76 files changed, 849 insertions, 304 deletions

diff --git a/net/802/psnap.c b/net/802/psnap.c
index 21cde8fd5795..db6baf7cf6e9 100644
--- a/net/802/psnap.c
+++ b/net/802/psnap.c
@@ -147,7 +147,6 @@ struct datalink_proto *register_snap_client(const unsigned char *desc,
 out:
         spin_unlock_bh(&snap_lock);
 
-        synchronize_net();
         return proto;
 }
 
diff --git a/net/8021q/vlan.h b/net/8021q/vlan.h
index c3408def8a19..9da07e30d1a2 100644
--- a/net/8021q/vlan.h
+++ b/net/8021q/vlan.h
@@ -118,11 +118,6 @@ extern void vlan_netlink_fini(void);
 
 extern struct rtnl_link_ops vlan_link_ops;
 
-static inline int is_vlan_dev(struct net_device *dev)
-{
-        return dev->priv_flags & IFF_802_1Q_VLAN;
-}
-
 extern int vlan_net_id;
 
 struct proc_dir_entry;
diff --git a/net/9p/Kconfig b/net/9p/Kconfig
index 7ed75c7bd5d1..d9ea09b11cf8 100644
--- a/net/9p/Kconfig
+++ b/net/9p/Kconfig
@@ -3,8 +3,8 @@
 #
 
 menuconfig NET_9P
-        depends on NET && EXPERIMENTAL
-        tristate "Plan 9 Resource Sharing Support (9P2000) (Experimental)"
+        depends on NET
+        tristate "Plan 9 Resource Sharing Support (9P2000)"
         help
           If you say Y here, you will get experimental support for
           Plan 9 resource sharing via the 9P2000 protocol.
@@ -16,8 +16,8 @@ menuconfig NET_9P
 if NET_9P
 
 config NET_9P_VIRTIO
-        depends on EXPERIMENTAL && VIRTIO
-        tristate "9P Virtio Transport (Experimental)"
+        depends on VIRTIO
+        tristate "9P Virtio Transport"
         help
           This builds support for a transports between
           guest partitions and a host partition.
diff --git a/net/9p/client.c b/net/9p/client.c
index ceab943dfc49..9e3b0e640da1 100644
--- a/net/9p/client.c
+++ b/net/9p/client.c
@@ -92,9 +92,6 @@ static int get_protocol_version(const substring_t *name)
         return version;
 }
 
-static struct p9_req_t *
-p9_client_rpc(struct p9_client *c, int8_t type, const char *fmt, ...);
-
 /**
  * parse_options - parse mount options into client structure
  * @opts: options string passed from mount
@@ -307,12 +304,13 @@ static int p9_tag_init(struct p9_client *c)
         c->tagpool = p9_idpool_create();
         if (IS_ERR(c->tagpool)) {
                 err = PTR_ERR(c->tagpool);
-                c->tagpool = NULL;
                 goto error;
         }
-
-        p9_idpool_get(c->tagpool); /* reserve tag 0 */
-
+        err = p9_idpool_get(c->tagpool); /* reserve tag 0 */
+        if (err < 0) {
+                p9_idpool_destroy(c->tagpool);
+                goto error;
+        }
         c->max_tag = 0;
 error:
         return err;
@@ -518,12 +516,15 @@ out_err:
         return err;
 }
 
+static struct p9_req_t *
+p9_client_rpc(struct p9_client *c, int8_t type, const char *fmt, ...);
+
 /**
  * p9_client_flush - flush (cancel) a request
  * @c: client state
  * @oldreq: request to cancel
  *
- * This sents a flush for a particular requests and links
+ * This sents a flush for a particular request and links
  * the flush request to the original request.  The current
  * code only supports a single flush request although the protocol
  * allows for multiple flush requests to be sent for a single request.
@@ -789,11 +790,13 @@ struct p9_client *p9_client_create(const char *dev_name, char *options)
         spin_lock_init(&clnt->lock);
         INIT_LIST_HEAD(&clnt->fidlist);
 
-        p9_tag_init(clnt);
+        err = p9_tag_init(clnt);
+        if (err < 0)
+                goto free_client;
 
         err = parse_opts(options, clnt);
         if (err < 0)
-                goto free_client;
+                goto destroy_tagpool;
 
         if (!clnt->trans_mod)
                 clnt->trans_mod = v9fs_get_default_trans();
@@ -802,13 +805,12 @@ struct p9_client *p9_client_create(const char *dev_name, char *options)
                 err = -EPROTONOSUPPORT;
                 P9_DPRINTK(P9_DEBUG_ERROR,
                                 "No transport defined or default transport\n");
-                goto free_client;
+                goto destroy_tagpool;
         }
 
         clnt->fidpool = p9_idpool_create();
         if (IS_ERR(clnt->fidpool)) {
                 err = PTR_ERR(clnt->fidpool);
-                clnt->fidpool = NULL;
                 goto put_trans;
         }
 
@@ -834,6 +836,8 @@ destroy_fidpool:
         p9_idpool_destroy(clnt->fidpool);
 put_trans:
         v9fs_put_trans(clnt->trans_mod);
+destroy_tagpool:
+        p9_idpool_destroy(clnt->tagpool);
 free_client:
         kfree(clnt);
         return ERR_PTR(err);
@@ -1298,7 +1302,7 @@ p9_client_read(struct p9_fid *fid, char *data, char __user *udata, u64 offset,
         if (count < rsize)
                 rsize = count;
 
-        /* Don't bother zerocopy form small IO (< 1024) */
+        /* Don't bother zerocopy for small IO (< 1024) */
         if (((clnt->trans_mod->pref & P9_TRANS_PREF_PAYLOAD_MASK) ==
                         P9_TRANS_PREF_PAYLOAD_SEP) && (rsize > 1024)) {
                 req = p9_client_rpc(clnt, P9_TREAD, "dqE", fid->fid, offset,
diff --git a/net/9p/mod.c b/net/9p/mod.c
index cf8a4128cd5c..72c398275051 100644
--- a/net/9p/mod.c
+++ b/net/9p/mod.c
@@ -139,7 +139,7 @@ void v9fs_put_trans(struct p9_trans_module *m)
 }
 
 /**
- * v9fs_init - Initialize module
+ * init_p9 - Initialize module
  *
  */
 static int __init init_p9(void)
@@ -154,7 +154,7 @@ static int __init init_p9(void)
 }
 
 /**
- * v9fs_init - shutdown module
+ * exit_p9 - shutdown module
  *
  */
 
diff --git a/net/9p/trans_fd.c b/net/9p/trans_fd.c
index 4a9084395d35..fdfdb5747f63 100644
--- a/net/9p/trans_fd.c
+++ b/net/9p/trans_fd.c
@@ -916,8 +916,8 @@ p9_fd_create_tcp(struct p9_client *client, const char *addr, char *args)
         sin_server.sin_family = AF_INET;
         sin_server.sin_addr.s_addr = in_aton(addr);
         sin_server.sin_port = htons(opts.port);
-        err = sock_create_kern(PF_INET, SOCK_STREAM, IPPROTO_TCP, &csocket);
-
+        err = __sock_create(read_pnet(&current->nsproxy->net_ns), PF_INET,
+                            SOCK_STREAM, IPPROTO_TCP, &csocket, 1);
         if (err) {
                 P9_EPRINTK(KERN_ERR, "p9_trans_tcp: problem creating socket\n");
                 return err;
@@ -954,7 +954,8 @@ p9_fd_create_unix(struct p9_client *client, const char *addr, char *args)
 
         sun_server.sun_family = PF_UNIX;
         strcpy(sun_server.sun_path, addr);
-        err = sock_create_kern(PF_UNIX, SOCK_STREAM, 0, &csocket);
+        err = __sock_create(read_pnet(&current->nsproxy->net_ns), PF_UNIX,
+                            SOCK_STREAM, 0, &csocket, 1);
         if (err < 0) {
                 P9_EPRINTK(KERN_ERR, "p9_trans_unix: problem creating socket\n");
                 return err;
diff --git a/net/9p/trans_rdma.c b/net/9p/trans_rdma.c
index 844a7a5607e3..159c50f1c6bf 100644
--- a/net/9p/trans_rdma.c
+++ b/net/9p/trans_rdma.c
@@ -589,7 +589,8 @@ rdma_create_trans(struct p9_client *client, const char *addr, char *args)
                 return -ENOMEM;
 
         /* Create the RDMA CM ID */
-        rdma->cm_id = rdma_create_id(p9_cm_event_handler, client, RDMA_PS_TCP);
+        rdma->cm_id = rdma_create_id(p9_cm_event_handler, client, RDMA_PS_TCP,
+                                     IB_QPT_RC);
         if (IS_ERR(rdma->cm_id))
                 goto error;
 
diff --git a/net/9p/util.c b/net/9p/util.c
index da6af81e59d9..9c1c9348ac35 100644
--- a/net/9p/util.c
+++ b/net/9p/util.c
@@ -93,7 +93,7 @@ int p9_idpool_get(struct p9_idpool *p)
 
 retry:
         if (idr_pre_get(&p->pool, GFP_NOFS) == 0)
-                return 0;
+                return -1;
 
         spin_lock_irqsave(&p->lock, flags);
 
diff --git a/net/atm/lec.c b/net/atm/lec.c
index 25073b6ef474..ba48daa68c1f 100644
--- a/net/atm/lec.c
+++ b/net/atm/lec.c
@@ -1171,7 +1171,7 @@ static int __init lane_module_init(void)
 #endif
 
         register_atm_ioctl(&lane_ioctl_ops);
-        pr_info("lec.c: " __DATE__ " " __TIME__ " initialized\n");
+        pr_info("lec.c: initialized\n");
         return 0;
 }
 
diff --git a/net/atm/mpc.c b/net/atm/mpc.c
index 644cdf071642..3ccca42e6f90 100644
--- a/net/atm/mpc.c
+++ b/net/atm/mpc.c
@@ -1482,7 +1482,7 @@ static __init int atm_mpoa_init(void)
         if (mpc_proc_init() != 0)
                 pr_info("failed to initialize /proc/mpoa\n");
 
-        pr_info("mpc.c: " __DATE__ " " __TIME__ " initialized\n");
+        pr_info("mpc.c: initialized\n");
 
         return 0;
 }
diff --git a/net/atm/proc.c b/net/atm/proc.c
index f85da0779e5e..be3afdefec58 100644
--- a/net/atm/proc.c
+++ b/net/atm/proc.c
@@ -191,7 +191,7 @@ static void vcc_info(struct seq_file *seq, struct atm_vcc *vcc)
 {
         struct sock *sk = sk_atm(vcc);
 
-        seq_printf(seq, "%p ", vcc);
+        seq_printf(seq, "%pK ", vcc);
         if (!vcc->dev)
                 seq_printf(seq, "Unassigned    ");
         else
@@ -218,7 +218,7 @@ static void svc_info(struct seq_file *seq, struct atm_vcc *vcc)
 {
         if (!vcc->dev)
                 seq_printf(seq, sizeof(void *) == 4 ?
-                           "N/A@%p%10s" : "N/A@%p%2s", vcc, "");
+                           "N/A@%pK%10s" : "N/A@%pK%2s", vcc, "");
         else
                 seq_printf(seq, "%3d %3d %5d         ",
                            vcc->dev->number, vcc->vpi, vcc->vci);
diff --git a/net/bluetooth/hidp/hidp.h b/net/bluetooth/hidp/hidp.h
index 12822cde4b49..19e95004b286 100644
--- a/net/bluetooth/hidp/hidp.h
+++ b/net/bluetooth/hidp/hidp.h
@@ -80,7 +80,7 @@
 #define HIDP_VIRTUAL_CABLE_UNPLUG       0
 #define HIDP_BOOT_PROTOCOL_MODE         1
 #define HIDP_BLUETOOTH_VENDOR_ID        9
-#define HIDP_WAITING_FOR_RETURN         10
+#define HIDP_WAITING_FOR_RETURN         10
 #define HIDP_WAITING_FOR_SEND_ACK       11
 
 struct hidp_connadd_req {
diff --git a/net/bridge/br_if.c b/net/bridge/br_if.c
index 5dbdfdfc3a34..1bacca4cb676 100644
--- a/net/bridge/br_if.c
+++ b/net/bridge/br_if.c
@@ -147,6 +147,7 @@ static void del_nbp(struct net_bridge_port *p)
         dev->priv_flags &= ~IFF_BRIDGE_PORT;
 
         netdev_rx_handler_unregister(dev);
+        synchronize_net();
 
         netdev_set_master(dev, NULL);
 
@@ -338,6 +339,8 @@ int br_add_if(struct net_bridge *br, struct net_device *dev)
         if (IS_ERR(p))
                 return PTR_ERR(p);
 
+        call_netdevice_notifiers(NETDEV_JOIN, dev);
+
         err = dev_set_promiscuity(dev, 1);
         if (err)
                 goto put_back;
diff --git a/net/bridge/br_netfilter.c b/net/bridge/br_netfilter.c
index e1f5ec75e91c..3fa123185e89 100644
--- a/net/bridge/br_netfilter.c
+++ b/net/bridge/br_netfilter.c
@@ -117,6 +117,10 @@ static struct dst_ops fake_dst_ops = {
  * ipt_REJECT needs it.  Future netfilter modules might
  * require us to fill additional fields.
  */
+static const u32 br_dst_default_metrics[RTAX_MAX] = {
+        [RTAX_MTU - 1] = 1500,
+};
+
 void br_netfilter_rtable_init(struct net_bridge *br)
 {
         struct rtable *rt = &br->fake_rtable;
@@ -124,7 +128,7 @@ void br_netfilter_rtable_init(struct net_bridge *br)
         atomic_set(&rt->dst.__refcnt, 1);
         rt->dst.dev = br->dev;
         rt->dst.path = &rt->dst;
-        dst_metric_set(&rt->dst, RTAX_MTU, 1500);
+        dst_init_metrics(&rt->dst, br_dst_default_metrics, true);
         rt->dst.flags   = DST_NOXFRM;
         rt->dst.ops = &fake_dst_ops;
 }
diff --git a/net/caif/caif_dev.c b/net/caif/caif_dev.c
index 366ca0fb7a29..682c0fedf360 100644
--- a/net/caif/caif_dev.c
+++ b/net/caif/caif_dev.c
@@ -142,6 +142,7 @@ static int receive(struct sk_buff *skb, struct net_device *dev,
 {
         struct cfpkt *pkt;
         struct caif_device_entry *caifd;
+        int err;
 
         pkt = cfpkt_fromnative(CAIF_DIR_IN, skb);
 
@@ -159,7 +160,11 @@ static int receive(struct sk_buff *skb, struct net_device *dev,
         caifd_hold(caifd);
         rcu_read_unlock();
 
-        caifd->layer.up->receive(caifd->layer.up, pkt);
+        err = caifd->layer.up->receive(caifd->layer.up, pkt);
+
+        /* For -EILSEQ the packet is not freed so so it now */
+        if (err == -EILSEQ)
+                cfpkt_destroy(pkt);
 
         /* Release reference to stack upwards */
         caifd_put(caifd);
diff --git a/net/caif/caif_socket.c b/net/caif/caif_socket.c
index b840395ced1d..a98628086452 100644
--- a/net/caif/caif_socket.c
+++ b/net/caif/caif_socket.c
@@ -19,7 +19,7 @@
 #include <linux/uaccess.h>
 #include <linux/debugfs.h>
 #include <linux/caif/caif_socket.h>
-#include <asm/atomic.h>
+#include <linux/atomic.h>
 #include <net/sock.h>
 #include <net/tcp_states.h>
 #include <net/caif/caif_layer.h>
@@ -816,6 +816,7 @@ static int caif_connect(struct socket *sock, struct sockaddr *uaddr,
                 if (sk->sk_shutdown & SHUTDOWN_MASK) {
                         /* Allow re-connect after SHUTDOWN_IND */
                         caif_disconnect_client(sock_net(sk), &cf_sk->layer);
+                        caif_free_client(&cf_sk->layer);
                         break;
                 }
                 /* No reconnect on a seqpacket socket */
@@ -926,7 +927,6 @@ static int caif_release(struct socket *sock)
 {
         struct sock *sk = sock->sk;
         struct caifsock *cf_sk = container_of(sk, struct caifsock, sk);
-        int res = 0;
 
         if (!sk)
                 return 0;
@@ -953,10 +953,7 @@ static int caif_release(struct socket *sock)
         sk->sk_state = CAIF_DISCONNECTED;
         sk->sk_shutdown = SHUTDOWN_MASK;
 
