15 files changed, 273 insertions, 343 deletions
diff --git a/net/bluetooth/af_bluetooth.c b/net/bluetooth/af_bluetooth.c
index 9d49ee6d7219..ba033f09196e 100644
--- a/net/bluetooth/af_bluetooth.c
+++ b/net/bluetooth/af_bluetooth.c
@@ -591,7 +591,7 @@ static int bt_seq_show(struct seq_file *seq, void *v)
                           atomic_read(&sk->sk_refcnt),
                           sk_rmem_alloc_get(sk),
                           sk_wmem_alloc_get(sk),
-                           sock_i_uid(sk),
+                           from_kuid(seq_user_ns(seq), sock_i_uid(sk)),
                           sock_i_ino(sk),
                           &src_baswapped,
                           &dst_baswapped,
diff --git a/net/bridge/br_netfilter.c b/net/bridge/br_netfilter.c
index 68e8f364bbf8..fe43bc7b063f 100644
--- a/net/bridge/br_netfilter.c
+++ b/net/bridge/br_netfilter.c
@@ -265,6 +265,9 @@ static int br_parse_ip_options(struct sk_buff *skb)
        struct net_device *dev = skb->dev;
        u32 len;
+        if (!pskb_may_pull(skb, sizeof(struct iphdr)))
+                goto inhdr_error;
        iph = ip_hdr(skb);
        opt = &(IPCB(skb)->opt);
diff --git a/net/core/pktgen.c b/net/core/pktgen.c
index 148e73d2c451..d1dc14c2aac4 100644
--- a/net/core/pktgen.c
+++ b/net/core/pktgen.c
@@ -248,8 +248,8 @@ struct pktgen_dev {
        int removal_mark;       /* non-zero => the device is marked for
                                 * removal by worker thread */
-        int min_pkt_size;       /* = ETH_ZLEN; */
+        int min_pkt_size;
-        int max_pkt_size;       /* = ETH_ZLEN; */
+        int max_pkt_size;
        int pkt_overhead;       /* overhead for MPLS, VLANs, IPSEC etc */
        int nfrags;
        struct page *page;
@@ -449,8 +449,6 @@ static void pktgen_stop_all_threads_ifs(void);
 static void pktgen_stop(struct pktgen_thread *t);
 static void pktgen_clear_counters(struct pktgen_dev *pkt_dev);
-static unsigned int scan_ip6(const char *s, char ip[16]);
 /* Module parameters, defaults. */
 static int pg_count_d __read_mostly = 1000;
 static int pg_delay_d __read_mostly;
@@ -702,8 +700,8 @@ static int pktgen_if_show(struct seq_file *seq, void *v)
                                &pkt_dev->cur_in6_saddr,
                                &pkt_dev->cur_in6_daddr);
        } else
-                seq_printf(seq, "     cur_saddr: 0x%x  cur_daddr: 0x%x\n",
+                seq_printf(seq, "     cur_saddr: %pI4  cur_daddr: %pI4\n",
-                           pkt_dev->cur_saddr, pkt_dev->cur_daddr);
+                           &pkt_dev->cur_saddr, &pkt_dev->cur_daddr);
        seq_printf(seq, "     cur_udp_dst: %d  cur_udp_src: %d\n",
                   pkt_dev->cur_udp_dst, pkt_dev->cur_udp_src);
@@ -1299,7 +1297,7 @@ static ssize_t pktgen_if_write(struct file *file,
                        return -EFAULT;
                buf[len] = 0;
-                scan_ip6(buf, pkt_dev->in6_daddr.s6_addr);
+                in6_pton(buf, -1, pkt_dev->in6_daddr.s6_addr, -1, NULL);
                snprintf(buf, sizeof(buf), "%pI6c", &pkt_dev->in6_daddr);
                pkt_dev->cur_in6_daddr = pkt_dev->in6_daddr;
@@ -1322,7 +1320,7 @@ static ssize_t pktgen_if_write(struct file *file,
                        return -EFAULT;
                buf[len] = 0;
-                scan_ip6(buf, pkt_dev->min_in6_daddr.s6_addr);
+                in6_pton(buf, -1, pkt_dev->min_in6_daddr.s6_addr, -1, NULL);
                snprintf(buf, sizeof(buf), "%pI6c", &pkt_dev->min_in6_daddr);
                pkt_dev->cur_in6_daddr = pkt_dev->min_in6_daddr;
@@ -1344,7 +1342,7 @@ static ssize_t pktgen_if_write(struct file *file,
                        return -EFAULT;
                buf[len] = 0;
-                scan_ip6(buf, pkt_dev->max_in6_daddr.s6_addr);
+                in6_pton(buf, -1, pkt_dev->max_in6_daddr.s6_addr, -1, NULL);
                snprintf(buf, sizeof(buf), "%pI6c", &pkt_dev->max_in6_daddr);
                if (debug)
@@ -1365,7 +1363,7 @@ static ssize_t pktgen_if_write(struct file *file,
                        return -EFAULT;
                buf[len] = 0;
-                scan_ip6(buf, pkt_dev->in6_saddr.s6_addr);
+                in6_pton(buf, -1, pkt_dev->in6_saddr.s6_addr, -1, NULL);
                snprintf(buf, sizeof(buf), "%pI6c", &pkt_dev->in6_saddr);
                pkt_dev->cur_in6_saddr = pkt_dev->in6_saddr;
@@ -2036,19 +2034,17 @@ static void pktgen_setup_inject(struct pktgen_dev *pkt_dev)
        /* Set up Dest MAC */
        memcpy(&(pkt_dev->hh[0]), pkt_dev->dst_mac, ETH_ALEN);
-        /* Set up pkt size */
-        pkt_dev->cur_pkt_size = pkt_dev->min_pkt_size;
        if (pkt_dev->flags & F_IPV6) {
-                /*
-                 * Skip this automatic address setting until locks or functions
-                 * gets exported
-                 */
-#ifdef NOTNOW
                int i, set = 0, err = 1;
                struct inet6_dev *idev;
+                if (pkt_dev->min_pkt_size == 0) {
+                        pkt_dev->min_pkt_size = 14 + sizeof(struct ipv6hdr)
+                                                + sizeof(struct udphdr)
+                                                + sizeof(struct pktgen_hdr)
+                                                + pkt_dev->pkt_overhead;
+                }
                for (i = 0; i < IN6_ADDR_HSIZE; i++)
                        if (pkt_dev->cur_in6_saddr.s6_addr[i]) {
                                set = 1;
@@ -2069,9 +2065,8 @@ static void pktgen_setup_inject(struct pktgen_dev *pkt_dev)
                                struct inet6_ifaddr *ifp;
                                read_lock_bh(&idev->lock);
-                                for (ifp = idev->addr_list; ifp;
+                                list_for_each_entry(ifp, &idev->addr_list, if_list) {
-                                     ifp = ifp->if_next) {
+                                        if ((ifp->scope & IFA_LINK) &&
-                                        if (ifp->scope == IFA_LINK &&
                                            !(ifp->flags & IFA_F_TENTATIVE)) {
