27 files changed, 135 insertions, 131 deletions

diff --git a/net/ipv4/devinet.c b/net/ipv4/devinet.c
index 91d3d96805d0..b12dae2b0b2d 100644
--- a/net/ipv4/devinet.c
+++ b/net/ipv4/devinet.c
@@ -1029,6 +1029,11 @@ skip:
         }
 }
 
+static inline bool inetdev_valid_mtu(unsigned mtu)
+{
+        return mtu >= 68;
+}
+
 /* Called only under RTNL semaphore */
 
 static int inetdev_event(struct notifier_block *this, unsigned long event,
@@ -1048,6 +1053,10 @@ static int inetdev_event(struct notifier_block *this, unsigned long event,
                                 IN_DEV_CONF_SET(in_dev, NOXFRM, 1);
                                 IN_DEV_CONF_SET(in_dev, NOPOLICY, 1);
                         }
+                } else if (event == NETDEV_CHANGEMTU) {
+                        /* Re-enabling IP */
+                        if (inetdev_valid_mtu(dev->mtu))
+                                in_dev = inetdev_init(dev);
                 }
                 goto out;
         }
@@ -1058,7 +1067,7 @@ static int inetdev_event(struct notifier_block *this, unsigned long event,
                 dev->ip_ptr = NULL;
                 break;
         case NETDEV_UP:
-                if (dev->mtu < 68)
+                if (!inetdev_valid_mtu(dev->mtu))
                         break;
                 if (dev->flags & IFF_LOOPBACK) {
                         struct in_ifaddr *ifa;
@@ -1080,9 +1089,9 @@ static int inetdev_event(struct notifier_block *this, unsigned long event,
                 ip_mc_down(in_dev);
                 break;
         case NETDEV_CHANGEMTU:
-                if (dev->mtu >= 68)
+                if (inetdev_valid_mtu(dev->mtu))
                         break;
-                /* MTU falled under 68, disable IP */
+                /* disable IP when MTU is not enough */
         case NETDEV_UNREGISTER:
                 inetdev_destroy(in_dev);
                 break;
diff --git a/net/ipv4/route.c b/net/ipv4/route.c
index e91bafeb32f4..6ee5354c9aa1 100644
--- a/net/ipv4/route.c
+++ b/net/ipv4/route.c
@@ -3121,9 +3121,9 @@ static struct ctl_table empty[1];
 static struct ctl_table ipv4_skeleton[] =
 {
         { .procname = "route", .ctl_name = NET_IPV4_ROUTE,
-          .child = ipv4_route_table},
+          .mode = 0555, .child = ipv4_route_table},
         { .procname = "neigh", .ctl_name = NET_IPV4_NEIGH,
-          .child = empty},
+          .mode = 0555, .child = empty},
         { }
 };
 
diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
index a00532de2a8c..8165f5aa8c71 100644
--- a/net/ipv4/tcp_output.c
+++ b/net/ipv4/tcp_output.c
@@ -468,7 +468,8 @@ static unsigned tcp_syn_options(struct sock *sk, struct sk_buff *skb,
         }
         if (likely(sysctl_tcp_window_scaling)) {
                 opts->ws = tp->rx_opt.rcv_wscale;
-                size += TCPOLEN_WSCALE_ALIGNED;
+                if(likely(opts->ws))
+                        size += TCPOLEN_WSCALE_ALIGNED;
         }
         if (likely(sysctl_tcp_sack)) {
                 opts->options |= OPTION_SACK_ADVERTISE;
@@ -509,7 +510,8 @@ static unsigned tcp_synack_options(struct sock *sk,
 
         if (likely(ireq->wscale_ok)) {
                 opts->ws = ireq->rcv_wscale;
-                size += TCPOLEN_WSCALE_ALIGNED;
+                if(likely(opts->ws))
+                        size += TCPOLEN_WSCALE_ALIGNED;
         }
         if (likely(doing_ts)) {
                 opts->options |= OPTION_TS;
diff --git a/net/ipv6/raw.c b/net/ipv6/raw.c
index 01d47674f7e5..e53e493606c5 100644
--- a/net/ipv6/raw.c
+++ b/net/ipv6/raw.c
@@ -377,14 +377,14 @@ static inline int rawv6_rcv_skb(struct sock * sk, struct sk_buff * skb)
             skb_checksum_complete(skb)) {
                 atomic_inc(&sk->sk_drops);
                 kfree_skb(skb);
-                return 0;
+                return NET_RX_DROP;
         }
 
         /* Charge it to the socket. */
         if (sock_queue_rcv_skb(sk,skb)<0) {
                 atomic_inc(&sk->sk_drops);
                 kfree_skb(skb);
-                return 0;
+                return NET_RX_DROP;
         }
 
         return 0;
@@ -429,7 +429,7 @@ int rawv6_rcv(struct sock *sk, struct sk_buff *skb)
                 if (skb_checksum_complete(skb)) {
                         atomic_inc(&sk->sk_drops);
                         kfree_skb(skb);
-                        return 0;
+                        return NET_RX_DROP;
                 }
         }
 
diff --git a/net/mac80211/debugfs_key.c b/net/mac80211/debugfs_key.c
index 7439b63df5d0..cf82acec913a 100644
--- a/net/mac80211/debugfs_key.c
+++ b/net/mac80211/debugfs_key.c
@@ -265,7 +265,7 @@ void ieee80211_debugfs_key_add_default(struct ieee80211_sub_if_data *sdata)
         key = sdata->default_key;
         if (key) {
                 sprintf(buf, "../keys/%d", key->debugfs.cnt);
-                sdata->debugfs.default_key =
+                sdata->common_debugfs.default_key =
                         debugfs_create_symlink("default_key",
                                                sdata->debugfsdir, buf);
         } else
@@ -277,8 +277,8 @@ void ieee80211_debugfs_key_remove_default(struct ieee80211_sub_if_data *sdata)
         if (!sdata)
                 return;
 
