                         pi->remote_tx_win = rfc.txwin_size;
                         pi->remote_max_tx = rfc.max_transmit;
-                        if (rfc.max_pdu_size > pi->conn->mtu - 10)
-                                rfc.max_pdu_size = le16_to_cpu(pi->conn->mtu - 10);
+
+                        if (le16_to_cpu(rfc.max_pdu_size) > pi->conn->mtu - 10)
+                                rfc.max_pdu_size = cpu_to_le16(pi->conn->mtu - 10);
 
                         pi->remote_mps = le16_to_cpu(rfc.max_pdu_size);
 
@@ -2714,8 +2724,8 @@ done:
                         break;
 
                 case L2CAP_MODE_STREAMING:
-                        if (rfc.max_pdu_size > pi->conn->mtu - 10)
-                                rfc.max_pdu_size = le16_to_cpu(pi->conn->mtu - 10);
+                        if (le16_to_cpu(rfc.max_pdu_size) > pi->conn->mtu - 10)
+                                rfc.max_pdu_size = cpu_to_le16(pi->conn->mtu - 10);
 
                         pi->remote_mps = le16_to_cpu(rfc.max_pdu_size);
 
@@ -2797,7 +2807,6 @@ static int l2cap_parse_conf_rsp(struct sock *sk, void *rsp, int len, void *data,
         if (*result == L2CAP_CONF_SUCCESS) {
                 switch (rfc.mode) {
                 case L2CAP_MODE_ERTM:
-                        pi->remote_tx_win   = rfc.txwin_size;
                         pi->retrans_timeout = le16_to_cpu(rfc.retrans_timeout);
                         pi->monitor_timeout = le16_to_cpu(rfc.monitor_timeout);
                         pi->mps    = le16_to_cpu(rfc.max_pdu_size);
@@ -2853,7 +2862,6 @@ static void l2cap_conf_rfc_get(struct sock *sk, void *rsp, int len)
 done:
         switch (rfc.mode) {
         case L2CAP_MODE_ERTM:
-                pi->remote_tx_win   = rfc.txwin_size;
                 pi->retrans_timeout = le16_to_cpu(rfc.retrans_timeout);
                 pi->monitor_timeout = le16_to_cpu(rfc.monitor_timeout);
                 pi->mps    = le16_to_cpu(rfc.max_pdu_size);
@@ -3339,6 +3347,15 @@ static inline int l2cap_information_rsp(struct l2cap_conn *conn, struct l2cap_cm
 
         del_timer(&conn->info_timer);
 
+        if (result != L2CAP_IR_SUCCESS) {
+                conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_DONE;
+                conn->info_ident = 0;
+
+                l2cap_conn_start(conn);
+
+                return 0;
+        }
+
         if (type == L2CAP_IT_FEAT_MASK) {
                 conn->feat_mask = get_unaligned_le32(rsp->data);
 
diff --git a/net/bluetooth/rfcomm/tty.c b/net/bluetooth/rfcomm/tty.c
index 026205c18b78..befc3a52aa04 100644
--- a/net/bluetooth/rfcomm/tty.c
+++ b/net/bluetooth/rfcomm/tty.c
@@ -1183,7 +1183,7 @@ int __init rfcomm_init_ttys(void)
         return 0;
 }
 
-void __exit rfcomm_cleanup_ttys(void)
+void rfcomm_cleanup_ttys(void)
 {
         tty_unregister_driver(rfcomm_tty_driver);
         put_tty_driver(rfcomm_tty_driver);
diff --git a/net/caif/cfpkt_skbuff.c b/net/caif/cfpkt_skbuff.c
index 01f238ff2346..c49a6695793a 100644
--- a/net/caif/cfpkt_skbuff.c
+++ b/net/caif/cfpkt_skbuff.c
@@ -9,7 +9,7 @@
 #include <linux/hardirq.h>
 #include <net/caif/cfpkt.h>
 
-#define PKT_PREFIX  16
+#define PKT_PREFIX  48
 #define PKT_POSTFIX 2
 #define PKT_LEN_WHEN_EXTENDING 128
 #define PKT_ERROR(pkt, errmsg) do {        \
diff --git a/net/can/bcm.c b/net/can/bcm.c
index 9c65e9deb9c3..08ffe9e4be20 100644
--- a/net/can/bcm.c
+++ b/net/can/bcm.c
@@ -60,6 +60,13 @@
 #include <net/sock.h>
 #include <net/net_namespace.h>
 
+/*
+ * To send multiple CAN frame content within TX_SETUP or to filter
+ * CAN messages with multiplex index within RX_SETUP, the number of
+ * different filters is limited to 256 due to the one byte index value.
+ */
+#define MAX_NFRAMES 256
+
 /* use of last_frames[index].can_dlc */
 #define RX_RECV    0x40 /* received data for this element */
 #define RX_THR     0x80 /* element not been sent due to throttle feature */
@@ -89,16 +96,16 @@ struct bcm_op {
         struct list_head list;
         int ifindex;
         canid_t can_id;
-        int flags;
+        u32 flags;
         unsigned long frames_abs, frames_filtered;
         struct timeval ival1, ival2;
         struct hrtimer timer, thrtimer;
         struct tasklet_struct tsklet, thrtsklet;
         ktime_t rx_stamp, kt_ival1, kt_ival2, kt_lastmsg;
         int rx_ifindex;
-        int count;
-        int nframes;
-        int currframe;
+        u32 count;
+        u32 nframes;
+        u32 currframe;
         struct can_frame *frames;
         struct can_frame *last_frames;
         struct can_frame sframe;
@@ -175,7 +182,7 @@ static int bcm_proc_show(struct seq_file *m, void *v)
 
                 seq_printf(m, "rx_op: %03X %-5s ",
                                 op->can_id, bcm_proc_getifname(ifname, op->ifindex));
-                seq_printf(m, "[%d]%c ", op->nframes,
+                seq_printf(m, "[%u]%c ", op->nframes,
                                 (op->flags & RX_CHECK_DLC)?'d':' ');
                 if (op->kt_ival1.tv64)
                         seq_printf(m, "timeo=%lld ",
@@ -198,7 +205,7 @@ static int bcm_proc_show(struct seq_file *m, void *v)
 
         list_for_each_entry(op, &bo->tx_ops, list) {
 
-                seq_printf(m, "tx_op: %03X %s [%d] ",
+                seq_printf(m, "tx_op: %03X %s [%u] ",
                                 op->can_id,
                                 bcm_proc_getifname(ifname, op->ifindex),
                                 op->nframes);
@@ -283,7 +290,7 @@ static void bcm_send_to_user(struct bcm_op *op, struct bcm_msg_head *head,
         struct can_frame *firstframe;
         struct sockaddr_can *addr;
         struct sock *sk = op->sk;
-        int datalen = head->nframes * CFSIZ;
+        unsigned int datalen = head->nframes * CFSIZ;
         int err;
 