                                                pkt_dev->cur_in6_saddr = ifp->addr;
                                                err = 0;
@@ -2084,8 +2079,14 @@ static void pktgen_setup_inject(struct pktgen_dev *pkt_dev)
                        if (err)
                                pr_err("ERROR: IPv6 link address not available\n");
                }
-#endif
        } else {
+                if (pkt_dev->min_pkt_size == 0) {
+                        pkt_dev->min_pkt_size = 14 + sizeof(struct iphdr)
+                                                + sizeof(struct udphdr)
+                                                + sizeof(struct pktgen_hdr)
+                                                + pkt_dev->pkt_overhead;
+                }
                pkt_dev->saddr_min = 0;
                pkt_dev->saddr_max = 0;
                if (strlen(pkt_dev->src_min) == 0) {
@@ -2111,6 +2112,10 @@ static void pktgen_setup_inject(struct pktgen_dev *pkt_dev)
                pkt_dev->daddr_max = in_aton(pkt_dev->dst_max);
        }
        /* Initialize current values. */
+        pkt_dev->cur_pkt_size = pkt_dev->min_pkt_size;
+        if (pkt_dev->min_pkt_size > pkt_dev->max_pkt_size)
+                pkt_dev->max_pkt_size = pkt_dev->min_pkt_size;
        pkt_dev->cur_dst_mac_offset = 0;
        pkt_dev->cur_src_mac_offset = 0;
        pkt_dev->cur_saddr = pkt_dev->saddr_min;
@@ -2758,97 +2763,6 @@ static struct sk_buff *fill_packet_ipv4(struct net_device *odev,
        return skb;
 }
-/*
- * scan_ip6, fmt_ip taken from dietlibc-0.21
- * Author Felix von Leitner <felix-dietlibc@fefe.de>
- *
- * Slightly modified for kernel.
- * Should be candidate for net/ipv4/utils.c
- * --ro
- */
-static unsigned int scan_ip6(const char *s, char ip[16])
-{
-        unsigned int i;
-        unsigned int len = 0;
-        unsigned long u;
-        char suffix[16];
-        unsigned int prefixlen = 0;
-        unsigned int suffixlen = 0;
-        __be32 tmp;
-        char *pos;
-        for (i = 0; i < 16; i++)
-                ip[i] = 0;
-        for (;;) {
-                if (*s == ':') {
-                        len++;
-                        if (s[1] == ':') {      /* Found "::", skip to part 2 */
-                                s += 2;
-                                len++;
-                                break;
-                        }
-                        s++;
-                }
-                u = simple_strtoul(s, &pos, 16);
-                i = pos - s;
-                if (!i)
-                        return 0;
-                if (prefixlen == 12 && s[i] == '.') {
-                        /* the last 4 bytes may be written as IPv4 address */
-                        tmp = in_aton(s);
-                        memcpy((struct in_addr *)(ip + 12), &tmp, sizeof(tmp));
-                        return i + len;
-                }
-                ip[prefixlen++] = (u >> 8);
-                ip[prefixlen++] = (u & 255);
-                s += i;
-                len += i;
-                if (prefixlen == 16)
-                        return len;
-        }
-/* part 2, after "::" */
-        for (;;) {
-                if (*s == ':') {
-                        if (suffixlen == 0)
-                                break;
-                        s++;
-                        len++;
-                } else if (suffixlen != 0)
-                        break;
-                u = simple_strtol(s, &pos, 16);
-                i = pos - s;
-                if (!i) {
-                        if (*s)
-                                len--;
-                        break;
-                }
-                if (suffixlen + prefixlen <= 12 && s[i] == '.') {
-                        tmp = in_aton(s);
-                        memcpy((struct in_addr *)(suffix + suffixlen), &tmp,
-                               sizeof(tmp));
-                        suffixlen += 4;
-                        len += strlen(s);
-                        break;
-                }
-                suffix[suffixlen++] = (u >> 8);
-                suffix[suffixlen++] = (u & 255);
-                s += i;
-                len += i;
-                if (prefixlen + suffixlen == 16)
-                        break;
-        }
-        for (i = 0; i < suffixlen; i++)
-                ip[16 - suffixlen + i] = suffix[i];
-        return len;
-}
 static struct sk_buff *fill_packet_ipv6(struct net_device *odev,
                                        struct pktgen_dev *pkt_dev)
 {
@@ -2927,7 +2841,7 @@ static struct sk_buff *fill_packet_ipv6(struct net_device *odev,
                  sizeof(struct ipv6hdr) - sizeof(struct udphdr) -
                  pkt_dev->pkt_overhead;
-        if (datalen < sizeof(struct pktgen_hdr)) {
+        if (datalen < 0 || datalen < sizeof(struct pktgen_hdr)) {
                datalen = sizeof(struct pktgen_hdr);
                net_info_ratelimited("increased datalen to %d\n", datalen);
        }
@@ -3548,8 +3462,6 @@ static int pktgen_add_device(struct pktgen_thread *t, const char *ifname)
        }
        pkt_dev->removal_mark = 0;
-        pkt_dev->min_pkt_size = ETH_ZLEN;
-        pkt_dev->max_pkt_size = ETH_ZLEN;
        pkt_dev->nfrags = 0;
        pkt_dev->delay = pg_delay_d;
        pkt_dev->count = pg_count_d;
diff --git a/net/core/utils.c b/net/core/utils.c
index f5613d569c23..e3487e461939 100644
--- a/net/core/utils.c
+++ b/net/core/utils.c
@@ -107,6 +107,18 @@ static inline int xdigit2bin(char c, int delim)
        return IN6PTON_UNKNOWN;
 }
+/**
+ * in4_pton - convert an IPv4 address from literal to binary representation
+ * @src: the start of the IPv4 address string
+ * @srclen: the length of the string, -1 means strlen(src)
+ * @dst: the binary (u8[4] array) representation of the IPv4 address
+ * @delim: the delimiter of the IPv4 address in @src, -1 means no delimiter
+ * @end: A pointer to the end of the parsed string will be placed here
+ *
+ * Return one on success, return zero when any error occurs
+ * and @end will point to the end of the parsed string.