-        debugfs_remove(sdata->debugfs.default_key);
-        sdata->debugfs.default_key = NULL;
+        debugfs_remove(sdata->common_debugfs.default_key);
+        sdata->common_debugfs.default_key = NULL;
 }
 
 void ieee80211_debugfs_key_sta_del(struct ieee80211_key *key,
diff --git a/net/mac80211/debugfs_netdev.c b/net/mac80211/debugfs_netdev.c
index 475f89a8aee1..8165df578c92 100644
--- a/net/mac80211/debugfs_netdev.c
+++ b/net/mac80211/debugfs_netdev.c
@@ -248,8 +248,8 @@ IEEE80211_IF_WFILE(min_discovery_timeout,
 static void add_sta_files(struct ieee80211_sub_if_data *sdata)
 {
         DEBUGFS_ADD(drop_unencrypted, sta);
-        DEBUGFS_ADD(force_unicast_rateidx, ap);
-        DEBUGFS_ADD(max_ratectrl_rateidx, ap);
+        DEBUGFS_ADD(force_unicast_rateidx, sta);
+        DEBUGFS_ADD(max_ratectrl_rateidx, sta);
 
         DEBUGFS_ADD(state, sta);
         DEBUGFS_ADD(bssid, sta);
@@ -283,8 +283,8 @@ static void add_ap_files(struct ieee80211_sub_if_data *sdata)
 static void add_wds_files(struct ieee80211_sub_if_data *sdata)
 {
         DEBUGFS_ADD(drop_unencrypted, wds);
-        DEBUGFS_ADD(force_unicast_rateidx, ap);
-        DEBUGFS_ADD(max_ratectrl_rateidx, ap);
+        DEBUGFS_ADD(force_unicast_rateidx, wds);
+        DEBUGFS_ADD(max_ratectrl_rateidx, wds);
 
         DEBUGFS_ADD(peer, wds);
 }
@@ -292,8 +292,8 @@ static void add_wds_files(struct ieee80211_sub_if_data *sdata)
 static void add_vlan_files(struct ieee80211_sub_if_data *sdata)
 {
         DEBUGFS_ADD(drop_unencrypted, vlan);
-        DEBUGFS_ADD(force_unicast_rateidx, ap);
-        DEBUGFS_ADD(max_ratectrl_rateidx, ap);
+        DEBUGFS_ADD(force_unicast_rateidx, vlan);
+        DEBUGFS_ADD(max_ratectrl_rateidx, vlan);
 }
 
 static void add_monitor_files(struct ieee80211_sub_if_data *sdata)
@@ -381,8 +381,8 @@ static void add_files(struct ieee80211_sub_if_data *sdata)
 static void del_sta_files(struct ieee80211_sub_if_data *sdata)
 {
         DEBUGFS_DEL(drop_unencrypted, sta);
-        DEBUGFS_DEL(force_unicast_rateidx, ap);
-        DEBUGFS_DEL(max_ratectrl_rateidx, ap);
+        DEBUGFS_DEL(force_unicast_rateidx, sta);
+        DEBUGFS_DEL(max_ratectrl_rateidx, sta);
 
         DEBUGFS_DEL(state, sta);
         DEBUGFS_DEL(bssid, sta);
@@ -416,8 +416,8 @@ static void del_ap_files(struct ieee80211_sub_if_data *sdata)
 static void del_wds_files(struct ieee80211_sub_if_data *sdata)
 {
         DEBUGFS_DEL(drop_unencrypted, wds);
-        DEBUGFS_DEL(force_unicast_rateidx, ap);
-        DEBUGFS_DEL(max_ratectrl_rateidx, ap);
+        DEBUGFS_DEL(force_unicast_rateidx, wds);
+        DEBUGFS_DEL(max_ratectrl_rateidx, wds);
 
         DEBUGFS_DEL(peer, wds);
 }
@@ -425,8 +425,8 @@ static void del_wds_files(struct ieee80211_sub_if_data *sdata)
 static void del_vlan_files(struct ieee80211_sub_if_data *sdata)
 {
         DEBUGFS_DEL(drop_unencrypted, vlan);
-        DEBUGFS_DEL(force_unicast_rateidx, ap);
-        DEBUGFS_DEL(max_ratectrl_rateidx, ap);
+        DEBUGFS_DEL(force_unicast_rateidx, vlan);
+        DEBUGFS_DEL(max_ratectrl_rateidx, vlan);
 }
 