-        if (cf_sk->sk.sk_socket->state == SS_CONNECTED ||
-                cf_sk->sk.sk_socket->state == SS_CONNECTING)
-                res = caif_disconnect_client(sock_net(sk), &cf_sk->layer);
-
+        caif_disconnect_client(sock_net(sk), &cf_sk->layer);
         cf_sk->sk.sk_socket->state = SS_DISCONNECTING;
         wake_up_interruptible_poll(sk_sleep(sk), POLLERR|POLLHUP);
 
@@ -964,7 +961,7 @@ static int caif_release(struct socket *sock)
         sk_stream_kill_queues(&cf_sk->sk);
         release_sock(sk);
         sock_put(sk);
-        return res;
+        return 0;
 }
 
 /* Copied from af_unix.c:unix_poll(), added CAIF tx_flow handling */
@@ -1120,7 +1117,7 @@ static int caif_create(struct net *net, struct socket *sock, int protocol,
         set_rx_flow_on(cf_sk);
 
         /* Set default options on configuration */
-        cf_sk->sk.sk_priority= CAIF_PRIO_NORMAL;
+        cf_sk->sk.sk_priority = CAIF_PRIO_NORMAL;
         cf_sk->conn_req.link_selector = CAIF_LINK_LOW_LATENCY;
         cf_sk->conn_req.protocol = protocol;
         /* Increase the number of sockets created. */
diff --git a/net/caif/cfcnfg.c b/net/caif/cfcnfg.c
index 351c2ca7e7b9..52fe33bee029 100644
--- a/net/caif/cfcnfg.c
+++ b/net/caif/cfcnfg.c
@@ -182,39 +182,26 @@ static int cfcnfg_get_id_from_ifi(struct cfcnfg *cnfg, int ifi)
 
 int caif_disconnect_client(struct net *net, struct cflayer *adap_layer)
 {
-        u8 channel_id = 0;
-        int ret = 0;
-        struct cflayer *servl = NULL;
+        u8 channel_id;
         struct cfcnfg *cfg = get_cfcnfg(net);
 
         caif_assert(adap_layer != NULL);
-
-        channel_id = adap_layer->id;
-        if (adap_layer->dn == NULL || channel_id == 0) {
-                pr_err("adap_layer->dn == NULL or adap_layer->id is 0\n");
-                ret = -ENOTCONN;
-                goto end;
-        }
-
-        servl = cfmuxl_remove_uplayer(cfg->mux, channel_id);
-        if (servl == NULL) {
-                pr_err("PROTOCOL ERROR - "
-                                "Error removing service_layer Channel_Id(%d)",
-                                channel_id);
-                ret = -EINVAL;
-                goto end;
-        }
-
-        ret = cfctrl_linkdown_req(cfg->ctrl, channel_id, adap_layer);
-
-end:
         cfctrl_cancel_req(cfg->ctrl, adap_layer);
+        channel_id = adap_layer->id;
+        if (channel_id != 0) {
+                struct cflayer *servl;
+                servl = cfmuxl_remove_uplayer(cfg->mux, channel_id);
+                if (servl != NULL)
+                        layer_set_up(servl, NULL);
+        } else
+                pr_debug("nothing to disconnect\n");
+        cfctrl_linkdown_req(cfg->ctrl, channel_id, adap_layer);
 
         /* Do RCU sync before initiating cleanup */
         synchronize_rcu();
         if (adap_layer->ctrlcmd != NULL)
                 adap_layer->ctrlcmd(adap_layer, CAIF_CTRLCMD_DEINIT_RSP, 0);
-        return ret;
+        return 0;
 
 }
 EXPORT_SYMBOL(caif_disconnect_client);
@@ -400,6 +387,14 @@ cfcnfg_linkup_rsp(struct cflayer *layer, u8 channel_id, enum cfctrl_srv serv,
         struct cfcnfg_phyinfo *phyinfo;
         struct net_device *netdev;
 
+        if (channel_id == 0) {
+                pr_warn("received channel_id zero\n");
+                if (adapt_layer != NULL && adapt_layer->ctrlcmd != NULL)
+                        adapt_layer->ctrlcmd(adapt_layer,
+                                                CAIF_CTRLCMD_INIT_FAIL_RSP, 0);
+                return;
+        }
+
         rcu_read_lock();
 
         if (adapt_layer == NULL) {
@@ -523,7 +518,6 @@ got_phyid:
         phyinfo->use_stx = stx;
         phyinfo->use_fcs = fcs;
 
-        phy_layer->type = phy_type;
         frml = cffrml_create(phyid, fcs);
 
         if (!frml) {
diff --git a/net/caif/cfctrl.c b/net/caif/cfctrl.c
index 0c00a6015dda..e22671bed669 100644
--- a/net/caif/cfctrl.c
+++ b/net/caif/cfctrl.c
@@ -178,20 +178,23 @@ static void init_info(struct caif_payload_info *info, struct cfctrl *cfctrl)
 void cfctrl_enum_req(struct cflayer *layer, u8 physlinkid)
 {
         struct cfctrl *cfctrl = container_obj(layer);
-        int ret;
         struct cfpkt *pkt = cfpkt_create(CFPKT_CTRL_PKT_LEN);
+        struct cflayer *dn = cfctrl->serv.layer.dn;
         if (!pkt) {
                 pr_warn("Out of memory\n");
                 return;
         }
+        if (!dn) {
+                pr_debug("not able to send enum request\n");
+                return;
+        }
         caif_assert(offsetof(struct cfctrl, serv.layer) == 0);
         init_info(cfpkt_info(pkt), cfctrl);
         cfpkt_info(pkt)->dev_info->id = physlinkid;
         cfctrl->serv.dev_info.id = physlinkid;
         cfpkt_addbdy(pkt, CFCTRL_CMD_ENUM);
         cfpkt_addbdy(pkt, physlinkid);
-        ret =
-            cfctrl->serv.layer.dn->transmit(cfctrl->serv.layer.dn, pkt);
+        dn->transmit(dn, pkt);
 }
 
 int cfctrl_linkup_request(struct cflayer *layer,
@@ -206,6 +209,12 @@ int cfctrl_linkup_request(struct cflayer *layer,
         int ret;
         char utility_name[16];
         struct cfpkt *pkt;
+        struct cflayer *dn = cfctrl->serv.layer.dn;
+
+        if (!dn) {
+                pr_debug("not able to send linkup request\n");
+                return -ENODEV;
+        }
 
         if (cfctrl_cancel_req(layer, user_layer) > 0) {
                 /* Slight Paranoia, check if already connecting */
@@ -282,7 +291,7 @@ int cfctrl_linkup_request(struct cflayer *layer,
          */
         cfpkt_info(pkt)->dev_info->id = param->phyid;
         ret =
-            cfctrl->serv.layer.dn->transmit(cfctrl->serv.layer.dn, pkt);
+            dn->transmit(dn, pkt);
         if (ret < 0) {
                 int count;
 
@@ -301,15 +310,23 @@ int cfctrl_linkdown_req(struct cflayer *layer, u8 channelid,
         int ret;
         struct cfctrl *cfctrl = container_obj(layer);
         struct cfpkt *pkt = cfpkt_create(CFPKT_CTRL_PKT_LEN);
+        struct cflayer *dn = cfctrl->serv.layer.dn;
+
         if (!pkt) {
                 pr_warn("Out of memory\n");
                 return -ENOMEM;
         }
+
+        if (!dn) {
+                pr_debug("not able to send link-down request\n");
+                return -ENODEV;
+        }
+
         cfpkt_addbdy(pkt, CFCTRL_CMD_LINK_DESTROY);
         cfpkt_addbdy(pkt, channelid);
         init_info(cfpkt_info(pkt), cfctrl);
         ret =
-            cfctrl->serv.layer.dn->transmit(cfctrl->serv.layer.dn, pkt);
+            dn->transmit(dn, pkt);
 #ifndef CAIF_NO_LOOP
         cfctrl->loop_linkused[channelid] = 0;
 #endif
@@ -351,7 +368,8 @@ static int cfctrl_recv(struct cflayer *layer, struct cfpkt *pkt)
         cfpkt_extr_head(pkt, &cmdrsp, 1);
         cmd = cmdrsp & CFCTRL_CMD_MASK;
         if (cmd != CFCTRL_CMD_LINK_ERR
-            && CFCTRL_RSP_BIT != (CFCTRL_RSP_BIT & cmdrsp)) {
+            && CFCTRL_RSP_BIT != (CFCTRL_RSP_BIT & cmdrsp)
+                && CFCTRL_ERR_BIT != (CFCTRL_ERR_BIT & cmdrsp)) {
                 if (handle_loop(cfctrl, cmd, pkt) != 0)
                         cmdrsp |= CFCTRL_ERR_BIT;
         }
@@ -477,7 +495,7 @@ static int cfctrl_recv(struct cflayer *layer, struct cfpkt *pkt)
                                 cfpkt_extr_head(pkt, &param, len);
                                 break;
                         default:
-                                pr_warn("Request setup - invalid link type (%d)\n",
+                                pr_warn("Request setup, invalid type (%d)\n",
                                         serv);
                                 goto error;
                         }
@@ -489,7 +507,8 @@ static int cfctrl_recv(struct cflayer *layer, struct cfpkt *pkt)
 
                         if (CFCTRL_ERR_BIT == (CFCTRL_ERR_BIT & cmdrsp) ||
                                 cfpkt_erroneous(pkt)) {
-                                pr_err("Invalid O/E bit or parse error on CAIF control channel\n");
+                                pr_err("Invalid O/E bit or parse error "
+                                                "on CAIF control channel\n");
                                 cfctrl->res.reject_rsp(cfctrl->serv.layer.up,
                                                        0,
                                                        req ? req->client_layer
@@ -550,9 +569,8 @@ static void cfctrl_ctrlcmd(struct cflayer *layr, enum caif_ctrlcmd ctrl,
         case _CAIF_CTRLCMD_PHYIF_FLOW_OFF_IND:
         case CAIF_CTRLCMD_FLOW_OFF_IND:
                 spin_lock_bh(&this->info_list_lock);
-                if (!list_empty(&this->list)) {
+                if (!list_empty(&this->list))
                         pr_debug("Received flow off in control layer\n");
-                }
                 spin_unlock_bh(&this->info_list_lock);
                 break;
         case _CAIF_CTRLCMD_PHYIF_DOWN_IND: {
@@ -587,16 +605,16 @@ static int handle_loop(struct cfctrl *ctrl, int cmd, struct cfpkt *pkt)
         case CFCTRL_CMD_LINK_SETUP:
                 spin_lock_bh(&ctrl->loop_linkid_lock);
                 if (!dec) {
-                        for (linkid = last_linkid + 1; linkid < 255; linkid++)
+                        for (linkid = last_linkid + 1; linkid < 254; linkid++)
                                 if (!ctrl->loop_linkused[linkid])
                                         goto found;
                 }
                 dec = 1;
-                for (linkid = last_linkid - 1; linkid > 0; linkid--)
+                for (linkid = last_linkid - 1; linkid > 1; linkid--)
                         if (!ctrl->loop_linkused[linkid])
                                 goto found;
                 spin_unlock_bh(&ctrl->loop_linkid_lock);
-
+                return -1;
 found:
                 if (linkid < 10)
                         dec = 0;
diff --git a/net/caif/cfmuxl.c b/net/caif/cfmuxl.c
index 2a56df7e0a4b..3a66b8c10e09 100644
--- a/net/caif/cfmuxl.c
+++ b/net/caif/cfmuxl.c
@@ -62,16 +62,6 @@ struct cflayer *cfmuxl_create(void)
         return &this->layer;
 }
 
-int cfmuxl_set_uplayer(struct cflayer *layr, struct cflayer *up, u8 linkid)
-{
-        struct cfmuxl *muxl = container_obj(layr);
-
-        spin_lock_bh(&muxl->receive_lock);
-        list_add_rcu(&up->node, &muxl->srvl_list);
-        spin_unlock_bh(&muxl->receive_lock);
-        return 0;
-}
-
 int cfmuxl_set_dnlayer(struct cflayer *layr, struct cflayer *dn, u8 phyid)
 {
         struct cfmuxl *muxl = (struct cfmuxl *) layr;
@@ -93,6 +83,24 @@ static struct cflayer *get_from_id(struct list_head *list, u16 id)
         return NULL;
 }
 
+int cfmuxl_set_uplayer(struct cflayer *layr, struct cflayer *up, u8 linkid)
+{
+        struct cfmuxl *muxl = container_obj(layr);
+        struct cflayer *old;
+
+        spin_lock_bh(&muxl->receive_lock);
+
+        /* Two entries with same id is wrong, so remove old layer from mux */
+        old = get_from_id(&muxl->srvl_list, linkid);
+        if (old != NULL)
+                list_del_rcu(&old->node);
+
+        list_add_rcu(&up->node, &muxl->srvl_list);
+        spin_unlock_bh(&muxl->receive_lock);
+
+        return 0;
+}
+
 struct cflayer *cfmuxl_remove_dnlayer(struct cflayer *layr, u8 phyid)
 {
         struct cfmuxl *muxl = container_obj(layr);
@@ -146,6 +154,11 @@ struct cflayer *cfmuxl_remove_uplayer(struct cflayer *layr, u8 id)
         struct cfmuxl *muxl = container_obj(layr);
         int idx = id % UP_CACHE_SIZE;
 
+        if (id == 0) {
+                pr_warn("Trying to remove control layer\n");
+                return NULL;
+        }
+
         spin_lock_bh(&muxl->receive_lock);
         up = get_from_id(&muxl->srvl_list, id);
         if (up == NULL)
@@ -235,12 +248,26 @@ static void cfmuxl_ctrlcmd(struct cflayer *layr, enum caif_ctrlcmd ctrl,
 {
         struct cfmuxl *muxl = container_obj(layr);
         struct cflayer *layer;
+        int idx;
 
         rcu_read_lock();
         list_for_each_entry_rcu(layer, &muxl->srvl_list, node) {
-                if (cfsrvl_phyid_match(layer, phyid) && layer->ctrlcmd)
+
+                if (cfsrvl_phyid_match(layer, phyid) && layer->ctrlcmd) {
+
+                        if ((ctrl == _CAIF_CTRLCMD_PHYIF_FLOW_OFF_IND ||
+                                ctrl == CAIF_CTRLCMD_REMOTE_SHUTDOWN_IND) &&
+                                        layer->id != 0) {
+
+                                idx = layer->id % UP_CACHE_SIZE;
+                                spin_lock_bh(&muxl->receive_lock);
+                                rcu_assign_pointer(muxl->up_cache[idx], NULL);
+                                list_del_rcu(&layer->node);
+                                spin_unlock_bh(&muxl->receive_lock);
+                        }
                         /* NOTE: ctrlcmd is not allowed to block */
                         layer->ctrlcmd(layer, ctrl, phyid);
+                }
         }
         rcu_read_unlock();
 }
diff --git a/net/can/bcm.c b/net/can/bcm.c
index cced806098a9..184a6572b67e 100644
--- a/net/can/bcm.c
+++ b/net/can/bcm.c
@@ -165,9 +165,9 @@ static int bcm_proc_show(struct seq_file *m, void *v)
         struct bcm_sock *bo = bcm_sk(sk);
         struct bcm_op *op;
 
-        seq_printf(m, ">>> socket %p", sk->sk_socket);
-        seq_printf(m, " / sk %p", sk);
-        seq_printf(m, " / bo %p", bo);
+        seq_printf(m, ">>> socket %pK", sk->sk_socket);
+        seq_printf(m, " / sk %pK", sk);
+        seq_printf(m, " / bo %pK", bo);
         seq_printf(m, " / dropped %lu", bo->dropped_usr_msgs);
         seq_printf(m, " / bound %s", bcm_proc_getifname(ifname, bo->ifindex));
         seq_printf(m, " <<<\n");
diff --git a/net/ceph/messenger.c b/net/ceph/messenger.c
index e15a82ccc05f..78b55f49de7c 100644
--- a/net/ceph/messenger.c
+++ b/net/ceph/messenger.c
@@ -76,7 +76,8 @@ const char *ceph_pr_addr(const struct sockaddr_storage *ss)
                 break;
 
         default:
-                sprintf(s, "(unknown sockaddr family %d)", (int)ss->ss_family);
+                snprintf(s, MAX_ADDR_STR_LEN, "(unknown sockaddr family %d)",
+                         (int)ss->ss_family);
         }
 
         return s;
@@ -598,7 +599,7 @@ static void prepare_write_keepalive(struct ceph_connection *con)
  * Connection negotiation.
  */
 