+ *
+ */
 int in4_pton(const char *src, int srclen,
             u8 *dst,
             int delim, const char **end)
@@ -161,6 +173,18 @@ out:
 }
 EXPORT_SYMBOL(in4_pton);
+/**
+ * in6_pton - convert an IPv6 address from literal to binary representation
+ * @src: the start of the IPv6 address string
+ * @srclen: the length of the string, -1 means strlen(src)
+ * @dst: the binary (u8[16] array) representation of the IPv6 address
+ * @delim: the delimiter of the IPv6 address in @src, -1 means no delimiter
+ * @end: A pointer to the end of the parsed string will be placed here
+ *
+ * Return one on success, return zero when any error occurs
+ * and @end will point to the end of the parsed string.
+ *
+ */
 int in6_pton(const char *src, int srclen,
             u8 *dst,
             int delim, const char **end)
diff --git a/net/ipv4/ip_vti.c b/net/ipv4/ip_vti.c
index 978bca4818ae..1831092f999f 100644
--- a/net/ipv4/ip_vti.c
+++ b/net/ipv4/ip_vti.c
@@ -374,7 +374,7 @@ static netdev_tx_t vti_tunnel_xmit(struct sk_buff *skb, struct net_device *dev)
        memset(&fl4, 0, sizeof(fl4));
        flowi4_init_output(&fl4, tunnel->parms.link,
-                           htonl(tunnel->parms.i_key), RT_TOS(tos),
+                           be32_to_cpu(tunnel->parms.i_key), RT_TOS(tos),
                           RT_SCOPE_UNIVERSE,
                           IPPROTO_IPIP, 0,
                           dst, tiph->saddr, 0, 0);
@@ -441,7 +441,7 @@ static int vti_tunnel_bind_dev(struct net_device *dev)
                struct flowi4 fl4;
                memset(&fl4, 0, sizeof(fl4));
                flowi4_init_output(&fl4, tunnel->parms.link,
-                                   htonl(tunnel->parms.i_key),
+                                   be32_to_cpu(tunnel->parms.i_key),
                                   RT_TOS(iph->tos), RT_SCOPE_UNIVERSE,
                                   IPPROTO_IPIP, 0,
                                   iph->daddr, iph->saddr, 0, 0);
diff --git a/net/ipv4/route.c b/net/ipv4/route.c
index 1a0da8dc8180..432f4bb77238 100644
--- a/net/ipv4/route.c
+++ b/net/ipv4/route.c
@@ -2220,7 +2220,7 @@ static int rt_fill_info(struct net *net,  __be32 dst, __be32 src,
                goto nla_put_failure;
        if (fl4->flowi4_mark &&
-            nla_put_be32(skb, RTA_MARK, fl4->flowi4_mark))
+            nla_put_u32(skb, RTA_MARK, fl4->flowi4_mark))
                goto nla_put_failure;
        error = rt->dst.error;
diff --git a/net/ipv4/sysctl_net_ipv4.c b/net/ipv4/sysctl_net_ipv4.c
index 9205e492dc9d..63d4eccc674d 100644
--- a/net/ipv4/sysctl_net_ipv4.c
+++ b/net/ipv4/sysctl_net_ipv4.c
@@ -248,6 +248,8 @@ int proc_tcp_fastopen_key(ctl_table *ctl, int write, void __user *buffer,
        ctxt = rcu_dereference(tcp_fastopen_ctx);
        if (ctxt)
                memcpy(user_key, ctxt->key, TCP_FASTOPEN_KEY_LENGTH);
+        else
+                memset(user_key, 0, sizeof(user_key));
        rcu_read_unlock();
        snprintf(tbl.data, tbl.maxlen, "%08x-%08x-%08x-%08x",
diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
index 75735c9a6a9d..ef998b008a57 100644
--- a/net/ipv4/tcp_ipv4.c
+++ b/net/ipv4/tcp_ipv4.c
@@ -708,10 +708,11 @@ static void tcp_v4_send_reset(struct sock *sk, struct sk_buff *skb)
        arg.csumoffset = offsetof(struct tcphdr, check) / 2;
        arg.flags = (sk && inet_sk(sk)->transparent) ? IP_REPLY_ARG_NOSRCCHECK : 0;
        /* When socket is gone, all binding information is lost.
-         * routing might fail in this case. using iif for oif to
+         * routing might fail in this case. No choice here, if we choose to force
-         * make sure we can deliver it
+         * input interface, we will misroute in case of asymmetric route.