         skb = alloc_skb(sizeof(*head) + datalen, gfp_any());
@@ -468,7 +475,7 @@ rx_changed_settime:
  * bcm_rx_cmp_to_index - (bit)compares the currently received data to formerly
  *                       received data stored in op->last_frames[]
  */
-static void bcm_rx_cmp_to_index(struct bcm_op *op, int index,
+static void bcm_rx_cmp_to_index(struct bcm_op *op, unsigned int index,
                                 const struct can_frame *rxdata)
 {
         /*
@@ -554,7 +561,8 @@ static enum hrtimer_restart bcm_rx_timeout_handler(struct hrtimer *hrtimer)
 /*
  * bcm_rx_do_flush - helper for bcm_rx_thr_flush
  */
-static inline int bcm_rx_do_flush(struct bcm_op *op, int update, int index)
+static inline int bcm_rx_do_flush(struct bcm_op *op, int update,
+                                  unsigned int index)
 {
         if ((op->last_frames) && (op->last_frames[index].can_dlc & RX_THR)) {
                 if (update)
@@ -575,7 +583,7 @@ static int bcm_rx_thr_flush(struct bcm_op *op, int update)
         int updated = 0;
 
         if (op->nframes > 1) {
-                int i;
+                unsigned int i;
 
                 /* for MUX filter we start at index 1 */
                 for (i = 1; i < op->nframes; i++)
@@ -624,7 +632,7 @@ static void bcm_rx_handler(struct sk_buff *skb, void *data)
 {
         struct bcm_op *op = (struct bcm_op *)data;
         const struct can_frame *rxframe = (struct can_frame *)skb->data;
-        int i;
+        unsigned int i;
 
         /* disable timeout */
         hrtimer_cancel(&op->timer);
@@ -822,14 +830,15 @@ static int bcm_tx_setup(struct bcm_msg_head *msg_head, struct msghdr *msg,
 {
         struct bcm_sock *bo = bcm_sk(sk);
         struct bcm_op *op;
-        int i, err;
+        unsigned int i;
+        int err;
 
         /* we need a real device to send frames */
         if (!ifindex)
                 return -ENODEV;
 
-        /* we need at least one can_frame */
-        if (msg_head->nframes < 1)
+        /* check nframes boundaries - we need at least one can_frame */
+        if (msg_head->nframes < 1 || msg_head->nframes > MAX_NFRAMES)
                 return -EINVAL;
 
         /* check the given can_id */
@@ -993,6 +1002,10 @@ static int bcm_rx_setup(struct bcm_msg_head *msg_head, struct msghdr *msg,
                 msg_head->nframes = 0;
         }
 
+        /* the first element contains the mux-mask => MAX_NFRAMES + 1  */
+        if (msg_head->nframes > MAX_NFRAMES + 1)
+                return -EINVAL;
+
         if ((msg_head->flags & RX_RTR_FRAME) &&
             ((msg_head->nframes != 1) ||
              (!(msg_head->can_id & CAN_RTR_FLAG))))
diff --git a/net/core/dev.c b/net/core/dev.c
index e1c1cdcc2bb0..1ae654391442 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -2517,6 +2517,7 @@ int netif_rx(struct sk_buff *skb)
                 struct rps_dev_flow voidflow, *rflow = &voidflow;
                 int cpu;
 
+                preempt_disable();
                 rcu_read_lock();
 
                 cpu = get_rps_cpu(skb->dev, skb, &rflow);
@@ -2526,6 +2527,7 @@ int netif_rx(struct sk_buff *skb)
                 ret = enqueue_to_backlog(skb, cpu, &rflow->last_qtail);
 
                 rcu_read_unlock();
+                preempt_enable();
         }
 #else
         {
@@ -3072,7 +3074,7 @@ enum gro_result dev_gro_receive(struct napi_struct *napi, struct sk_buff *skb)
         int mac_len;
         enum gro_result ret;
 
-        if (!(skb->dev->features & NETIF_F_GRO))
+        if (!(skb->dev->features & NETIF_F_GRO) || netpoll_rx_on(skb))
                 goto normal;
 
         if (skb_is_gso(skb) || skb_has_frags(skb))
@@ -3159,9 +3161,6 @@ __napi_gro_receive(struct napi_struct *napi, struct sk_buff *skb)
 {
         struct sk_buff *p;
 
-        if (netpoll_rx_on(skb))
-                return GRO_NORMAL;
-
         for (p = napi->gro_list; p; p = p->next) {
                 NAPI_GRO_CB(p)->same_flow =
                         (p->dev == skb->dev) &&
diff --git a/net/dns_resolver/dns_key.c b/net/dns_resolver/dns_key.c
index 400a04d5c9a1..739435a6af39 100644
--- a/net/dns_resolver/dns_key.c
+++ b/net/dns_resolver/dns_key.c
@@ -29,6 +29,7 @@
 #include <linux/kernel.h>
 #include <linux/keyctl.h>
 #include <linux/err.h>
+#include <linux/seq_file.h>
 #include <keys/dns_resolver-type.h>
 #include <keys/user-type.h>
 #include "internal.h"
@@ -43,6 +44,8 @@ MODULE_PARM_DESC(debug, "DNS Resolver debugging mask");
 
 const struct cred *dns_resolver_cache;
 
+#define DNS_ERRORNO_OPTION      "dnserror"
+
 /*
  * Instantiate a user defined key for dns_resolver.
  *
@@ -59,9 +62,10 @@ static int
 dns_resolver_instantiate(struct key *key, const void *_data, size_t datalen)
 {
         struct user_key_payload *upayload;
+        unsigned long derrno;
         int ret;
         size_t result_len = 0;
-        const char *data = _data, *opt;
+        const char *data = _data, *end, *opt;
 
         kenter("%%%d,%s,'%s',%zu",
                key->serial, key->description, data, datalen);
@@ -71,13 +75,77 @@ dns_resolver_instantiate(struct key *key, const void *_data, size_t datalen)
         datalen--;
 