-static void prepare_connect_authorizer(struct ceph_connection *con)
+static int prepare_connect_authorizer(struct ceph_connection *con)
 {
         void *auth_buf;
         int auth_len = 0;
@@ -612,13 +613,20 @@ static void prepare_connect_authorizer(struct ceph_connection *con)
                                          con->auth_retry);
         mutex_lock(&con->mutex);
 
+        if (test_bit(CLOSED, &con->state) ||
+            test_bit(OPENING, &con->state))
+                return -EAGAIN;
+
         con->out_connect.authorizer_protocol = cpu_to_le32(auth_protocol);
         con->out_connect.authorizer_len = cpu_to_le32(auth_len);
 
-        con->out_kvec[con->out_kvec_left].iov_base = auth_buf;
-        con->out_kvec[con->out_kvec_left].iov_len = auth_len;
-        con->out_kvec_left++;
-        con->out_kvec_bytes += auth_len;
+        if (auth_len) {
+                con->out_kvec[con->out_kvec_left].iov_base = auth_buf;
+                con->out_kvec[con->out_kvec_left].iov_len = auth_len;
+                con->out_kvec_left++;
+                con->out_kvec_bytes += auth_len;
+        }
+        return 0;
 }
 
 /*
@@ -640,9 +648,9 @@ static void prepare_write_banner(struct ceph_messenger *msgr,
         set_bit(WRITE_PENDING, &con->state);
 }
 
-static void prepare_write_connect(struct ceph_messenger *msgr,
-                                  struct ceph_connection *con,
-                                  int after_banner)
+static int prepare_write_connect(struct ceph_messenger *msgr,
+                                 struct ceph_connection *con,
+                                 int after_banner)
 {
         unsigned global_seq = get_global_seq(con->msgr, 0);
         int proto;
@@ -683,7 +691,7 @@ static void prepare_write_connect(struct ceph_messenger *msgr,
         con->out_more = 0;
         set_bit(WRITE_PENDING, &con->state);
 
-        prepare_connect_authorizer(con);
+        return prepare_connect_authorizer(con);
 }
 
 
@@ -1065,8 +1073,10 @@ static void addr_set_port(struct sockaddr_storage *ss, int p)
         switch (ss->ss_family) {
         case AF_INET:
                 ((struct sockaddr_in *)ss)->sin_port = htons(p);
+                break;
         case AF_INET6:
                 ((struct sockaddr_in6 *)ss)->sin6_port = htons(p);
+                break;
         }
 }
 
@@ -1216,6 +1226,7 @@ static int process_connect(struct ceph_connection *con)
         u64 sup_feat = con->msgr->supported_features;
         u64 req_feat = con->msgr->required_features;
         u64 server_feat = le64_to_cpu(con->in_reply.features);
+        int ret;
 
         dout("process_connect on %p tag %d\n", con, (int)con->in_tag);
 
@@ -1250,7 +1261,9 @@ static int process_connect(struct ceph_connection *con)
                         return -1;
                 }
                 con->auth_retry = 1;
-                prepare_write_connect(con->msgr, con, 0);
+                ret = prepare_write_connect(con->msgr, con, 0);
+                if (ret < 0)
+                        return ret;
                 prepare_read_connect(con);
                 break;
 
@@ -1277,6 +1290,9 @@ static int process_connect(struct ceph_connection *con)
                 if (con->ops->peer_reset)
                         con->ops->peer_reset(con);
                 mutex_lock(&con->mutex);
+                if (test_bit(CLOSED, &con->state) ||
+                    test_bit(OPENING, &con->state))
+                        return -EAGAIN;
                 break;
 
         case CEPH_MSGR_TAG_RETRY_SESSION:
@@ -1341,7 +1357,9 @@ static int process_connect(struct ceph_connection *con)
                  * to WAIT.  This shouldn't happen if we are the
                  * client.
                  */
-                pr_err("process_connect peer connecting WAIT\n");
+                pr_err("process_connect got WAIT as client\n");
+                con->error_msg = "protocol error, got WAIT as client";
+                return -1;
 
         default:
                 pr_err("connect protocol error, will retry\n");
@@ -1810,6 +1828,17 @@ static int try_read(struct ceph_connection *con)
 more:
         dout("try_read tag %d in_base_pos %d\n", (int)con->in_tag,
              con->in_base_pos);
+
+        /*
+         * process_connect and process_message drop and re-take
+         * con->mutex.  make sure we handle a racing close or reopen.
+         */
+        if (test_bit(CLOSED, &con->state) ||
+            test_bit(OPENING, &con->state)) {
+                ret = -EAGAIN;
+                goto out;
+        }
+
         if (test_bit(CONNECTING, &con->state)) {
                 if (!test_bit(NEGOTIATING, &con->state)) {
                         dout("try_read connecting\n");
@@ -1938,8 +1967,10 @@ static void con_work(struct work_struct *work)
 {
         struct ceph_connection *con = container_of(work, struct ceph_connection,
                                                    work.work);
+        int ret;
 
         mutex_lock(&con->mutex);
+restart:
         if (test_and_clear_bit(BACKOFF, &con->state)) {
                 dout("con_work %p backing off\n", con);
                 if (queue_delayed_work(ceph_msgr_wq, &con->work,
@@ -1969,18 +2000,31 @@ static void con_work(struct work_struct *work)
                 con_close_socket(con);
         }
 
-        if (test_and_clear_bit(SOCK_CLOSED, &con->state) ||
-            try_read(con) < 0 ||
-            try_write(con) < 0) {
-                mutex_unlock(&con->mutex);
-                ceph_fault(con);     /* error/fault path */
-                goto done_unlocked;
-        }
+        if (test_and_clear_bit(SOCK_CLOSED, &con->state))
+                goto fault;
+
+        ret = try_read(con);
+        if (ret == -EAGAIN)
+                goto restart;
+        if (ret < 0)
+                goto fault;
+
+        ret = try_write(con);
+        if (ret == -EAGAIN)
+                goto restart;
+        if (ret < 0)
+                goto fault;
 
 done:
         mutex_unlock(&con->mutex);
 done_unlocked:
         con->ops->put(con);
+        return;
+
+fault:
+        mutex_unlock(&con->mutex);
+        ceph_fault(con);     /* error/fault path */
+        goto done_unlocked;
 }
 
 
diff --git a/net/ceph/osd_client.c b/net/ceph/osd_client.c
index 6b5dda1cb5df..6ea2b892f44b 100644
--- a/net/ceph/osd_client.c
+++ b/net/ceph/osd_client.c
@@ -124,7 +124,7 @@ static void calc_layout(struct ceph_osd_client *osdc,
         ceph_calc_raw_layout(osdc, layout, vino.snap, off,
                              plen, &bno, req, op);
 
-        sprintf(req->r_oid, "%llx.%08llx", vino.ino, bno);
+        snprintf(req->r_oid, sizeof(req->r_oid), "%llx.%08llx", vino.ino, bno);
         req->r_oid_len = strlen(req->r_oid);
 }
 
@@ -1421,6 +1421,15 @@ void ceph_osdc_handle_map(struct ceph_osd_client *osdc, struct ceph_msg *msg)
 done:
         downgrade_write(&osdc->map_sem);
         ceph_monc_got_osdmap(&osdc->client->monc, osdc->osdmap->epoch);
+
+        /*
+         * subscribe to subsequent osdmap updates if full to ensure
+         * we find out when we are no longer full and stop returning
+         * ENOSPC.
+         */
+        if (ceph_osdmap_flag(osdc->osdmap, CEPH_OSDMAP_FULL))
+                ceph_monc_request_next_osdmap(&osdc->client->monc);
+
         send_queued(osdc);
         up_read(&osdc->map_sem);
         wake_up_all(&osdc->client->auth_wq);
@@ -1677,8 +1686,14 @@ int ceph_osdc_start_request(struct ceph_osd_client *osdc,
          */
         if (req->r_sent == 0) {
                 rc = __map_request(osdc, req);
-                if (rc < 0)
+                if (rc < 0) {
+                        if (nofail) {
+                                dout("osdc_start_request failed map, "
+                                     " will retry %lld\n", req->r_tid);
+                                rc = 0;
+                        }
                         goto out_unlock;
+                }
                 if (req->r_osd == NULL) {
                         dout("send_request %p no up osds in pg\n", req);
                         ceph_monc_request_next_osdmap(&osdc->client->monc);
diff --git a/net/ceph/osdmap.c b/net/ceph/osdmap.c
index 71603ac3dff5..e97c3588c3ec 100644
--- a/net/ceph/osdmap.c
+++ b/net/ceph/osdmap.c
@@ -765,7 +765,7 @@ struct ceph_osdmap *osdmap_apply_incremental(void **p, void *end,
         }
 
         map->epoch++;
-        map->modified = map->modified;
+        map->modified = modified;
         if (newcrush) {
                 if (map->crush)
                         crush_destroy(map->crush);
@@ -830,15 +830,20 @@ struct ceph_osdmap *osdmap_apply_incremental(void **p, void *end,
                 map->osd_addr[osd] = addr;
         }
 
-        /* new_down */
+        /* new_state */
         ceph_decode_32_safe(p, end, len, bad);
         while (len--) {
                 u32 osd;
+                u8 xorstate;
                 ceph_decode_32_safe(p, end, osd, bad);
+                xorstate = **(u8 **)p;
                 (*p)++;  /* clean flag */
-                pr_info("osd%d down\n", osd);
+                if (xorstate == 0)
+                        xorstate = CEPH_OSD_UP;
+                if (xorstate & CEPH_OSD_UP)
+                        pr_info("osd%d down\n", osd);
                 if (osd < map->max_osd)
-                        map->osd_state[osd] &= ~CEPH_OSD_UP;
+                        map->osd_state[osd] ^= xorstate;
         }
 
         /* new_weight */
diff --git a/net/core/dev.c b/net/core/dev.c
index d94537914a71..c7e305d13b71 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -1308,6 +1308,13 @@ void dev_disable_lro(struct net_device *dev)
 {
         u32 flags;
 
+        /*
+         * If we're trying to disable lro on a vlan device
+         * use the underlying physical device instead
+         */
+        if (is_vlan_dev(dev))
+                dev = vlan_dev_real_dev(dev);
+
         if (dev->ethtool_ops && dev->ethtool_ops->get_flags)
                 flags = dev->ethtool_ops->get_flags(dev);
         else
@@ -4294,10 +4301,8 @@ int netdev_set_master(struct net_device *slave, struct net_device *master)
 
         slave->master = master;
 
-        if (old) {
-                synchronize_net();
+        if (old)
                 dev_put(old);
-        }
         return 0;
 }
 EXPORT_SYMBOL(netdev_set_master);
@@ -5956,7 +5961,10 @@ EXPORT_SYMBOL(free_netdev);
 void synchronize_net(void)
 {
         might_sleep();
-        synchronize_rcu();
+        if (rtnl_is_locked())
+                synchronize_rcu_expedited();
+        else
+                synchronize_rcu();
 }
 EXPORT_SYMBOL(synchronize_net);
 
diff --git a/net/core/dst.c b/net/core/dst.c
index 81a4fa1c95ed..9ccca038444f 100644
--- a/net/core/dst.c
+++ b/net/core/dst.c
@@ -315,7 +315,7 @@ void __dst_destroy_metrics_generic(struct dst_entry *dst, unsigned long old)
 {
         unsigned long prev, new;
 
-        new = (unsigned long) dst_default_metrics;
+        new = ((unsigned long) dst_default_metrics) | DST_METRICS_READ_ONLY;
         prev = cmpxchg(&dst->_metrics, old, new);
         if (prev == old)
                 kfree(__DST_METRICS_PTR(old));
diff --git a/net/core/fib_rules.c b/net/core/fib_rules.c
index 3911586e12e4..008dc70b064b 100644
--- a/net/core/fib_rules.c
+++ b/net/core/fib_rules.c
@@ -602,6 +602,7 @@ static int dump_rules(struct sk_buff *skb, struct netlink_callback *cb,
 skip:
                 idx++;
         }
+        rcu_read_unlock();
         cb->args[1] = idx;
         rules_ops_put(ops);
 
diff --git a/net/core/filter.c b/net/core/filter.c
index 0eb8c4466eaa..0e3622f1dcb1 100644
--- a/net/core/filter.c
+++ b/net/core/filter.c
@@ -350,7 +350,9 @@ load_b:
                         continue;
                 }
                 default:
-                        WARN_ON(1);
+                        WARN_RATELIMIT(1, "Unknown code:%u jt:%u tf:%u k:%u\n",
+                                       fentry->code, fentry->jt,
+                                       fentry->jf, fentry->k);
                         return 0;
                 }
         }
diff --git a/net/core/net_namespace.c b/net/core/net_namespace.c
index 2e2dce6583e1..6c6b86d0da15 100644
--- a/net/core/net_namespace.c
+++ b/net/core/net_namespace.c
@@ -8,6 +8,8 @@
 #include <linux/idr.h>
 #include <linux/rculist.h>
 #include <linux/nsproxy.h>
+#include <linux/proc_fs.h>
+#include <linux/file.h>
 #include <net/net_namespace.h>
 #include <net/netns/generic.h>
 
@@ -302,6 +304,28 @@ void __put_net(struct net *net)
 }
 EXPORT_SYMBOL_GPL(__put_net);
 
+struct net *get_net_ns_by_fd(int fd)
+{
+        struct proc_inode *ei;
+        struct file *file;
+        struct net *net;
+
+        net = ERR_PTR(-EINVAL);
+        file = proc_ns_fget(fd);
+        if (!file)
+                goto out;
+
+        ei = PROC_I(file->f_dentry->d_inode);
+        if (ei->ns_ops != &netns_operations)
+                goto out;
+
+        net = get_net(ei->ns);
+out:
+        if (file)
+                fput(file);
+        return net;
+}
+
 #else
 struct net *copy_net_ns(unsigned long flags, struct net *old_net)
 {
@@ -309,6 +333,11 @@ struct net *copy_net_ns(unsigned long flags, struct net *old_net)
                 return ERR_PTR(-EINVAL);
         return old_net;
 }
+
+struct net *get_net_ns_by_fd(int fd)
+{
+        return ERR_PTR(-EINVAL);
+}
 #endif
 
 struct net *get_net_ns_by_pid(pid_t pid)
@@ -561,3 +590,39 @@ void unregister_pernet_device(struct pernet_operations *ops)
         mutex_unlock(&net_mutex);
 }
 EXPORT_SYMBOL_GPL(unregister_pernet_device);
+
+#ifdef CONFIG_NET_NS
+static void *netns_get(struct task_struct *task)
+{
+        struct net *net = NULL;
+        struct nsproxy *nsproxy;
+
+        rcu_read_lock();
+        nsproxy = task_nsproxy(task);
+        if (nsproxy)
+                net = get_net(nsproxy->net_ns);
+        rcu_read_unlock();
+
+        return net;
+}
+
+static void netns_put(void *ns)
+{
+        put_net(ns);
+}
+
+static int netns_install(struct nsproxy *nsproxy, void *ns)
+{
+        put_net(nsproxy->net_ns);
+        nsproxy->net_ns = get_net(ns);
+        return 0;
+}
+
+const struct proc_ns_operations netns_operations = {
+        .name           = "net",
+        .type           = CLONE_NEWNET,
+        .get            = netns_get,
+        .put            = netns_put,
+        .install        = netns_install,
+};
+#endif
diff --git a/net/core/pktgen.c b/net/core/pktgen.c
index 67870e9fd097..f76079cd750c 100644
--- a/net/core/pktgen.c
+++ b/net/core/pktgen.c
@@ -3544,13 +3544,12 @@ static int pktgen_add_device(struct pktgen_thread *t, const char *ifname)
                 return -ENOMEM;
 
         strcpy(pkt_dev->odevname, ifname);
-        pkt_dev->flows = vmalloc_node(MAX_CFLOWS * sizeof(struct flow_state),
+        pkt_dev->flows = vzalloc_node(MAX_CFLOWS * sizeof(struct flow_state),
                                       node);
         if (pkt_dev->flows == NULL) {
                 kfree(pkt_dev);
                 return -ENOMEM;
         }
-        memset(pkt_dev->flows, 0, MAX_CFLOWS * sizeof(struct flow_state));
 
         pkt_dev->removal_mark = 0;
         pkt_dev->min_pkt_size = ETH_ZLEN;
@@ -3708,6 +3707,7 @@ static int __init pg_init(void)
 {
         int cpu;
         struct proc_dir_entry *pe;
+        int ret = 0;
 
         pr_info("%s", version);
 