         */
-        arg.bound_dev_if = sk ? sk->sk_bound_dev_if : inet_iif(skb);
+        if (sk)
+                arg.bound_dev_if = sk->sk_bound_dev_if;
        net = dev_net(skb_dst(skb)->dev);
        arg.tos = ip_hdr(skb)->tos;
diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
index 49c890386ce9..26175bffbaa0 100644
--- a/net/ipv6/tcp_ipv6.c
+++ b/net/ipv6/tcp_ipv6.c
@@ -877,7 +877,8 @@ static void tcp_v6_send_response(struct sk_buff *skb, u32 seq, u32 ack, u32 win,
        __tcp_v6_send_check(buff, &fl6.saddr, &fl6.daddr);
        fl6.flowi6_proto = IPPROTO_TCP;
-        fl6.flowi6_oif = inet6_iif(skb);
+        if (ipv6_addr_type(&fl6.daddr) & IPV6_ADDR_LINKLOCAL)
+                fl6.flowi6_oif = inet6_iif(skb);
        fl6.fl6_dport = t1->dest;
        fl6.fl6_sport = t1->source;
        security_skb_classify_flow(skb, flowi6_to_flowi(&fl6));
diff --git a/net/mac80211/mesh_sync.c b/net/mac80211/mesh_sync.c
index accfa00ffcdf..a16b7b4b1e02 100644
--- a/net/mac80211/mesh_sync.c
+++ b/net/mac80211/mesh_sync.c
@@ -56,7 +56,6 @@ void mesh_sync_adjust_tbtt(struct ieee80211_sub_if_data *sdata)
        u64 tsfdelta;
        spin_lock_bh(&ifmsh->sync_offset_lock);
        if (ifmsh->sync_offset_clockdrift_max < beacon_int_fraction) {
                msync_dbg(sdata, "TBTT : max clockdrift=%lld; adjusting\n",
                          (long long) ifmsh->sync_offset_clockdrift_max);
@@ -69,11 +68,11 @@ void mesh_sync_adjust_tbtt(struct ieee80211_sub_if_data *sdata)
                tsfdelta = -beacon_int_fraction;
                ifmsh->sync_offset_clockdrift_max -= beacon_int_fraction;
        }
+        spin_unlock_bh(&ifmsh->sync_offset_lock);
        tsf = drv_get_tsf(local, sdata);
        if (tsf != -1ULL)
                drv_set_tsf(local, sdata, tsf + tsfdelta);
-        spin_unlock_bh(&ifmsh->sync_offset_lock);
 }
 static void mesh_sync_offset_rx_bcn_presp(struct ieee80211_sub_if_data *sdata,
diff --git a/net/mac80211/status.c b/net/mac80211/status.c
index 2ce89732d0f2..3af0cc4130f1 100644
--- a/net/mac80211/status.c
+++ b/net/mac80211/status.c
@@ -34,7 +34,7 @@ void ieee80211_tx_status_irqsafe(struct ieee80211_hw *hw,
                skb_queue_len(&local->skb_queue_unreliable);
        while (tmp > IEEE80211_IRQSAFE_QUEUE_LIMIT &&
               (skb = skb_dequeue(&local->skb_queue_unreliable))) {
-                dev_kfree_skb_irq(skb);
+                ieee80211_free_txskb(hw, skb);
                tmp--;
                I802_DEBUG_INC(local->tx_status_drop);
        }
@@ -159,7 +159,7 @@ static void ieee80211_handle_filtered_frame(struct ieee80211_local *local,
                           "dropped TX filtered frame, queue_len=%d PS=%d @%lu\n",
                           skb_queue_len(&sta->tx_filtered[ac]),
                           !!test_sta_flag(sta, WLAN_STA_PS_STA), jiffies);
-        dev_kfree_skb(skb);
+        ieee80211_free_txskb(&local->hw, skb);
 }
 static void ieee80211_check_pending_bar(struct sta_info *sta, u8 *addr, u8 tid)
diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c
index e0e0d1d0e830..c9bf83f36657 100644
--- a/net/mac80211/tx.c
+++ b/net/mac80211/tx.c
@@ -354,7 +354,7 @@ static void purge_old_ps_buffers(struct ieee80211_local *local)
                        total += skb_queue_len(&sta->ps_tx_buf[ac]);
                        if (skb) {
                                purged++;
-                                dev_kfree_skb(skb);
+                                ieee80211_free_txskb(&local->hw, skb);
                                break;
                        }
                }
@@ -466,7 +466,7 @@ ieee80211_tx_h_unicast_ps_buf(struct ieee80211_tx_data *tx)
                        ps_dbg(tx->sdata,
                               "STA %pM TX buffer for AC %d full - dropping oldest frame\n",
                               sta->sta.addr, ac);
-                        dev_kfree_skb(old);
+                        ieee80211_free_txskb(&local->hw, old);
                } else
                        tx->local->total_ps_buffered++;
@@ -1103,7 +1103,7 @@ static bool ieee80211_tx_prep_agg(struct ieee80211_tx_data *tx,
                spin_unlock(&tx->sta->lock);
                if (purge_skb)
-                        dev_kfree_skb(purge_skb);
+                        ieee80211_free_txskb(&tx->local->hw, purge_skb);
        }
        /* reset session timer */
@@ -1214,7 +1214,7 @@ static bool ieee80211_tx_frags(struct ieee80211_local *local,
 #ifdef CONFIG_MAC80211_VERBOSE_DEBUG
                if (WARN_ON_ONCE(q >= local->hw.queues)) {
                        __skb_unlink(skb, skbs);
-                        dev_kfree_skb(skb);
+                        ieee80211_free_txskb(&local->hw, skb);
                        continue;
                }
 #endif
@@ -1356,7 +1356,7 @@ static int invoke_tx_handlers(struct ieee80211_tx_data *tx)
        if (unlikely(res == TX_DROP)) {
                I802_DEBUG_INC(tx->local->tx_handlers_drop);
                if (tx->skb)
-                        dev_kfree_skb(tx->skb);
+                        ieee80211_free_txskb(&tx->local->hw, tx->skb);
                else
                        __skb_queue_purge(&tx->skbs);
                return -1;
@@ -1393,7 +1393,7 @@ static bool ieee80211_tx(struct ieee80211_sub_if_data *sdata,
        res_prepare = ieee80211_tx_prepare(sdata, &tx, skb);
        if (unlikely(res_prepare == TX_DROP)) {
-                dev_kfree_skb(skb);
+                ieee80211_free_txskb(&local->hw, skb);
                goto out;
        } else if (unlikely(res_prepare == TX_QUEUED)) {
                goto out;
@@ -1465,7 +1465,7 @@ void ieee80211_xmit(struct ieee80211_sub_if_data *sdata, struct sk_buff *skb)
        headroom = max_t(int, 0, headroom);
        if (ieee80211_skb_resize(sdata, skb, headroom, may_encrypt)) {
-                dev_kfree_skb(skb);
+                ieee80211_free_txskb(&local->hw, skb);
                rcu_read_unlock();
                return;
        }
@@ -2050,8 +2050,10 @@ netdev_tx_t ieee80211_subif_start_xmit(struct sk_buff *skb,
                head_need += IEEE80211_ENCRYPT_HEADROOM;
                head_need += local->tx_headroom;
                head_need = max_t(int, 0, head_need);
-                if (ieee80211_skb_resize(sdata, skb, head_need, true))
+                if (ieee80211_skb_resize(sdata, skb, head_need, true)) {
-                        goto fail;
+                        ieee80211_free_txskb(&local->hw, skb);
+                        return NETDEV_TX_OK;
+                }
        }
        if (encaps_data) {
@@ -2184,7 +2186,7 @@ void ieee80211_tx_pending(unsigned long data)
                        struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
                        if (WARN_ON(!info->control.vif)) {
-                                kfree_skb(skb);
+                                ieee80211_free_txskb(&local->hw, skb);
                                continue;
                        }
diff --git a/net/sunrpc/svc_xprt.c b/net/sunrpc/svc_xprt.c
index bac973a31367..194d865fae72 100644
--- a/net/sunrpc/svc_xprt.c
+++ b/net/sunrpc/svc_xprt.c
@@ -208,6 +208,35 @@ static struct svc_xprt *__svc_xpo_create(struct svc_xprt_class *xcl,
        return xcl->xcl_ops->xpo_create(serv, net, sap, len, flags);
 }
+/*
+ * svc_xprt_received conditionally queues the transport for processing
+ * by another thread. The caller must hold the XPT_BUSY bit and must
+ * not thereafter touch transport data.