 static void del_monitor_files(struct ieee80211_sub_if_data *sdata)
diff --git a/net/mac80211/ieee80211_i.h b/net/mac80211/ieee80211_i.h
index ec59345af65b..4498d8713652 100644
--- a/net/mac80211/ieee80211_i.h
+++ b/net/mac80211/ieee80211_i.h
@@ -470,6 +470,8 @@ struct ieee80211_sub_if_data {
                         struct dentry *auth_transaction;
                         struct dentry *flags;
                         struct dentry *num_beacons_sta;
+                        struct dentry *force_unicast_rateidx;
+                        struct dentry *max_ratectrl_rateidx;
                 } sta;
                 struct {
                         struct dentry *drop_unencrypted;
@@ -483,15 +485,21 @@ struct ieee80211_sub_if_data {
                 struct {
                         struct dentry *drop_unencrypted;
                         struct dentry *peer;
+                        struct dentry *force_unicast_rateidx;
+                        struct dentry *max_ratectrl_rateidx;
                 } wds;
                 struct {
                         struct dentry *drop_unencrypted;
+                        struct dentry *force_unicast_rateidx;
+                        struct dentry *max_ratectrl_rateidx;
                 } vlan;
                 struct {
                         struct dentry *mode;
                 } monitor;
-                struct dentry *default_key;
         } debugfs;
+        struct {
+                struct dentry *default_key;
+        } common_debugfs;
 
 #ifdef CONFIG_MAC80211_MESH
         struct dentry *mesh_stats_dir;
diff --git a/net/mac80211/mesh.c b/net/mac80211/mesh.c
index b5933b271491..35f2f95f2fa7 100644
--- a/net/mac80211/mesh.c
+++ b/net/mac80211/mesh.c
@@ -383,7 +383,7 @@ errcopy:
                 hlist_for_each_safe(p, q, &newtbl->hash_buckets[i])
                         tbl->free_node(p, 0);
         }
-        __mesh_table_free(tbl);
+        __mesh_table_free(newtbl);
 endgrow:
         return NULL;
 }
diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
index 1e97fb9fb34b..9bb68c6a8f44 100644
--- a/net/mac80211/mlme.c
+++ b/net/mac80211/mlme.c
@@ -478,51 +478,21 @@ int ieee80211_ht_addt_info_ie_to_ht_bss_info(
 static void ieee80211_sta_send_associnfo(struct net_device *dev,
                                          struct ieee80211_if_sta *ifsta)
 {
-        char *buf;
-        size_t len;
-        int i;
         union iwreq_data wrqu;
 
-        if (!ifsta->assocreq_ies && !ifsta->assocresp_ies)
-                return;
-
-        buf = kmalloc(50 + 2 * (ifsta->assocreq_ies_len +
-                                ifsta->assocresp_ies_len), GFP_KERNEL);
-        if (!buf)
-                return;
-
-        len = sprintf(buf, "ASSOCINFO(");
         if (ifsta->assocreq_ies) {
-                len += sprintf(buf + len, "ReqIEs=");
-                for (i = 0; i < ifsta->assocreq_ies_len; i++) {
-                        len += sprintf(buf + len, "%02x",
-                                       ifsta->assocreq_ies[i]);
-                }
+                memset(&wrqu, 0, sizeof(wrqu));
+                wrqu.data.length = ifsta->assocreq_ies_len;
+                wireless_send_event(dev, IWEVASSOCREQIE, &wrqu,
+                                    ifsta->assocreq_ies);
         }
-        if (ifsta->assocresp_ies) {
-                if (ifsta->assocreq_ies)
-                        len += sprintf(buf + len, " ");
-                len += sprintf(buf + len, "RespIEs=");
-                for (i = 0; i < ifsta->assocresp_ies_len; i++) {
-                        len += sprintf(buf + len, "%02x",
-                                       ifsta->assocresp_ies[i]);
-                }
-        }
-        len += sprintf(buf + len, ")");
 
-        if (len > IW_CUSTOM_MAX) {
-                len = sprintf(buf, "ASSOCRESPIE=");
-                for (i = 0; i < ifsta->assocresp_ies_len; i++) {
-                        len += sprintf(buf + len, "%02x",
-                                       ifsta->assocresp_ies[i]);
-                }
+        if (ifsta->assocresp_ies) {
+                memset(&wrqu, 0, sizeof(wrqu));
+                wrqu.data.length = ifsta->assocresp_ies_len;
+                wireless_send_event(dev, IWEVASSOCRESPIE, &wrqu,
+                                    ifsta->assocresp_ies);
         }
-
-        memset(&wrqu, 0, sizeof(wrqu));
-        wrqu.data.length = len;
-        wireless_send_event(dev, IWEVCUSTOM, &wrqu, buf);
-
-        kfree(buf);
 }
 
 
@@ -813,7 +783,7 @@ static void ieee80211_send_assoc(struct net_device *dev,
                 }
         }
 
-        if (count == 8) {
+        if (rates_len > count) {
                 pos = skb_put(skb, rates_len - count + 2);
                 *pos++ = WLAN_EID_EXT_SUPP_RATES;
                 *pos++ = rates_len - count;
@@ -2868,7 +2838,7 @@ static void ieee80211_rx_bss_info(struct net_device *dev,
                        jiffies);
 #endif /* CONFIG_MAC80211_IBSS_DEBUG */
                 if (beacon_timestamp > rx_timestamp) {
-#ifndef CONFIG_MAC80211_IBSS_DEBUG
+#ifdef CONFIG_MAC80211_IBSS_DEBUG
                         printk(KERN_DEBUG "%s: beacon TSF higher than "
                                "local TSF - IBSS merge with BSSID %s\n",
                                dev->name, print_mac(mac, mgmt->bssid));
diff --git a/net/rfkill/rfkill.c b/net/rfkill/rfkill.c
index 35a9994e2339..74aecc098bad 100644
--- a/net/rfkill/rfkill.c
+++ b/net/rfkill/rfkill.c
@@ -377,7 +377,7 @@ static ssize_t rfkill_claim_show(struct device *dev,
 {
         struct rfkill *rfkill = to_rfkill(dev);
 