         /* deal with any options embedded in the data */
+        end = data + datalen;
         opt = memchr(data, '#', datalen);
         if (!opt) {
-                kdebug("no options currently supported");
-                return -EINVAL;
+                /* no options: the entire data is the result */
+                kdebug("no options");
+                result_len = datalen;
+        } else {
+                const char *next_opt;
+
+                result_len = opt - data;
+                opt++;
+                kdebug("options: '%s'", opt);
+                do {
+                        const char *eq;
+                        int opt_len, opt_nlen, opt_vlen, tmp;
+
+                        next_opt = memchr(opt, '#', end - opt) ?: end;
+                        opt_len = next_opt - opt;
+                        if (!opt_len) {
+                                printk(KERN_WARNING
+                                       "Empty option to dns_resolver key %d\n",
+                                       key->serial);
+                                return -EINVAL;
+                        }
+
+                        eq = memchr(opt, '=', opt_len) ?: end;
+                        opt_nlen = eq - opt;
+                        eq++;
+                        opt_vlen = next_opt - eq; /* will be -1 if no value */
+
+                        tmp = opt_vlen >= 0 ? opt_vlen : 0;
+                        kdebug("option '%*.*s' val '%*.*s'",
+                               opt_nlen, opt_nlen, opt, tmp, tmp, eq);
+
+                        /* see if it's an error number representing a DNS error
+                         * that's to be recorded as the result in this key */
+                        if (opt_nlen == sizeof(DNS_ERRORNO_OPTION) - 1 &&
+                            memcmp(opt, DNS_ERRORNO_OPTION, opt_nlen) == 0) {
+                                kdebug("dns error number option");
+                                if (opt_vlen <= 0)
+                                        goto bad_option_value;
+
+                                ret = strict_strtoul(eq, 10, &derrno);
+                                if (ret < 0)
+                                        goto bad_option_value;
+
+                                if (derrno < 1 || derrno > 511)
+                                        goto bad_option_value;
+
+                                kdebug("dns error no. = %lu", derrno);
+                                key->type_data.x[0] = -derrno;
+                                continue;
+                        }
+
+                bad_option_value:
+                        printk(KERN_WARNING
+                               "Option '%*.*s' to dns_resolver key %d:"
+                               " bad/missing value\n",
+                               opt_nlen, opt_nlen, opt, key->serial);
+                        return -EINVAL;
+                } while (opt = next_opt + 1, opt < end);
+        }
+
+        /* don't cache the result if we're caching an error saying there's no
+         * result */
+        if (key->type_data.x[0]) {
+                kleave(" = 0 [h_error %ld]", key->type_data.x[0]);
+                return 0;
         }
 
-        result_len = datalen;
+        kdebug("store result");
         ret = key_payload_reserve(key, result_len);
         if (ret < 0)
                 return -EINVAL;
@@ -135,13 +203,27 @@ no_match:
         return ret;
 }
 
+/*
+ * Describe a DNS key
+ */
+static void dns_resolver_describe(const struct key *key, struct seq_file *m)
+{
+        int err = key->type_data.x[0];
+
+        seq_puts(m, key->description);
+        if (err)
+                seq_printf(m, ": %d", err);
+        else
+                seq_printf(m, ": %u", key->datalen);
+}
+
 struct key_type key_type_dns_resolver = {
         .name           = "dns_resolver",
         .instantiate    = dns_resolver_instantiate,
         .match          = dns_resolver_match,
         .revoke         = user_revoke,
         .destroy        = user_destroy,
-        .describe       = user_describe,
+        .describe       = dns_resolver_describe,
         .read           = user_read,
 };
 
diff --git a/net/dns_resolver/dns_query.c b/net/dns_resolver/dns_query.c
index 03d5255f5cf2..c32be292c7e3 100644
--- a/net/dns_resolver/dns_query.c
+++ b/net/dns_resolver/dns_query.c
@@ -136,6 +136,11 @@ int dns_query(const char *type, const char *name, size_t namelen,
         if (ret < 0)
                 goto put;
 
+        /* If the DNS server gave an error, return that to the caller */
+        ret = rkey->type_data.x[0];
+        if (ret)
+                goto put;
+
         upayload = rcu_dereference_protected(rkey->payload.data,
                                              lockdep_is_held(&rkey->sem));
         len = upayload->datalen;
diff --git a/net/dsa/Kconfig b/net/dsa/Kconfig
index 11201784d29a..87bb5f4de0e8 100644
--- a/net/dsa/Kconfig
+++ b/net/dsa/Kconfig
@@ -1,7 +1,7 @@
 menuconfig NET_DSA
         bool "Distributed Switch Architecture support"
         default n
-        depends on EXPERIMENTAL && NET_ETHERNET && !S390
+        depends on EXPERIMENTAL && NETDEVICES && !S390
         select PHYLIB
         ---help---
           This allows you to use hardware switch chips that use
diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
index 3c426cb318e7..e663b78a2ef6 100644
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -3930,7 +3930,7 @@ u8 *tcp_parse_md5sig_option(struct tcphdr *th)
                         if (opsize < 2 || opsize > length)
                                 return NULL;
                         if (opcode == TCPOPT_MD5SIG)
-                                return ptr;
+                                return opsize == TCPOLEN_MD5SIG ? ptr : NULL;
                 }
                 ptr += opsize - 2;
                 length -= opsize;
diff --git a/net/irda/irnet/irnet_ppp.c b/net/irda/irnet/irnet_ppp.c
index 800bc53b7f63..dfe7b38dd4af 100644
--- a/net/irda/irnet/irnet_ppp.c
+++ b/net/irda/irnet/irnet_ppp.c
@@ -20,7 +20,7 @@
 /* Please put other headers in irnet.h - Thanks */
 
 /* Generic PPP callbacks (to call us) */
-static struct ppp_channel_ops irnet_ppp_ops = {
+static const struct ppp_channel_ops irnet_ppp_ops = {
         .start_xmit = ppp_irnet_send,
         .ioctl = ppp_irnet_ioctl
 };
diff --git a/net/l2tp/l2tp_ppp.c b/net/l2tp/l2tp_ppp.c
index 90d82b3f2889..ff954b3e94b6 100644
--- a/net/l2tp/l2tp_ppp.c
+++ b/net/l2tp/l2tp_ppp.c
@@ -135,7 +135,10 @@ struct pppol2tp_session {
 
 static int pppol2tp_xmit(struct ppp_channel *chan, struct sk_buff *skb);
 
-static struct ppp_channel_ops pppol2tp_chan_ops = { pppol2tp_xmit , NULL };
+static const struct ppp_channel_ops pppol2tp_chan_ops = {
+        .start_xmit =  pppol2tp_xmit,
+};
+
 static const struct proto_ops pppol2tp_ops;
 
 /* Helpers to obtain tunnel/session contexts from sockets.
diff --git a/net/mac80211/main.c b/net/mac80211/main.c
index 7cc4f913a431..798a91b100cc 100644
--- a/net/mac80211/main.c
+++ b/net/mac80211/main.c
@@ -685,10 +685,12 @@ int ieee80211_register_hw(struct ieee80211_hw *hw)
 
         return 0;
 