@@ -3718,11 +3718,10 @@ static int __init pg_init(void)
         pe = proc_create(PGCTRL, 0600, pg_proc_dir, &pktgen_fops);
         if (pe == NULL) {
                 pr_err("ERROR: cannot create %s procfs entry\n", PGCTRL);
-                proc_net_remove(&init_net, PG_PROC_DIR);
-                return -EINVAL;
+                ret = -EINVAL;
+                goto remove_dir;
         }
 
-        /* Register us to receive netdevice events */
         register_netdevice_notifier(&pktgen_notifier_block);
 
         for_each_online_cpu(cpu) {
@@ -3736,13 +3735,18 @@ static int __init pg_init(void)
 
         if (list_empty(&pktgen_threads)) {
                 pr_err("ERROR: Initialization failed for all threads\n");
-                unregister_netdevice_notifier(&pktgen_notifier_block);
-                remove_proc_entry(PGCTRL, pg_proc_dir);
-                proc_net_remove(&init_net, PG_PROC_DIR);
-                return -ENODEV;
+                ret = -ENODEV;
+                goto unregister;
         }
 
         return 0;
+
+ unregister:
+        unregister_netdevice_notifier(&pktgen_notifier_block);
+        remove_proc_entry(PGCTRL, pg_proc_dir);
+ remove_dir:
+        proc_net_remove(&init_net, PG_PROC_DIR);
+        return ret;
 }
 
 static void __exit pg_cleanup(void)
diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
index d2ba2597c75a..abd936d8a716 100644
--- a/net/core/rtnetlink.c
+++ b/net/core/rtnetlink.c
@@ -850,6 +850,7 @@ static int rtnl_fill_ifinfo(struct sk_buff *skb, struct net_device *dev,
         struct nlattr *attr, *af_spec;
         struct rtnl_af_ops *af_ops;
 
+        ASSERT_RTNL();
         nlh = nlmsg_put(skb, pid, seq, type, sizeof(*ifm), flags);
         if (nlh == NULL)
                 return -EMSGSIZE;
@@ -1045,6 +1046,7 @@ const struct nla_policy ifla_policy[IFLA_MAX+1] = {
         [IFLA_LINKMODE]         = { .type = NLA_U8 },
         [IFLA_LINKINFO]         = { .type = NLA_NESTED },
         [IFLA_NET_NS_PID]       = { .type = NLA_U32 },
+        [IFLA_NET_NS_FD]        = { .type = NLA_U32 },
         [IFLA_IFALIAS]          = { .type = NLA_STRING, .len = IFALIASZ-1 },
         [IFLA_VFINFO_LIST]      = {. type = NLA_NESTED },
         [IFLA_VF_PORTS]         = { .type = NLA_NESTED },
@@ -1093,6 +1095,8 @@ struct net *rtnl_link_get_net(struct net *src_net, struct nlattr *tb[])
          */
         if (tb[IFLA_NET_NS_PID])
                 net = get_net_ns_by_pid(nla_get_u32(tb[IFLA_NET_NS_PID]));
+        else if (tb[IFLA_NET_NS_FD])
+                net = get_net_ns_by_fd(nla_get_u32(tb[IFLA_NET_NS_FD]));
         else
                 net = get_net(src_net);
         return net;
@@ -1223,7 +1227,7 @@ static int do_setlink(struct net_device *dev, struct ifinfomsg *ifm,
         int send_addr_notify = 0;
         int err;
 
-        if (tb[IFLA_NET_NS_PID]) {
+        if (tb[IFLA_NET_NS_PID] || tb[IFLA_NET_NS_FD]) {
                 struct net *net = rtnl_link_get_net(dev_net(dev), tb);
                 if (IS_ERR(net)) {
                         err = PTR_ERR(net);
@@ -1876,6 +1880,7 @@ static int rtnetlink_rcv_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
         int min_len;
         int family;
         int type;
+        int err;
 
         type = nlh->nlmsg_type;
         if (type > RTM_MAX)
@@ -1902,8 +1907,11 @@ static int rtnetlink_rcv_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
                 if (dumpit == NULL)
                         return -EOPNOTSUPP;
 
+                __rtnl_unlock();
                 rtnl = net->rtnl;
-                return netlink_dump_start(rtnl, skb, nlh, dumpit, NULL);
+                err = netlink_dump_start(rtnl, skb, nlh, dumpit, NULL);
+                rtnl_lock();
+                return err;
         }
 
         memset(rta_buf, 0, (rtattr_max * sizeof(struct rtattr *)));
@@ -1956,6 +1964,8 @@ static int rtnetlink_event(struct notifier_block *this, unsigned long event, voi
         case NETDEV_GOING_DOWN:
         case NETDEV_UNREGISTER:
         case NETDEV_UNREGISTER_BATCH:
+        case NETDEV_RELEASE:
+        case NETDEV_JOIN:
                 break;
         default:
                 rtmsg_ifinfo(RTM_NEWLINK, dev, 0);
@@ -1973,7 +1983,7 @@ static int __net_init rtnetlink_net_init(struct net *net)
 {
         struct sock *sk;
         sk = netlink_kernel_create(net, NETLINK_ROUTE, RTNLGRP_MAX,
-                                   rtnetlink_rcv, NULL, THIS_MODULE);
+                                   rtnetlink_rcv, &rtnl_mutex, THIS_MODULE);
         if (!sk)
                 return -ENOMEM;
         net->rtnl = sk;
diff --git a/net/dns_resolver/dns_key.c b/net/dns_resolver/dns_key.c
index cfa7a5e1c5c9..fa000d26dc60 100644
--- a/net/dns_resolver/dns_key.c
+++ b/net/dns_resolver/dns_key.c
@@ -212,10 +212,12 @@ static void dns_resolver_describe(const struct key *key, struct seq_file *m)
         int err = key->type_data.x[0];
 
         seq_puts(m, key->description);
-        if (err)
-                seq_printf(m, ": %d", err);
-        else
-                seq_printf(m, ": %u", key->datalen);
+        if (key_is_instantiated(key)) {
+                if (err)
+                        seq_printf(m, ": %d", err);
+                else
+                        seq_printf(m, ": %u", key->datalen);
+        }
 }
 
 /*
diff --git a/net/ipv4/fib_trie.c b/net/ipv4/fib_trie.c
index c779ce96e5b5..58c25ea5a5c1 100644
--- a/net/ipv4/fib_trie.c
+++ b/net/ipv4/fib_trie.c
@@ -72,6 +72,7 @@
 #include <linux/init.h>
 #include <linux/list.h>
 #include <linux/slab.h>
+#include <linux/prefetch.h>
 #include <net/net_namespace.h>
 #include <net/ip.h>
 #include <net/protocol.h>
diff --git a/net/ipv4/igmp.c b/net/ipv4/igmp.c
index 672e476c8c8a..f1d27f6c9351 100644
--- a/net/ipv4/igmp.c
+++ b/net/ipv4/igmp.c
@@ -1155,20 +1155,18 @@ static void igmp_group_dropped(struct ip_mc_list *im)
 
         if (!in_dev->dead) {
                 if (IGMP_V1_SEEN(in_dev))
-                        goto done;
+                        return;
                 if (IGMP_V2_SEEN(in_dev)) {
                         if (reporter)
                                 igmp_send_report(in_dev, im, IGMP_HOST_LEAVE_MESSAGE);
-                        goto done;
+                        return;
                 }
                 /* IGMPv3 */
                 igmpv3_add_delrec(in_dev, im);
 
                 igmp_ifc_event(in_dev);
         }
-done:
 #endif
-        ip_mc_clear_src(im);
 }
 
 static void igmp_group_added(struct ip_mc_list *im)
@@ -1305,6 +1303,7 @@ void ip_mc_dec_group(struct in_device *in_dev, __be32 addr)
                                 *ip = i->next_rcu;
                                 in_dev->mc_count--;
                                 igmp_group_dropped(i);
+                                ip_mc_clear_src(i);
 
                                 if (!in_dev->dead)
                                         ip_rt_multicast_event(in_dev);
@@ -1414,7 +1413,8 @@ void ip_mc_destroy_dev(struct in_device *in_dev)
                 in_dev->mc_list = i->next_rcu;
                 in_dev->mc_count--;
 
-                igmp_group_dropped(i);
+                /* We've dropped the groups in ip_mc_down already */
+                ip_mc_clear_src(i);
                 ip_ma_put(i);
         }
 }
diff --git a/net/ipv4/inet_connection_sock.c b/net/ipv4/inet_connection_sock.c
index 61fac4cabc78..c14d88ad348d 100644
--- a/net/ipv4/inet_connection_sock.c
+++ b/net/ipv4/inet_connection_sock.c
@@ -33,7 +33,7 @@ EXPORT_SYMBOL(inet_csk_timer_bug_msg);
  * This struct holds the first and last local port number.
  */
 struct local_ports sysctl_local_ports __read_mostly = {
-        .lock = SEQLOCK_UNLOCKED,
+        .lock = __SEQLOCK_UNLOCKED(sysctl_local_ports.lock),
         .range = { 32768, 61000 },
 };
 
diff --git a/net/ipv4/ping.c b/net/ipv4/ping.c
index 1f3bb11490c9..9aaa67165f42 100644
--- a/net/ipv4/ping.c
+++ b/net/ipv4/ping.c
@@ -137,9 +137,6 @@ static void ping_v4_unhash(struct sock *sk)
         struct inet_sock *isk = inet_sk(sk);
         pr_debug("ping_v4_unhash(isk=%p,isk->num=%u)\n", isk, isk->inet_num);
         if (sk_hashed(sk)) {
-                struct hlist_nulls_head *hslot;
-
-                hslot = ping_hashslot(&ping_table, sock_net(sk), isk->inet_num);
                 write_lock_bh(&ping_table.lock);
                 hlist_nulls_del(&sk->sk_nulls_node);
                 sock_put(sk);
diff --git a/net/ipv4/raw.c b/net/ipv4/raw.c
index 11e1780455f2..c9893d43242e 100644
--- a/net/ipv4/raw.c
+++ b/net/ipv4/raw.c
@@ -979,7 +979,7 @@ static void raw_sock_seq_show(struct seq_file *seq, struct sock *sp, int i)
               srcp  = inet->inet_num;
 
         seq_printf(seq, "%4d: %08X:%04X %08X:%04X"
-                " %02X %08X:%08X %02X:%08lX %08X %5d %8d %lu %d %p %d\n",
+                " %02X %08X:%08X %02X:%08lX %08X %5d %8d %lu %d %pK %d\n",
                 i, src, srcp, dest, destp, sp->sk_state,
                 sk_wmem_alloc_get(sp),
                 sk_rmem_alloc_get(sp),
diff --git a/net/ipv4/route.c b/net/ipv4/route.c
index b24d58e6bbcd..52b0b956508b 100644
--- a/net/ipv4/route.c
+++ b/net/ipv4/route.c
@@ -1665,6 +1665,7 @@ static int ip_rt_bug(struct sk_buff *skb)
                 &ip_hdr(skb)->saddr, &ip_hdr(skb)->daddr,
                 skb->dev ? skb->dev->name : "?");
         kfree_skb(skb);
+        WARN_ON(1);
         return 0;
 }
 
diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
index 3c8d9b6f1ea4..a7d6671e33b8 100644
--- a/net/ipv4/tcp_ipv4.c
+++ b/net/ipv4/tcp_ipv4.c
@@ -2371,7 +2371,7 @@ static void get_openreq4(struct sock *sk, struct request_sock *req,
         int ttd = req->expires - jiffies;
 
         seq_printf(f, "%4d: %08X:%04X %08X:%04X"
-                " %02X %08X:%08X %02X:%08lX %08X %5d %8d %u %d %p%n",
+                " %02X %08X:%08X %02X:%08lX %08X %5d %8d %u %d %pK%n",
                 i,
                 ireq->loc_addr,
                 ntohs(inet_sk(sk)->inet_sport),
@@ -2426,7 +2426,7 @@ static void get_tcp4_sock(struct sock *sk, struct seq_file *f, int i, int *len)
                 rx_queue = max_t(int, tp->rcv_nxt - tp->copied_seq, 0);
 
         seq_printf(f, "%4d: %08X:%04X %08X:%04X %02X %08X:%08X %02X:%08lX "
-                        "%08X %5d %8d %lu %d %p %lu %lu %u %u %d%n",
+                        "%08X %5d %8d %lu %d %pK %lu %lu %u %u %d%n",
                 i, src, srcp, dest, destp, sk->sk_state,
                 tp->write_seq - tp->snd_una,
                 rx_queue,
@@ -2461,7 +2461,7 @@ static void get_timewait4_sock(struct inet_timewait_sock *tw,
         srcp  = ntohs(tw->tw_sport);
 
         seq_printf(f, "%4d: %08X:%04X %08X:%04X"
-                " %02X %08X:%08X %02X:%08lX %08X %5d %8d %d %d %p%n",
+                " %02X %08X:%08X %02X:%08lX %08X %5d %8d %d %d %pK%n",
                 i, src, srcp, dest, destp, tw->tw_substate, 0, 0,
                 3, jiffies_to_clock_t(ttd), 0, 0, 0, 0,
                 atomic_read(&tw->tw_refcnt), tw, len);
diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
index 599374f65c76..abca870d8ff6 100644
--- a/net/ipv4/udp.c
+++ b/net/ipv4/udp.c
@@ -2090,7 +2090,7 @@ static void udp4_format_sock(struct sock *sp, struct seq_file *f,
         __u16 srcp        = ntohs(inet->inet_sport);
 
         seq_printf(f, "%5d: %08X:%04X %08X:%04X"
-                " %02X %08X:%08X %02X:%08lX %08X %5d %8d %lu %d %p %d%n",
+                " %02X %08X:%08X %02X:%08lX %08X %5d %8d %lu %d %pK %d%n",
                 bucket, src, srcp, dest, destp, sp->sk_state,
                 sk_wmem_alloc_get(sp),
                 sk_rmem_alloc_get(sp),
diff --git a/net/ipv6/raw.c b/net/ipv6/raw.c
index ae64984f81aa..cc7313b8f7ea 100644
--- a/net/ipv6/raw.c
+++ b/net/ipv6/raw.c
@@ -1240,7 +1240,7 @@ static void raw6_sock_seq_show(struct seq_file *seq, struct sock *sp, int i)
         srcp  = inet_sk(sp)->inet_num;
         seq_printf(seq,
                    "%4d: %08X%08X%08X%08X:%04X %08X%08X%08X%08X:%04X "
-                   "%02X %08X:%08X %02X:%08lX %08X %5d %8d %lu %d %p %d\n",
+                   "%02X %08X:%08X %02X:%08lX %08X %5d %8d %lu %d %pK %d\n",
                    i,
                    src->s6_addr32[0], src->s6_addr32[1],
                    src->s6_addr32[2], src->s6_addr32[3], srcp,
diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
index 868366470b4a..d1fd28711ba5 100644
--- a/net/ipv6/tcp_ipv6.c
+++ b/net/ipv6/tcp_ipv6.c
@@ -2036,7 +2036,7 @@ static void get_openreq6(struct seq_file *seq,
 
         seq_printf(seq,
                    "%4d: %08X%08X%08X%08X:%04X %08X%08X%08X%08X:%04X "
-                   "%02X %08X:%08X %02X:%08lX %08X %5d %8d %d %d %p\n",
+                   "%02X %08X:%08X %02X:%08lX %08X %5d %8d %d %d %pK\n",
                    i,
                    src->s6_addr32[0], src->s6_addr32[1],
                    src->s6_addr32[2], src->s6_addr32[3],
@@ -2087,7 +2087,7 @@ static void get_tcp6_sock(struct seq_file *seq, struct sock *sp, int i)
 