-        return sprintf(buf, "%d", rfkill->user_claim);
+        return sprintf(buf, "%d\n", rfkill->user_claim);
 }
 
 static ssize_t rfkill_claim_store(struct device *dev,
diff --git a/net/sched/cls_api.c b/net/sched/cls_api.c
index 5cafdd4c8018..8eb79e92e94c 100644
--- a/net/sched/cls_api.c
+++ b/net/sched/cls_api.c
@@ -205,7 +205,7 @@ replay:
                 }
         }
 
-        root_lock = qdisc_root_lock(q);
+        root_lock = qdisc_root_sleeping_lock(q);
 
         if (tp == NULL) {
                 /* Proto-tcf does not exist, create new one */
diff --git a/net/sched/cls_route.c b/net/sched/cls_route.c
index 481260a4f10f..e3d8455eebc2 100644
--- a/net/sched/cls_route.c
+++ b/net/sched/cls_route.c
@@ -75,7 +75,7 @@ static __inline__ int route4_fastmap_hash(u32 id, int iif)
 static inline
 void route4_reset_fastmap(struct Qdisc *q, struct route4_head *head, u32 id)
 {
-        spinlock_t *root_lock = qdisc_root_lock(q);
+        spinlock_t *root_lock = qdisc_root_sleeping_lock(q);
 
         spin_lock_bh(root_lock);
         memset(head->fastmap, 0, sizeof(head->fastmap));
diff --git a/net/sched/sch_api.c b/net/sched/sch_api.c
index e7fb9e0d21b4..1122c952aa99 100644
--- a/net/sched/sch_api.c
+++ b/net/sched/sch_api.c
@@ -624,7 +624,7 @@ static struct Qdisc *dev_graft_qdisc(struct netdev_queue *dev_queue,
         struct Qdisc *oqdisc = dev_queue->qdisc_sleeping;
         spinlock_t *root_lock;
 
-        root_lock = qdisc_root_lock(oqdisc);
+        root_lock = qdisc_lock(oqdisc);
         spin_lock_bh(root_lock);
 
         /* Prune old scheduler */
@@ -635,7 +635,7 @@ static struct Qdisc *dev_graft_qdisc(struct netdev_queue *dev_queue,
         if (qdisc == NULL)
                 qdisc = &noop_qdisc;
         dev_queue->qdisc_sleeping = qdisc;
-        dev_queue->qdisc = &noop_qdisc;
+        rcu_assign_pointer(dev_queue->qdisc, &noop_qdisc);
 
         spin_unlock_bh(root_lock);
 
@@ -830,9 +830,16 @@ qdisc_create(struct net_device *dev, struct netdev_queue *dev_queue,
                         sch->stab = stab;
                 }
                 if (tca[TCA_RATE]) {
+                        spinlock_t *root_lock;
+
+                        if ((sch->parent != TC_H_ROOT) &&
+                            !(sch->flags & TCQ_F_INGRESS))
+                                root_lock = qdisc_root_sleeping_lock(sch);
+                        else
+                                root_lock = qdisc_lock(sch);
+
                         err = gen_new_estimator(&sch->bstats, &sch->rate_est,
-                                                qdisc_root_lock(sch),
-                                                tca[TCA_RATE]);
+                                                root_lock, tca[TCA_RATE]);
                         if (err) {
                                 /*
                                  * Any broken qdiscs that would require
@@ -884,7 +891,8 @@ static int qdisc_change(struct Qdisc *sch, struct nlattr **tca)
 
         if (tca[TCA_RATE])
                 gen_replace_estimator(&sch->bstats, &sch->rate_est,
-                                      qdisc_root_lock(sch), tca[TCA_RATE]);
+                                      qdisc_root_sleeping_lock(sch),
+                                      tca[TCA_RATE]);
         return 0;
 }
 
@@ -1161,8 +1169,8 @@ static int tc_fill_qdisc(struct sk_buff *skb, struct Qdisc *q, u32 clid,
         if (q->stab && qdisc_dump_stab(skb, q->stab) < 0)
                 goto nla_put_failure;
 
-        if (gnet_stats_start_copy_compat(skb, TCA_STATS2, TCA_STATS,
-                                         TCA_XSTATS, qdisc_root_lock(q), &d) < 0)
+        if (gnet_stats_start_copy_compat(skb, TCA_STATS2, TCA_STATS, TCA_XSTATS,
+                                         qdisc_root_sleeping_lock(q), &d) < 0)
                 goto nla_put_failure;
 
         if (q->ops->dump_stats && q->ops->dump_stats(q, &d) < 0)
@@ -1453,8 +1461,8 @@ static int tc_fill_tclass(struct sk_buff *skb, struct Qdisc *q,
         if (cl_ops->dump && cl_ops->dump(q, cl, skb, tcm) < 0)
                 goto nla_put_failure;
 