+#ifdef CONFIG_INET
  fail_ifa:
         pm_qos_remove_notifier(PM_QOS_NETWORK_LATENCY,
                                &local->network_latency_notifier);
         rtnl_lock();
+#endif
  fail_pm_qos:
         ieee80211_led_exit(local);
         ieee80211_remove_interfaces(local);
diff --git a/net/mac80211/rate.c b/net/mac80211/rate.c
index 6d0bd198af19..be04d46110fe 100644
--- a/net/mac80211/rate.c
+++ b/net/mac80211/rate.c
@@ -103,6 +103,7 @@ ieee80211_rate_control_ops_get(const char *name)
         struct rate_control_ops *ops;
         const char *alg_name;
 
+        kparam_block_sysfs_write(ieee80211_default_rc_algo);
         if (!name)
                 alg_name = ieee80211_default_rc_algo;
         else
@@ -120,6 +121,7 @@ ieee80211_rate_control_ops_get(const char *name)
         /* try built-in one if specific alg requested but not found */
         if (!ops && strlen(CONFIG_MAC80211_RC_DEFAULT))
                 ops = ieee80211_try_rate_control_ops_get(CONFIG_MAC80211_RC_DEFAULT);
+        kparam_unblock_sysfs_write(ieee80211_default_rc_algo);
 
         return ops;
 }
diff --git a/net/mac80211/scan.c b/net/mac80211/scan.c
index 41f20fb7e670..872d7b6ef6b3 100644
--- a/net/mac80211/scan.c
+++ b/net/mac80211/scan.c
@@ -400,19 +400,7 @@ static int __ieee80211_start_scan(struct ieee80211_sub_if_data *sdata,
         else
                 __set_bit(SCAN_SW_SCANNING, &local->scanning);
 
-        /*
-         * Kicking off the scan need not be protected,
-         * only the scan variable stuff, since now
-         * local->scan_req is assigned and other callers
-         * will abort their scan attempts.
-         *
-         * This avoids too many locking dependencies
-         * so that the scan completed calls have more
-         * locking freedom.
-         */
-
         ieee80211_recalc_idle(local);
-        mutex_unlock(&local->scan_mtx);
 
         if (local->ops->hw_scan) {
                 WARN_ON(!ieee80211_prep_hw_scan(local));
@@ -420,8 +408,6 @@ static int __ieee80211_start_scan(struct ieee80211_sub_if_data *sdata,
         } else
                 rc = ieee80211_start_sw_scan(local);
 
-        mutex_lock(&local->scan_mtx);
-
         if (rc) {
                 kfree(local->hw_scan_req);
                 local->hw_scan_req = NULL;
diff --git a/net/rxrpc/ar-ack.c b/net/rxrpc/ar-ack.c
index 2714da167fb8..b6ffe4e1b84a 100644
--- a/net/rxrpc/ar-ack.c
+++ b/net/rxrpc/ar-ack.c
@@ -245,6 +245,9 @@ static void rxrpc_resend_timer(struct rxrpc_call *call)
         _enter("%d,%d,%d",
                call->acks_tail, call->acks_unacked, call->acks_head);
 
+        if (call->state >= RXRPC_CALL_COMPLETE)
+                return;
+
         resend = 0;
         resend_at = 0;
 
diff --git a/net/rxrpc/ar-call.c b/net/rxrpc/ar-call.c
index 909d092de9f4..bf656c230ba9 100644
--- a/net/rxrpc/ar-call.c
+++ b/net/rxrpc/ar-call.c
@@ -786,6 +786,7 @@ static void rxrpc_call_life_expired(unsigned long _call)
 
 /*
  * handle resend timer expiry
+ * - may not take call->state_lock as this can deadlock against del_timer_sync()
  */
 static void rxrpc_resend_time_expired(unsigned long _call)
 {
@@ -796,12 +797,9 @@ static void rxrpc_resend_time_expired(unsigned long _call)
         if (call->state >= RXRPC_CALL_COMPLETE)
                 return;
 
-        read_lock_bh(&call->state_lock);
         clear_bit(RXRPC_CALL_RUN_RTIMER, &call->flags);
-        if (call->state < RXRPC_CALL_COMPLETE &&
-            !test_and_set_bit(RXRPC_CALL_RESEND_TIMER, &call->events))
+        if (!test_and_set_bit(RXRPC_CALL_RESEND_TIMER, &call->events))
                 rxrpc_queue_call(call);
-        read_unlock_bh(&call->state_lock);
 }
 
 /*
diff --git a/net/rxrpc/ar-internal.h b/net/rxrpc/ar-internal.h
index 7043b294bb67..8e22bd345e71 100644
--- a/net/rxrpc/ar-internal.h
+++ b/net/rxrpc/ar-internal.h
@@ -597,12 +597,6 @@ extern unsigned rxrpc_debug;
 #define dbgprintk(FMT,...) \
         printk("[%-6.6s] "FMT"\n", current->comm ,##__VA_ARGS__)
 
-/* make sure we maintain the format strings, even when debugging is disabled */
-static inline __attribute__((format(printf,1,2)))
-void _dbprintk(const char *fmt, ...)
-{
-}
-
 #define kenter(FMT,...) dbgprintk("==> %s("FMT")",__func__ ,##__VA_ARGS__)
 #define kleave(FMT,...) dbgprintk("<== %s()"FMT"",__func__ ,##__VA_ARGS__)
 #define kdebug(FMT,...) dbgprintk("    "FMT ,##__VA_ARGS__)
@@ -655,11 +649,11 @@ do {							\
 } while (0)
 
 #else
-#define _enter(FMT,...) _dbprintk("==> %s("FMT")",__func__ ,##__VA_ARGS__)
-#define _leave(FMT,...) _dbprintk("<== %s()"FMT"",__func__ ,##__VA_ARGS__)
-#define _debug(FMT,...) _dbprintk("    "FMT ,##__VA_ARGS__)
-#define _proto(FMT,...) _dbprintk("### "FMT ,##__VA_ARGS__)
-#define _net(FMT,...)   _dbprintk("@@@ "FMT ,##__VA_ARGS__)
+#define _enter(FMT,...) no_printk("==> %s("FMT")",__func__ ,##__VA_ARGS__)
+#define _leave(FMT,...) no_printk("<== %s()"FMT"",__func__ ,##__VA_ARGS__)
+#define _debug(FMT,...) no_printk("    "FMT ,##__VA_ARGS__)
+#define _proto(FMT,...) no_printk("### "FMT ,##__VA_ARGS__)
+#define _net(FMT,...)   no_printk("@@@ "FMT ,##__VA_ARGS__)
 #endif
 
 /*
diff --git a/net/sched/act_nat.c b/net/sched/act_nat.c
index d0386a413e8d..509a2d53a99d 100644
--- a/net/sched/act_nat.c
+++ b/net/sched/act_nat.c
@@ -114,6 +114,7 @@ static int tcf_nat(struct sk_buff *skb, struct tc_action *a,
         int egress;
         int action;
         int ihl;
+        int noff;
 
         spin_lock(&p->tcf_lock);
 