         seq_printf(seq,
                    "%4d: %08X%08X%08X%08X:%04X %08X%08X%08X%08X:%04X "
-                   "%02X %08X:%08X %02X:%08lX %08X %5d %8d %lu %d %p %lu %lu %u %u %d\n",
+                   "%02X %08X:%08X %02X:%08lX %08X %5d %8d %lu %d %pK %lu %lu %u %u %d\n",
                    i,
                    src->s6_addr32[0], src->s6_addr32[1],
                    src->s6_addr32[2], src->s6_addr32[3], srcp,
@@ -2129,7 +2129,7 @@ static void get_timewait6_sock(struct seq_file *seq,
 
         seq_printf(seq,
                    "%4d: %08X%08X%08X%08X:%04X %08X%08X%08X%08X:%04X "
-                   "%02X %08X:%08X %02X:%08lX %08X %5d %8d %d %d %p\n",
+                   "%02X %08X:%08X %02X:%08lX %08X %5d %8d %d %d %pK\n",
                    i,
                    src->s6_addr32[0], src->s6_addr32[1],
                    src->s6_addr32[2], src->s6_addr32[3], srcp,
diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c
index fc0c42a88e54..41f8c9c08dba 100644
--- a/net/ipv6/udp.c
+++ b/net/ipv6/udp.c
@@ -1391,7 +1391,7 @@ static void udp6_sock_seq_show(struct seq_file *seq, struct sock *sp, int bucket
         srcp  = ntohs(inet->inet_sport);
         seq_printf(seq,
                    "%5d: %08X%08X%08X%08X:%04X %08X%08X%08X%08X:%04X "
-                   "%02X %08X:%08X %02X:%08lX %08X %5d %8d %lu %d %p %d\n",
+                   "%02X %08X:%08X %02X:%08lX %08X %5d %8d %lu %d %pK %d\n",
                    bucket,
                    src->s6_addr32[0], src->s6_addr32[1],
                    src->s6_addr32[2], src->s6_addr32[3], srcp,
diff --git a/net/ipv6/xfrm6_tunnel.c b/net/ipv6/xfrm6_tunnel.c
index a6770a04e3bd..4fe1db12d2a3 100644
--- a/net/ipv6/xfrm6_tunnel.c
+++ b/net/ipv6/xfrm6_tunnel.c
@@ -241,7 +241,7 @@ static int xfrm6_tunnel_rcv(struct sk_buff *skb)
         __be32 spi;
 
         spi = xfrm6_tunnel_spi_lookup(net, (const xfrm_address_t *)&iph->saddr);
-        return xfrm6_rcv_spi(skb, IPPROTO_IPV6, spi) > 0 ? : 0;
+        return xfrm6_rcv_spi(skb, IPPROTO_IPV6, spi);
 }
 
 static int xfrm6_tunnel_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
diff --git a/net/iucv/iucv.c b/net/iucv/iucv.c
index a15c01524959..7f9124914b13 100644
--- a/net/iucv/iucv.c
+++ b/net/iucv/iucv.c
@@ -54,7 +54,7 @@
 #include <asm/atomic.h>
 #include <asm/ebcdic.h>
 #include <asm/io.h>
-#include <asm/s390_ext.h>
+#include <asm/irq.h>
 #include <asm/smp.h>
 
 /*
diff --git a/net/key/af_key.c b/net/key/af_key.c
index d62401c25684..8f92cf8116ea 100644
--- a/net/key/af_key.c
+++ b/net/key/af_key.c
@@ -3656,7 +3656,7 @@ static int pfkey_seq_show(struct seq_file *f, void *v)
         if (v == SEQ_START_TOKEN)
                 seq_printf(f ,"sk       RefCnt Rmem   Wmem   User   Inode\n");
         else
-                seq_printf(f ,"%p %-6d %-6u %-6u %-6u %-6lu\n",
+                seq_printf(f, "%pK %-6d %-6u %-6u %-6u %-6lu\n",
                                s,
                                atomic_read(&s->sk_refcnt),
                                sk_rmem_alloc_get(s),
diff --git a/net/mac80211/iface.c b/net/mac80211/iface.c
index 7dfbe71dc637..49d4f869e0bc 100644
--- a/net/mac80211/iface.c
+++ b/net/mac80211/iface.c
@@ -384,11 +384,11 @@ static void ieee80211_do_stop(struct ieee80211_sub_if_data *sdata,
         int i;
         enum nl80211_channel_type orig_ct;
 
+        clear_bit(SDATA_STATE_RUNNING, &sdata->state);
+
         if (local->scan_sdata == sdata)
                 ieee80211_scan_cancel(local);
 
-        clear_bit(SDATA_STATE_RUNNING, &sdata->state);
-
         /*
          * Stop TX on this interface first.
          */
diff --git a/net/mac80211/main.c b/net/mac80211/main.c
index 0d7b08db8e56..866f269183cf 100644
--- a/net/mac80211/main.c
+++ b/net/mac80211/main.c
@@ -752,11 +752,25 @@ int ieee80211_register_hw(struct ieee80211_hw *hw)
         hw->wiphy->interface_modes |= BIT(NL80211_IFTYPE_MONITOR);
         hw->wiphy->software_iftypes |= BIT(NL80211_IFTYPE_MONITOR);
 
-        /* mac80211 doesn't support more than 1 channel */
-        for (i = 0; i < hw->wiphy->n_iface_combinations; i++)
-                if (hw->wiphy->iface_combinations[i].num_different_channels > 1)
+        /*
+         * mac80211 doesn't support more than 1 channel, and also not more
+         * than one IBSS interface
+         */
+        for (i = 0; i < hw->wiphy->n_iface_combinations; i++) {
+                const struct ieee80211_iface_combination *c;
+                int j;
+
+                c = &hw->wiphy->iface_combinations[i];
+
+                if (c->num_different_channels > 1)
                         return -EINVAL;
 
+                for (j = 0; j < c->n_limits; j++)
+                        if ((c->limits[j].types & BIT(NL80211_IFTYPE_ADHOC)) &&
+                            c->limits[j].max > 1)
+                                return -EINVAL;
+        }
+
 #ifndef CONFIG_MAC80211_MESH
         /* mesh depends on Kconfig, but drivers should set it if they want */
         local->hw.wiphy->interface_modes &= ~BIT(NL80211_IFTYPE_MESH_POINT);
@@ -1076,6 +1090,8 @@ static void __exit ieee80211_exit(void)
                 ieee80211s_stop();
 
         ieee80211_iface_exit();
+
+        rcu_barrier();
 }
 
 
diff --git a/net/mac80211/mesh.h b/net/mac80211/mesh.h
index e7c5fddb4804..249e733362e7 100644
--- a/net/mac80211/mesh.h
+++ b/net/mac80211/mesh.h
@@ -120,6 +120,7 @@ struct mesh_path {
  *      buckets
  * @mean_chain_len: maximum average length for the hash buckets' list, if it is
  *      reached, the table will grow
+ * rcu_head: RCU head to free the table
  */
 struct mesh_table {
         /* Number of buckets will be 2^N */
@@ -132,6 +133,8 @@ struct mesh_table {
         int (*copy_node) (struct hlist_node *p, struct mesh_table *newtbl);
         int size_order;
         int mean_chain_len;
+
+        struct rcu_head rcu_head;
 };
 
 /* Recent multicast cache */
@@ -286,10 +289,6 @@ static inline bool mesh_path_sel_is_hwmp(struct ieee80211_sub_if_data *sdata)
         return sdata->u.mesh.mesh_pp_id == IEEE80211_PATH_PROTOCOL_HWMP;
 }
 
-#define for_each_mesh_entry(x, p, node, i) \
-        for (i = 0; i <= x->hash_mask; i++) \
-                hlist_for_each_entry_rcu(node, p, &x->hash_buckets[i], list)
-
 void ieee80211_mesh_notify_scan_completed(struct ieee80211_local *local);
 
 void ieee80211_mesh_quiesce(struct ieee80211_sub_if_data *sdata);
diff --git a/net/mac80211/mesh_pathtbl.c b/net/mac80211/mesh_pathtbl.c
index 83ce48e31913..0d2faacc3e87 100644
--- a/net/mac80211/mesh_pathtbl.c
+++ b/net/mac80211/mesh_pathtbl.c
@@ -36,8 +36,8 @@ struct mpath_node {
         struct mesh_path *mpath;
 };
 
-static struct mesh_table *mesh_paths;
-static struct mesh_table *mpp_paths; /* Store paths for MPP&MAP */
+static struct mesh_table __rcu *mesh_paths;
+static struct mesh_table __rcu *mpp_paths; /* Store paths for MPP&MAP */
 
 int mesh_paths_generation;
 
@@ -48,17 +48,40 @@ int mesh_paths_generation;
 static DEFINE_RWLOCK(pathtbl_resize_lock);
 
 
+static inline struct mesh_table *resize_dereference_mesh_paths(void)
+{
+        return rcu_dereference_protected(mesh_paths,
+                lockdep_is_held(&pathtbl_resize_lock));
+}
+
+static inline struct mesh_table *resize_dereference_mpp_paths(void)
+{
+        return rcu_dereference_protected(mpp_paths,
+                lockdep_is_held(&pathtbl_resize_lock));
+}
+
+/*
+ * CAREFUL -- "tbl" must not be an expression,
+ * in particular not an rcu_dereference(), since
+ * it's used twice. So it is illegal to do
+ *      for_each_mesh_entry(rcu_dereference(...), ...)
+ */
+#define for_each_mesh_entry(tbl, p, node, i) \
+        for (i = 0; i <= tbl->hash_mask; i++) \
+                hlist_for_each_entry_rcu(node, p, &tbl->hash_buckets[i], list)
+
+
 static struct mesh_table *mesh_table_alloc(int size_order)
 {
         int i;
         struct mesh_table *newtbl;
 
-        newtbl = kmalloc(sizeof(struct mesh_table), GFP_KERNEL);
+        newtbl = kmalloc(sizeof(struct mesh_table), GFP_ATOMIC);
         if (!newtbl)
                 return NULL;
 
         newtbl->hash_buckets = kzalloc(sizeof(struct hlist_head) *
-                        (1 << size_order), GFP_KERNEL);
+                        (1 << size_order), GFP_ATOMIC);
 
         if (!newtbl->hash_buckets) {
                 kfree(newtbl);
@@ -66,7 +89,7 @@ static struct mesh_table *mesh_table_alloc(int size_order)
         }
 
         newtbl->hashwlock = kmalloc(sizeof(spinlock_t) *
-                        (1 << size_order), GFP_KERNEL);
+                        (1 << size_order), GFP_ATOMIC);
         if (!newtbl->hashwlock) {
                 kfree(newtbl->hash_buckets);
                 kfree(newtbl);
@@ -258,12 +281,13 @@ struct mesh_path *mpp_path_lookup(u8 *dst, struct ieee80211_sub_if_data *sdata)
  */
 struct mesh_path *mesh_path_lookup_by_idx(int idx, struct ieee80211_sub_if_data *sdata)
 {
+        struct mesh_table *tbl = rcu_dereference(mesh_paths);
         struct mpath_node *node;
         struct hlist_node *p;
         int i;
         int j = 0;
 
-        for_each_mesh_entry(mesh_paths, p, node, i) {
+        for_each_mesh_entry(tbl, p, node, i) {
                 if (sdata && node->mpath->sdata != sdata)
                         continue;
                 if (j++ == idx) {
@@ -293,6 +317,7 @@ int mesh_path_add(u8 *dst, struct ieee80211_sub_if_data *sdata)
 {
         struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh;
         struct ieee80211_local *local = sdata->local;
+        struct mesh_table *tbl;
         struct mesh_path *mpath, *new_mpath;
         struct mpath_node *node, *new_node;
         struct hlist_head *bucket;
@@ -332,10 +357,12 @@ int mesh_path_add(u8 *dst, struct ieee80211_sub_if_data *sdata)
         spin_lock_init(&new_mpath->state_lock);
         init_timer(&new_mpath->timer);
 
-        hash_idx = mesh_table_hash(dst, sdata, mesh_paths);
-        bucket = &mesh_paths->hash_buckets[hash_idx];
+        tbl = resize_dereference_mesh_paths();
+
+        hash_idx = mesh_table_hash(dst, sdata, tbl);
+        bucket = &tbl->hash_buckets[hash_idx];
 
-        spin_lock_bh(&mesh_paths->hashwlock[hash_idx]);
+        spin_lock_bh(&tbl->hashwlock[hash_idx]);
 
         err = -EEXIST;
         hlist_for_each_entry(node, n, bucket, list) {
@@ -345,13 +372,13 @@ int mesh_path_add(u8 *dst, struct ieee80211_sub_if_data *sdata)
         }
 
         hlist_add_head_rcu(&new_node->list, bucket);
-        if (atomic_inc_return(&mesh_paths->entries) >=
-                mesh_paths->mean_chain_len * (mesh_paths->hash_mask + 1))
+        if (atomic_inc_return(&tbl->entries) >=
+            tbl->mean_chain_len * (tbl->hash_mask + 1))
                 grow = 1;
 
         mesh_paths_generation++;
 
-        spin_unlock_bh(&mesh_paths->hashwlock[hash_idx]);
+        spin_unlock_bh(&tbl->hashwlock[hash_idx]);
         read_unlock_bh(&pathtbl_resize_lock);
         if (grow) {
                 set_bit(MESH_WORK_GROW_MPATH_TABLE,  &ifmsh->wrkq_flags);
@@ -360,7 +387,7 @@ int mesh_path_add(u8 *dst, struct ieee80211_sub_if_data *sdata)
         return 0;
 
 err_exists:
-        spin_unlock_bh(&mesh_paths->hashwlock[hash_idx]);
+        spin_unlock_bh(&tbl->hashwlock[hash_idx]);
         read_unlock_bh(&pathtbl_resize_lock);
         kfree(new_node);
 err_node_alloc:
@@ -370,58 +397,59 @@ err_path_alloc:
         return err;
 }
 
+static void mesh_table_free_rcu(struct rcu_head *rcu)
+{
+        struct mesh_table *tbl = container_of(rcu, struct mesh_table, rcu_head);
+
+        mesh_table_free(tbl, false);
+}
+
 void mesh_mpath_table_grow(void)
 {
         struct mesh_table *oldtbl, *newtbl;
 
-        rcu_read_lock();
-        newtbl = mesh_table_alloc(rcu_dereference(mesh_paths)->size_order + 1);
-        if (!newtbl)
-                return;
         write_lock_bh(&pathtbl_resize_lock);
-        oldtbl = mesh_paths;
-        if (mesh_table_grow(mesh_paths, newtbl) < 0) {
-                rcu_read_unlock();
+        oldtbl = resize_dereference_mesh_paths();
+        newtbl = mesh_table_alloc(oldtbl->size_order + 1);
+        if (!newtbl)
+                goto out;
+        if (mesh_table_grow(oldtbl, newtbl) < 0) {
                 __mesh_table_free(newtbl);
-                write_unlock_bh(&pathtbl_resize_lock);
-                return;
+                goto out;
         }
-        rcu_read_unlock();
         rcu_assign_pointer(mesh_paths, newtbl);
-        write_unlock_bh(&pathtbl_resize_lock);
 
-        synchronize_rcu();
-        mesh_table_free(oldtbl, false);
+        call_rcu(&oldtbl->rcu_head, mesh_table_free_rcu);
+
+ out:
+        write_unlock_bh(&pathtbl_resize_lock);
 }
 
 void mesh_mpp_table_grow(void)
 {
         struct mesh_table *oldtbl, *newtbl;
 