-        if (gnet_stats_start_copy_compat(skb, TCA_STATS2, TCA_STATS,
-                                         TCA_XSTATS, qdisc_root_lock(q), &d) < 0)
+        if (gnet_stats_start_copy_compat(skb, TCA_STATS2, TCA_STATS, TCA_XSTATS,
+                                         qdisc_root_sleeping_lock(q), &d) < 0)
                 goto nla_put_failure;
 
         if (cl_ops->dump_stats && cl_ops->dump_stats(q, cl, &d) < 0)
diff --git a/net/sched/sch_cbq.c b/net/sched/sch_cbq.c
index 8fa90d68ec6d..8b06fa900482 100644
--- a/net/sched/sch_cbq.c
+++ b/net/sched/sch_cbq.c
@@ -1754,7 +1754,7 @@ static void cbq_put(struct Qdisc *sch, unsigned long arg)
 
         if (--cl->refcnt == 0) {
 #ifdef CONFIG_NET_CLS_ACT
-                spinlock_t *root_lock = qdisc_root_lock(sch);
+                spinlock_t *root_lock = qdisc_root_sleeping_lock(sch);
                 struct cbq_sched_data *q = qdisc_priv(sch);
 
                 spin_lock_bh(root_lock);
@@ -1839,7 +1839,7 @@ cbq_change_class(struct Qdisc *sch, u32 classid, u32 parentid, struct nlattr **t
 
                 if (tca[TCA_RATE])
                         gen_replace_estimator(&cl->bstats, &cl->rate_est,
-                                              qdisc_root_lock(sch),
+                                              qdisc_root_sleeping_lock(sch),
                                               tca[TCA_RATE]);
                 return 0;
         }
@@ -1930,7 +1930,7 @@ cbq_change_class(struct Qdisc *sch, u32 classid, u32 parentid, struct nlattr **t
 
         if (tca[TCA_RATE])
                 gen_new_estimator(&cl->bstats, &cl->rate_est,
-                                  qdisc_root_lock(sch), tca[TCA_RATE]);
+                                  qdisc_root_sleeping_lock(sch), tca[TCA_RATE]);
 
         *arg = (unsigned long)cl;
         return 0;
diff --git a/net/sched/sch_generic.c b/net/sched/sch_generic.c
index 5f0ade7806a7..9634091ee2f0 100644
--- a/net/sched/sch_generic.c
+++ b/net/sched/sch_generic.c
@@ -634,7 +634,7 @@ static void dev_deactivate_queue(struct net_device *dev,
                 if (!(qdisc->flags & TCQ_F_BUILTIN))
                         set_bit(__QDISC_STATE_DEACTIVATED, &qdisc->state);
 
-                dev_queue->qdisc = qdisc_default;
+                rcu_assign_pointer(dev_queue->qdisc, qdisc_default);
                 qdisc_reset(qdisc);
 
                 spin_unlock_bh(qdisc_lock(qdisc));
@@ -709,7 +709,7 @@ static void shutdown_scheduler_queue(struct net_device *dev,
         struct Qdisc *qdisc_default = _qdisc_default;
 
         if (qdisc) {
-                dev_queue->qdisc = qdisc_default;
+                rcu_assign_pointer(dev_queue->qdisc, qdisc_default);
                 dev_queue->qdisc_sleeping = qdisc_default;
 
                 qdisc_destroy(qdisc);
diff --git a/net/sched/sch_hfsc.c b/net/sched/sch_hfsc.c
index c2b8d9cce3d2..c1e77da8cd09 100644
--- a/net/sched/sch_hfsc.c
+++ b/net/sched/sch_hfsc.c
@@ -1045,7 +1045,7 @@ hfsc_change_class(struct Qdisc *sch, u32 classid, u32 parentid,
 
                 if (tca[TCA_RATE])
                         gen_replace_estimator(&cl->bstats, &cl->rate_est,
-                                              qdisc_root_lock(sch),
+                                              qdisc_root_sleeping_lock(sch),
                                               tca[TCA_RATE]);
                 return 0;
         }
@@ -1104,7 +1104,7 @@ hfsc_change_class(struct Qdisc *sch, u32 classid, u32 parentid,
 
         if (tca[TCA_RATE])
                 gen_new_estimator(&cl->bstats, &cl->rate_est,
-                                  qdisc_root_lock(sch), tca[TCA_RATE]);
+                                  qdisc_root_sleeping_lock(sch), tca[TCA_RATE]);
         *arg = (unsigned long)cl;
         return 0;
 }
diff --git a/net/sched/sch_htb.c b/net/sched/sch_htb.c
index 0df0df202ed0..d14f02056ae6 100644
--- a/net/sched/sch_htb.c
+++ b/net/sched/sch_htb.c
@@ -1043,7 +1043,7 @@ static int htb_init(struct Qdisc *sch, struct nlattr *opt)
 
 static int htb_dump(struct Qdisc *sch, struct sk_buff *skb)
 {
-        spinlock_t *root_lock = qdisc_root_lock(sch);
+        spinlock_t *root_lock = qdisc_root_sleeping_lock(sch);
         struct htb_sched *q = qdisc_priv(sch);
         struct nlattr *nest;
         struct tc_htb_glob gopt;
@@ -1075,7 +1075,7 @@ static int htb_dump_class(struct Qdisc *sch, unsigned long arg,
                           struct sk_buff *skb, struct tcmsg *tcm)
 {
         struct htb_class *cl = (struct htb_class *)arg;
-        spinlock_t *root_lock = qdisc_root_lock(sch);
+        spinlock_t *root_lock = qdisc_root_sleeping_lock(sch);
         struct nlattr *nest;
         struct tc_htb_opt opt;
 