@@ -132,7 +133,8 @@ static int tcf_nat(struct sk_buff *skb, struct tc_action *a,
         if (unlikely(action == TC_ACT_SHOT))
                 goto drop;
 
-        if (!pskb_may_pull(skb, sizeof(*iph)))
+        noff = skb_network_offset(skb);
+        if (!pskb_may_pull(skb, sizeof(*iph) + noff))
                 goto drop;
 
         iph = ip_hdr(skb);
@@ -144,7 +146,7 @@ static int tcf_nat(struct sk_buff *skb, struct tc_action *a,
 
         if (!((old_addr ^ addr) & mask)) {
                 if (skb_cloned(skb) &&
-                    !skb_clone_writable(skb, sizeof(*iph)) &&
+                    !skb_clone_writable(skb, sizeof(*iph) + noff) &&
                     pskb_expand_head(skb, 0, 0, GFP_ATOMIC))
                         goto drop;
 
@@ -172,9 +174,9 @@ static int tcf_nat(struct sk_buff *skb, struct tc_action *a,
         {
                 struct tcphdr *tcph;
 
-                if (!pskb_may_pull(skb, ihl + sizeof(*tcph)) ||
+                if (!pskb_may_pull(skb, ihl + sizeof(*tcph) + noff) ||
                     (skb_cloned(skb) &&
-                     !skb_clone_writable(skb, ihl + sizeof(*tcph)) &&
+                     !skb_clone_writable(skb, ihl + sizeof(*tcph) + noff) &&
                      pskb_expand_head(skb, 0, 0, GFP_ATOMIC)))
                         goto drop;
 
@@ -186,9 +188,9 @@ static int tcf_nat(struct sk_buff *skb, struct tc_action *a,
         {
                 struct udphdr *udph;
 
-                if (!pskb_may_pull(skb, ihl + sizeof(*udph)) ||
+                if (!pskb_may_pull(skb, ihl + sizeof(*udph) + noff) ||
                     (skb_cloned(skb) &&
-                     !skb_clone_writable(skb, ihl + sizeof(*udph)) &&
+                     !skb_clone_writable(skb, ihl + sizeof(*udph) + noff) &&
                      pskb_expand_head(skb, 0, 0, GFP_ATOMIC)))
                         goto drop;
 
@@ -205,7 +207,7 @@ static int tcf_nat(struct sk_buff *skb, struct tc_action *a,
         {
                 struct icmphdr *icmph;
 
-                if (!pskb_may_pull(skb, ihl + sizeof(*icmph)))
+                if (!pskb_may_pull(skb, ihl + sizeof(*icmph) + noff))
                         goto drop;
 
                 icmph = (void *)(skb_network_header(skb) + ihl);
@@ -215,7 +217,8 @@ static int tcf_nat(struct sk_buff *skb, struct tc_action *a,
                     (icmph->type != ICMP_PARAMETERPROB))
                         break;
 
-                if (!pskb_may_pull(skb, ihl + sizeof(*icmph) + sizeof(*iph)))
+                if (!pskb_may_pull(skb, ihl + sizeof(*icmph) + sizeof(*iph) +
+                                        noff))
                         goto drop;
 
                 icmph = (void *)(skb_network_header(skb) + ihl);
@@ -229,8 +232,8 @@ static int tcf_nat(struct sk_buff *skb, struct tc_action *a,
                         break;
 
                 if (skb_cloned(skb) &&
-                    !skb_clone_writable(skb,
-                                        ihl + sizeof(*icmph) + sizeof(*iph)) &&
+                    !skb_clone_writable(skb, ihl + sizeof(*icmph) +
+                                             sizeof(*iph) + noff) &&
                     pskb_expand_head(skb, 0, 0, GFP_ATOMIC))
                         goto drop;
 
diff --git a/net/sched/cls_flow.c b/net/sched/cls_flow.c
index f73542d2cdd0..e17096e3913c 100644
--- a/net/sched/cls_flow.c
+++ b/net/sched/cls_flow.c
@@ -65,37 +65,47 @@ static inline u32 addr_fold(void *addr)
         return (a & 0xFFFFFFFF) ^ (BITS_PER_LONG > 32 ? a >> 32 : 0);
 }
 
-static u32 flow_get_src(const struct sk_buff *skb)
+static u32 flow_get_src(struct sk_buff *skb)
 {
         switch (skb->protocol) {
         case htons(ETH_P_IP):
-                return ntohl(ip_hdr(skb)->saddr);
+                if (pskb_network_may_pull(skb, sizeof(struct iphdr)))
+                        return ntohl(ip_hdr(skb)->saddr);
+                break;
         case htons(ETH_P_IPV6):
-                return ntohl(ipv6_hdr(skb)->saddr.s6_addr32[3]);
-        default:
-                return addr_fold(skb->sk);
+                if (pskb_network_may_pull(skb, sizeof(struct ipv6hdr)))
+                        return ntohl(ipv6_hdr(skb)->saddr.s6_addr32[3]);
+                break;
         }
+
+        return addr_fold(skb->sk);
 }
 
-static u32 flow_get_dst(const struct sk_buff *skb)
+static u32 flow_get_dst(struct sk_buff *skb)
 {
         switch (skb->protocol) {
         case htons(ETH_P_IP):
-                return ntohl(ip_hdr(skb)->daddr);
+                if (pskb_network_may_pull(skb, sizeof(struct iphdr)))
+                        return ntohl(ip_hdr(skb)->daddr);
+                break;
         case htons(ETH_P_IPV6):
-                return ntohl(ipv6_hdr(skb)->daddr.s6_addr32[3]);
-        default:
-                return addr_fold(skb_dst(skb)) ^ (__force u16)skb->protocol;
+                if (pskb_network_may_pull(skb, sizeof(struct ipv6hdr)))
+                        return ntohl(ipv6_hdr(skb)->daddr.s6_addr32[3]);
+                break;
         }
+
+        return addr_fold(skb_dst(skb)) ^ (__force u16)skb->protocol;
 }
 
-static u32 flow_get_proto(const struct sk_buff *skb)
+static u32 flow_get_proto(struct sk_buff *skb)
 {
         switch (skb->protocol) {
         case htons(ETH_P_IP):
-                return ip_hdr(skb)->protocol;
+                return pskb_network_may_pull(skb, sizeof(struct iphdr)) ?
+                       ip_hdr(skb)->protocol : 0;
         case htons(ETH_P_IPV6):
-                return ipv6_hdr(skb)->nexthdr;
+                return pskb_network_may_pull(skb, sizeof(struct ipv6hdr)) ?
+                       ipv6_hdr(skb)->nexthdr : 0;
         default:
                 return 0;
         }
@@ -116,58 +126,64 @@ static int has_ports(u8 protocol)
         }
 }
 