-        rcu_read_lock();
-        newtbl = mesh_table_alloc(rcu_dereference(mpp_paths)->size_order + 1);
-        if (!newtbl)
-                return;
         write_lock_bh(&pathtbl_resize_lock);
-        oldtbl = mpp_paths;
-        if (mesh_table_grow(mpp_paths, newtbl) < 0) {
-                rcu_read_unlock();
+        oldtbl = resize_dereference_mpp_paths();
+        newtbl = mesh_table_alloc(oldtbl->size_order + 1);
+        if (!newtbl)
+                goto out;
+        if (mesh_table_grow(oldtbl, newtbl) < 0) {
                 __mesh_table_free(newtbl);
-                write_unlock_bh(&pathtbl_resize_lock);
-                return;
+                goto out;
         }
-        rcu_read_unlock();
         rcu_assign_pointer(mpp_paths, newtbl);
-        write_unlock_bh(&pathtbl_resize_lock);
+        call_rcu(&oldtbl->rcu_head, mesh_table_free_rcu);
 
-        synchronize_rcu();
-        mesh_table_free(oldtbl, false);
+ out:
+        write_unlock_bh(&pathtbl_resize_lock);
 }
 
 int mpp_path_add(u8 *dst, u8 *mpp, struct ieee80211_sub_if_data *sdata)
 {
         struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh;
         struct ieee80211_local *local = sdata->local;
+        struct mesh_table *tbl;
         struct mesh_path *mpath, *new_mpath;
         struct mpath_node *node, *new_node;
         struct hlist_head *bucket;
@@ -456,10 +484,12 @@ int mpp_path_add(u8 *dst, u8 *mpp, struct ieee80211_sub_if_data *sdata)
         new_mpath->exp_time = jiffies;
         spin_lock_init(&new_mpath->state_lock);
 
-        hash_idx = mesh_table_hash(dst, sdata, mpp_paths);
-        bucket = &mpp_paths->hash_buckets[hash_idx];
+        tbl = resize_dereference_mpp_paths();
 
-        spin_lock_bh(&mpp_paths->hashwlock[hash_idx]);
+        hash_idx = mesh_table_hash(dst, sdata, tbl);
+        bucket = &tbl->hash_buckets[hash_idx];
+
+        spin_lock_bh(&tbl->hashwlock[hash_idx]);
 
         err = -EEXIST;
         hlist_for_each_entry(node, n, bucket, list) {
@@ -469,11 +499,11 @@ int mpp_path_add(u8 *dst, u8 *mpp, struct ieee80211_sub_if_data *sdata)
         }
 
         hlist_add_head_rcu(&new_node->list, bucket);
-        if (atomic_inc_return(&mpp_paths->entries) >=
-                mpp_paths->mean_chain_len * (mpp_paths->hash_mask + 1))
+        if (atomic_inc_return(&tbl->entries) >=
+            tbl->mean_chain_len * (tbl->hash_mask + 1))
                 grow = 1;
 
-        spin_unlock_bh(&mpp_paths->hashwlock[hash_idx]);
+        spin_unlock_bh(&tbl->hashwlock[hash_idx]);
         read_unlock_bh(&pathtbl_resize_lock);
         if (grow) {
                 set_bit(MESH_WORK_GROW_MPP_TABLE,  &ifmsh->wrkq_flags);
@@ -482,7 +512,7 @@ int mpp_path_add(u8 *dst, u8 *mpp, struct ieee80211_sub_if_data *sdata)
         return 0;
 
 err_exists:
-        spin_unlock_bh(&mpp_paths->hashwlock[hash_idx]);
+        spin_unlock_bh(&tbl->hashwlock[hash_idx]);
         read_unlock_bh(&pathtbl_resize_lock);
         kfree(new_node);
 err_node_alloc:
@@ -502,6 +532,7 @@ err_path_alloc:
  */
 void mesh_plink_broken(struct sta_info *sta)
 {
+        struct mesh_table *tbl;
         static const u8 bcast[ETH_ALEN] = {0xff, 0xff, 0xff, 0xff, 0xff, 0xff};
         struct mesh_path *mpath;
         struct mpath_node *node;
@@ -510,10 +541,11 @@ void mesh_plink_broken(struct sta_info *sta)
         int i;
 
         rcu_read_lock();
-        for_each_mesh_entry(mesh_paths, p, node, i) {
+        tbl = rcu_dereference(mesh_paths);
+        for_each_mesh_entry(tbl, p, node, i) {
                 mpath = node->mpath;
                 spin_lock_bh(&mpath->state_lock);
-                if (mpath->next_hop == sta &&
+                if (rcu_dereference(mpath->next_hop) == sta &&
                     mpath->flags & MESH_PATH_ACTIVE &&
                     !(mpath->flags & MESH_PATH_FIXED)) {
                         mpath->flags &= ~MESH_PATH_ACTIVE;
@@ -542,30 +574,38 @@ void mesh_plink_broken(struct sta_info *sta)
  */
 void mesh_path_flush_by_nexthop(struct sta_info *sta)
 {
+        struct mesh_table *tbl;
         struct mesh_path *mpath;
         struct mpath_node *node;
         struct hlist_node *p;
         int i;
 
-        for_each_mesh_entry(mesh_paths, p, node, i) {
+        rcu_read_lock();
+        tbl = rcu_dereference(mesh_paths);
+        for_each_mesh_entry(tbl, p, node, i) {
                 mpath = node->mpath;
-                if (mpath->next_hop == sta)
+                if (rcu_dereference(mpath->next_hop) == sta)
                         mesh_path_del(mpath->dst, mpath->sdata);
         }
+        rcu_read_unlock();
 }
 
 void mesh_path_flush(struct ieee80211_sub_if_data *sdata)
 {
+        struct mesh_table *tbl;
         struct mesh_path *mpath;
         struct mpath_node *node;
         struct hlist_node *p;
         int i;
 
-        for_each_mesh_entry(mesh_paths, p, node, i) {
+        rcu_read_lock();
+        tbl = rcu_dereference(mesh_paths);
+        for_each_mesh_entry(tbl, p, node, i) {
                 mpath = node->mpath;
                 if (mpath->sdata == sdata)
                         mesh_path_del(mpath->dst, mpath->sdata);
         }
+        rcu_read_unlock();
 }
 
 static void mesh_path_node_reclaim(struct rcu_head *rp)
@@ -589,6 +629,7 @@ static void mesh_path_node_reclaim(struct rcu_head *rp)
  */
 int mesh_path_del(u8 *addr, struct ieee80211_sub_if_data *sdata)
 {
+        struct mesh_table *tbl;
         struct mesh_path *mpath;
         struct mpath_node *node;
         struct hlist_head *bucket;
@@ -597,19 +638,20 @@ int mesh_path_del(u8 *addr, struct ieee80211_sub_if_data *sdata)
         int err = 0;
 
         read_lock_bh(&pathtbl_resize_lock);
-        hash_idx = mesh_table_hash(addr, sdata, mesh_paths);
-        bucket = &mesh_paths->hash_buckets[hash_idx];
+        tbl = resize_dereference_mesh_paths();
+        hash_idx = mesh_table_hash(addr, sdata, tbl);
+        bucket = &tbl->hash_buckets[hash_idx];
 
-        spin_lock_bh(&mesh_paths->hashwlock[hash_idx]);
+        spin_lock_bh(&tbl->hashwlock[hash_idx]);
         hlist_for_each_entry(node, n, bucket, list) {
                 mpath = node->mpath;
                 if (mpath->sdata == sdata &&
-                                memcmp(addr, mpath->dst, ETH_ALEN) == 0) {
+                    memcmp(addr, mpath->dst, ETH_ALEN) == 0) {
                         spin_lock_bh(&mpath->state_lock);
                         mpath->flags |= MESH_PATH_RESOLVING;
                         hlist_del_rcu(&node->list);
                         call_rcu(&node->rcu, mesh_path_node_reclaim);
-                        atomic_dec(&mesh_paths->entries);
+                        atomic_dec(&tbl->entries);
                         spin_unlock_bh(&mpath->state_lock);
                         goto enddel;
                 }
@@ -618,7 +660,7 @@ int mesh_path_del(u8 *addr, struct ieee80211_sub_if_data *sdata)
         err = -ENXIO;
 enddel:
         mesh_paths_generation++;
-        spin_unlock_bh(&mesh_paths->hashwlock[hash_idx]);
+        spin_unlock_bh(&tbl->hashwlock[hash_idx]);
         read_unlock_bh(&pathtbl_resize_lock);
         return err;
 }
@@ -719,8 +761,10 @@ static void mesh_path_node_free(struct hlist_node *p, bool free_leafs)
         struct mpath_node *node = hlist_entry(p, struct mpath_node, list);
         mpath = node->mpath;
         hlist_del_rcu(p);
-        if (free_leafs)
+        if (free_leafs) {
+                del_timer_sync(&mpath->timer);
                 kfree(mpath);
+        }
         kfree(node);
 }
 
@@ -745,52 +789,60 @@ static int mesh_path_node_copy(struct hlist_node *p, struct mesh_table *newtbl)
 
 int mesh_pathtbl_init(void)
 {
-        mesh_paths = mesh_table_alloc(INIT_PATHS_SIZE_ORDER);
-        if (!mesh_paths)
+        struct mesh_table *tbl_path, *tbl_mpp;
+
+        tbl_path = mesh_table_alloc(INIT_PATHS_SIZE_ORDER);
+        if (!tbl_path)
                 return -ENOMEM;
-        mesh_paths->free_node = &mesh_path_node_free;
-        mesh_paths->copy_node = &mesh_path_node_copy;
-        mesh_paths->mean_chain_len = MEAN_CHAIN_LEN;
+        tbl_path->free_node = &mesh_path_node_free;
+        tbl_path->copy_node = &mesh_path_node_copy;
+        tbl_path->mean_chain_len = MEAN_CHAIN_LEN;
 
-        mpp_paths = mesh_table_alloc(INIT_PATHS_SIZE_ORDER);
-        if (!mpp_paths) {
-                mesh_table_free(mesh_paths, true);
+        tbl_mpp = mesh_table_alloc(INIT_PATHS_SIZE_ORDER);
+        if (!tbl_mpp) {
+                mesh_table_free(tbl_path, true);
                 return -ENOMEM;
         }
-        mpp_paths->free_node = &mesh_path_node_free;
-        mpp_paths->copy_node = &mesh_path_node_copy;
-        mpp_paths->mean_chain_len = MEAN_CHAIN_LEN;
+        tbl_mpp->free_node = &mesh_path_node_free;
+        tbl_mpp->copy_node = &mesh_path_node_copy;
+        tbl_mpp->mean_chain_len = MEAN_CHAIN_LEN;
+
+        /* Need no locking since this is during init */
+        RCU_INIT_POINTER(mesh_paths, tbl_path);
+        RCU_INIT_POINTER(mpp_paths, tbl_mpp);
 
         return 0;
 }
 
 void mesh_path_expire(struct ieee80211_sub_if_data *sdata)
 {
+        struct mesh_table *tbl;
         struct mesh_path *mpath;
         struct mpath_node *node;
         struct hlist_node *p;
         int i;
 
-        read_lock_bh(&pathtbl_resize_lock);
-        for_each_mesh_entry(mesh_paths, p, node, i) {
+        rcu_read_lock();
+        tbl = rcu_dereference(mesh_paths);
+        for_each_mesh_entry(tbl, p, node, i) {
                 if (node->mpath->sdata != sdata)
                         continue;
                 mpath = node->mpath;
                 spin_lock_bh(&mpath->state_lock);
                 if ((!(mpath->flags & MESH_PATH_RESOLVING)) &&
                     (!(mpath->flags & MESH_PATH_FIXED)) &&
-                        time_after(jiffies,
-                         mpath->exp_time + MESH_PATH_EXPIRE)) {
+                     time_after(jiffies, mpath->exp_time + MESH_PATH_EXPIRE)) {
                         spin_unlock_bh(&mpath->state_lock);
                         mesh_path_del(mpath->dst, mpath->sdata);
                 } else
                         spin_unlock_bh(&mpath->state_lock);
         }
-        read_unlock_bh(&pathtbl_resize_lock);
+        rcu_read_unlock();
 }
 
 void mesh_pathtbl_unregister(void)
 {
-        mesh_table_free(mesh_paths, true);
-        mesh_table_free(mpp_paths, true);
+        /* no need for locking during exit path */
+        mesh_table_free(rcu_dereference_raw(mesh_paths), true);
+        mesh_table_free(rcu_dereference_raw(mpp_paths), true);
 }
diff --git a/net/mac80211/scan.c b/net/mac80211/scan.c
index d20046b5d8f4..27af6723cb5e 100644
--- a/net/mac80211/scan.c
+++ b/net/mac80211/scan.c
@@ -719,6 +719,11 @@ void ieee80211_scan_work(struct work_struct *work)
          * without scheduling a new work
          */
         do {
+                if (!ieee80211_sdata_running(sdata)) {
+                        aborted = true;
+                        goto out_complete;
+                }
+
                 switch (local->next_scan_state) {
                 case SCAN_DECISION:
                         /* if no more bands/channels left, complete scan */
diff --git a/net/netfilter/ipset/ip_set_bitmap_ip.c b/net/netfilter/ipset/ip_set_bitmap_ip.c
index a113ff066928..ba2d16607f48 100644
--- a/net/netfilter/ipset/ip_set_bitmap_ip.c
+++ b/net/netfilter/ipset/ip_set_bitmap_ip.c
@@ -293,7 +293,7 @@ bitmap_ip_uadt(struct ip_set *set, struct nlattr *tb[],
 
         for (; !before(ip_to, ip); ip += map->hosts) {
                 id = ip_to_id(map, ip);
-                ret = adtfn(set, &id, timeout);;
+                ret = adtfn(set, &id, timeout);
 
                 if (ret && !ip_set_eexist(ret, flags))
                         return ret;
diff --git a/net/netlabel/netlabel_addrlist.h b/net/netlabel/netlabel_addrlist.h
index 1c1c093cf279..2b9644e19de0 100644
--- a/net/netlabel/netlabel_addrlist.h
+++ b/net/netlabel/netlabel_addrlist.h
@@ -96,12 +96,12 @@ static inline struct netlbl_af4list *__af4list_valid_rcu(struct list_head *s,
 
 #define netlbl_af4list_foreach(iter, head)                              \
         for (iter = __af4list_valid((head)->next, head);                \
-             prefetch(iter->list.next), &iter->list != (head);          \
+             &iter->list != (head);                                     \
              iter = __af4list_valid(iter->list.next, head))
 
 #define netlbl_af4list_foreach_rcu(iter, head)                          \
         for (iter = __af4list_valid_rcu((head)->next, head);            \
-             prefetch(iter->list.next), &iter->list != (head);          \
+             &iter->list != (head);                                     \
              iter = __af4list_valid_rcu(iter->list.next, head))
 
 #define netlbl_af4list_foreach_safe(iter, tmp, head)                    \
@@ -163,12 +163,12 @@ static inline struct netlbl_af6list *__af6list_valid_rcu(struct list_head *s,
 
 #define netlbl_af6list_foreach(iter, head)                              \
         for (iter = __af6list_valid((head)->next, head);                \
-             prefetch(iter->list.next), &iter->list != (head);          \
+             &iter->list != (head);                                     \
              iter = __af6list_valid(iter->list.next, head))
 
 #define netlbl_af6list_foreach_rcu(iter, head)                          \
         for (iter = __af6list_valid_rcu((head)->next, head);            \
-             prefetch(iter->list.next), &iter->list != (head);          \
+             &iter->list != (head);                                     \
              iter = __af6list_valid_rcu(iter->list.next, head))
 
 #define netlbl_af6list_foreach_safe(iter, tmp, head)                    \
diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c
index 5fe4f3b04ed3..6ef64adf7362 100644
--- a/net/netlink/af_netlink.c
+++ b/net/netlink/af_netlink.c
@@ -1985,7 +1985,7 @@ static int netlink_seq_show(struct seq_file *seq, void *v)
                 struct sock *s = v;
                 struct netlink_sock *nlk = nlk_sk(s);
 