+ *
+ * Note: XPT_DATA only gets cleared when a read-attempt finds no (or
+ * insufficient) data.
+ */
+static void svc_xprt_received(struct svc_xprt *xprt)
+{
+        BUG_ON(!test_bit(XPT_BUSY, &xprt->xpt_flags));
+        /* As soon as we clear busy, the xprt could be closed and
+         * 'put', so we need a reference to call svc_xprt_enqueue with:
+         */
+        svc_xprt_get(xprt);
+        clear_bit(XPT_BUSY, &xprt->xpt_flags);
+        svc_xprt_enqueue(xprt);
+        svc_xprt_put(xprt);
+}
+void svc_add_new_perm_xprt(struct svc_serv *serv, struct svc_xprt *new)
+{
+        clear_bit(XPT_TEMP, &new->xpt_flags);
+        spin_lock_bh(&serv->sv_lock);
+        list_add(&new->xpt_list, &serv->sv_permsocks);
+        spin_unlock_bh(&serv->sv_lock);
+        svc_xprt_received(new);
+}
 int svc_create_xprt(struct svc_serv *serv, const char *xprt_name,
                    struct net *net, const int family,
                    const unsigned short port, int flags)
@@ -232,13 +261,8 @@ int svc_create_xprt(struct svc_serv *serv, const char *xprt_name,
                        module_put(xcl->xcl_owner);
                        return PTR_ERR(newxprt);
                }
+                svc_add_new_perm_xprt(serv, newxprt);
-                clear_bit(XPT_TEMP, &newxprt->xpt_flags);
-                spin_lock_bh(&serv->sv_lock);
-                list_add(&newxprt->xpt_list, &serv->sv_permsocks);
-                spin_unlock_bh(&serv->sv_lock);
                newport = svc_xprt_local_port(newxprt);
-                clear_bit(XPT_BUSY, &newxprt->xpt_flags);
                return newport;
        }
 err:
@@ -394,27 +418,6 @@ static struct svc_xprt *svc_xprt_dequeue(struct svc_pool *pool)
        return xprt;
 }
-/*
- * svc_xprt_received conditionally queues the transport for processing
- * by another thread. The caller must hold the XPT_BUSY bit and must
- * not thereafter touch transport data.
- *
- * Note: XPT_DATA only gets cleared when a read-attempt finds no (or
- * insufficient) data.
- */
-void svc_xprt_received(struct svc_xprt *xprt)
-{
-        BUG_ON(!test_bit(XPT_BUSY, &xprt->xpt_flags));
-        /* As soon as we clear busy, the xprt could be closed and
-         * 'put', so we need a reference to call svc_xprt_enqueue with:
-         */
-        svc_xprt_get(xprt);
-        clear_bit(XPT_BUSY, &xprt->xpt_flags);
-        svc_xprt_enqueue(xprt);
-        svc_xprt_put(xprt);
-}
-EXPORT_SYMBOL_GPL(svc_xprt_received);
 /**
 * svc_reserve - change the space reserved for the reply to a request.
 * @rqstp:  The request in question
@@ -565,33 +568,12 @@ static void svc_check_conn_limits(struct svc_serv *serv)
        }
 }
-/*
+int svc_alloc_arg(struct svc_rqst *rqstp)
- * Receive the next request on any transport.  This code is carefully
- * organised not to touch any cachelines in the shared svc_serv
- * structure, only cachelines in the local svc_pool.
- */
-int svc_recv(struct svc_rqst *rqstp, long timeout)
 {
-        struct svc_xprt         *xprt = NULL;
+        struct svc_serv *serv = rqstp->rq_server;
-        struct svc_serv         *serv = rqstp->rq_server;
+        struct xdr_buf *arg;
-        struct svc_pool         *pool = rqstp->rq_pool;
+        int pages;
-        int                     len, i;
+        int i;
-        int                     pages;
-        struct xdr_buf          *arg;
-        DECLARE_WAITQUEUE(wait, current);
-        long                    time_left;
-        dprintk("svc: server %p waiting for data (to = %ld)\n",
-                rqstp, timeout);
-        if (rqstp->rq_xprt)
-                printk(KERN_ERR
-                        "svc_recv: service %p, transport not NULL!\n",
-                         rqstp);
-        if (waitqueue_active(&rqstp->rq_wait))
-                printk(KERN_ERR
-                        "svc_recv: service %p, wait queue active!\n",
-                         rqstp);
        /* now allocate needed pages.  If we get a failure, sleep briefly */
        pages = (serv->sv_max_mesg + PAGE_SIZE) / PAGE_SIZE;
@@ -621,11 +603,15 @@ int svc_recv(struct svc_rqst *rqstp, long timeout)
        arg->page_len = (pages-2)*PAGE_SIZE;
        arg->len = (pages-1)*PAGE_SIZE;
        arg->tail[0].iov_len = 0;
+        return 0;
+}
-        try_to_freeze();
+struct svc_xprt *svc_get_next_xprt(struct svc_rqst *rqstp, long timeout)
-        cond_resched();
+{
-        if (signalled() || kthread_should_stop())
+        struct svc_xprt *xprt;
-                return -EINTR;
+        struct svc_pool         *pool = rqstp->rq_pool;
+        DECLARE_WAITQUEUE(wait, current);
+        long                    time_left;
        /* Normally we will wait up to 5 seconds for any required
         * cache information to be provided.