-static u32 flow_get_proto_src(const struct sk_buff *skb)
+static u32 flow_get_proto_src(struct sk_buff *skb)
 {
-        u32 res = 0;
-
         switch (skb->protocol) {
         case htons(ETH_P_IP): {
-                struct iphdr *iph = ip_hdr(skb);
+                struct iphdr *iph;
 
+                if (!pskb_network_may_pull(skb, sizeof(*iph)))
+                        break;
+                iph = ip_hdr(skb);
                 if (!(iph->frag_off&htons(IP_MF|IP_OFFSET)) &&
-                    has_ports(iph->protocol))
-                        res = ntohs(*(__be16 *)((void *)iph + iph->ihl * 4));
+                    has_ports(iph->protocol) &&
+                    pskb_network_may_pull(skb, iph->ihl * 4 + 2))
+                        return ntohs(*(__be16 *)((void *)iph + iph->ihl * 4));
                 break;
         }
         case htons(ETH_P_IPV6): {
-                struct ipv6hdr *iph = ipv6_hdr(skb);
+                struct ipv6hdr *iph;
 
+                if (!pskb_network_may_pull(skb, sizeof(*iph) + 2))
+                        break;
+                iph = ipv6_hdr(skb);
                 if (has_ports(iph->nexthdr))
-                        res = ntohs(*(__be16 *)&iph[1]);
+                        return ntohs(*(__be16 *)&iph[1]);
                 break;
         }
-        default:
-                res = addr_fold(skb->sk);
         }
 
-        return res;
+        return addr_fold(skb->sk);
 }
 
-static u32 flow_get_proto_dst(const struct sk_buff *skb)
+static u32 flow_get_proto_dst(struct sk_buff *skb)
 {
-        u32 res = 0;
-
         switch (skb->protocol) {
         case htons(ETH_P_IP): {
-                struct iphdr *iph = ip_hdr(skb);
+                struct iphdr *iph;
 
+                if (!pskb_network_may_pull(skb, sizeof(*iph)))
+                        break;
+                iph = ip_hdr(skb);
                 if (!(iph->frag_off&htons(IP_MF|IP_OFFSET)) &&
-                    has_ports(iph->protocol))
-                        res = ntohs(*(__be16 *)((void *)iph + iph->ihl * 4 + 2));
+                    has_ports(iph->protocol) &&
+                    pskb_network_may_pull(skb, iph->ihl * 4 + 4))
+                        return ntohs(*(__be16 *)((void *)iph + iph->ihl * 4 + 2));
                 break;
         }
         case htons(ETH_P_IPV6): {
-                struct ipv6hdr *iph = ipv6_hdr(skb);
+                struct ipv6hdr *iph;
 
+                if (!pskb_network_may_pull(skb, sizeof(*iph) + 4))
+                        break;
+                iph = ipv6_hdr(skb);
                 if (has_ports(iph->nexthdr))
-                        res = ntohs(*(__be16 *)((void *)&iph[1] + 2));
+                        return ntohs(*(__be16 *)((void *)&iph[1] + 2));
                 break;
         }
-        default:
-                res = addr_fold(skb_dst(skb)) ^ (__force u16)skb->protocol;
         }
 
-        return res;
+        return addr_fold(skb_dst(skb)) ^ (__force u16)skb->protocol;
 }
 
 static u32 flow_get_iif(const struct sk_buff *skb)
@@ -211,7 +227,7 @@ static u32 flow_get_nfct(const struct sk_buff *skb)
 })
 #endif
 
-static u32 flow_get_nfct_src(const struct sk_buff *skb)
+static u32 flow_get_nfct_src(struct sk_buff *skb)
 {
         switch (skb->protocol) {
         case htons(ETH_P_IP):
@@ -223,7 +239,7 @@ fallback:
         return flow_get_src(skb);
 }
 
-static u32 flow_get_nfct_dst(const struct sk_buff *skb)
+static u32 flow_get_nfct_dst(struct sk_buff *skb)
 {
         switch (skb->protocol) {
         case htons(ETH_P_IP):
@@ -235,14 +251,14 @@ fallback:
         return flow_get_dst(skb);
 }
 
-static u32 flow_get_nfct_proto_src(const struct sk_buff *skb)
+static u32 flow_get_nfct_proto_src(struct sk_buff *skb)
 {
         return ntohs(CTTUPLE(skb, src.u.all));
 fallback:
         return flow_get_proto_src(skb);
 }
 
-static u32 flow_get_nfct_proto_dst(const struct sk_buff *skb)
+static u32 flow_get_nfct_proto_dst(struct sk_buff *skb)
 {
         return ntohs(CTTUPLE(skb, dst.u.all));
 fallback:
@@ -281,7 +297,7 @@ static u32 flow_get_vlan_tag(const struct sk_buff *skb)
         return tag & VLAN_VID_MASK;
 }
 
-static u32 flow_key_get(const struct sk_buff *skb, int key)
+static u32 flow_key_get(struct sk_buff *skb, int key)
 {
         switch (key) {
         case FLOW_KEY_SRC:
diff --git a/net/sched/cls_rsvp.h b/net/sched/cls_rsvp.h
index dd9414e44200..425a1790b048 100644
--- a/net/sched/cls_rsvp.h
+++ b/net/sched/cls_rsvp.h
@@ -143,9 +143,17 @@ static int rsvp_classify(struct sk_buff *skb, struct tcf_proto *tp,
         u8 tunnelid = 0;
         u8 *xprt;
 #if RSVP_DST_LEN == 4
-        struct ipv6hdr *nhptr = ipv6_hdr(skb);
+        struct ipv6hdr *nhptr;
+
+        if (!pskb_network_may_pull(skb, sizeof(*nhptr)))
+                return -1;
+        nhptr = ipv6_hdr(skb);
 #else
-        struct iphdr *nhptr = ip_hdr(skb);
+        struct iphdr *nhptr;
+
+        if (!pskb_network_may_pull(skb, sizeof(*nhptr)))
+                return -1;
+        nhptr = ip_hdr(skb);
 #endif
 
 restart:
diff --git a/net/sched/sch_api.c b/net/sched/sch_api.c
index b9e8c3b7d406..408eea7086aa 100644
--- a/net/sched/sch_api.c
+++ b/net/sched/sch_api.c
@@ -150,22 +150,34 @@ int register_qdisc(struct Qdisc_ops *qops)
         if (qops->enqueue == NULL)
                 qops->enqueue = noop_qdisc_ops.enqueue;
         if (qops->peek == NULL) {
-                if (qops->dequeue == NULL) {
+                if (qops->dequeue == NULL)
                         qops->peek = noop_qdisc_ops.peek;
-                } else {
-                        rc = -EINVAL;
-                        goto out;
-                }
+                else
+                        goto out_einval;
         }
         if (qops->dequeue == NULL)
                 qops->dequeue = noop_qdisc_ops.dequeue;
 