-                seq_printf(seq, "%p %-3d %-6d %08x %-8d %-8d %p %-8d %-8d %-8lu\n",
+                seq_printf(seq, "%pK %-3d %-6d %08x %-8d %-8d %pK %-8d %-8d %-8lu\n",
                            s,
                            s->sk_protocol,
                            nlk->pid,
diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
index 549527bca87a..925f715686a5 100644
--- a/net/packet/af_packet.c
+++ b/net/packet/af_packet.c
@@ -2706,7 +2706,7 @@ static int packet_seq_show(struct seq_file *seq, void *v)
                 const struct packet_sock *po = pkt_sk(s);
 
                 seq_printf(seq,
-                           "%p %-6d %-4d %04x   %-5d %1d %-6u %-6u %-6lu\n",
+                           "%pK %-6d %-4d %04x   %-5d %1d %-6u %-6u %-6lu\n",
                            s,
                            atomic_read(&s->sk_refcnt),
                            s->sk_type,
diff --git a/net/phonet/socket.c b/net/phonet/socket.c
index 8c5bfcef92cb..ab07711cf2f4 100644
--- a/net/phonet/socket.c
+++ b/net/phonet/socket.c
@@ -607,7 +607,7 @@ static int pn_sock_seq_show(struct seq_file *seq, void *v)
                 struct pn_sock *pn = pn_sk(sk);
 
                 seq_printf(seq, "%2d %04X:%04X:%02X %02X %08X:%08X %5d %lu "
-                        "%d %p %d%n",
+                        "%d %pK %d%n",
                         sk->sk_protocol, pn->sobject, pn->dobject,
                         pn->resource, sk->sk_state,
                         sk_wmem_alloc_get(sk), sk_rmem_alloc_get(sk),
diff --git a/net/rds/ib.c b/net/rds/ib.c
index cce19f95c624..3b83086bcc30 100644
--- a/net/rds/ib.c
+++ b/net/rds/ib.c
@@ -325,7 +325,7 @@ static int rds_ib_laddr_check(__be32 addr)
         /* Create a CMA ID and try to bind it. This catches both
          * IB and iWARP capable NICs.
          */
-        cm_id = rdma_create_id(NULL, NULL, RDMA_PS_TCP);
+        cm_id = rdma_create_id(NULL, NULL, RDMA_PS_TCP, IB_QPT_RC);
         if (IS_ERR(cm_id))
                 return PTR_ERR(cm_id);
 
diff --git a/net/rds/ib_cm.c b/net/rds/ib_cm.c
index ee369d201a65..fd453dd5124b 100644
--- a/net/rds/ib_cm.c
+++ b/net/rds/ib_cm.c
@@ -587,7 +587,7 @@ int rds_ib_conn_connect(struct rds_connection *conn)
         /* XXX I wonder what affect the port space has */
         /* delegate cm event handler to rdma_transport */
         ic->i_cm_id = rdma_create_id(rds_rdma_cm_event_handler, conn,
-                                     RDMA_PS_TCP);
+                                     RDMA_PS_TCP, IB_QPT_RC);
         if (IS_ERR(ic->i_cm_id)) {
                 ret = PTR_ERR(ic->i_cm_id);
                 ic->i_cm_id = NULL;
diff --git a/net/rds/iw.c b/net/rds/iw.c
index 5a9676fe594f..f7474844f096 100644
--- a/net/rds/iw.c
+++ b/net/rds/iw.c
@@ -226,7 +226,7 @@ static int rds_iw_laddr_check(__be32 addr)
         /* Create a CMA ID and try to bind it. This catches both
          * IB and iWARP capable NICs.
          */
-        cm_id = rdma_create_id(NULL, NULL, RDMA_PS_TCP);
+        cm_id = rdma_create_id(NULL, NULL, RDMA_PS_TCP, IB_QPT_RC);
         if (IS_ERR(cm_id))
                 return PTR_ERR(cm_id);
 
diff --git a/net/rds/iw_cm.c b/net/rds/iw_cm.c
index 3a60a15d1b4a..c12db66f24c7 100644
--- a/net/rds/iw_cm.c
+++ b/net/rds/iw_cm.c
@@ -522,7 +522,7 @@ int rds_iw_conn_connect(struct rds_connection *conn)
         /* XXX I wonder what affect the port space has */
         /* delegate cm event handler to rdma_transport */
         ic->i_cm_id = rdma_create_id(rds_rdma_cm_event_handler, conn,
-                                     RDMA_PS_TCP);
+                                     RDMA_PS_TCP, IB_QPT_RC);
         if (IS_ERR(ic->i_cm_id)) {
                 ret = PTR_ERR(ic->i_cm_id);
                 ic->i_cm_id = NULL;
diff --git a/net/rds/rdma_transport.c b/net/rds/rdma_transport.c
index 4195a0539829..f8760e1b6688 100644
--- a/net/rds/rdma_transport.c
+++ b/net/rds/rdma_transport.c
@@ -158,7 +158,8 @@ static int rds_rdma_listen_init(void)
         struct rdma_cm_id *cm_id;
         int ret;
 
-        cm_id = rdma_create_id(rds_rdma_cm_event_handler, NULL, RDMA_PS_TCP);
+        cm_id = rdma_create_id(rds_rdma_cm_event_handler, NULL, RDMA_PS_TCP,
+                               IB_QPT_RC);
         if (IS_ERR(cm_id)) {
                 ret = PTR_ERR(cm_id);
                 printk(KERN_ERR "RDS/RDMA: failed to setup listener, "
diff --git a/net/rfkill/Kconfig b/net/rfkill/Kconfig
index 48464ca13b24..78efe895b663 100644
--- a/net/rfkill/Kconfig
+++ b/net/rfkill/Kconfig
@@ -33,3 +33,12 @@ config RFKILL_REGULATOR
 
           To compile this driver as a module, choose M here: the module will
           be called rfkill-regulator.
+
+config RFKILL_GPIO
+        tristate "GPIO RFKILL driver"
+        depends on RFKILL && GPIOLIB && HAVE_CLK
+        default n
+        help
+          If you say yes here you get support of a generic gpio RFKILL
+          driver. The platform should fill in the appropriate fields in the
+          rfkill_gpio_platform_data structure and pass that to the driver.
diff --git a/net/rfkill/Makefile b/net/rfkill/Makefile
index d9a5a58ffd8c..311768783f4a 100644
--- a/net/rfkill/Makefile
+++ b/net/rfkill/Makefile
@@ -6,3 +6,4 @@ rfkill-y			+= core.o
 rfkill-$(CONFIG_RFKILL_INPUT)   += input.o
 obj-$(CONFIG_RFKILL)            += rfkill.o
 obj-$(CONFIG_RFKILL_REGULATOR)  += rfkill-regulator.o
+obj-$(CONFIG_RFKILL_GPIO)       += rfkill-gpio.o
diff --git a/net/rfkill/rfkill-gpio.c b/net/rfkill/rfkill-gpio.c
new file mode 100644
index 000000000000..256c5ddd2d72
--- /dev/null
+++ b/net/rfkill/rfkill-gpio.c
@@ -0,0 +1,227 @@
+/*
+ * Copyright (c) 2011, NVIDIA Corporation.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+ */
+
+#include <linux/gpio.h>
+#include <linux/init.h>
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/rfkill.h>
+#include <linux/platform_device.h>
+#include <linux/clk.h>
+#include <linux/slab.h>
+
+#include <linux/rfkill-gpio.h>
+
+enum rfkill_gpio_clk_state {
+        UNSPECIFIED = 0,
+        PWR_ENABLED,
+        PWR_DISABLED
+};
+
+#define PWR_CLK_SET(_RF, _EN) \
+        ((_RF)->pwr_clk_enabled = (!(_EN) ? PWR_ENABLED : PWR_DISABLED))
+#define PWR_CLK_ENABLED(_RF) ((_RF)->pwr_clk_enabled == PWR_ENABLED)
+#define PWR_CLK_DISABLED(_RF) ((_RF)->pwr_clk_enabled != PWR_ENABLED)
+
+struct rfkill_gpio_data {
+        struct rfkill_gpio_platform_data        *pdata;
+        struct rfkill                           *rfkill_dev;
+        char                                    *reset_name;
+        char                                    *shutdown_name;
+        enum rfkill_gpio_clk_state              pwr_clk_enabled;
+        struct clk                              *pwr_clk;
+};
+
+static int rfkill_gpio_set_power(void *data, bool blocked)
+{
+        struct rfkill_gpio_data *rfkill = data;
+
+        if (blocked) {
+                if (gpio_is_valid(rfkill->pdata->shutdown_gpio))
+                        gpio_direction_output(rfkill->pdata->shutdown_gpio, 0);
+                if (gpio_is_valid(rfkill->pdata->reset_gpio))
+                        gpio_direction_output(rfkill->pdata->reset_gpio, 0);
+                if (rfkill->pwr_clk && PWR_CLK_ENABLED(rfkill))
+                        clk_disable(rfkill->pwr_clk);
+        } else {
+                if (rfkill->pwr_clk && PWR_CLK_DISABLED(rfkill))
+                        clk_enable(rfkill->pwr_clk);
+                if (gpio_is_valid(rfkill->pdata->reset_gpio))
+                        gpio_direction_output(rfkill->pdata->reset_gpio, 1);
+                if (gpio_is_valid(rfkill->pdata->shutdown_gpio))
+                        gpio_direction_output(rfkill->pdata->shutdown_gpio, 1);
+        }
+
+        if (rfkill->pwr_clk)
+                PWR_CLK_SET(rfkill, blocked);
+
+        return 0;
+}
+
+static const struct rfkill_ops rfkill_gpio_ops = {
+        .set_block = rfkill_gpio_set_power,
+};
+
+static int rfkill_gpio_probe(struct platform_device *pdev)
+{
+        struct rfkill_gpio_data *rfkill;
+        struct rfkill_gpio_platform_data *pdata = pdev->dev.platform_data;
+        int ret = 0;
+        int len = 0;
+
+        if (!pdata) {
+                pr_warn("%s: No platform data specified\n", __func__);
+                return -EINVAL;
+        }
+
+        /* make sure at-least one of the GPIO is defined and that
+         * a name is specified for this instance */
+        if (!pdata->name || (!gpio_is_valid(pdata->reset_gpio) &&
+                !gpio_is_valid(pdata->shutdown_gpio))) {
+                pr_warn("%s: invalid platform data\n", __func__);
+                return -EINVAL;
+        }
+
+        rfkill = kzalloc(sizeof(*rfkill), GFP_KERNEL);
+        if (!rfkill)
+                return -ENOMEM;
+
+        rfkill->pdata = pdata;
+
+        len = strlen(pdata->name);
+        rfkill->reset_name = kzalloc(len + 7, GFP_KERNEL);
+        if (!rfkill->reset_name) {
+                ret = -ENOMEM;
+                goto fail_alloc;
+        }
+
+        rfkill->shutdown_name = kzalloc(len + 10, GFP_KERNEL);
+        if (!rfkill->shutdown_name) {
+                ret = -ENOMEM;
+                goto fail_reset_name;
+        }
+
+        snprintf(rfkill->reset_name, len + 6 , "%s_reset", pdata->name);
+        snprintf(rfkill->shutdown_name, len + 9, "%s_shutdown", pdata->name);
+
+        if (pdata->power_clk_name) {
+                rfkill->pwr_clk = clk_get(&pdev->dev, pdata->power_clk_name);
+                if (IS_ERR(rfkill->pwr_clk)) {
+                        pr_warn("%s: can't find pwr_clk.\n", __func__);
+                        goto fail_shutdown_name;
+                }
+        }
+
+        if (gpio_is_valid(pdata->reset_gpio)) {
+                ret = gpio_request(pdata->reset_gpio, rfkill->reset_name);
+                if (ret) {
+                        pr_warn("%s: failed to get reset gpio.\n", __func__);
+                        goto fail_clock;
+                }
+        }
+
+        if (gpio_is_valid(pdata->shutdown_gpio)) {
+                ret = gpio_request(pdata->shutdown_gpio, rfkill->shutdown_name);
+                if (ret) {
+                        pr_warn("%s: failed to get shutdown gpio.\n", __func__);
+                        goto fail_reset;
+                }
+        }
+
+        rfkill->rfkill_dev = rfkill_alloc(pdata->name, &pdev->dev, pdata->type,
+                                &rfkill_gpio_ops, rfkill);
+        if (!rfkill->rfkill_dev)
+                goto fail_shutdown;
+
+        ret = rfkill_register(rfkill->rfkill_dev);
+        if (ret < 0)
+                goto fail_rfkill;
+
+        platform_set_drvdata(pdev, rfkill);
+
+        dev_info(&pdev->dev, "%s device registered.\n", pdata->name);
+
+        return 0;
+
+fail_rfkill:
+        rfkill_destroy(rfkill->rfkill_dev);
+fail_shutdown:
+        if (gpio_is_valid(pdata->shutdown_gpio))
+                gpio_free(pdata->shutdown_gpio);
+fail_reset:
+        if (gpio_is_valid(pdata->reset_gpio))
+                gpio_free(pdata->reset_gpio);
+fail_clock:
+        if (rfkill->pwr_clk)
+                clk_put(rfkill->pwr_clk);
+fail_shutdown_name:
+        kfree(rfkill->shutdown_name);
+fail_reset_name:
+        kfree(rfkill->reset_name);
+fail_alloc:
+        kfree(rfkill);
+
+        return ret;
+}
+
+static int rfkill_gpio_remove(struct platform_device *pdev)
+{
+        struct rfkill_gpio_data *rfkill = platform_get_drvdata(pdev);
+
+        rfkill_unregister(rfkill->rfkill_dev);
+        rfkill_destroy(rfkill->rfkill_dev);
+        if (gpio_is_valid(rfkill->pdata->shutdown_gpio))
+                gpio_free(rfkill->pdata->shutdown_gpio);
+        if (gpio_is_valid(rfkill->pdata->reset_gpio))
+                gpio_free(rfkill->pdata->reset_gpio);
+        if (rfkill->pwr_clk && PWR_CLK_ENABLED(rfkill))
+                clk_disable(rfkill->pwr_clk);
+        if (rfkill->pwr_clk)
+                clk_put(rfkill->pwr_clk);
+        kfree(rfkill->shutdown_name);
+        kfree(rfkill->reset_name);
+        kfree(rfkill);
+
+        return 0;
+}
+
+static struct platform_driver rfkill_gpio_driver = {
+        .probe = rfkill_gpio_probe,
+        .remove = __devexit_p(rfkill_gpio_remove),
+        .driver = {
+                   .name = "rfkill_gpio",
+                   .owner = THIS_MODULE,
+        },
+};
+
+static int __init rfkill_gpio_init(void)
+{
+        return platform_driver_register(&rfkill_gpio_driver);
+}
+
+static void __exit rfkill_gpio_exit(void)
+{
+        platform_driver_unregister(&rfkill_gpio_driver);
+}
+
+module_init(rfkill_gpio_init);
+module_exit(rfkill_gpio_exit);
+
+MODULE_DESCRIPTION("gpio rfkill");
+MODULE_AUTHOR("NVIDIA");
+MODULE_LICENSE("GPL");
diff --git a/net/sched/sch_generic.c b/net/sched/sch_generic.c
index c84b65920d1b..b1721d71c27c 100644
--- a/net/sched/sch_generic.c
+++ b/net/sched/sch_generic.c
@@ -815,9 +815,17 @@ static bool some_qdisc_is_busy(struct net_device *dev)
         return false;
 }
 
+/**
+ *      dev_deactivate_many - deactivate transmissions on several devices
+ *      @head: list of devices to deactivate
+ *
+ *      This function returns only when all outstanding transmissions
+ *      have completed, unless all devices are in dismantle phase.
+ */
 void dev_deactivate_many(struct list_head *head)
 {
         struct net_device *dev;
+        bool sync_needed = false;
 
         list_for_each_entry(dev, head, unreg_list) {
                 netdev_for_each_tx_queue(dev, dev_deactivate_queue,
@@ -827,10 +835,15 @@ void dev_deactivate_many(struct list_head *head)
                                              &noop_qdisc);
 
                 dev_watchdog_down(dev);
+                sync_needed |= !dev->dismantle;
         }
 
-        /* Wait for outstanding qdisc-less dev_queue_xmit calls. */
-        synchronize_rcu();
+        /* Wait for outstanding qdisc-less dev_queue_xmit calls.
+         * This is avoided if all devices are in dismantle phase :
+         * Caller will call synchronize_net() for us
+         */
+        if (sync_needed)
+                synchronize_net();
 
         /* Wait for outstanding qdisc_run calls. */
         list_for_each_entry(dev, head, unreg_list)
diff --git a/net/sched/sch_sfq.c b/net/sched/sch_sfq.c
index 7ef87f9eb675..b6ea6afa55b0 100644
--- a/net/sched/sch_sfq.c
+++ b/net/sched/sch_sfq.c
@@ -361,7 +361,7 @@ sfq_enqueue(struct sk_buff *skb, struct Qdisc *sch)
 {
         struct sfq_sched_data *q = qdisc_priv(sch);
         unsigned int hash;
-        sfq_index x;
+        sfq_index x, qlen;
         struct sfq_slot *slot;
         int uninitialized_var(ret);
 