@@ -663,7 +649,7 @@ int svc_recv(struct svc_rqst *rqstp, long timeout)
                if (kthread_should_stop()) {
                        set_current_state(TASK_RUNNING);
                        spin_unlock_bh(&pool->sp_lock);
-                        return -EINTR;
+                        return ERR_PTR(-EINTR);
                }
                add_wait_queue(&rqstp->rq_wait, &wait);
@@ -684,48 +670,58 @@ int svc_recv(struct svc_rqst *rqstp, long timeout)
                        spin_unlock_bh(&pool->sp_lock);
                        dprintk("svc: server %p, no data yet\n", rqstp);
                        if (signalled() || kthread_should_stop())
-                                return -EINTR;
+                                return ERR_PTR(-EINTR);
                        else
-                                return -EAGAIN;
+                                return ERR_PTR(-EAGAIN);
                }
        }
        spin_unlock_bh(&pool->sp_lock);
+        return xprt;
+}
+void svc_add_new_temp_xprt(struct svc_serv *serv, struct svc_xprt *newxpt)
+{
+        spin_lock_bh(&serv->sv_lock);
+        set_bit(XPT_TEMP, &newxpt->xpt_flags);
+        list_add(&newxpt->xpt_list, &serv->sv_tempsocks);
+        serv->sv_tmpcnt++;
+        if (serv->sv_temptimer.function == NULL) {
+                /* setup timer to age temp transports */
+                setup_timer(&serv->sv_temptimer, svc_age_temp_xprts,
+                            (unsigned long)serv);
+                mod_timer(&serv->sv_temptimer,
+                          jiffies + svc_conn_age_period * HZ);
+        }
+        spin_unlock_bh(&serv->sv_lock);
+        svc_xprt_received(newxpt);
+}
+static int svc_handle_xprt(struct svc_rqst *rqstp, struct svc_xprt *xprt)
+{
+        struct svc_serv *serv = rqstp->rq_server;
+        int len = 0;
-        len = 0;
        if (test_bit(XPT_CLOSE, &xprt->xpt_flags)) {
                dprintk("svc_recv: found XPT_CLOSE\n");
                svc_delete_xprt(xprt);
                /* Leave XPT_BUSY set on the dead xprt: */
-                goto out;
+                return 0;
        }
        if (test_bit(XPT_LISTENER, &xprt->xpt_flags)) {
                struct svc_xprt *newxpt;
+                /*
+                 * We know this module_get will succeed because the
+                 * listener holds a reference too
+                 */
+                __module_get(xprt->xpt_class->xcl_owner);
+                svc_check_conn_limits(xprt->xpt_server);
                newxpt = xprt->xpt_ops->xpo_accept(xprt);
-                if (newxpt) {
+                if (newxpt)
-                        /*
+                        svc_add_new_temp_xprt(serv, newxpt);
-                         * We know this module_get will succeed because the
-                         * listener holds a reference too
-                         */
-                        __module_get(newxpt->xpt_class->xcl_owner);
-                        svc_check_conn_limits(xprt->xpt_server);
-                        spin_lock_bh(&serv->sv_lock);
-                        set_bit(XPT_TEMP, &newxpt->xpt_flags);
-                        list_add(&newxpt->xpt_list, &serv->sv_tempsocks);
-                        serv->sv_tmpcnt++;
-                        if (serv->sv_temptimer.function == NULL) {
-                                /* setup timer to age temp transports */
-                                setup_timer(&serv->sv_temptimer,
-                                            svc_age_temp_xprts,
-                                            (unsigned long)serv);
-                                mod_timer(&serv->sv_temptimer,
-                                          jiffies + svc_conn_age_period * HZ);
-                        }
-                        spin_unlock_bh(&serv->sv_lock);
-                        svc_xprt_received(newxpt);
-                }
        } else if (xprt->xpt_ops->xpo_has_wspace(xprt)) {
+                /* XPT_DATA|XPT_DEFERRED case: */
                dprintk("svc: server %p, pool %u, transport %p, inuse=%d\n",
-                        rqstp, pool->sp_id, xprt,
+                        rqstp, rqstp->rq_pool->sp_id, xprt,
                        atomic_read(&xprt->xpt_ref.refcount));
                rqstp->rq_deferred = svc_deferred_dequeue(xprt);
                if (rqstp->rq_deferred)
@@ -736,10 +732,51 @@ int svc_recv(struct svc_rqst *rqstp, long timeout)
                rqstp->rq_reserved = serv->sv_max_mesg;
                atomic_add(rqstp->rq_reserved, &xprt->xpt_reserved);
        }
+        /* clear XPT_BUSY: */
        svc_xprt_received(xprt);
+        return len;
+}
+/*
+ * Receive the next request on any transport.  This code is carefully
+ * organised not to touch any cachelines in the shared svc_serv
+ * structure, only cachelines in the local svc_pool.
+ */
+int svc_recv(struct svc_rqst *rqstp, long timeout)
+{
+        struct svc_xprt         *xprt = NULL;
+        struct svc_serv         *serv = rqstp->rq_server;
+        int                     len, err;
+        dprintk("svc: server %p waiting for data (to = %ld)\n",
+                rqstp, timeout);
+        if (rqstp->rq_xprt)
+                printk(KERN_ERR
+                        "svc_recv: service %p, transport not NULL!\n",
+                         rqstp);
+        if (waitqueue_active(&rqstp->rq_wait))
+                printk(KERN_ERR
+                        "svc_recv: service %p, wait queue active!\n",
+                         rqstp);
+        err = svc_alloc_arg(rqstp);
+        if (err)
+                return err;
+        try_to_freeze();
+        cond_resched();
+        if (signalled() || kthread_should_stop())
+                return -EINTR;
+        xprt = svc_get_next_xprt(rqstp, timeout);
+        if (IS_ERR(xprt))
+                return PTR_ERR(xprt);
+        len = svc_handle_xprt(rqstp, xprt);
        /* No data, incomplete (TCP) read, or accept() */
-        if (len == 0 || len == -EAGAIN)
+        if (len <= 0)
                goto out;
        clear_bit(XPT_OLD, &xprt->xpt_flags);
@@ -917,16 +954,18 @@ void svc_close_xprt(struct svc_xprt *xprt)
 }
 EXPORT_SYMBOL_GPL(svc_close_xprt);
-static void svc_close_list(struct list_head *xprt_list, struct net *net)
+static void svc_close_list(struct svc_serv *serv, struct list_head *xprt_list, struct net *net)
 {
        struct svc_xprt *xprt;
+        spin_lock(&serv->sv_lock);
        list_for_each_entry(xprt, xprt_list, xpt_list) {
                if (xprt->xpt_net != net)
                        continue;
                set_bit(XPT_CLOSE, &xprt->xpt_flags);
                set_bit(XPT_BUSY, &xprt->xpt_flags);
        }
+        spin_unlock(&serv->sv_lock);
 }
 static void svc_clear_pools(struct svc_serv *serv, struct net *net)
@@ -949,24 +988,28 @@ static void svc_clear_pools(struct svc_serv *serv, struct net *net)
        }
 }
-static void svc_clear_list(struct list_head *xprt_list, struct net *net)
+static void svc_clear_list(struct svc_serv *serv, struct list_head *xprt_list, struct net *net)
 {
        struct svc_xprt *xprt;
        struct svc_xprt *tmp;
+        LIST_HEAD(victims);
+        spin_lock(&serv->sv_lock);
        list_for_each_entry_safe(xprt, tmp, xprt_list, xpt_list) {
                if (xprt->xpt_net != net)
                        continue;
-                svc_delete_xprt(xprt);
+                list_move(&xprt->xpt_list, &victims);
        }
-        list_for_each_entry(xprt, xprt_list, xpt_list)
+        spin_unlock(&serv->sv_lock);
-                BUG_ON(xprt->xpt_net == net);
+        list_for_each_entry_safe(xprt, tmp, &victims, xpt_list)
+                svc_delete_xprt(xprt);
 }
 void svc_close_net(struct svc_serv *serv, struct net *net)
 {
-        svc_close_list(&serv->sv_tempsocks, net);
+        svc_close_list(serv, &serv->sv_tempsocks, net);
-        svc_close_list(&serv->sv_permsocks, net);
+        svc_close_list(serv, &serv->sv_permsocks, net);
        svc_clear_pools(serv, net);
        /*
@@ -974,8 +1017,8 @@ void svc_close_net(struct svc_serv *serv, struct net *net)
         * svc_xprt_enqueue will not add new entries without taking the
         * sp_lock and checking XPT_BUSY.