+        if (qops->cl_ops) {
+                const struct Qdisc_class_ops *cops = qops->cl_ops;
+
+                if (!(cops->get && cops->put && cops->walk && cops->leaf))
+                        goto out_einval;
+
+                if (cops->tcf_chain && !(cops->bind_tcf && cops->unbind_tcf))
+                        goto out_einval;
+        }
+
         qops->next = NULL;
         *qp = qops;
         rc = 0;
 out:
         write_unlock(&qdisc_mod_lock);
         return rc;
+
+out_einval:
+        rc = -EINVAL;
+        goto out;
 }
 EXPORT_SYMBOL(register_qdisc);
 
diff --git a/net/sched/sch_atm.c b/net/sched/sch_atm.c
index e114f23d5eae..340662789529 100644
--- a/net/sched/sch_atm.c
+++ b/net/sched/sch_atm.c
@@ -418,7 +418,7 @@ static int atm_tc_enqueue(struct sk_buff *skb, struct Qdisc *sch)
         }
 
         ret = qdisc_enqueue(skb, flow->q);
-        if (ret != 0) {
+        if (ret != NET_XMIT_SUCCESS) {
 drop: __maybe_unused
                 if (net_xmit_drop_count(ret)) {
                         sch->qstats.drops++;
@@ -442,7 +442,7 @@ drop: __maybe_unused
          */
         if (flow == &p->link) {
                 sch->q.qlen++;
-                return 0;
+                return NET_XMIT_SUCCESS;
         }
         tasklet_schedule(&p->task);
         return NET_XMIT_SUCCESS | __NET_XMIT_BYPASS;
diff --git a/net/sched/sch_sfq.c b/net/sched/sch_sfq.c
index c65762823f5e..201cbac2b32c 100644
--- a/net/sched/sch_sfq.c
+++ b/net/sched/sch_sfq.c
@@ -122,7 +122,11 @@ static unsigned sfq_hash(struct sfq_sched_data *q, struct sk_buff *skb)
         switch (skb->protocol) {
         case htons(ETH_P_IP):
         {
-                const struct iphdr *iph = ip_hdr(skb);
+                const struct iphdr *iph;
+
+                if (!pskb_network_may_pull(skb, sizeof(*iph)))
+                        goto err;
+                iph = ip_hdr(skb);
                 h = (__force u32)iph->daddr;
                 h2 = (__force u32)iph->saddr ^ iph->protocol;
                 if (!(iph->frag_off&htons(IP_MF|IP_OFFSET)) &&
@@ -131,25 +135,32 @@ static unsigned sfq_hash(struct sfq_sched_data *q, struct sk_buff *skb)
                      iph->protocol == IPPROTO_UDPLITE ||
                      iph->protocol == IPPROTO_SCTP ||
                      iph->protocol == IPPROTO_DCCP ||
-                     iph->protocol == IPPROTO_ESP))
+                     iph->protocol == IPPROTO_ESP) &&
+                     pskb_network_may_pull(skb, iph->ihl * 4 + 4))
                         h2 ^= *(((u32*)iph) + iph->ihl);
                 break;
         }
         case htons(ETH_P_IPV6):
         {
-                struct ipv6hdr *iph = ipv6_hdr(skb);
+                struct ipv6hdr *iph;
+
+                if (!pskb_network_may_pull(skb, sizeof(*iph)))
+                        goto err;
+                iph = ipv6_hdr(skb);
                 h = (__force u32)iph->daddr.s6_addr32[3];
                 h2 = (__force u32)iph->saddr.s6_addr32[3] ^ iph->nexthdr;
-                if (iph->nexthdr == IPPROTO_TCP ||
-                    iph->nexthdr == IPPROTO_UDP ||
-                    iph->nexthdr == IPPROTO_UDPLITE ||
-                    iph->nexthdr == IPPROTO_SCTP ||
-                    iph->nexthdr == IPPROTO_DCCP ||
-                    iph->nexthdr == IPPROTO_ESP)
+                if ((iph->nexthdr == IPPROTO_TCP ||
+                     iph->nexthdr == IPPROTO_UDP ||
+                     iph->nexthdr == IPPROTO_UDPLITE ||
+                     iph->nexthdr == IPPROTO_SCTP ||
+                     iph->nexthdr == IPPROTO_DCCP ||
+                     iph->nexthdr == IPPROTO_ESP) &&
+                    pskb_network_may_pull(skb, sizeof(*iph) + 4))
                         h2 ^= *(u32*)&iph[1];
                 break;
         }
         default:
+err:
                 h = (unsigned long)skb_dst(skb) ^ (__force u32)skb->protocol;
                 h2 = (unsigned long)skb->sk;
         }
@@ -323,7 +334,7 @@ sfq_enqueue(struct sk_buff *skb, struct Qdisc *sch)
         if (++sch->q.qlen <= q->limit) {
                 sch->bstats.bytes += qdisc_pkt_len(skb);
                 sch->bstats.packets++;
-                return 0;
+                return NET_XMIT_SUCCESS;
         }
 
         sfq_drop(sch);
@@ -497,11 +508,26 @@ nla_put_failure:
         return -1;
 }
 
+static struct Qdisc *sfq_leaf(struct Qdisc *sch, unsigned long arg)
+{
+        return NULL;
+}
+
 static unsigned long sfq_get(struct Qdisc *sch, u32 classid)
 {
         return 0;
 }
 
+static unsigned long sfq_bind(struct Qdisc *sch, unsigned long parent,
+                              u32 classid)
+{
+        return 0;
+}
+
+static void sfq_put(struct Qdisc *q, unsigned long cl)
+{
+}
+
 static struct tcf_proto **sfq_find_tcf(struct Qdisc *sch, unsigned long cl)
 {
         struct sfq_sched_data *q = qdisc_priv(sch);
@@ -554,8 +580,12 @@ static void sfq_walk(struct Qdisc *sch, struct qdisc_walker *arg)
 }
 
 static const struct Qdisc_class_ops sfq_class_ops = {
+        .leaf           =       sfq_leaf,
         .get            =       sfq_get,
+        .put            =       sfq_put,
         .tcf_chain      =       sfq_find_tcf,
+        .bind_tcf       =       sfq_bind,
+        .unbind_tcf     =       sfq_put,
         .dump           =       sfq_dump_class,
         .dump_stats     =       sfq_dump_class_stats,
         .walk           =       sfq_walk,
diff --git a/net/sched/sch_tbf.c b/net/sched/sch_tbf.c
index 0991c640cd3e..641a30d64635 100644
--- a/net/sched/sch_tbf.c
+++ b/net/sched/sch_tbf.c
@@ -127,7 +127,7 @@ static int tbf_enqueue(struct sk_buff *skb, struct Qdisc* sch)
                 return qdisc_reshape_fail(skb, sch);
 