@@ -405,20 +405,12 @@ sfq_enqueue(struct sk_buff *skb, struct Qdisc *sch)
         if (++sch->q.qlen <= q->limit)
                 return NET_XMIT_SUCCESS;
 
+        qlen = slot->qlen;
         sfq_drop(sch);
-        return NET_XMIT_CN;
-}
-
-static struct sk_buff *
-sfq_peek(struct Qdisc *sch)
-{
-        struct sfq_sched_data *q = qdisc_priv(sch);
-
-        /* No active slots */
-        if (q->tail == NULL)
-                return NULL;
-
-        return q->slots[q->tail->next].skblist_next;
+        /* Return Congestion Notification only if we dropped a packet
+         * from this flow.
+         */
+        return (qlen != slot->qlen) ? NET_XMIT_CN : NET_XMIT_SUCCESS;
 }
 
 static struct sk_buff *
@@ -702,7 +694,7 @@ static struct Qdisc_ops sfq_qdisc_ops __read_mostly = {
         .priv_size      =       sizeof(struct sfq_sched_data),
         .enqueue        =       sfq_enqueue,
         .dequeue        =       sfq_dequeue,
-        .peek           =       sfq_peek,
+        .peek           =       qdisc_peek_dequeued,
         .drop           =       sfq_drop,
         .init           =       sfq_init,
         .reset          =       sfq_reset,
diff --git a/net/sctp/associola.c b/net/sctp/associola.c
index 1a21c571aa03..525f97c467e9 100644
--- a/net/sctp/associola.c
+++ b/net/sctp/associola.c
@@ -64,6 +64,7 @@
 /* Forward declarations for internal functions. */
 static void sctp_assoc_bh_rcv(struct work_struct *work);
 static void sctp_assoc_free_asconf_acks(struct sctp_association *asoc);
+static void sctp_assoc_free_asconf_queue(struct sctp_association *asoc);
 
 /* Keep track of the new idr low so that we don't re-use association id
  * numbers too fast.  It is protected by they idr spin lock is in the
@@ -446,6 +447,9 @@ void sctp_association_free(struct sctp_association *asoc)
         /* Free any cached ASCONF_ACK chunk. */
         sctp_assoc_free_asconf_acks(asoc);
 
+        /* Free the ASCONF queue. */
+        sctp_assoc_free_asconf_queue(asoc);
+
         /* Free any cached ASCONF chunk. */
         if (asoc->addip_last_asconf)
                 sctp_chunk_free(asoc->addip_last_asconf);
@@ -1578,6 +1582,18 @@ retry:
         return error;
 }
 
+/* Free the ASCONF queue */
+static void sctp_assoc_free_asconf_queue(struct sctp_association *asoc)
+{
+        struct sctp_chunk *asconf;
+        struct sctp_chunk *tmp;
+
+        list_for_each_entry_safe(asconf, tmp, &asoc->addip_chunk_list, list) {
+                list_del_init(&asconf->list);
+                sctp_chunk_free(asconf);
+        }
+}
+
 /* Free asconf_ack cache */
 static void sctp_assoc_free_asconf_acks(struct sctp_association *asoc)
 {
diff --git a/net/sctp/proc.c b/net/sctp/proc.c
index 61aacfbbaa92..05a6ce214714 100644
--- a/net/sctp/proc.c
+++ b/net/sctp/proc.c
@@ -212,7 +212,7 @@ static int sctp_eps_seq_show(struct seq_file *seq, void *v)
         sctp_for_each_hentry(epb, node, &head->chain) {
                 ep = sctp_ep(epb);
                 sk = epb->sk;
-                seq_printf(seq, "%8p %8p %-3d %-3d %-4d %-5d %5d %5lu ", ep, sk,
+                seq_printf(seq, "%8pK %8pK %-3d %-3d %-4d %-5d %5d %5lu ", ep, sk,
                            sctp_sk(sk)->type, sk->sk_state, hash,
                            epb->bind_addr.port,
                            sock_i_uid(sk), sock_i_ino(sk));
@@ -316,7 +316,7 @@ static int sctp_assocs_seq_show(struct seq_file *seq, void *v)
                 assoc = sctp_assoc(epb);
                 sk = epb->sk;
                 seq_printf(seq,
-                           "%8p %8p %-3d %-3d %-2d %-4d "
+                           "%8pK %8pK %-3d %-3d %-2d %-4d "
                            "%4d %8d %8d %7d %5lu %-5d %5d ",
                            assoc, sk, sctp_sk(sk)->type, sk->sk_state,
                            assoc->state, hash,
diff --git a/net/sunrpc/addr.c b/net/sunrpc/addr.c
index 1419d0cdbbac..4195233c4914 100644
--- a/net/sunrpc/addr.c
+++ b/net/sunrpc/addr.c
@@ -151,7 +151,7 @@ static size_t rpc_pton4(const char *buf, const size_t buflen,
                 return 0;
 
         sin->sin_family = AF_INET;
-        return sizeof(struct sockaddr_in);;
+        return sizeof(struct sockaddr_in);
 }
 
 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
diff --git a/net/sunrpc/auth.c b/net/sunrpc/auth.c
index 67e31276682a..cd6e4aa19dbf 100644
--- a/net/sunrpc/auth.c
+++ b/net/sunrpc/auth.c
@@ -326,10 +326,12 @@ rpcauth_prune_expired(struct list_head *free, int nr_to_scan)
  * Run memory cache shrinker.
  */
 static int
-rpcauth_cache_shrinker(struct shrinker *shrink, int nr_to_scan, gfp_t gfp_mask)
+rpcauth_cache_shrinker(struct shrinker *shrink, struct shrink_control *sc)
 {
         LIST_HEAD(free);
         int res;
+        int nr_to_scan = sc->nr_to_scan;
+        gfp_t gfp_mask = sc->gfp_mask;
 
         if ((gfp_mask & GFP_KERNEL) != GFP_KERNEL)
                 return (nr_to_scan == 0) ? 0 : -1;
diff --git a/net/sunrpc/xprtrdma/svc_rdma_transport.c b/net/sunrpc/xprtrdma/svc_rdma_transport.c
index 1a10dcd999ea..c3c232a88d94 100644
--- a/net/sunrpc/xprtrdma/svc_rdma_transport.c
+++ b/net/sunrpc/xprtrdma/svc_rdma_transport.c
@@ -333,7 +333,7 @@ static void rq_cq_reap(struct svcxprt_rdma *xprt)
 }
 
 /*
- * Processs a completion context
+ * Process a completion context
  */
 static void process_context(struct svcxprt_rdma *xprt,
                             struct svc_rdma_op_ctxt *ctxt)
@@ -695,7 +695,8 @@ static struct svc_xprt *svc_rdma_create(struct svc_serv *serv,
                 return ERR_PTR(-ENOMEM);
         xprt = &cma_xprt->sc_xprt;
 
-        listen_id = rdma_create_id(rdma_listen_handler, cma_xprt, RDMA_PS_TCP);
+        listen_id = rdma_create_id(rdma_listen_handler, cma_xprt, RDMA_PS_TCP,
+                                   IB_QPT_RC);
         if (IS_ERR(listen_id)) {
                 ret = PTR_ERR(listen_id);
                 dprintk("svcrdma: rdma_create_id failed = %d\n", ret);
diff --git a/net/sunrpc/xprtrdma/verbs.c b/net/sunrpc/xprtrdma/verbs.c
index d4297dc43dc4..80f8da344df5 100644
--- a/net/sunrpc/xprtrdma/verbs.c
+++ b/net/sunrpc/xprtrdma/verbs.c
@@ -387,7 +387,7 @@ rpcrdma_create_id(struct rpcrdma_xprt *xprt,
 
         init_completion(&ia->ri_done);
 
-        id = rdma_create_id(rpcrdma_conn_upcall, xprt, RDMA_PS_TCP);
+        id = rdma_create_id(rpcrdma_conn_upcall, xprt, RDMA_PS_TCP, IB_QPT_RC);
         if (IS_ERR(id)) {
                 rc = PTR_ERR(id);
                 dprintk("RPC:       %s: rdma_create_id() failed %i\n",
diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c
index b1d75beb7e20..0722a25a3a33 100644
--- a/net/unix/af_unix.c
+++ b/net/unix/af_unix.c
@@ -2254,7 +2254,7 @@ static int unix_seq_show(struct seq_file *seq, void *v)
                 struct unix_sock *u = unix_sk(s);
                 unix_state_lock(s);
 
-                seq_printf(seq, "%p: %08X %08X %08X %04X %02X %5lu",
+                seq_printf(seq, "%pK: %08X %08X %08X %04X %02X %5lu",
                         s,
                         atomic_read(&s->sk_refcnt),
                         0,
diff --git a/net/wireless/core.h b/net/wireless/core.h
index bf0fb40e3c8b..3dce1f167eba 100644
--- a/net/wireless/core.h
+++ b/net/wireless/core.h
@@ -245,6 +245,7 @@ struct cfg80211_event {
                         u16 status;
                 } cr;
                 struct {
+                        struct ieee80211_channel *channel;
                         u8 bssid[ETH_ALEN];
                         const u8 *req_ie;
                         const u8 *resp_ie;
@@ -392,7 +393,9 @@ int __cfg80211_disconnect(struct cfg80211_registered_device *rdev,
 int cfg80211_disconnect(struct cfg80211_registered_device *rdev,
                         struct net_device *dev, u16 reason,
                         bool wextev);
-void __cfg80211_roamed(struct wireless_dev *wdev, const u8 *bssid,
+void __cfg80211_roamed(struct wireless_dev *wdev,
+                       struct ieee80211_channel *channel,
+                       const u8 *bssid,
                        const u8 *req_ie, size_t req_ie_len,
                        const u8 *resp_ie, size_t resp_ie_len);
 int cfg80211_mgd_wext_connect(struct cfg80211_registered_device *rdev,
diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
index 2222ce08ee91..ec83f413a7ed 100644
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -3294,8 +3294,6 @@ static int nl80211_trigger_scan(struct sk_buff *skb, struct genl_info *info)
         struct cfg80211_registered_device *rdev = info->user_ptr[0];
         struct net_device *dev = info->user_ptr[1];
         struct cfg80211_scan_request *request;
-        struct cfg80211_ssid *ssid;
-        struct ieee80211_channel *channel;
         struct nlattr *attr;
         struct wiphy *wiphy;
         int err, tmp, n_ssids = 0, n_channels, i;
@@ -3342,8 +3340,8 @@ static int nl80211_trigger_scan(struct sk_buff *skb, struct genl_info *info)
                 return -EINVAL;
 
         request = kzalloc(sizeof(*request)
-                        + sizeof(*ssid) * n_ssids
-                        + sizeof(channel) * n_channels
+                        + sizeof(*request->ssids) * n_ssids
+                        + sizeof(*request->channels) * n_channels
                         + ie_len, GFP_KERNEL);
         if (!request)
                 return -ENOMEM;
@@ -3449,8 +3447,6 @@ static int nl80211_start_sched_scan(struct sk_buff *skb,
         struct cfg80211_sched_scan_request *request;
         struct cfg80211_registered_device *rdev = info->user_ptr[0];
         struct net_device *dev = info->user_ptr[1];
-        struct cfg80211_ssid *ssid;
-        struct ieee80211_channel *channel;
         struct nlattr *attr;
         struct wiphy *wiphy;
         int err, tmp, n_ssids = 0, n_channels, i;
@@ -3507,8 +3503,8 @@ static int nl80211_start_sched_scan(struct sk_buff *skb,
                 return -EINVAL;
 
         request = kzalloc(sizeof(*request)
-                        + sizeof(*ssid) * n_ssids
-                        + sizeof(channel) * n_channels
+                        + sizeof(*request->ssids) * n_ssids
+                        + sizeof(*request->channels) * n_channels
                         + ie_len, GFP_KERNEL);
         if (!request)
                 return -ENOMEM;
diff --git a/net/wireless/sme.c b/net/wireless/sme.c
index e17b0bee6bdc..b7b6ff8be553 100644
--- a/net/wireless/sme.c
+++ b/net/wireless/sme.c
@@ -250,7 +250,8 @@ static struct cfg80211_bss *cfg80211_get_conn_bss(struct wireless_dev *wdev)
         if (wdev->conn->params.privacy)
                 capa |= WLAN_CAPABILITY_PRIVACY;
 
-        bss = cfg80211_get_bss(wdev->wiphy, NULL, wdev->conn->params.bssid,
+        bss = cfg80211_get_bss(wdev->wiphy, wdev->conn->params.channel,
+                               wdev->conn->params.bssid,
                                wdev->conn->params.ssid,
                                wdev->conn->params.ssid_len,
                                WLAN_CAPABILITY_ESS | WLAN_CAPABILITY_PRIVACY,
@@ -470,7 +471,10 @@ void __cfg80211_connect_result(struct net_device *dev, const u8 *bssid,
         }
 
         if (!bss)
-                bss = cfg80211_get_bss(wdev->wiphy, NULL, bssid,
+                bss = cfg80211_get_bss(wdev->wiphy,
+                                       wdev->conn ? wdev->conn->params.channel :
+                                       NULL,
+                                       bssid,
                                        wdev->ssid, wdev->ssid_len,
                                        WLAN_CAPABILITY_ESS,
                                        WLAN_CAPABILITY_ESS);
@@ -538,7 +542,9 @@ void cfg80211_connect_result(struct net_device *dev, const u8 *bssid,
 }
 EXPORT_SYMBOL(cfg80211_connect_result);
 
-void __cfg80211_roamed(struct wireless_dev *wdev, const u8 *bssid,
+void __cfg80211_roamed(struct wireless_dev *wdev,
+                       struct ieee80211_channel *channel,
+                       const u8 *bssid,
                        const u8 *req_ie, size_t req_ie_len,
                        const u8 *resp_ie, size_t resp_ie_len)
 {
@@ -565,7 +571,7 @@ void __cfg80211_roamed(struct wireless_dev *wdev, const u8 *bssid,
         cfg80211_put_bss(&wdev->current_bss->pub);
         wdev->current_bss = NULL;
 
-        bss = cfg80211_get_bss(wdev->wiphy, NULL, bssid,
+        bss = cfg80211_get_bss(wdev->wiphy, channel, bssid,
                                wdev->ssid, wdev->ssid_len,
                                WLAN_CAPABILITY_ESS, WLAN_CAPABILITY_ESS);
 
@@ -603,7 +609,9 @@ void __cfg80211_roamed(struct wireless_dev *wdev, const u8 *bssid,
 #endif
 }
 
-void cfg80211_roamed(struct net_device *dev, const u8 *bssid,
+void cfg80211_roamed(struct net_device *dev,
+                     struct ieee80211_channel *channel,
+                     const u8 *bssid,
                      const u8 *req_ie, size_t req_ie_len,
                      const u8 *resp_ie, size_t resp_ie_len, gfp_t gfp)
 {
@@ -619,6 +627,7 @@ void cfg80211_roamed(struct net_device *dev, const u8 *bssid,
                 return;
 
         ev->type = EVENT_ROAMED;
+        ev->rm.channel = channel;
         memcpy(ev->rm.bssid, bssid, ETH_ALEN);
         ev->rm.req_ie = ((u8 *)ev) + sizeof(*ev);
         ev->rm.req_ie_len = req_ie_len;
diff --git a/net/wireless/util.c b/net/wireless/util.c
index f0536d44d43c..4d7b83fbc32f 100644
--- a/net/wireless/util.c
+++ b/net/wireless/util.c
@@ -746,7 +746,7 @@ static void cfg80211_process_wdev_events(struct wireless_dev *wdev)
                                 NULL);
                         break;
                 case EVENT_ROAMED:
-                        __cfg80211_roamed(wdev, ev->rm.bssid,
+                        __cfg80211_roamed(wdev, ev->rm.channel, ev->rm.bssid,
                                           ev->rm.req_ie, ev->rm.req_ie_len,
                                           ev->rm.resp_ie, ev->rm.resp_ie_len);
                         break;