@@ -1372,7 +1372,7 @@ static int htb_change_class(struct Qdisc *sch, u32 classid,
                         goto failure;
 
                 gen_new_estimator(&cl->bstats, &cl->rate_est,
-                                  qdisc_root_lock(sch),
+                                  qdisc_root_sleeping_lock(sch),
                                   tca[TCA_RATE] ? : &est.nla);
                 cl->refcnt = 1;
                 cl->children = 0;
@@ -1427,7 +1427,7 @@ static int htb_change_class(struct Qdisc *sch, u32 classid,
         } else {
                 if (tca[TCA_RATE])
                         gen_replace_estimator(&cl->bstats, &cl->rate_est,
-                                              qdisc_root_lock(sch),
+                                              qdisc_root_sleeping_lock(sch),
                                               tca[TCA_RATE]);
                 sch_tree_lock(sch);
         }
diff --git a/net/sched/sch_netem.c b/net/sched/sch_netem.c
index fb0294d0b55e..3781e55046d0 100644
--- a/net/sched/sch_netem.c
+++ b/net/sched/sch_netem.c
@@ -341,7 +341,7 @@ static int get_dist_table(struct Qdisc *sch, const struct nlattr *attr)
         for (i = 0; i < n; i++)
                 d->table[i] = data[i];
 
-        root_lock = qdisc_root_lock(sch);
+        root_lock = qdisc_root_sleeping_lock(sch);
 
         spin_lock_bh(root_lock);
         d = xchg(&q->delay_dist, d);
diff --git a/net/sched/sch_teql.c b/net/sched/sch_teql.c
index 2c35c678563b..d35ef059abb1 100644
--- a/net/sched/sch_teql.c
+++ b/net/sched/sch_teql.c
@@ -161,7 +161,7 @@ teql_destroy(struct Qdisc* sch)
                                                 txq = netdev_get_tx_queue(master->dev, 0);
                                                 master->slaves = NULL;
 
-                                                root_lock = qdisc_root_lock(txq->qdisc);
+                                                root_lock = qdisc_root_sleeping_lock(txq->qdisc);
                                                 spin_lock_bh(root_lock);
                                                 qdisc_reset(txq->qdisc);
                                                 spin_unlock_bh(root_lock);
diff --git a/net/sctp/auth.c b/net/sctp/auth.c
index 1fcb4cf2f4c9..52db5f60daa0 100644
--- a/net/sctp/auth.c
+++ b/net/sctp/auth.c
@@ -786,6 +786,9 @@ int sctp_auth_ep_set_hmacs(struct sctp_endpoint *ep,
         for (i = 0; i < hmacs->shmac_num_idents; i++) {
                 id = hmacs->shmac_idents[i];
 
+                if (id > SCTP_AUTH_HMAC_ID_MAX)
+                        return -EOPNOTSUPP;
+
                 if (SCTP_AUTH_HMAC_ID_SHA1 == id)
                         has_sha1 = 1;
 
diff --git a/net/sctp/socket.c b/net/sctp/socket.c
index afa952e726d7..5ffb9dec1c3f 100644
--- a/net/sctp/socket.c
+++ b/net/sctp/socket.c
@@ -3086,6 +3086,7 @@ static int sctp_setsockopt_hmac_ident(struct sock *sk,
                                     int optlen)
 {
         struct sctp_hmacalgo *hmacs;
+        u32 idents;
         int err;
 
         if (!sctp_auth_enable)
@@ -3103,8 +3104,9 @@ static int sctp_setsockopt_hmac_ident(struct sock *sk,
                 goto out;
         }
 
-        if (hmacs->shmac_num_idents == 0 ||
-            hmacs->shmac_num_idents > SCTP_AUTH_NUM_HMACS) {
+        idents = hmacs->shmac_num_idents;
+        if (idents == 0 || idents > SCTP_AUTH_NUM_HMACS ||
+            (idents * sizeof(u16)) > (optlen - sizeof(struct sctp_hmacalgo))) {
                 err = -EINVAL;
                 goto out;
         }
@@ -3144,7 +3146,7 @@ static int sctp_setsockopt_auth_key(struct sock *sk,
                 goto out;
         }
 