         ret = qdisc_enqueue(skb, q->qdisc);
-        if (ret != 0) {
+        if (ret != NET_XMIT_SUCCESS) {
                 if (net_xmit_drop_count(ret))
                         sch->qstats.drops++;
                 return ret;
@@ -136,7 +136,7 @@ static int tbf_enqueue(struct sk_buff *skb, struct Qdisc* sch)
         sch->q.qlen++;
         sch->bstats.bytes += qdisc_pkt_len(skb);
         sch->bstats.packets++;
-        return 0;
+        return NET_XMIT_SUCCESS;
 }
 
 static unsigned int tbf_drop(struct Qdisc* sch)
diff --git a/net/sched/sch_teql.c b/net/sched/sch_teql.c
index 807643bdcbac..feaabc103ce6 100644
--- a/net/sched/sch_teql.c
+++ b/net/sched/sch_teql.c
@@ -85,7 +85,7 @@ teql_enqueue(struct sk_buff *skb, struct Qdisc* sch)
                 __skb_queue_tail(&q->q, skb);
                 sch->bstats.bytes += qdisc_pkt_len(skb);
                 sch->bstats.packets++;
-                return 0;
+                return NET_XMIT_SUCCESS;
         }
 
         kfree_skb(skb);
diff --git a/net/sunrpc/auth.c b/net/sunrpc/auth.c
index 880d0de3f50f..36cb66022a27 100644
--- a/net/sunrpc/auth.c
+++ b/net/sunrpc/auth.c
@@ -39,7 +39,7 @@ static LIST_HEAD(cred_unused);
 static unsigned long number_cred_unused;
 
 #define MAX_HASHTABLE_BITS (10) 
-static int param_set_hashtbl_sz(const char *val, struct kernel_param *kp)
+static int param_set_hashtbl_sz(const char *val, const struct kernel_param *kp)
 {
         unsigned long num;
         unsigned int nbits;
@@ -61,7 +61,7 @@ out_inval:
         return -EINVAL;
 }
 
-static int param_get_hashtbl_sz(char *buffer, struct kernel_param *kp)
+static int param_get_hashtbl_sz(char *buffer, const struct kernel_param *kp)
 {
         unsigned int nbits;
 
@@ -71,6 +71,11 @@ static int param_get_hashtbl_sz(char *buffer, struct kernel_param *kp)
 
 #define param_check_hashtbl_sz(name, p) __param_check(name, p, unsigned int);
 
+static struct kernel_param_ops param_ops_hashtbl_sz = {
+        .set = param_set_hashtbl_sz,
+        .get = param_get_hashtbl_sz,
+};
+
 module_param_named(auth_hashtable_size, auth_hashbits, hashtbl_sz, 0644);
 MODULE_PARM_DESC(auth_hashtable_size, "RPC credential cache hashtable size");
 
diff --git a/net/sunrpc/xprtsock.c b/net/sunrpc/xprtsock.c
index 7ca65c7005ea..49a62f0c4b87 100644
--- a/net/sunrpc/xprtsock.c
+++ b/net/sunrpc/xprtsock.c
@@ -2577,7 +2577,8 @@ void cleanup_socket_xprt(void)
         xprt_unregister_transport(&xs_bc_tcp_transport);
 }
 
-static int param_set_uint_minmax(const char *val, struct kernel_param *kp,
+static int param_set_uint_minmax(const char *val,
+                const struct kernel_param *kp,
                 unsigned int min, unsigned int max)
 {
         unsigned long num;
@@ -2592,34 +2593,37 @@ static int param_set_uint_minmax(const char *val, struct kernel_param *kp,
         return 0;
 }
 
-static int param_set_portnr(const char *val, struct kernel_param *kp)
+static int param_set_portnr(const char *val, const struct kernel_param *kp)
 {
         return param_set_uint_minmax(val, kp,
                         RPC_MIN_RESVPORT,
                         RPC_MAX_RESVPORT);
 }
 
-static int param_get_portnr(char *buffer, struct kernel_param *kp)
-{
-        return param_get_uint(buffer, kp);
-}
+static struct kernel_param_ops param_ops_portnr = {
+        .set = param_set_portnr,
+        .get = param_get_uint,
+};
+
 #define param_check_portnr(name, p) \
         __param_check(name, p, unsigned int);
 
 module_param_named(min_resvport, xprt_min_resvport, portnr, 0644);
 module_param_named(max_resvport, xprt_max_resvport, portnr, 0644);
 
-static int param_set_slot_table_size(const char *val, struct kernel_param *kp)
+static int param_set_slot_table_size(const char *val,
+                                     const struct kernel_param *kp)
 {
         return param_set_uint_minmax(val, kp,
                         RPC_MIN_SLOT_TABLE,
                         RPC_MAX_SLOT_TABLE);
 }
 
-static int param_get_slot_table_size(char *buffer, struct kernel_param *kp)
-{
-        return param_get_uint(buffer, kp);
-}
+static struct kernel_param_ops param_ops_slot_table_size = {
+        .set = param_set_slot_table_size,
+        .get = param_get_uint,
+};
+
 #define param_check_slot_table_size(name, p) \
         __param_check(name, p, unsigned int);
 
diff --git a/net/wireless/mlme.c b/net/wireless/mlme.c
index e74a1a2119d3..d1a3fb99fdf2 100644
--- a/net/wireless/mlme.c
+++ b/net/wireless/mlme.c
@@ -843,13 +843,19 @@ int cfg80211_mlme_action(struct cfg80211_registered_device *rdev,
                 return -EINVAL;
         if (mgmt->u.action.category != WLAN_CATEGORY_PUBLIC) {
                 /* Verify that we are associated with the destination AP */
+                wdev_lock(wdev);
+
                 if (!wdev->current_bss ||
                     memcmp(wdev->current_bss->pub.bssid, mgmt->bssid,
                            ETH_ALEN) != 0 ||
                     (wdev->iftype == NL80211_IFTYPE_STATION &&
                      memcmp(wdev->current_bss->pub.bssid, mgmt->da,
-                            ETH_ALEN) != 0))
+                            ETH_ALEN) != 0)) {
+                        wdev_unlock(wdev);
                         return -ENOTCONN;
+                }
+
+                wdev_unlock(wdev);
         }
 
         if (memcmp(mgmt->sa, dev->dev_addr, ETH_ALEN) != 0)