         */
-        svc_clear_list(&serv->sv_tempsocks, net);
+        svc_clear_list(serv, &serv->sv_tempsocks, net);
-        svc_clear_list(&serv->sv_permsocks, net);
+        svc_clear_list(serv, &serv->sv_permsocks, net);
 }
 /*
diff --git a/net/sunrpc/svcsock.c b/net/sunrpc/svcsock.c
index 998aa8c1807c..03827cef1fa7 100644
--- a/net/sunrpc/svcsock.c
+++ b/net/sunrpc/svcsock.c
@@ -59,7 +59,7 @@
 static struct svc_sock *svc_setup_socket(struct svc_serv *, struct socket *,
-                                         int *errp, int flags);
+                                         int flags);
 static void             svc_udp_data_ready(struct sock *, int);
 static int              svc_udp_recvfrom(struct svc_rqst *);
 static int              svc_udp_sendto(struct svc_rqst *);
@@ -305,57 +305,6 @@ static int svc_one_sock_name(struct svc_sock *svsk, char *buf, int remaining)
        return len;
 }
-/**
- * svc_sock_names - construct a list of listener names in a string
- * @serv: pointer to RPC service
- * @buf: pointer to a buffer to fill in with socket names
- * @buflen: size of the buffer to be filled
- * @toclose: pointer to '\0'-terminated C string containing the name
- *              of a listener to be closed
- *
- * Fills in @buf with a '\n'-separated list of names of listener
- * sockets.  If @toclose is not NULL, the socket named by @toclose
- * is closed, and is not included in the output list.
- *
- * Returns positive length of the socket name string, or a negative
- * errno value on error.
- */
-int svc_sock_names(struct svc_serv *serv, char *buf, const size_t buflen,
-                   const char *toclose)
-{
-        struct svc_sock *svsk, *closesk = NULL;
-        int len = 0;
-        if (!serv)
-                return 0;
-        spin_lock_bh(&serv->sv_lock);
-        list_for_each_entry(svsk, &serv->sv_permsocks, sk_xprt.xpt_list) {
-                int onelen = svc_one_sock_name(svsk, buf + len, buflen - len);
-                if (onelen < 0) {
-                        len = onelen;
-                        break;
-                }
-                if (toclose && strcmp(toclose, buf + len) == 0) {
-                        closesk = svsk;
-                        svc_xprt_get(&closesk->sk_xprt);
-                } else
-                        len += onelen;
-        }
-        spin_unlock_bh(&serv->sv_lock);
-        if (closesk) {
-                /* Should unregister with portmap, but you cannot
-                 * unregister just one protocol...
-                 */
-                svc_close_xprt(&closesk->sk_xprt);
-                svc_xprt_put(&closesk->sk_xprt);
-        } else if (toclose)
-                return -ENOENT;
-        return len;
-}
-EXPORT_SYMBOL_GPL(svc_sock_names);
 /*
 * Check input queue length
 */
@@ -598,11 +547,9 @@ static int svc_udp_recvfrom(struct svc_rqst *rqstp)
                        dprintk("svc: recvfrom returned error %d\n", -err);
                        set_bit(XPT_DATA, &svsk->sk_xprt.xpt_flags);
                }
-                return -EAGAIN;
+                return 0;
        }
        len = svc_addr_len(svc_addr(rqstp));
-        if (len == 0)
-                return -EAFNOSUPPORT;
        rqstp->rq_addrlen = len;
        if (skb->tstamp.tv64 == 0) {
                skb->tstamp = ktime_get_real();
@@ -620,10 +567,7 @@ static int svc_udp_recvfrom(struct svc_rqst *rqstp)
        if (!svc_udp_get_dest_address(rqstp, cmh)) {
                net_warn_ratelimited("svc: received unknown control message %d/%d; dropping RPC reply datagram\n",
                                     cmh->cmsg_level, cmh->cmsg_type);
-out_free:
+                goto out_free;
-                trace_kfree_skb(skb, svc_udp_recvfrom);
-                skb_free_datagram_locked(svsk->sk_sk, skb);
-                return 0;
        }
        rqstp->rq_daddrlen = svc_addr_len(svc_daddr(rqstp));
@@ -662,6 +606,10 @@ out_free:
                serv->sv_stats->netudpcnt++;
        return len;
+out_free:
+        trace_kfree_skb(skb, svc_udp_recvfrom);
+        skb_free_datagram_locked(svsk->sk_sk, skb);
+        return 0;
 }
 static int
@@ -900,8 +848,9 @@ static struct svc_xprt *svc_tcp_accept(struct svc_xprt *xprt)
         */
        newsock->sk->sk_sndtimeo = HZ*30;
-        if (!(newsvsk = svc_setup_socket(serv, newsock, &err,
+        newsvsk = svc_setup_socket(serv, newsock,
-                                 (SVC_SOCK_ANONYMOUS | SVC_SOCK_TEMPORARY))))
+                                 (SVC_SOCK_ANONYMOUS | SVC_SOCK_TEMPORARY));
+        if (IS_ERR(newsvsk))
                goto failed;
        svc_xprt_set_remote(&newsvsk->sk_xprt, sin, slen);
        err = kernel_getsockname(newsock, sin, &slen);
@@ -1174,13 +1123,13 @@ error:
        if (len != -EAGAIN)
                goto err_other;
        dprintk("RPC: TCP recvfrom got EAGAIN\n");
-        return -EAGAIN;
+        return 0;
 err_other:
        printk(KERN_NOTICE "%s: recvfrom returned errno %d\n",
               svsk->sk_xprt.xpt_server->sv_name, -len);
        set_bit(XPT_CLOSE, &svsk->sk_xprt.xpt_flags);
 err_noclose:
-        return -EAGAIN; /* record not complete */
+        return 0;       /* record not complete */
 }
 /*
@@ -1383,29 +1332,29 @@ EXPORT_SYMBOL_GPL(svc_sock_update_bufs);
 */
 static struct svc_sock *svc_setup_socket(struct svc_serv *serv,
                                                struct socket *sock,