-        if (authkey->sca_keylength > optlen) {
+        if (authkey->sca_keylength > optlen - sizeof(struct sctp_authkey)) {
                 ret = -EINVAL;
                 goto out;
         }
diff --git a/net/sunrpc/sysctl.c b/net/sunrpc/sysctl.c
index 0f8c439b848a..5231f7aaac0e 100644
--- a/net/sunrpc/sysctl.c
+++ b/net/sunrpc/sysctl.c
@@ -60,24 +60,14 @@ static int proc_do_xprt(ctl_table *table, int write, struct file *file,
                         void __user *buffer, size_t *lenp, loff_t *ppos)
 {
         char tmpbuf[256];
-        int len;
+        size_t len;
+
         if ((*ppos && !write) || !*lenp) {
                 *lenp = 0;
                 return 0;
         }
-        if (write)
-                return -EINVAL;
-        else {
-                len = svc_print_xprts(tmpbuf, sizeof(tmpbuf));
-                if (!access_ok(VERIFY_WRITE, buffer, len))
-                        return -EFAULT;
-
-                if (__copy_to_user(buffer, tmpbuf, len))
-                        return -EFAULT;
-        }
-        *lenp -= len;
-        *ppos += len;
-        return 0;
+        len = svc_print_xprts(tmpbuf, sizeof(tmpbuf));
+        return simple_read_from_buffer(buffer, *lenp, ppos, tmpbuf, len);
 }
 
 static int
diff --git a/net/sunrpc/xprtrdma/svc_rdma_recvfrom.c b/net/sunrpc/xprtrdma/svc_rdma_recvfrom.c
index b4b17f44cb29..74de31a06616 100644
--- a/net/sunrpc/xprtrdma/svc_rdma_recvfrom.c
+++ b/net/sunrpc/xprtrdma/svc_rdma_recvfrom.c
@@ -443,18 +443,18 @@ int svc_rdma_recvfrom(struct svc_rqst *rqstp)
 
         dprintk("svcrdma: rqstp=%p\n", rqstp);
 
-        spin_lock_bh(&rdma_xprt->sc_read_complete_lock);
+        spin_lock_bh(&rdma_xprt->sc_rq_dto_lock);
         if (!list_empty(&rdma_xprt->sc_read_complete_q)) {
                 ctxt = list_entry(rdma_xprt->sc_read_complete_q.next,
                                   struct svc_rdma_op_ctxt,
                                   dto_q);
                 list_del_init(&ctxt->dto_q);
         }
-        spin_unlock_bh(&rdma_xprt->sc_read_complete_lock);
-        if (ctxt)
+        if (ctxt) {
+                spin_unlock_bh(&rdma_xprt->sc_rq_dto_lock);
                 return rdma_read_complete(rqstp, ctxt);
+        }
 
-        spin_lock_bh(&rdma_xprt->sc_rq_dto_lock);
         if (!list_empty(&rdma_xprt->sc_rq_dto_q)) {
                 ctxt = list_entry(rdma_xprt->sc_rq_dto_q.next,
                                   struct svc_rdma_op_ctxt,
diff --git a/net/sunrpc/xprtrdma/svc_rdma_transport.c b/net/sunrpc/xprtrdma/svc_rdma_transport.c
index 19ddc382b777..900cb69728c6 100644
--- a/net/sunrpc/xprtrdma/svc_rdma_transport.c
+++ b/net/sunrpc/xprtrdma/svc_rdma_transport.c
@@ -359,11 +359,11 @@ static void sq_cq_reap(struct svcxprt_rdma *xprt)
                         if (test_bit(RDMACTXT_F_LAST_CTXT, &ctxt->flags)) {
                                 struct svc_rdma_op_ctxt *read_hdr = ctxt->read_hdr;
                                 BUG_ON(!read_hdr);
+                                spin_lock_bh(&xprt->sc_rq_dto_lock);
                                 set_bit(XPT_DATA, &xprt->sc_xprt.xpt_flags);
-                                spin_lock_bh(&xprt->sc_read_complete_lock);
                                 list_add_tail(&read_hdr->dto_q,
                                               &xprt->sc_read_complete_q);
-                                spin_unlock_bh(&xprt->sc_read_complete_lock);
+                                spin_unlock_bh(&xprt->sc_rq_dto_lock);
                                 svc_xprt_enqueue(&xprt->sc_xprt);
                         }
                         svc_rdma_put_context(ctxt, 0);
@@ -428,7 +428,6 @@ static struct svcxprt_rdma *rdma_create_xprt(struct svc_serv *serv,
         init_waitqueue_head(&cma_xprt->sc_send_wait);
 
         spin_lock_init(&cma_xprt->sc_lock);
-        spin_lock_init(&cma_xprt->sc_read_complete_lock);
         spin_lock_init(&cma_xprt->sc_rq_dto_lock);
 
         cma_xprt->sc_ord = svcrdma_ord;
diff --git a/net/wireless/Kconfig b/net/wireless/Kconfig
index ab015c62d561..833b024f8f66 100644
--- a/net/wireless/Kconfig
+++ b/net/wireless/Kconfig
@@ -39,4 +39,5 @@ config WIRELESS_EXT_SYSFS
           files in /sys/class/net/*/wireless/. The same information
           is available via the ioctls as well.
 
-          Say Y if you have programs using it (we don't know of any).
+          Say Y if you have programs using it, like old versions of
+          hal.
diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c
index 841b32a2e680..46914b79d850 100644
--- a/net/xfrm/xfrm_policy.c
+++ b/net/xfrm/xfrm_policy.c
@@ -1731,8 +1731,7 @@ restart:
                          * We can't enlist stable bundles either.
                          */
                         write_unlock_bh(&policy->lock);
-                        if (dst)
-                                dst_free(dst);
+                        dst_free(dst);
 
                         if (pol_dead)
                                 XFRM_INC_STATS(LINUX_MIB_XFRMOUTPOLDEAD);
@@ -1748,8 +1747,7 @@ restart:
                         err = xfrm_dst_update_origin(dst, fl);
                 if (unlikely(err)) {
                         write_unlock_bh(&policy->lock);
-                        if (dst)
-                                dst_free(dst);
+                        dst_free(dst);
                         XFRM_INC_STATS(LINUX_MIB_XFRMOUTBUNDLECHECKERROR);
                         goto error;
                 }
diff --git a/net/xfrm/xfrm_state.c b/net/xfrm/xfrm_state.c
index 4c6914ef7d92..7bd62f61593f 100644
--- a/net/xfrm/xfrm_state.c
+++ b/net/xfrm/xfrm_state.c
@@ -780,11 +780,13 @@ xfrm_state_find(xfrm_address_t *daddr, xfrm_address_t *saddr,
 {
         unsigned int h;
         struct hlist_node *entry;
-        struct xfrm_state *x, *x0;
+        struct xfrm_state *x, *x0, *to_put;
         int acquire_in_progress = 0;
         int error = 0;
         struct xfrm_state *best = NULL;
 
+        to_put = NULL;
+
         spin_lock_bh(&xfrm_state_lock);
         h = xfrm_dst_hash(daddr, saddr, tmpl->reqid, family);
         hlist_for_each_entry(x, entry, xfrm_state_bydst+h, bydst) {
@@ -833,7 +835,7 @@ xfrm_state_find(xfrm_address_t *daddr, xfrm_address_t *saddr,
                 if (tmpl->id.spi &&
                     (x0 = __xfrm_state_lookup(daddr, tmpl->id.spi,
                                               tmpl->id.proto, family)) != NULL) {
-                        xfrm_state_put(x0);
+                        to_put = x0;
                         error = -EEXIST;
                         goto out;
                 }
@@ -849,7 +851,7 @@ xfrm_state_find(xfrm_address_t *daddr, xfrm_address_t *saddr,
                 error = security_xfrm_state_alloc_acquire(x, pol->security, fl->secid);
                 if (error) {
                         x->km.state = XFRM_STATE_DEAD;
-                        xfrm_state_put(x);
+                        to_put = x;
                         x = NULL;
                         goto out;
                 }
@@ -870,7 +872,7 @@ xfrm_state_find(xfrm_address_t *daddr, xfrm_address_t *saddr,
                         xfrm_hash_grow_check(x->bydst.next != NULL);
                 } else {
                         x->km.state = XFRM_STATE_DEAD;
-                        xfrm_state_put(x);
+                        to_put = x;
                         x = NULL;
                         error = -ESRCH;
                 }
@@ -881,6 +883,8 @@ out:
         else
                 *err = acquire_in_progress ? -EAGAIN : error;
         spin_unlock_bh(&xfrm_state_lock);
+        if (to_put)
+                xfrm_state_put(to_put);
         return x;
 }
 
@@ -1067,18 +1071,20 @@ static struct xfrm_state *__xfrm_find_acq_byseq(u32 seq);
 
 int xfrm_state_add(struct xfrm_state *x)
 {
-        struct xfrm_state *x1;
+        struct xfrm_state *x1, *to_put;
         int family;
         int err;
         int use_spi = xfrm_id_proto_match(x->id.proto, IPSEC_PROTO_ANY);
 
         family = x->props.family;
 
+        to_put = NULL;
+
         spin_lock_bh(&xfrm_state_lock);
 
         x1 = __xfrm_state_locate(x, use_spi, family);
         if (x1) {
-                xfrm_state_put(x1);
+                to_put = x1;
                 x1 = NULL;
                 err = -EEXIST;
                 goto out;
@@ -1088,7 +1094,7 @@ int xfrm_state_add(struct xfrm_state *x)
                 x1 = __xfrm_find_acq_byseq(x->km.seq);
                 if (x1 && ((x1->id.proto != x->id.proto) ||
                     xfrm_addr_cmp(&x1->id.daddr, &x->id.daddr, family))) {
-                        xfrm_state_put(x1);
+                        to_put = x1;
                         x1 = NULL;
                 }
         }
@@ -1110,6 +1116,9 @@ out:
                 xfrm_state_put(x1);
         }
 
+        if (to_put)
+                xfrm_state_put(to_put);
+
         return err;
 }
 EXPORT_SYMBOL(xfrm_state_add);
@@ -1269,10 +1278,12 @@ EXPORT_SYMBOL(xfrm_state_migrate);
 
 int xfrm_state_update(struct xfrm_state *x)
 {
-        struct xfrm_state *x1;
+        struct xfrm_state *x1, *to_put;
         int err;
         int use_spi = xfrm_id_proto_match(x->id.proto, IPSEC_PROTO_ANY);
 
+        to_put = NULL;
+
         spin_lock_bh(&xfrm_state_lock);
         x1 = __xfrm_state_locate(x, use_spi, x->props.family);
 
@@ -1281,7 +1292,7 @@ int xfrm_state_update(struct xfrm_state *x)
                 goto out;
 
         if (xfrm_state_kern(x1)) {
-                xfrm_state_put(x1);
+                to_put = x1;
                 err = -EEXIST;
                 goto out;
         }
@@ -1295,6 +1306,9 @@ int xfrm_state_update(struct xfrm_state *x)
 out:
         spin_unlock_bh(&xfrm_state_lock);
 
+        if (to_put)
+                xfrm_state_put(to_put);
+
         if (err)
                 return err;