-                                                int *errp, int flags)
+                                                int flags)
 {
        struct svc_sock *svsk;
        struct sock     *inet;
        int             pmap_register = !(flags & SVC_SOCK_ANONYMOUS);
+        int             err = 0;
        dprintk("svc: svc_setup_socket %p\n", sock);
-        if (!(svsk = kzalloc(sizeof(*svsk), GFP_KERNEL))) {
+        svsk = kzalloc(sizeof(*svsk), GFP_KERNEL);
-                *errp = -ENOMEM;
+        if (!svsk)
-                return NULL;
+                return ERR_PTR(-ENOMEM);
-        }
        inet = sock->sk;
        /* Register socket with portmapper */
-        if (*errp >= 0 && pmap_register)
+        if (pmap_register)
-                *errp = svc_register(serv, sock_net(sock->sk), inet->sk_family,
+                err = svc_register(serv, sock_net(sock->sk), inet->sk_family,
                                     inet->sk_protocol,
                                     ntohs(inet_sk(inet)->inet_sport));
-        if (*errp < 0) {
+        if (err < 0) {
                kfree(svsk);
-                return NULL;
+                return ERR_PTR(err);
        }
        inet->sk_user_data = svsk;
@@ -1450,42 +1399,38 @@ int svc_addsock(struct svc_serv *serv, const int fd, char *name_return,
        int err = 0;
        struct socket *so = sockfd_lookup(fd, &err);
        struct svc_sock *svsk = NULL;
+        struct sockaddr_storage addr;
+        struct sockaddr *sin = (struct sockaddr *)&addr;
+        int salen;
        if (!so)
                return err;
+        err = -EAFNOSUPPORT;
        if ((so->sk->sk_family != PF_INET) && (so->sk->sk_family != PF_INET6))
-                err =  -EAFNOSUPPORT;
+                goto out;
-        else if (so->sk->sk_protocol != IPPROTO_TCP &&
+        err =  -EPROTONOSUPPORT;
+        if (so->sk->sk_protocol != IPPROTO_TCP &&
            so->sk->sk_protocol != IPPROTO_UDP)
-                err =  -EPROTONOSUPPORT;
+                goto out;
-        else if (so->state > SS_UNCONNECTED)
+        err = -EISCONN;
-                err = -EISCONN;
+        if (so->state > SS_UNCONNECTED)
-        else {
+                goto out;
-                if (!try_module_get(THIS_MODULE))
+        err = -ENOENT;
-                        err = -ENOENT;
+        if (!try_module_get(THIS_MODULE))
-                else
+                goto out;
-                        svsk = svc_setup_socket(serv, so, &err,
+        svsk = svc_setup_socket(serv, so, SVC_SOCK_DEFAULTS);
-                                                SVC_SOCK_DEFAULTS);
+        if (IS_ERR(svsk)) {
-                if (svsk) {
+                module_put(THIS_MODULE);
-                        struct sockaddr_storage addr;
+                err = PTR_ERR(svsk);
-                        struct sockaddr *sin = (struct sockaddr *)&addr;
+                goto out;
-                        int salen;
-                        if (kernel_getsockname(svsk->sk_sock, sin, &salen) == 0)
-                                svc_xprt_set_local(&svsk->sk_xprt, sin, salen);
-                        clear_bit(XPT_TEMP, &svsk->sk_xprt.xpt_flags);
-                        spin_lock_bh(&serv->sv_lock);
-                        list_add(&svsk->sk_xprt.xpt_list, &serv->sv_permsocks);
-                        spin_unlock_bh(&serv->sv_lock);
-                        svc_xprt_received(&svsk->sk_xprt);
-                        err = 0;
-                } else
-                        module_put(THIS_MODULE);
-        }
-        if (err) {
-                sockfd_put(so);
-                return err;
        }
+        if (kernel_getsockname(svsk->sk_sock, sin, &salen) == 0)
+                svc_xprt_set_local(&svsk->sk_xprt, sin, salen);
+        svc_add_new_perm_xprt(serv, &svsk->sk_xprt);
        return svc_one_sock_name(svsk, name_return, len);
+out:
+        sockfd_put(so);
+        return err;
 }
 EXPORT_SYMBOL_GPL(svc_addsock);
@@ -1563,11 +1508,13 @@ static struct svc_xprt *svc_create_socket(struct svc_serv *serv,
                        goto bummer;
        }
-        if ((svsk = svc_setup_socket(serv, sock, &error, flags)) != NULL) {
+        svsk = svc_setup_socket(serv, sock, flags);
-                svc_xprt_set_local(&svsk->sk_xprt, newsin, newlen);
+        if (IS_ERR(svsk)) {
-                return (struct svc_xprt *)svsk;
+                error = PTR_ERR(svsk);
+                goto bummer;
        }
+        svc_xprt_set_local(&svsk->sk_xprt, newsin, newlen);
+        return (struct svc_xprt *)svsk;
 bummer:
        dprintk("svc: svc_create_socket error = %d\n", -error);
        sock_release(sock);
diff --git a/net/sunrpc/xprtrdma/svc_rdma_transport.c b/net/sunrpc/xprtrdma/svc_rdma_transport.c
index 73b428bef598..62e4f9bcc387 100644
--- a/net/sunrpc/xprtrdma/svc_rdma_transport.c
+++ b/net/sunrpc/xprtrdma/svc_rdma_transport.c
@@ -578,10 +578,6 @@ static void handle_connect_req(struct rdma_cm_id *new_cma_id, size_t client_ird)
        list_add_tail(&newxprt->sc_accept_q, &listen_xprt->sc_accept_q);
        spin_unlock_bh(&listen_xprt->sc_lock);
-        /*
-         * Can't use svc_xprt_received here because we are not on a
-         * rqstp thread
-        */
        set_bit(XPT_CONN, &listen_xprt->sc_xprt.xpt_flags);
        svc_xprt_enqueue(&listen_xprt->sc_xprt);
 }